Payload CMS Release: 2.24.2

TL;DR

Payload CMS v2.24.2: Bug Fixes and MongoDB Improvements

This release focuses on fixing several important bugs and adds a new MongoDB adapter feature. Key improvements include fixing international character sorting in MongoDB, resolving autosave issues with relationship drawers, ensuring proper permission handling, and adding a new MongoDB adapter option to preserve untracked data types. The release also includes security dependency updates and proper typing for Stripe plugin webhooks.

Highlight of the Release

• Added new jsonParse flag to MongoDB adapter to preserve untracked data types
• Fixed sorting of international characters in MongoDB queries
• Resolved autosave issues with relationship drawers
• Improved permission handling in authentication flow
• Updated security dependencies (nodemailer, braces, ws)

Migration Guide

This release doesn't require any specific migration steps as it primarily contains bug fixes and non-breaking enhancements.

Using the new MongoDB jsonParse flag:

If you want to take advantage of the new MongoDB adapter feature to preserve untracked data types, you can opt-in by setting the jsonParse flag in your MongoDB adapter configuration:

import { buildConfig } from 'payload/config';
import { mongooseAdapter } from '@payloadcms/db-mongodb';

export default buildConfig({
  db: mongooseAdapter({
    url: process.env.MONGODB_URI,
    // Set this to true to preserve untracked MongoDB data types
    jsonParse: true
  }),
  // rest of your config
});

This is particularly useful if you're working with MongoDB data that contains special data types that need to be preserved during operations.

Upgrade Recommendations

We recommend all users upgrade to v2.24.2, especially if you:

• Work with international characters and rely on proper sorting in MongoDB
• Use autosave functionality with relationship fields
• Use the Stripe plugin with async webhooks
• Need to preserve special MongoDB data types in your application

This release is a maintenance update with important bug fixes and a useful new feature for MongoDB users. The upgrade should be straightforward with no breaking changes.

To upgrade, run:

npm install [email protected]
# or
yarn add [email protected]
# or
pnpm add [email protected]

Bug Fixes

Critical Bug Fixes

• International Character Sorting: Fixed an issue where regular characters were taking precedence over international characters in MongoDB sort operations (#6923). This resolves the inconsistent sorting behavior reported in issue #6719.

• Autosave Relationship Drawers: Fixed a problem where collections with autosave enabled would open and immediately close when edited inside a relationship field (#7325). The fix threads the onSave function through to autosave and checks the current drawer depth to determine the appropriate action.

• Permission Handling: Resolved an issue where permissions weren't being properly fetched and set before setting the user (#7337), which could lead to authorization problems.

• Stripe Plugin Typing: Improved type definitions for async webhooks in the Stripe plugin (#7316), providing better TypeScript support.

Security Updates

• Updated several dependencies to address security vulnerabilities:
  • Bumped braces from 3.0.2 to 3.0.3 in /examples/auth/next-app (#7286)
  • Bumped nodemailer from 6.9.4 to 6.9.14 in /examples/email (#7289)
  • Bumped ws from 7.5.9 to 7.5.10 in /examples/auth/payload (#7288)

New Features

MongoDB Adapter Enhancement

• New jsonParse Flag: Added a new option to the MongoDB adapter that preserves existing, untracked MongoDB data types by avoiding the use of JSON.parse(JSON.stringify(mongooseDoc)). This is particularly useful when working with MongoDB data that contains special data types that need to be preserved during operations.

This feature allows developers to maintain the integrity of data structures stored in MongoDB, especially when working with external systems or complex data types that Payload might not explicitly track.

Security Updates

This release includes several important security-related dependency updates:

• Nodemailer: Updated from 6.9.4 to 6.9.14 in the email examples to address security vulnerabilities.

• WebSocket (ws): Updated from 7.5.9 to 7.5.10 in the auth examples to patch security issues.

• Braces: Updated from 3.0.2 to 3.0.3 in the Next.js auth example to fix security vulnerabilities.

These updates help protect against potential security exploits in these dependencies and should be applied as part of regular maintenance.

Performance Improvements

• MongoDB Sorting: The fix for international character sorting (#6923) not only corrects functionality but may also improve performance for queries involving sorted international text by ensuring more efficient and predictable sorting operations.

• Optimized Permission Handling: By ensuring permissions are fetched and set before setting the user (#7337), the system avoids potential redundant operations and race conditions, potentially improving performance in authentication flows.

Impact Summary

Payload CMS v2.24.2 delivers important bug fixes and quality-of-life improvements that enhance the developer and content editor experience. The release addresses several critical issues including international character sorting in MongoDB, autosave functionality with relationship fields, and permission handling during authentication.

The addition of the jsonParse flag to the MongoDB adapter is particularly valuable for developers working with complex data structures or integrating with external systems that use MongoDB's special data types. This feature allows for preserving these data types without Payload's standard JSON serialization process.

For international users, the fix for character sorting ensures a more consistent and expected behavior when working with non-English content. Content editors will appreciate the improved reliability of the autosave feature when working with relationship fields, which previously could cause frustrating UI issues.

The security updates to dependencies help maintain the overall security posture of applications built with Payload. While these changes are primarily maintenance-focused, they represent Payload's commitment to providing a secure and reliable CMS platform.

Full Release Notes