chore(deps): bump payload from 2.0.5 to 3.77.0 in /examples/live-preview/payload

[dependabot]

Bumps payload from 2.0.5 to 3.77.0.

Release notes

Sourced from payload's releases.

v3.77.0

v3.77.0 (2026-02-18)

🚀 Features

• pass local API depth through to req.query.depth for consistency (#15023) (9a38469)
• db-*: add customID arg to db.create (#15653) (0935824)
• plugin-mcp: migrate from @​vercel/mcp-adapter to mcp-handler (#15661) (24025fd)

---

Feature Details

Local API Depth Consistency - The depth option passed to Local API calls like payload.find() is now automatically set on req.query.depth. Previously, hooks relying on req.query.depth would behave differently between Local API and REST/GraphQL calls unless you manually passed req: { query: { depth: x } } in addition to depth: x. This change ensures consistent behavior across all API methods. #15023

Custom ID Support in db.create (db-*) - New customID argument on payload.db.create allows creating documents with a specific ID without requiring a custom ID field in your collection schema. #15653

payload.db.create({ collection: 'posts', customID: 'ce98d6c4-c3ab-45de-9dfc-bf33d94cc941', data: { } })

MCP Plugin Migration (plugin-mcp) - Migrates from the deprecated @vercel/mcp-adapter to mcp-handler and bumps @modelcontextprotocol/sdk to 1.25.2 addressing a security vulnerability. Exposes new handler options: disableSse, onEvent, and redisUrl. #15661

import { mcpPlugin } from '@payloadcms/plugin-mcp'
export default buildConfig({
plugins: [
mcpPlugin({
// Optional: Enable SSE transport (disabled by default)
disableSse: false,
// Optional: Redis URL for SSE session management (defaults to REDIS_URL env)
redisUrl: 'redis://localhost:6379',
// Optional: Track MCP events for analytics/debugging
onEvent: (event) => {
console.log('MCP event:', event)
},
}),
],
})

---

🐛 Bug Fixes

• hasMany text fields cannot be filtered with contains operator (#15671) (4513a05)
• use consistent empty state styling between list and folder views (#15555) (8953b37)
• populate previousValue correctly in afterChange hooks for nested lexical fields (#15623) (1cc3bb9)

... (truncated)

Commits

• 71be0ca chore(release): v3.77.0 [skip ci]
• 0935824 feat(db-*): add customID arg to db.create (#15653)
• 9a38469 feat: pass local API depth through to req.query.depth for consistency (#1...
• 1cc3bb9 fix: populate previousValue correctly in afterChange hooks for nested lexical...
• 3a486c5 chore(release): v3.76.1 [skip ci]
• 6937eec fix: use optional chaining for adminThumbnail size lookup to prevent crash (#...
• a313627 fix: non-image files should not recieve 0 bytes with useTempFiles (#15538)
• 8283c25 fix: add CSP headers to SVG uploads to prevent XSS (#15506)
• 5909064 chore(release): v3.76.0 [skip ci]
• 73a9650 fix(plugin-import-export): errors when import/export files were stored in a s...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@payloadcms/bundler-webpack@1.0.5 → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report