Bump payload from 2.0.14 to 3.28.0

[dependabot]

Bumps payload from 2.0.14 to 3.28.0.

Release notes

Sourced from payload's releases.

v3.28.0

v3.28.0 (2025-03-11)

Important

Compilation Performance Improvements

We’ve introduced a new opt-in flag that can cut Payload’s compile times in half during development. To enable it, add the following to your next.config.js:

const nextConfig = {
  // ...
}
-export default withPayload(nextConfig)
+export default withPayload(nextConfig, { devBundleServerPackages: false })

In some rare cases, you may see unexpected behavior if your project relies on server-only Payload dependencies being bundled during development. Because of this, we’ve made the feature opt-in for existing projects.

Lexical Version Bump

This release upgrades the lexical dependency from 0.21.0 to 0.27.1. Alongside table improvements and bug fixes, this version bump lays the groundwork for frequently requested features like color pickers.

If you installed lexical manually, update it to 0.27.1. Installing lexical manually is not recommended, as it may break between updates, and our re-exported versions should be used. See the yellow banner box for details.

If you still encounter richtext-lexical errors, do the following, in this order:

1. Delete node_modules
2. Delete your lockfile (e.g. pnpm-lock.json)
3. Reinstall your dependencies (e.g. pnpm install)

---

🚀 Features

• defaults to noindex nofollow (#11623) (5285518)
• threads path through field validate function (#11591) (3ede7ab)
• allow specification of which JWT extraction methods are supported, and in which order (#10794) (8f6d2e7)
• db-mongodb: strip keys from the data that don't exist in the schema from read results (#11558) (2ad035f)
• next: fully expose Next.js metadata (#11593) (397c1f1)
• richtext-lexical: allow disabling indentation for specific nodes (#11631) (eb09ce9)
• richtext-lexical: upgrade lexical from 0.21.0 to 0.27.1 (#11564) (557ac99)
• richtext-lexical: adds ability to disable auto link creation (#11563) (1e708bd)
• richtext-lexical: new HTML converter (#11370) (36921bd)
• ui: form state queues (#11579) (ac1e3cf)
• ui: adds disable copy to locale option to collection config (#11546) (657ad20)

🐛 Bug Fixes

• ensure only authenticated users can access the payload-locked-documents collection (#11624) (8f3d1bd)

... (truncated)

Commits

• d959d84 chore(release): v3.28.0 [skip ci]
• 5285518 feat: defaults to noindex nofollow (#11623)
• 243cdb1 refactor: more reliable import map generation, supporting turbopack and tscon...
• 8f3d1bd fix: ensure only authenticated users can access the `payload-locked-documents...
• 397c1f1 feat(next): fully expose Next.js metadata (#11593)
• 6d0924e fix: upload imageSizes forces original file uploads to be compressed (#11612)
• 3ede7ab feat: threads path through field validate function (#11591)
• 657ad20 feat(ui): adds disable copy to locale option to collection config (#11546)
• 8378654 fix(ui): apply consistent styling to custom & default block thumbnails (#11555)
• 4811531 fix(ui): incorrect error states (#11574)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/payload@2.0.14 ➜ 3.28.0	eval, unsafe	+114	285 MB	elliotpayload

View full report↗︎

[socket-security]

Report is too large to display inline.
View full report↗︎

Next steps

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/argparse@2.0.1
• @SocketSecurity ignore npm/require-from-string@2.0.2
• @SocketSecurity ignore npm/ajv@8.17.1
• @SocketSecurity ignore npm/esbuild@0.23.1
• @SocketSecurity ignore npm/fdir@6.4.3
• @SocketSecurity ignore npm/ws@8.18.1
• @SocketSecurity ignore npm/@apidevtools/json-schema-ref-parser@11.9.3
• @SocketSecurity ignore npm/get-tsconfig@4.8.1
• @SocketSecurity ignore npm/pino@9.5.0
• @SocketSecurity ignore npm/pino-pretty@13.0.0
• @SocketSecurity ignore npm/graphql@16.10.0
• @SocketSecurity ignore npm/payload@3.28.0

[dependabot]

Superseded by #174.