Bump payloadcms group to 3.84.1, postcss, uuid, next, and axios by dependabot[bot] · Pull Request #1046 · NWACus/web

dependabot · 2026-04-20T12:32:03Z

Description

Combines five open dependency PRs (this one plus #1031, #1033, #1054, #1056) into a single shipping PR, in keeping with the rationale from #1021. Bumps the Payload group from 3.81.0 → 3.84.1 and reworks both project-maintained patches in the process.

Related Issues

Supersedes:

Bump axios from 1.12.0 to 1.15.0 #1031 — axios 1.12.0 → 1.15.0
Bump next from 15.4.11 to 15.5.15 #1033 — next 15.4.11 → 15.5.15
Bump uuid from 11.1.0 to 14.0.0 #1054 — uuid 11.1.0 → 14.0.0
Bump postcss from 8.5.3 to 8.5.10 #1056 — postcss 8.5.3 → 8.5.10

Key Changes

Payload CMS group 3.81.0 → 3.84.1 (17 packages)

Patch updates — both project-maintained patches in patches/ needed rework against 3.84.1:

@payloadcms/plugin-mcp patch shrunk 116 → 37 lines. Per commit 0cd3054a (PR MCP Server #1022), the patch originally added instructions and authDepth support. In 3.84.1 instructions was upstreamed natively on MCPServerOptions, and the runtime already reads pluginOptions.authDepth ?? 1. Only the authDepth?: number type declaration is still needed locally.
@payloadcms/storage-vercel-blob patch grew 155 → 184 lines and was reworked against the restructured 3.84.1 layout (handleUpload.js → uploadFile.js, new adapter.js indirection). Per PR Bump the payloadcms group to 3.81.0 #982, this patch exposes allowOverwrite because the Vercel Blob v2 SDK changed the default to false, breaking the seeding workflow. The upstream PR (payloadcms/payload#16078) was closed without merging on 2026-04-24, so we continue to maintain this locally.

Other dependency bumps

postcss 8.5.3 → 8.5.14 — XSS fix for unescaped </style> in non-bundler cases
uuid 11.1.0 → 14.0.0 — security fix (GHSA-w5hq-g745-h8pq) for out-of-bounds writes in v3()/v5()/v6() when given an invalid offset
next 15.4.11 → 15.5.15 — CVE-2026-23869 and CVE-2026-29057 patches plus next/image LRU disk cache and pages-router Content-Length/ETag fix
axios 1.14.0 → 1.15.0 — no_proxy hostname normalization SSRF fix and unrestricted cloud metadata exfiltration via header injection chain fix

Breaking-change review

uuid 11 → 14 spans three majors with breaking changes; verified each is satisfied by the current setup:

v12 — drops Node 16, removes CommonJS, requires TS ≥ 5.2. Project uses Node 24.x (engines.node) and is "type": "module"; TS is 5.7.3.
v13 — makes browser exports the default. Both consumers (src/scripts/sanitize-db.ts, src/collections/Users/components/inviteUserAction.ts) use named imports (import { v4 as uuid } from 'uuid') which are unaffected by which export is the default.
v14 — drops Node 18, expects global crypto. Both satisfied by Node 24.x.

next 15.4 → 15.5 is a minor version with no documented breakages relevant to this app.

axios 1.14 → 1.15 and postcss 8.5.3 → 8.5.14 are patches/minor only.

The Payload 3.83 → 3.84 bump removed/renamed several public types (PluginMCPServerConfig → MCPPluginConfig) and restructured the storage-vercel-blob package — surfaced as TS errors when the existing patches silently failed to apply. Both patches were regenerated against the new layout (see "Patch updates" above) and pnpm tsc is clean.

Other change

Excluded .claude/worktrees/ from Jest's testPathIgnorePatterns so stale Claude worktree copies don't pollute test runs. Without this, jest picks up tests under .claude/worktrees/*/__tests__/ against parent-repo source paths and trips on transitive Payload module loading. Behavior is identical for non-worktree users.

How to test

pnpm tsc — passes
pnpm lint — passes (warnings only, unchanged baseline)
pnpm test — all 40 suites / 376 tests pass locally
Spot-check Payload admin loads and a few collections render
Verify file uploads still work — important since @payloadcms/storage-vercel-blob 3.84.1 restructured the upload handler and the local allowOverwrite patch was reworked
Verify pnpm seed:standalone completes (the allowOverwrite: true flag is what keeps seeding working)
Verify a server-side page renders with the new Next 15.5 patch
Verify MCP API key auth still works (uses local authDepth: 3 patch)

Screenshots / Demo video

N/A — dependency updates only

Migration Explanation

No database migrations needed. All changes are package version bumps and patch refresh.

Future enhancements / Questions

Not addressed in this PR (require dedicated upgrades per #1021):

Next 16, Tailwind 4, ESLint 10, Sentry 10, TypeScript 6, Zod 4, Pino 10

If/when payloadcms/payload upstreams allowOverwrite and authDepth, the corresponding local patches can be dropped.

