Installation
Requirements and install command for @delmaredigital/payload-puck.
Install the plugin together with Puck's core package. Coming from an earlier version? The upgrade guide lists the steps each breaking or security release needs.
npm i @delmaredigital/payload-puck @puckeditor/core @payloadcms/db-postgresThe quick start assumes an existing Payload app with its Next.js routes, @payload-config alias and admin layout. It uses Postgres and these environment variables:
PAYLOAD_SECRET=replace-with-a-random-secret-at-least-32-characters
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/my-appMerge its configuration with your app's existing collections and plugins.
Requirements
| Dependency | Version | Purpose |
|---|---|---|
node | ≥ 20.9.0 | Runtime |
@puckeditor/core | ≥ 0.24.0 | Visual editor core |
payload | ≥ 3.69.0 | CMS backend |
@payloadcms/next | ≥ 3.69.0 | Payload Next.js integration (optional peer) |
@payloadcms/ui | ≥ 3.69.0 | Payload admin UI (optional peer) |
@tailwindcss/postcss | ≥ 4.0.0 | Tailwind 4 PostCSS integration (optional peer) |
next | ≥ 15.4.8 | React framework |
react / react-dom | ≥ 19.2.1 | UI library |
tailwindcss | ≥ 3.0.0 (or ≥ 4.0.0) | Component and RichText styling (optional peer) |
zod | ≥ 3.0.0 | Input schemas for AI tools (optional peer) |
The AI and heading-analyzer Puck plugins (@puckeditor/plugin-ai, @puckeditor/cloud-client, @puckeditor/plugin-heading-analyzer) and the TipTap rich text editor ship as dependencies of this package, so you don't install them yourself.
Puck 0.21 moved from @measured/puck to @puckeditor/core. This plugin requires the new package scope.
Next.js security floor
If your app uses Next.js middleware (or proxy.ts) to protect dynamic routes, use next ≥ 15.5.16 / 16.2.5 to pick up the fix for CVE-2026-44574 (middleware bypass via dynamic route parameter injection). Turbopack users need ≥ 15.5.18 / 16.2.6.
Using payload-better-auth?
Any published version of @delmaredigital/payload-better-auth works, because its auth strategy stamps collection on the user, which is what the access checks need. 0.9.0 or later is recommended: it is the first release where the recommended payload.auth() wiring, combined with the request headers this plugin forwards into Payload, has no side effects for API-key requests. See custom API routes.
Next
Continue with the quick start.