[Snyk] Upgrade @payloadcms/live-preview-react from 3.60.0 to 3.61.0

[MrFriggo]

Snyk has created this PR to upgrade @payloadcms/live-preview-react from 3.60.0 to 3.61.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 14 versions ahead of your current version.

• The recommended version was released 22 days ago.

Release notes

Package name: @payloadcms/live-preview-react

• 3.61.0 - 2025-10-23
  

  v3.61.0 (2025-10-23)

  🚀 Features

  • @ payloadcms/plugin-mcp Released (BETA) - New plugin that enables Payload to function as an MCP server, allowing AI models to interact with your collections through a standardized protocol. The plugin provides built-in tools for CRUD operations on collections and supports custom tools. #13674
    • MCP Documentation
    • GitHub Discussion for feedback

  🐛 Bug Fixes

  • user updatedAt modified during session operations (#14269) (a1671ec)
  • document header text clipping (#14291) (db973e9)
  • typescript requires fields when draft: true despite passing draft: true (#14271) (1016cd0)
  • blocks access control not respecting update access whether on collection or on a per field basis (#14226) (88cb687)
  • allow slugField to accept localized argument and fixed slug generation with custom field names (#14234) (2ced43d)
  • db-postgres: limit index and foreign key names length (#14236) (a63b4d9)
  • drizzle: folders with trash enabled don't display documents in polymorphic joins (#14223) (6d3aaaf)
  • plugin-form-builder: display full textarea content in form submissions (#14161) (24dad01)
  • plugin-multi-tenant: block references issue (#14320) (4f8b7d2)
  • plugin-search: exclude skipped drafts in reindex handler (#14224) (0dc782c)
  • richtext-lexical: ensure block node form displays up-to-date value when editor remounts (#14295) (f8e6b65)
  • richtext-lexical: node replacements ignored for block, inline block, upload, unknown and relationship nodes (#14249) (1561853)
  • richtext-lexical, ui: ui errors with Slash Menu in Lexical and SearchBar component in RTL (#14231) (fed3bba)
  • ui: document locked modal blocks interaction after clicking Go Back (#14287) (5782a41)
  • ui: change password button being hidden and unlock button being shown incorrectly on account page (#14220) (bcb4d8e)

  ⚡ Performance

  • richtext-lexical: decrease size of field schema, minor perf optimizations (#14248) (e25ce1c)
  • richtext-lexical: do not return i18n from editor adapter (#14228) (54224c3)

  🛠 Refactors

  • richtext-lexical: ensure classNames of all nodes can be customized (#14294) (e1ef1d2)

  📚 Documentation

  • improve slate to lexical migration docs (#14309) (6838c56)
  • db indexes - code example missing const (#14171) (3b37f4a)
  • add explanation about re-renders in useFormFields (#14288) (8cdb5dc)
  • add jsdocs to RichText adapter (#14246) (8b0ac01)
  • clarify admin.timezones list configuration with example (#14238) (de5f3db)
  • fix link to slug-overrides in text.mdx (#14211) (8136a84)
  • add mention of the useUploadHandlers error and steps to remedy it with a mention to monorepos (#14233) (8663024)

  🔨 Build

  • add plugin-mcp to publishList (#14319) (894cf0c)
  • add README sync for top-level -> packages/payload (#14316) (2aba827)

  🏡 Chores

  • extract snapshot logic, correct types in version ops (#14290) (c2dcd12)
  • bump pino to v9.14.0 and pino-pretty (#14283) (b252658)
  • refresh CLAUDE.md (#14268) (05a869d)
  • cleanup, short-circuit .split calls (#14245) (d57be12)