🤖 Generated with Claude Code

Bumps the payloadcms group with 17 updates: | Package | From | To | | --- | --- | --- | | [@payloadcms/admin-bar](https://github.com/payloadcms/payload/tree/HEAD/packages/admin-bar) | `3.81.0` | `3.83.0` | | [@payloadcms/db-sqlite](https://github.com/payloadcms/payload/tree/HEAD/packages/db-sqlite) | `3.81.0` | `3.83.0` | | [@payloadcms/email-nodemailer](https://github.com/payloadcms/payload/tree/HEAD/packages/email-nodemailer) | `3.81.0` | `3.83.0` | | [@payloadcms/email-resend](https://github.com/payloadcms/payload/tree/HEAD/packages/email-resend) | `3.81.0` | `3.83.0` | | [@payloadcms/next](https://github.com/payloadcms/payload/tree/HEAD/packages/next) | `3.81.0` | `3.83.0` | | [@payloadcms/plugin-form-builder](https://github.com/payloadcms/payload/tree/HEAD/packages/plugin-form-builder) | `3.81.0` | `3.83.0` | | [@payloadcms/plugin-mcp](https://github.com/payloadcms/payload/tree/HEAD/packages/plugin-mcp) | `3.81.0` | `3.83.0` | | [@payloadcms/plugin-sentry](https://github.com/payloadcms/payload/tree/HEAD/packages/plugin-sentry) | `3.81.0` | `3.83.0` | | [@payloadcms/plugin-seo](https://github.com/payloadcms/payload/tree/HEAD/packages/plugin-seo) | `3.81.0` | `3.83.0` | | [@payloadcms/richtext-lexical](https://github.com/payloadcms/payload/tree/HEAD/packages/richtext-lexical) | `3.81.0` | `3.83.0` | | [@payloadcms/storage-vercel-blob](https://github.com/payloadcms/payload/tree/HEAD/packages/storage-vercel-blob) | `3.81.0` | `3.83.0` | | [@payloadcms/ui](https://github.com/payloadcms/payload/tree/HEAD/packages/ui) | `3.81.0` | `3.83.0` | | [payload](https://github.com/payloadcms/payload/tree/HEAD/packages/payload) | `3.81.0` | `3.83.0` | | [@payloadcms/drizzle](https://github.com/payloadcms/payload/tree/HEAD/packages/drizzle) | `3.81.0` | `3.83.0` | | [@payloadcms/graphql](https://github.com/payloadcms/payload/tree/HEAD/packages/graphql) | `3.81.0` | `3.83.0` | | [@payloadcms/plugin-cloud-storage](https://github.com/payloadcms/payload/tree/HEAD/packages/plugin-cloud-storage) | `3.81.0` | `3.83.0` | | [@payloadcms/translations](https://github.com/payloadcms/payload/tree/HEAD/packages/translations) | `3.81.0` | `3.83.0` | Updates `@payloadcms/admin-bar` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/admin-bar) Updates `@payloadcms/db-sqlite` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/db-sqlite) Updates `@payloadcms/email-nodemailer` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/email-nodemailer) Updates `@payloadcms/email-resend` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/email-resend) Updates `@payloadcms/next` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/next) Updates `@payloadcms/plugin-form-builder` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/plugin-form-builder) Updates `@payloadcms/plugin-mcp` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/plugin-mcp) Updates `@payloadcms/plugin-sentry` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/plugin-sentry) Updates `@payloadcms/plugin-seo` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/plugin-seo) Updates `@payloadcms/richtext-lexical` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/richtext-lexical) Updates `@payloadcms/storage-vercel-blob` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/storage-vercel-blob) Updates `@payloadcms/ui` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/ui) Updates `payload` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/payload) Updates `@payloadcms/drizzle` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/drizzle) Updates `@payloadcms/graphql` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/graphql) Updates `@payloadcms/plugin-cloud-storage` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/plugin-cloud-storage) Updates `@payloadcms/translations` from 3.81.0 to 3.83.0 - [Release notes](https://github.com/payloadcms/payload/releases) - [Commits](https://github.com/payloadcms/payload/commits/v3.83.0/packages/translations) --- updated-dependencies: - dependency-name: "@payloadcms/admin-bar" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/db-sqlite" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/email-nodemailer" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/email-resend" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/next" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/plugin-form-builder" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/plugin-mcp" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/plugin-sentry" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/plugin-seo" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/richtext-lexical" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/storage-vercel-blob" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/ui" dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: payload dependency-version: 3.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/drizzle" dependency-version: 3.83.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/graphql" dependency-version: 3.83.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/plugin-cloud-storage" dependency-version: 3.83.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: payloadcms - dependency-name: "@payloadcms/translations" dependency-version: 3.83.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: payloadcms ... Signed-off-by: dependabot[bot] <support@github.com>

