build(deps): bump @payloadcms/storage-s3 from 3.88.0 to 3.90.0

[dependabot]

Bumps @payloadcms/storage-s3 from 3.88.0 to 3.90.0.

Release notes

Sourced from @​payloadcms/storage-s3's releases.

v3.90.0

v3.90.0 (2026-09-18)

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

• Regenerate your payload types: pnpm payload generate:types
• If you are using a relational database, you will need to create and run a migration:

pnpm payload migrate:create <migration-name>
pnpm payload migrate

Password changes now revoke other sessions

• No action needed.

Password reset now clears lockouts; forgot-password is throttled

• Adds new resetPasswordRequestedAt field to user collections

• Action required:

  • Regenerate types: pnpm payload generate:types
  • If using a relational database, perform migration:

pnpm payload migrate:create add-reset-password-requested-at
pnpm payload migrate

Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

• Have publish or unpublish events queued when upgrading.
• Use multiple admin-capable auth collections.

... (truncated)

Commits

• e10b602 chore(release): v3.90.0 [skip ci]
• bd4857d fix: contain cloud storage upload prefixes
• 8e880a4 fix: incorrect prefix from client upload
• e757563 fix: enforce collection access for client uploads (3.x)
• a8c3a8e fix: validate upload identity and xml delivery 3.x
• 2df8238 fix: prevent client-upload overwrite with If-None-Match
• 479458d chore(release): v3.89.0 [skip ci]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.