build(deps): bump payload from 3.36.0 to 3.74.0

[dependabot]

Bumps payload from 3.36.0 to 3.74.0.

Release notes

Sourced from payload's releases.

v3.74.0

v3.74.0 (2026-01-30)

🚀 Features

• thread override access in doc level hooks (#15421) (85d5263)
• extend strictDraftTypes to all draft operations (#15292) (9239164)
• add support for custom UnpublishButton component (#15400) (94254da)
• storage-r2: client uploads using R2 multipart api (#14733) (5c38902)
• ui: allows opting out of popup closing logic (#15407) (fb2b602)
• ui: allows customizing Popup component portal className (#15406) (0f55464)

---

Override Access in Document-Level Hooks - Access the overrideAccess value inside collection and global hooks. Useful when hook logic needs to know whether access control was bypassed, such as when querying related documents up a hierarchy. #15421

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeChange: [
      ({ overrideAccess, req }) => {
        if (overrideAccess) {
          // Access control was bypassed
        }
      },
    ],
  },
}

---

Extended strictDraftTypes to All Operations - When strictDraftTypes: true is enabled, TypeScript now enforces draft type safety across all Local API operations (not just queries). The draft option is forbidden for collections/globals without drafts enabled, preventing silent runtime behavior where draft flags are ignored. #15292

import { buildConfig } from 'payload'
export default buildConfig({
typescript: {
strictDraftTypes: true, // Enables compile-time draft enforcement
},
// ...
})

⚠️ Note: Generic collection slugs may require explicit type assertions when using draft options.

---

... (truncated)

Commits

• de4fa0c chore(release): v3.74.0 [skip ci]
• 2dc2e7c fix: isolate payload-preferences by auth collection (#15425)
• 85d5263 feat: thread override access in doc level hooks (#15421)
• 9239164 feat: extend strictDraftTypes to all draft operations (#15292)
• 6b45fee chore: export getSafeFileName utility (#15424)
• 94254da feat: add support for custom UnpublishButton component (#15400)
• 99b051e fix: traverseFields returning wrong parentPath dot notation for non-localised...
• 5561799 fix: widgets and other features failing with transitive dependency imports (#...
• 7043e3f chore(deps): bump tsx (#15363)
• 2511c02 fix: replace deprecated scmp with crypto.timingSafeEqual (#15322)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Important

Bump payload from 3.36.0 to 3.74.0, adding new features and improvements in document hooks, draft operations, UI, and storage.

• Dependency Update:
  • Bump payload from 3.36.0 to 3.74.0 in package.json.
• Features:
  • Override access in document-level hooks.
  • Extend strictDraftTypes to all draft operations.
  • Support for custom UnpublishButton component.
• Improvements:
  • UI: Opt-out of popup closing logic and customize Popup component portal className.
  • Storage: Client uploads using R2 multipart API.

^{This description was created by for f9d2a6e. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to f9d2a6e in 9 seconds. Click for details.

• Reviewed 13 lines of code in 1 files
• Skipped 1 files when reviewing.
• Skipped posting 0 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

Workflow ID: wflow_T1cBFcjMwZSw1Wu4

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[dependabot]

Superseded by #228.

[github-actions]

PR closed or merged. Staging URL has been deleted.