  🤝 Contributors

  • Jarrod Flesch (@ JarrodMFlesch)
  • Elliot DeNolf (@ denolfe)
  • Kendell (@ kendelljoseph)
  • Alessio Gravili (@ AlessioGr)
  • Patrik (@ PatrikKozak)
  • Boyan Bratvanov (@ bratvanov)
  • Paul (@ paulpopus)
  • German Jablonski (@ GermanJablo)
  • Bogdan Covrig (@ bogdaaamn)
  • Romain Pironneau (@ romainpi)
  • Sasha (@ r1tsuu)
  • Ahmed Abdellahi Abdat (@ ahmed-abdat)
  • Said Akhrarov (@ akhrarovsaid)
• 3.61.0-internal.dd40839 - 2025-10-22
• 3.61.0-internal.c47b5e9 - 2025-10-23
• 3.61.0-internal.c252d14 - 2025-10-22
• 3.61.0-internal.7d69f4e - 2025-10-23
• 3.61.0-internal.1898a30 - 2025-10-24
• 3.61.0-internal.5662539 - 2025-10-29
• 3.61.0-canary.6 - 2025-10-23
• 3.61.0-canary.5 - 2025-10-22
• 3.61.0-canary.4 - 2025-10-21
• 3.61.0-canary.3 - 2025-10-20
• 3.61.0-canary.2 - 2025-10-19
• 3.61.0-canary.1 - 2025-10-18
• 3.61.0-canary.0 - 2025-10-17
• 3.60.0 - 2025-10-16
  

  v3.60.0 (2025-10-16)

  🚀 Features

  • accept multiple locales in fallbackLocale (#13822) (623a1b8)
  • adds settingsMenu to admin navigation sidebar (#14139) (ee8b3cf)
  • plugin-multi-tenant: allow collection access to be overridden via callback (#14127) (c40eec2)
  • plugin-multi-tenant: allow hasMany on tenant field overrides (#14120) (fb93cd1)
  • plugin-multi-tenant: user collection access overrides (#14119) (38b7a60)
  • richtext-lexical: add collection filtering to UploadFeature, refactor relationship hooks (#14111) (6defba9)
  • richtext-lexical: client-side block markdown shortcuts, code block (#13813) (07a1eff)

  Localization

  • Multiple fallback locales - fallbackLocale now accepts an array of locales for queries and locale configs. Payload will check each locale in order until finding a value, eliminating the need for manual fallback handling. #13822

    / Local API **/
    await payload.findByID({
    id,
    collection,
    locale: 'en',
    fallbackLocale: ['fr', 'es'],
    })

    /** REST API **/
    await fetch(<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">baseURL</span><span class="pl-kos">}</span></span>/api/<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">collectionSlug</span><span class="pl-kos">}</span></span>?locale=en&amp;fallbackLocale[]=fr&amp;fallbackLocale[]=es)

    /** GraphQL **/
    await restClient.GRAPHQL_POST({
    body,
    query: { locale: 'en', fallbackLocale: ['fr', 'es']},
    })

    /** Locale Configs **/
    locales: [
    {
    code: 'en',
    label: 'English',
    fallbackLocale: ['fr', 'es'],
    },
    ]

  Admin UI

  • Settings menu in navigation - New admin.components.settingsMenu config option adds a gear icon above the logout button. Click to open a popup menu with custom admin-level utilities and actions that don't fit into collection or global navigation. #14139

    

  Multi-Tenant Plugin

  • Collection access overrides - New accessResultOverride callback allows modifying multi-tenant access control results per operation (read, create, update, delete, readVersions, unlock). Enables custom logic like allowing shared content across tenants. #14127

    multiTenantPlugin<ConfigType>({
      collections: {
        posts: {
          accessResultOverride: async ({ accessResult, accessKey, req }) => {
            // here is where you can change the access result or return something entirely different
            if (accessKey === 'read') {
              return {
                or: [
                  {
                    isShared: {
                      equals: true,
                    }
                  },
                  accessResult
                ]
              }
            } else {
              return accessResult
            }
          }
        }
      }
    })

  • Multiple tenants per document - Tenant field overrides now support hasMany relationships, allowing documents to belong to multiple tenants. #14120

  • User collection access overrides - New usersAccessResultOverride callback enables customizing access control on the users collection, overriding default tenant privacy when needed. #14119

    usersAccessResultOverride: ({
    accessKey: 'read', // 'create', 'read', 'update', 'delete', 'readVersions', 'unlock'
    accessResult: AccessResult, // the AccessResult type
    ...args, // AccessArgs
    }) => {
    // this is where you could adjust what gets returned here.
    if (accessKey === 'read') {
    return true // over simplified example
    }

    // default to returning the result from the plugin
    return accessResult
    }

  Lexical Rich Text

  • Upload collection filtering - UploadFeature now supports disabledCollections and enabledCollections to control which collections appear in the upload drawer. Also refactors enabled relationships logic with cleaner useEnabledRelationships hook. #14111

