build(deps-dev): bump payload from 3.70.0 to 3.74.0

[dependabot]

Bumps payload from 3.70.0 to 3.74.0.

Release notes

Sourced from payload's releases.

v3.74.0

v3.74.0 (2026-01-30)

🚀 Features

• thread override access in doc level hooks (#15421) (85d5263)
• extend strictDraftTypes to all draft operations (#15292) (9239164)
• add support for custom UnpublishButton component (#15400) (94254da)
• storage-r2: client uploads using R2 multipart api (#14733) (5c38902)
• ui: allows opting out of popup closing logic (#15407) (fb2b602)
• ui: allows customizing Popup component portal className (#15406) (0f55464)

---

Override Access in Document-Level Hooks - Access the overrideAccess value inside collection and global hooks. Useful when hook logic needs to know whether access control was bypassed, such as when querying related documents up a hierarchy. #15421

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeChange: [
      ({ overrideAccess, req }) => {
        if (overrideAccess) {
          // Access control was bypassed
        }
      },
    ],
  },
}

---

Extended strictDraftTypes to All Operations - When strictDraftTypes: true is enabled, TypeScript now enforces draft type safety across all Local API operations (not just queries). The draft option is forbidden for collections/globals without drafts enabled, preventing silent runtime behavior where draft flags are ignored. #15292

import { buildConfig } from 'payload'
export default buildConfig({
typescript: {
strictDraftTypes: true, // Enables compile-time draft enforcement
},
// ...
})

⚠️ Note: Generic collection slugs may require explicit type assertions when using draft options.

---

... (truncated)

Commits

• de4fa0c chore(release): v3.74.0 [skip ci]
• 2dc2e7c fix: isolate payload-preferences by auth collection (#15425)
• 85d5263 feat: thread override access in doc level hooks (#15421)
• 9239164 feat: extend strictDraftTypes to all draft operations (#15292)
• 6b45fee chore: export getSafeFileName utility (#15424)
• 94254da feat: add support for custom UnpublishButton component (#15400)
• 99b051e fix: traverseFields returning wrong parentPath dot notation for non-localised...
• 5561799 fix: widgets and other features failing with transitive dependency imports (#...
• 7043e3f chore(deps): bump tsx (#15363)
• 2511c02 fix: replace deprecated scmp with crypto.timingSafeEqual (#15322)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Dependabot couldn't access the repository. Because of this, Dependabot cannot update this pull request.

[dependabot]

Looks like payload is up-to-date now, so this is no longer needed.