@payloadcms/codemod 4.0.0-internal.58473b9 → 4.0.0-internal.5e065b3

package/dist/runbook/payload-v4-upgrade.md

@@ -19,11 +19,11 @@ while the v3 packages are still installed:
 
 ## 1. Next.js 16
 
-Payload v4 requires Next 16. The command did not touch Next. Run Next's own recommended agent
+Payload v4 requires Next 16.4 or higher. The command did not touch Next. Run Next's own recommended agent
 workflow, which bumps Next + React and migrates the code as one unit:
 <https://nextjs.org/docs/app/guides/upgrading/version-16#use-an-ai-agent-recommended>
 
-Keep the resulting Next version within `>=16.2.6 <17` (the exact target is printed in the
+Keep the resulting Next version within `>=16.4.0 <17` (the exact target is printed in the
 upgrade report), since Next's `upgrade latest` may point past 16 in future.
 
 ## 2. Regenerate generated files

package/dist/runbook/v4.mdx

@@ -156,6 +156,31 @@ Run a typecheck after the codemod. Three patterns it cannot resolve:
 
 `payload.jobs.queue`, `run`, `runByID`, `cancel`, and `cancelByID` now also default `overrideAccess` to `false`. The option remains optional, but omitting it runs the corresponding `jobs.access.queue`, `jobs.access.run`, or `jobs.access.cancel` function. The codemod adds `overrideAccess: true` to these calls—including zero-argument `payload.jobs.run()` calls—to preserve Payload 3 behavior for review.
 
+### On-demand validation adds a `validate` operation
+
+The `Operation` type now includes `validate`. The `operation` argument for collection, global, and field `beforeValidate` and `beforeChange` hooks also includes `validate`.
+
+On-demand validation runs these hooks without saving the candidate. Update exhaustive operation checks and skip external side effects that should only run during `create` or `update`:
+
+```ts
+import type { CollectionBeforeChangeHook } from 'payload'
+
+const syncCustomer: CollectionBeforeChangeHook = async ({
+  data,
+  operation,
+}) => {
+  if (operation === 'validate') {
+    return data
+  }
+
+  await syncCustomerWithStripe(data)
+
+  return data
+}
+```
+
+Sanitized collection and global access types now require a `validate` key. Payload supplies this key during configuration sanitization and uses `update` access by default. Code that constructs a sanitized access object directly must add the key.
+
 ### Collection and Global Access Control callbacks receive `slug`
 
 Collection and Global Access Control callback arguments now include the document's `slug`. This additive property is unlikely to affect most projects, but code that manually invokes access callbacks or `executeAccess` must now pass `slug`. Code that validates, enumerates, or compares the exact callback argument shape may also need updating.
@@ -1029,9 +1054,9 @@ Run `npx @payloadcms/codemod --transform migrate-db-types-subpath` to migrate au
 
 The minimum supported Node.js version is now **24.15.0** (previously 18.20.2). Upgrade your runtime — along with any CI, Docker images, and deployment targets — to the latest node LTS version or newer before upgrading to 4.0.
 
-### Minimum supported Next.js version is now 16.2.6 ([#16537](https://github.com/payloadcms/payload/pull/16537))
+### Minimum supported Next.js version is now 16.4.0 ([#16537](https://github.com/payloadcms/payload/pull/16537))
 
-Older versions of Next.js are no longer supported. Update Next.js to **16.2.6** or newer.
+Older versions of Next.js are no longer supported. Update Next.js to **16.4.0** or newer.
 
 ### Minimum supported TypeScript version is now 6.0.3 ([#16692](https://github.com/payloadcms/payload/pull/16692))
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/codemod",
-  "version": "4.0.0-internal.58473b9",
+  "version": "4.0.0-internal.5e065b3",
   "description": "Codemods for migrating Payload projects across versions.",
   "homepage": "https://payloadcms.com",
   "repository": {