Merge remote-tracking branch 'origin/main' into feat/file-transformers

# Conflicts:
#	test/a11y/collections/Media/index.ts

Author: r1tsuu

.github/actions/audit-dependencies/src/lib/catalog.test.ts

@@ -23,7 +23,7 @@ describe('loadCatalogs', () => {
       [
         'catalog:',
         "  zod: '^4.6.0'",
-        "  react: '19.2.6'",
+        "  react: '19.3.0'",
         'catalogs:',
         '  react18:',
         "    react: '18.2.0'",
@@ -34,7 +34,7 @@ describe('loadCatalogs', () => {
     const catalogs = await loadCatalogs({ repoRoot: dir })
 
     expect(catalogs.default.zod).toBe('^4.6.0')
-    expect(catalogs.default.react).toBe('19.2.6')
+    expect(catalogs.default.react).toBe('19.3.0')
     expect(catalogs.named.react18.react).toBe('18.2.0')
   })
 

app-tanstack/app/_payload.tsx

@@ -1,3 +1,4 @@
+/* THIS FILE WAS GENERATED AUTOMATICALLY BY PAYLOAD. MODIFY AT YOUR OWN RISK. */
 import { payloadLayoutRoute } from '@payloadcms/tanstack-start/client'
 import { createFileRoute } from '@tanstack/react-router'
 

app-tanstack/app/_payload/admin.$.tsx

@@ -1,3 +1,4 @@
+/* THIS FILE WAS GENERATED AUTOMATICALLY BY PAYLOAD. MODIFY AT YOUR OWN RISK. */
 import { payloadAdminSplatRoute } from '@payloadcms/tanstack-start/client'
 import { createFileRoute } from '@tanstack/react-router'
 

app-tanstack/app/_payload/admin.index.tsx

@@ -1,3 +1,4 @@
+/* THIS FILE WAS GENERATED AUTOMATICALLY BY PAYLOAD. MODIFY AT YOUR OWN RISK. */
 import { payloadAdminIndexRoute } from '@payloadcms/tanstack-start/client'
 import { createFileRoute } from '@tanstack/react-router'
 

app-tanstack/app/_payload/api.$.ts

@@ -1,3 +1,4 @@
+/* THIS FILE WAS GENERATED AUTOMATICALLY BY PAYLOAD. MODIFY AT YOUR OWN RISK. */
 import { payloadApiHandlers } from '@payloadcms/tanstack-start/server'
 import { createFileRoute } from '@tanstack/react-router'
 

app-tanstack/app/_payload/server.functions.ts

@@ -1,3 +1,4 @@
+/* THIS FILE WAS GENERATED AUTOMATICALLY BY PAYLOAD. MODIFY AT YOUR OWN RISK. */
 import type { ServerFunctionClientArgs } from 'payload'
 
 import { createServerFunctionClient } from '@payloadcms/tanstack-start/client'

docs/access-control/overview.mdx

@@ -45,9 +45,9 @@ const defaultPayloadAccess = ({ req: { payload, user } }) => {
 
 <Banner type="warning">
   **Important:** By default, all [Local API](../local-api/overview) operations
-  respect Access Control based on the passed `user`. Set
-  `overrideAccess: true` only when the operation should entirely bypass
-  Access Control. See [Local API Access Control](../local-api/access-control).
+  respect Access Control based on the passed `user`. Set `overrideAccess: true`
+  only when the operation should entirely bypass Access Control. See [Local API
+  Access Control](../local-api/access-control).
 </Banner>
 
 ## Base Access Control

docs/authentication/api-keys.mdx

@@ -104,7 +104,7 @@ Payload ensures that the same, uniform [Access Control](../access-control/overvi
 
 ### API Key Only Auth
 
-If you want to use API keys as the only authentication method for a collection, you can disable the default local strategy by setting `disableLocalStrategy` to `true` on the collection's `auth` property. This will disable the ability to authenticate with email and password, and will only allow for authentication via API key.
+If you want to use API keys as the only authentication method for a collection, you can disable the default local strategy by setting `disableLocalStrategy` to `true` on the collection's `auth` property. Setting it to `false` keeps local authentication enabled. Disabling the local strategy prevents authentication with email and password, leaving API keys as the collection's authentication method.
 
 ```ts
 import type { CollectionConfig } from 'payload'

docs/authentication/custom-strategies.mdx

@@ -40,6 +40,8 @@ The `authenticate` function is passed the following arguments:
 
 At its core a strategy simply takes information from the incoming request and returns a user. This is exactly how Payload's built-in strategies function.
 
+The example below sets `disableLocalStrategy` to `true` because the custom strategy replaces local authentication. Set it to `false` or omit it to keep email and password authentication enabled alongside your custom strategy.
+
 Your `authenticate` method should return an object containing a Payload user document and any optional headers that you'd like Payload to set for you when we return a response.
 
 ```ts

docs/authentication/overview.mdx

@@ -88,7 +88,7 @@ The following options are available:
 | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **`cookies`**                  | Set cookie options, including `secure`, `sameSite`, and `domain`. For advanced users.                                                                                                                                       |
 | **`depth`**                    | How many levels deep a `user` document should be populated when creating the JWT and binding the `user` to the `req`. Defaults to `0` and should only be modified if absolutely necessary, as this will affect performance. |
-| **`disableLocalStrategy`**     | Advanced - disable Payload's built-in local auth strategy. Only use this property if you have replaced Payload's auth mechanisms with your own.                                                                             |
+| **`disableLocalStrategy`**     | Set to `true` to disable local authentication, `false` (default) to keep it enabled, or an object to retain auth fields while disabling it. [More details](#disable-local-strategy).                                        |
 | **`forgotPassword`**           | Customize the way that the `forgotPassword` operation functions. [More details](./email#forgot-password).                                                                                                                   |
 | **`lockTime`**                 | Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than `maxLoginAttempts` allows for.                                                                                  |
 | **`loginWithUsername`**        | Ability to allow users to login with username/password. [More](/docs/authentication/overview#login-with-username)                                                                                                           |
@@ -100,6 +100,27 @@ The following options are available:
 | **`useSessions`**              | True by default. Set to `false` to use stateless JWTs for authentication instead of sessions. Stateless JWTs cannot be revoked, so they stay valid until `tokenExpiration` even after a password change.                    |
 | **`verify`**                   | Set to `true` or pass an object with verification options to require users to verify by email before they are allowed to log into your app. [More details](./email#email-verification).                                     |
 
+### Disable Local Strategy
+
+The built-in local strategy authenticates users with an email or username and password. It is enabled by default. Set `disableLocalStrategy` to `true` to disable it, or to `false` to explicitly keep it enabled. Only disable the local strategy if you have configured another authentication method, such as [API keys](./api-keys) or a [custom strategy](./custom-strategies).
+
+You can also pass an object to disable the local strategy while retaining its auth fields:
+
+```ts
+{
+  slug: 'users',
+  auth: {
+    disableLocalStrategy: {
+      enableFields: true,
+      optionalPassword: true,
+    },
+  },
+}
+```
+
+- `enableFields` retains the local auth fields in the database and generated types.
+- `optionalPassword` makes the password field optional when auth fields are retained.
+
 ### Login With Username
 
 You can allow users to login with their username instead of their email address by setting the `loginWithUsername` property to `true`.