…rn/payloadcms-95182545b6

Combines four open dependabot PRs (#1031, #1033, #1054, #1056) into this single PR to ship one merged dependency bump. - postcss 8.5.3 → 8.5.14 (XSS fix in non-bundler cases) - uuid 11.1.0 → 14.0.0 (security fix for v3/v5/v6 buffer write bounds; drops node 18, requires global crypto — both satisfied by node 24.x engine; uuid is only used as a named v4 ESM import in two server files) - next 15.4.11 → 15.5.15 (CVE-2026-23869 and CVE-2026-29057 patches) - axios 1.14.0 → 1.15.0 (no_proxy SSRF and header injection fixes) Also exclude .claude/worktrees from Jest so stale worktree copies don't cause pre-existing-but-noisy test failures unrelated to these bumps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Both project-maintained patches needed updates against 3.84.1: - plugin-mcp: shrunk from 116 to 37 lines. The `instructions` support added in PR #1022 is now upstream (`MCPServerOptions.instructions`), and the runtime already reads `pluginOptions.authDepth ?? 1`. Only the `authDepth?: number` type declaration remains. - storage-vercel-blob: reworked against the restructured 3.84.1 layout (handleUpload.js → uploadFile.js, new adapter.js indirection). The upstream PR for `allowOverwrite` (payloadcms/payload#16078) was closed without merging, so this patch is still required to keep the seeding workflow working. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- next-env.d.ts: Next 15.5 adds a reference to .next/types/routes.d.ts for typed routes (auto-emitted by next dev/build). - src/app/(payload)/admin/importMap.js: Payload 3.84 emits a JSDoc type annotation on the generated importMap. - package.json: explicitly mark msw and protobufjs build scripts as ignored. Both are unused (msw runs in node-mode jest, never as a browser worker; protobufjs ships prebuilt artifacts) and silencing the install-time warning is cleaner than re-prompting every time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-04T23:51:39Z

Preview deployment: https://dependabotxnpmxandxyarnxpayload-6aaa8c0.preview.avy-fx.org

dependabot Bot added dependencies Pull requests that update a dependency file javascript labels Apr 20, 2026

dependabot Bot temporarily deployed to Preview April 20, 2026 12:32 Inactive

dependabot Bot had a problem deploying to Preview April 20, 2026 12:32 Failure

style: run prettify and lint:fix

09fedbd

rchlfryn removed the javascript label May 4, 2026

rchlfryn and others added 2 commits May 4, 2026 16:01

Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…

e37bdd4

…rn/payloadcms-95182545b6

rchlfryn temporarily deployed to Preview May 4, 2026 23:19 — with GitHub Actions Inactive

rchlfryn had a problem deploying to Preview May 4, 2026 23:19 — with GitHub Actions Failure

rchlfryn changed the title ~~Bump the payloadcms group with 17 updates~~ Bump payloadcms group, postcss, uuid, next, and axios May 4, 2026

This was referenced May 4, 2026

Bump axios from 1.12.0 to 1.15.0 #1031

Closed

Bump next from 15.4.11 to 15.5.15 #1033

Closed

Bump uuid from 11.1.0 to 14.0.0 #1054

Closed

Bump postcss from 8.5.3 to 8.5.10 #1056

Closed

rchlfryn self-assigned this May 4, 2026

rchlfryn temporarily deployed to Preview May 4, 2026 23:34 — with GitHub Actions Inactive

rchlfryn had a problem deploying to Preview May 4, 2026 23:34 — with GitHub Actions Error

rchlfryn changed the title ~~Bump payloadcms group, postcss, uuid, next, and axios~~ Bump payloadcms group to 3.84.1, postcss, uuid, next, and axios May 4, 2026

rchlfryn temporarily deployed to Preview May 4, 2026 23:41 — with GitHub Actions Inactive

rchlfryn temporarily deployed to Preview May 4, 2026 23:42 — with GitHub Actions Inactive

Fix URL from payload upgrade

c519744

rchlfryn temporarily deployed to Preview May 5, 2026 00:05 — with GitHub Actions Inactive

rchlfryn requested a review from busbyk May 5, 2026 00:05

Merge branch 'main' into dependabot/npm_and_yarn/payloadcms-95182545b6

63de07e

rchlfryn temporarily deployed to Preview May 6, 2026 23:31 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump payloadcms group to 3.84.1, postcss, uuid, next, and axios#1046

Bump payloadcms group to 3.84.1, postcss, uuid, next, and axios#1046
dependabot[bot] wants to merge 8 commits intomainfrom
dependabot/npm_and_yarn/payloadcms-95182545b6

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited by rchlfryn

Loading

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited by rchlfryn Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Key Changes

Breaking-change review

Other change

How to test

Screenshots / Demo video

Migration Explanation

Future enhancements / Questions

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited by rchlfryn

Loading