  • Client-side markdown shortcuts & code blocks - Blocks with admin.jsx now support markdown shortcuts on the client (previously server-only). Includes pre-made CodeBlock component for use in BlocksFeature. Also fixes readOnly handling across nested fields. #13813

    Screenshot.2025-10-01.at.10.14.54.mp4

    Screenshot.2025-10-01.at.10.14.54.mp4

  🐛 Bug Fixes

  • findDistinct by explicit ID paths in relationships and virtual fields (#14215) (2b1b6ee)
  • hasMany / polymorphic relationships to custom number IDs (#14201) (a3b3865)
  • hide fields with read: false in list view columns, filters, and groupBy (#14118) (bcd40b6)
  • validate Point Field to -180 to 180 for longitude and -90 to 90 for latitude (#14206) (13a1d90)
  • urls in upload sizes are not encoded (#14205) (747a049)
  • restoring trashed drafts with empty required fields fails validation (#14186) (3317207)
  • db-d1-sqlite: add missing blocksAsJSON property (#14103) (f14a38e)
  • db-mongodb: documents not showing in folders with useJoinAggregations: false (#14155) (e613a78)
  • db-mongodb: improve check for ObjectId (#14131) (32e2be1)
  • graphql: bump tsx version to get around esbuild vulnerability (#14207) (d7ec48f)
  • next: custom views not overriding built-in single-segment routes (#14066) (691f810)
  • plugin-multi-tenant: object reference mutations in addFilterOptionsToFields (#14150) (e62f1fe)
  • richtext-lexical: state key collisions when multiple TextStateFeatures are registered (#14194) (f01a6ed)
  • richtext-lexical: editor throws an error if OrderedList is registered but not UnorderedList or CheckList (#14149) (1fe75e0)
  • richtext-lexical: editing a copied inline block also modifies the original (#14137) (5bacb38)
  • richtext-lexical: correctly type field property of RenderLexical (#14141) (cd94f8e)
  • richtext-lexical: improve type autocomplete and assignability for lexical nodes (#14112) (a46faf1)
  • sdk: pagination is not passed to search params (#14126) (ee9f160)
  • storage-gcs: bump @ google-cloud/storage for vulnerability (#14199) (1077aa7)
  • storage-r2: uploads with prefix don't work, add test/storage-r2 (#14132) (4fd4cb0)
  • templates: encoding and decoding slugs in website template (#14216) (cacf523)
  • templates: ecommerce seeding issue (#14196) (d65b8c6)

  🛠 Refactors

  • richtext-lexical: add jsdoc to deprecated HTMLConverterFeature (#14193) (0b718bd)

  📚 Documentation

  • revert sentry docs change (#14113) (8844eaf)
  • incorrect pg driver injection example in Sentry integration docs (#14088) (95dbaed)

  🧪 Tests

  • allows running Jest tests through Test Explorer in VSCode and other improvements (#13751) (0d92a43)

  ⚙️ CI

  • notify website repo on release [skip ci] (#14140) (a36e5d2)
  • add website dispatch event, testing for releases [skip ci] (#14138) (b0d31ba)
  • add missing labels to bug report template [skip ci] (#14134) (3069e5b)
  • update generate-template-variations script to cover cloudflare template (#14105) (e78057b)

  🏡 Chores

  • better audit dependencies script (#14189) (f9e75a4)
  • ignore agent local files [skip ci] (#14184) (7ecb5a0)
  • drizzle: bump drizzle-orm and drizzle-kit for vulnerabilities (#14200) (4afa286)
  • email-nodemailer: bump nodemailer dependencies to latest (#14121) (077c6f5)

  🤝 Contributors

  • Sasha (@ r1tsuu)
  • Patrik (@ PatrikKozak)
  • Paul (@ paulpopus)
  • Jessica Rynkar (@ jessrynkar)
  • German Jablonski (@ GermanJablo)
  • Elliot DeNolf (@ denolfe)
  • Elliott W (@ elliott-w)
  • Jarrod Flesch (@ JarrodMFlesch)
  • Alessio Gravili (@ AlessioGr)
  • Diogo Gaspar (@ shadowoff09)

from @payloadcms/live-preview-react GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs