v1.8.0 — Campaign Studio

The biggest Spwig release yet. Its centrepiece is Campaign Studio — a
complete email-marketing suite built right into the admin, so merchants can
design, automate, send and measure marketing email (and stop paying a
third-party service for it) without ever leaving Spwig. Around that headline,
1.8.0 lands a large platform-wide security-hardening pass and a broad
stability and correctness sweep — the great majority of both surfaced by
Spwig's continuous automated code review and validated by the full test suite.

Campaign Studio ships in every edition, Community included (email goes out
through your own configured mail gateway), and is released as Beta while we
gather real-world feedback.

Upgrading. The normal update applies this release's new database migrations
(in the new email-marketing app and the email subsystem) automatically — there
are no manual migration steps and no breaking API changes. All public API
additions are backward-compatible, and older SDK/integration clients are
unaffected.

Added

• Campaign Studio — a complete email-marketing suite built into Spwig (Beta).
  Design, send, automate and measure marketing email without leaving the admin
  or paying for a third-party service like Mailchimp. Available on every
  edition, Community included; email goes out through your own mail gateway, so
  your list and your sending stay yours. Reach it from the new Campaign
  Studio entry in the Marketing menu.

  • Visual email builder. Compose campaigns from drag-and-drop content
    blocks — headings, text, images, buttons and layout structure — with shared
    style, typography and colour controls that match the rest of the admin. A
    live preview renders in your store's own theme, so an email looks the way it
    will actually arrive.
  • Commerce blocks that pull in live store content. Drop in real products,
    a discount code, a gift-card promotion, or your latest blog
    posts, chosen with built-in pickers — no copy-pasting links or prices.
  • Personalization. Merge fields let you greet each recipient by name and
    tailor content per contact, with safe handling so a stray field can never
    break a send or leak data.
  • Audiences & segmentation. Build dynamic segments with a visual rule
    builder — targeting on customer activity and spend, subscriber tags, and
    signals from loyalty, affiliate and RFM (recency/frequency/value)
    data — and seed ready-made starter audiences in one click. Contacts unify
    registered customers and anonymous leads in one list.
  • Grow your list from the storefront. A storefront newsletter signup feeds
    subscribers straight into Campaign Studio, and you can bulk-import existing
    contacts from CSV or Excel (with names and tags).
  • A/B testing. Test subject lines and content and let Campaign Studio pick
    the winner automatically, with real statistical-significance scoring rather
    than guesswork. A/B works across one-off sends, recurring campaigns (per
    occurrence) and individual journey steps.
  • Triggered journeys. A visual canvas builds multi-step automations with
    branching logic, driven by real store events — abandoned-cart recovery,
    win-back for lapsing customers, post-delivery review requests, back-in-stock
    follow-ups, plus signup and order triggers. Journeys can be exported and
    imported to share or reuse.
  • Recurring campaigns. Schedule newsletters and digests that assemble
    themselves — a "new since last send" mode surfaces only products and blog
    posts added since the last edition, and a freshness policy can hold or skip
    a send when there's genuinely nothing new to say.
  • Campaign analytics & revenue reporting. Every campaign gets a report
    with an engagement time series, a link-level click map showing exactly what
    got clicked, and per-recipient activity. Campaign Studio also attributes
    real revenue, orders, average order value, revenue-per-email and ROAS
    back to each campaign (and to each journey), so you can see what your email
    actually earns.
  • Deliverability & compliance built in. One-click unsubscribe (RFC 8058
    List-Unsubscribe), a visible unsubscribe footer on every campaign, DKIM
    signing and an automatic plain-text version keep you the right side of inbox
    rules and consent law. Every send is double consent-gated and honours the
    customer's communication preferences.
  • Automatic list hygiene. Bounces and spam complaints are ingested from
    your provider and suppressed automatically — with soft-bounce thresholds and
    a suppression dashboard — so you stop mailing dead or hostile addresses and
    protect your sender reputation.

• More reliable email delivery under the hood. The engine that sends every
  message — order confirmations, password resets and now marketing campaigns —
  was reworked to put transactional mail first: time-critical emails always take
  priority over bulk campaigns, each sending account has its own per-minute
  budget, and a retry-and-recovery sweep automatically re-sends anything left
  stuck mid-flight. The result is steadier delivery and fewer surprises when a
  big campaign and a rush of orders land at the same time.

Security

1.8.0 is a large, platform-wide security-hardening release. The great majority
of these fixes were surfaced by Spwig's continuous automated code review, then
human-reviewed and validated by the full test suite. There are essentially no
dependency changes in this release — this is hardening of Spwig's own code, not
a dependency refresh.

• Richer storefront content is sanitized more strictly. Spwig's content
  sanitizer — which cleans merchant- and staff-authored rich text before it
  reaches shoppers — now scrubs inline CSS against a strict allow-list of safe
  styling properties and enforces real sandboxing on any embedded frame,
  dropping frames that request the ability to break out of the sandbox, navigate
  the top window, or spawn unsandboxed pop-ups. This closes several
  cross-site-scripting and page-hijack vectors on marketing and content pages
  that non-owner staff can edit.
• GDPR cookie-consent export is injection-safe. Visitor-supplied fields in
  the cookie-consent audit export (such as the browser user-agent) are now
  neutralized so they can never be interpreted as a live formula when the
  exported file is opened in a spreadsheet — closing a CSV/formula-injection
  risk in a compliance export.
• Storefront search click-tracking respects ownership. The search analytics
  click endpoint now verifies that the caller actually owns the search it is
  recording, so one shopper can no longer register activity against another's
  search session. The same search surfaces now reject nonsensical numeric
  input — non-finite or negative price filters and out-of-range result limits
  are clamped or refused before they reach the database.
• Outbound webhooks and gateway callbacks are protected against server-side
  request forgery. Webhook destination URLs are validated — and re-validated
  at delivery time — to reject internal, loopback, and cloud-metadata addresses,
  closing an SSRF vector and defending against DNS-rebinding. Delivery-event and
  bounce callbacks are now scoped to the account whose signature verified,
  rate-limited, and size-capped, and the mail gateway's management key is only
  ever sent to the operator-pinned trusted address.
• Email campaign subject lines can no longer run template code. Campaign
  personalization now flows exclusively through an allow-listed set of safe
  merge fields (first name, store name, unsubscribe link, and so on) resolved by
  plain text substitution, closing a server-side template-injection vector on
  the subject line and keeping merged values escaped and header-injection-safe.
• Sensitive admin actions require the right permission, not just staff
  access. Operational and destructive management endpoints now gate on an
  explicit permission rather than merely proving admin-site access,
  login-required forms reject anonymous submissions, and the admin-path guard
  correctly recognizes every supported language prefix so protection is never
  bypassed by a locale in the URL.
• API tokens are scoped to their purpose. The help-system's admin metadata
  endpoint now accepts only tokens actually issued for the help system, so a
  webhook or integration token can no longer read data outside its remit.
• Less sensitive data in logs, exports, and emails. Crash/error reports now
  redact sensitive request headers and values before they are recorded, an
  internal debug context view escapes request-derived data, and
  region-restricted products can no longer leak into an email sent from a store
  whose home market doesn't sell them.
• Hardened input handling against denial-of-service. Bulk subscriber imports
  enforce their row cap while parsing (so a small, highly-compressible file
  can't balloon into millions of rows), product-feed generation and webhook
  payloads are bounded and cap their batch sizes, and numerous endpoints now
  clamp or reject malformed, oversized, or negative parameters before acting on
  them. Path-prefix matching was also tightened so an unrelated URL can no
  longer be mistaken for a protected one.

Fixed

• Currency and locale correctness across the store. A pass through the
  currency and locale layer fixes a helper that ignored the currencies
  configured in Site Settings, tightens the currency context, template tags,
  endpoints and the supported-currency model, and corrects a language fallback
  that previously hard-coded every language missing from the configured list —
  so the currency selector, prices and translated language names all reflect
  what the merchant actually set up.
• Merchant app sales figures read correctly. In the Spwig Merchant ...

v1.7.5

v1.7.5 — 2026-08-24

A maintenance release: customer/merchant-facing fixes plus reliability hardening across the messaging systems. Upgrading is drop-in — no manual migration steps, no breaking API changes.

Fixed

• Order emails link to the order — the "view your order" link in the order confirmation, shipping, delivery and refund emails now points to the customer's real order-confirmation page (in their language) instead of a dead address.
• Webhooks fire only after a change is saved — deliveries are dispatched after the triggering database change commits, so an integration never receives an event for a record that hasn't been persisted yet.
• Email system hardening — providers, DKIM signing, SMTP server control, theme integration, domain handling, translated-template import and the setup wizard; per-template failures are now reported accurately.
• SMS provider hardening — more robust recipient handling and provider selection.
• Translation webhook metadata — no longer omits the existing translation webhook.

Security

• Dependency refresh: Stripe 11.6.0, Django REST Framework 3.18.0, google-api-python-client 2.199.0, plus boto3, google-auth, google-auth-httplib2 and phonenumbers patch updates.

Changed

• Docs: removed the editions comparison table; added the starting-points headless-storefront demos link.
• Headless API: responsive image sources extended to categories, variants, order items and brand logos.

Spwig v1.7.4

Admin refinements and reliability fixes on top of 1.7.3. Drop-in — no migrations.

Added

• Responsive image srcset ladders in image_sources for headless storefronts (additive).
• Tabbed admin editors for product reviews and subscription plans.

Fixed

• Page Builder: storefront element CSS (carousel/testimonials/CTA), Add-Page 500, per-release element-registry cache key.
• Selected theme CSS always loads, even mid-switch.

Security

• Review-comment XSS escaping; hardening across email, SMS, and webhooks.

Spwig 1.7.3

Self-hosted, AGPL-3.0 e-commerce platform. This release syncs the public source with the 1.7.3 platform build.

Added

• Inventory operations — stock transfer/adjustment services with auditable movement history; back-in-stock notifications
• Agentic commerce (UCP) foundations, Community-ungated
• Wallet and subscriptions improvements
• Form builder — reCAPTCHA v3, encrypted field storage, SSRF-hardened outbound webhooks
• Visibility engine extracted into its own visibility/ app

Fixed

• Checkout money-handling corrections (settlement amount, step advancement, session-lock idempotency)

Security

• SSRF IP-pinning on form webhook actions; encrypted-at-rest form fields

See CHANGELOG.md for the full list.

v1.7.2

[1.7.2] - 2026-08-08

A payments and hardening release. Spwig adds Razorpay as a new payment
gateway for merchants in India and Singapore, and the payment gateway system
becomes fully modular — providers install as self-contained marketplace
components with no change to the platform core.
Alongside the new capability, our daily code reviews drove a broad round of
proactive enhancements and hardening across the merchant admin and mobile
API, referrals, wallet, subscriptions, single sign-on, payouts, and gateway
refunds. Upgrading is drop-in: changes to the public API are additive and
backward-compatible, and no manual migration steps are required.

Added

• Razorpay payments (India & Singapore). Merchants registered in India
  or Singapore can now accept payments through Razorpay Standard Checkout —
  cards, UPI, netbanking, wallets, EMI and Pay Later in India, and cards and
  UPI in Singapore — settling in INR or SGD. Payments are verified and
  captured server-side, with full and partial refunds. Add it under
  Settings → Payments and install from the marketplace.

Changed

Payments

• Spwig's payment gateways are now fully modular: adding a provider no
  longer touches the platform core, because each gateway is a
  self-contained marketplace component that declares its own checkout,
  webhook and key handling. Stripe, PayPal, Airwallex, Square and Revolut
  were updated to this model, so the gateway catalogue stays consistent and
  is quicker to extend — which is how Razorpay drops in cleanly.

Fixed

Merchant admin & mobile API

• Proactive enhancements and hardening surfaced through our daily code
  reviews: tightened permissions and rate limiting, stricter input
  handling, and more accurate reporting and exports. All
  backward-compatible.

Referrals, wallet & subscriptions

• Accuracy and robustness improvements to the referrals and wallet systems
  and to subscription-provider handling, also caught in daily review.

Single sign-on & payouts

• Hardening of enterprise single sign-on and payout-provider setup.

Gateway refunds

• Gateway refunds are now processed more reliably and are idempotent, so a
  retried refund can't be issued twice.

v1.7.1

[1.7.1] - 2026-08-05

A performance, consistency, and hardening release that also lands major
new merchant-facing capabilities — subscriptions in the built-in storefront,
region-based product availability, and an opt-in preview of AI Shopping
(agentic commerce, off by default). The Spwig admin
gets faster and more visually consistent: a large amount of duplicated
and dead styling has been removed, and every app now draws from one
shared, token-driven design system — so buttons, badges, cards, colours
and dark mode look the same across the whole admin, with less to
download and parse. On the storefront, images move to AVIF with a
<picture> element and automatic fallback, and CSS and JavaScript
delivery is deduplicated and cache-busted through the asset manifest.
Alongside the polish, a broad sweep of correctness and robustness fixes
lands across cart, checkout, orders, accounts, wallet, and payments,
and the installer and first-boot path gain further safety. Upgrading runs
additive schema migrations plus automatic data back-fills (region
availability and digital-product stock) — no manual migration steps are
required. Changes to the public API are additive and backward-compatible —
new response fields (image_sources, ships_to_region) and a new
POST /api/store/set-region/ endpoint — so existing integrations keep
working unchanged.

Upgrade notes

• Regenerate media to get AVIF for your existing images. New uploads
  are converted to AVIF automatically, but images already in your library
  are not reprocessed on upgrade. To serve the new format across your
  catalogue, open Media Library → Image Processing and run
  Regenerate All Product Thumbnails — it now produces AVIF alongside
  WebP. Your store keeps working throughout: each image upgrades to AVIF
  once its renditions finish, and falls back to WebP or the original until
  then, so there is never a broken image.

Added

• Subscriptions in the built-in storefront. Spwig's subscription
  engine and APIs already powered subscriptions on headless storefronts;
  the built-in storefront now sells them end to end. Product pages gain a
  "one-time vs. Subscribe & Save" selector with per-tier pricing, free
  trials, setup fees and cancellation terms (for simple, variable and
  digital products); the cart and checkout show the billing cadence; and
  customers view, pause, resume, cancel and update the payment method for
  their subscriptions from their account. The reusable payment method is
  captured at checkout through one provider-agnostic flow that works across
  every bundled gateway — Stripe, PayPal, Airwallex, Square and Revolut.
• Each recurring cycle now generates a paid order that flows through
  normal fulfilment, so physical subscriptions re-ship and digital ones
  re-grant access automatically every period, with renewal reminders,
  trial-ending, payment-failed (dunning) and cancellation emails sent
  throughout. Billing is handled uniformly for all gateways through
  Spwig's own engine, charging the first cycle at checkout and each
  renewal off-session from the saved payment method.
• AI Shopping (agentic commerce) — opt-in preview. Spwig stores can now be
  discovered, browsed, and — optionally — checked out by AI shopping assistants
  over open agentic-commerce protocols (UCP, plus ACP product feeds and a
  storefront MCP endpoint). It ships off by default: until a merchant turns
  it on under Settings → AI Shopping, the store exposes no agent surface at
  all. When enabled, the merchant controls which protocols are live, whether
  unverified agents may read (browse) versus check out, the store's public
  support/terms/privacy/returns details, and — per product — whether an item is
  visible to agents. Each store gets its own cryptographic agent identity
  (Ed25519 transport and ECDSA/AP2 signing keys published as a JWKS), a
  .well-known discovery document, and an emergency kill switch that halts all
  agent activity instantly. This is an early, experimental preview and is not
  enabled on upgrade.
• AVIF renditions are generated for media-library images and served
  through a <picture> element across the storefront — the product
  gallery main image and its swaps, and JavaScript-driven surfaces
  (mini-cart, quick view, recommendations) — with WebP/JPEG fallback
  for browsers that don't support AVIF.
• Storefront catalog API serializers gain an additive image_sources
  field exposing the available renditions; existing image fields are
  unchanged.
• Region availability. Merchants can restrict a product to — or exclude
  it from — chosen sales regions via a Region availability setting
  (all regions / only selected / all except selected). The storefront detects
  the shopper's region and, on a first visit to a non-default region, confirms
  it ("We've set your region to [X]") with a country picker; a region selector
  can also be placed in the header. Region-restricted products are shown marked
  "Does not ship to [country]" (with a filter) or hidden, per a Stock Display
  Settings option, and switching region follows the region's default currency
  on multi-currency stores. Additive headless/API support: POST /api/store/set-region/, a ships_to_region field on the catalog product
  API, and a ?ship_only filter. (Server-side enforcement at checkout is a
  planned follow-up.)
• Variable products now show a variant price range (e.g. "$59.99 – $89.99",
  collapsing to a single price when all variants match) on listings and the
  product page, instead of the parent product's price.
• Merchants can now read the platform release notes (this changelog) directly
  from the admin upgrade page, so what's new in each version is visible in place
  when reviewing an update.
• The checkout-session API gains additive amount_due and tendered_amount
  fields, and web order placement now runs through a warn-only quote-drift check
  that flags a price/total mismatch before an order is created — groundwork
  shared with the AI Shopping checkout flow.

Changed

Admin interface

• Every admin app now draws from one shared design system, so buttons,
  badges, cards, list rows, tabs and forms are consistent across the
  whole admin instead of each app styling its own.
• Removed a large amount of duplicated and dead admin styling and moved
  the rest onto shared design tokens — dark mode and colour are now
  driven centrally and identical everywhere, and there is less CSS to
  download and parse, so the admin feels snappier.
• Improved colour contrast to meet WCAG AA for status badges,
  indicators and buttons in both light and dark themes.

Storefront delivery

• Storefront widget CSS and page-builder element scripts now route
  through the asset manifest, so each asset loads once, is
  deduplicated across widgets, and is cache-busted on change.
• Only the product_grid layout variant actually in use is loaded,
  and product-card JavaScript plus the quick-view modal are skipped on
  pages that render no product cards — less CSS/JS on the wire.

Fixed

Installer, first boot, and packaging

• Hardened the first-boot and re-run paths of the installer (v1.4.0):
  safer re-runs, SSL handling, and upload configuration.
• The pre-baked static manifest now self-heals when incomplete, so
  core assets always load on a fresh install; a post-seed
  post-condition asserts an active storefront theme.
• Bundled themes are restored to the preinstalled manifest, and the
  deploy step extracts the full installer package and publishes a
  versioned copy.

Django 5.2 readiness

• Updated the component static finders to Django 5.2's find_all
  signature, switched SSO JWT token claims and other paths to
  timezone-aware now(), and cleared the remaining low-risk
  deprecations.

Cart & checkout

• Pre-order and backorder products can now actually be bought. A product
  marked pre-order, or one with backorders enabled (at the product,
  category, or store level), was advertised as "Pre-Order"/"Backorder"
  but was in practice unbuyable once it hit zero stock: it was hidden
  from region listings, its product page showed a misleading "not
  available in your region" notice with no add-to-cart button, and any
  order that slipped through was rejected at placement. It is now
  purchasable end to end, and such an item is recorded on the order as
  awaiting stock so it can be fulfilled when stock arrives. A genuinely
  out-of-stock product with neither option stays unbuyable, and
  region-restriction rules are unchanged.
• Fixed a crash when a guest session key is missing, validated the
  step-4 delivery-window inputs before use, and corrected stock
  checks to account for variant-level stock rows.
• On-sale listings now exclude products without a usable sale price,
  mini-cart line totals include per-unit customization charges, and
  recommendation lists honour the requested item limit.
• Removed per-row database queries from the cart, cart-item, wishlist,
  and recently-viewed admin changelists and from product
  recommendations and per-line cart images — related data is now
  selected or prefetched in a single pass.

Orders

• Zero-amount money values format correctly instead of rendering raw;
  order tracking honours the stored estimated delivery date; and the
  refund relation is selected up front to avoid extra queries.
• Made order-note concatenation, items_json length checks, and the
  order timeline robust to empty and edge values, so cancelled and
  refunded orders no longer display as completed.
• Test-order generation now respects the store's currency and valid
  order statuses, its source distribution, and rejects an invalid
  --days argument; country-code lookups are case-insensitive.

Payments

• Gateway refunds that previously failed on a Money/Decimal comparison
  now process correctly, the capture row is locked during a refund to
  prevent over-refunding, ...

Spwig 1.7.0

Spwig 1.7.0 — the stored-value release, with agentic commerce built in.

This is a substantial release, please review the CHANGELOG.md for full details. In this release, gift cards become a first-class part of the platform, sold on the storefront, delivered by email, spendable at checkout and at the POS, and handled cleanly through refunds, now modelled as true payment tenders rather than discounts. The customer wallet graduates to spendable store credit, loyalty rewards pay out into it, and the payment/refund/reward paths gain substantial hardening, auditability, and test coverage. Alongside it, this release adds Agentic Commerce (opt-in, built into the core), a built-in Test Gateway for first-run checkout, scoped API tokens, and a reworked checkout.

Highlights

💳 Stored value (gift cards & wallet)

• Gift cards purchasable on the storefront (fixed/custom denominations, recipient, gift message, scheduled delivery) — paid orders mint funded cards and email them, on web and POS, with idempotent issuance and a reconciler.
• Gift cards are now payment tenders, not discounts — a card settles the full post-tax, post-shipping total and writes a real payment record. Multiple tenders combine on one order; a fully covered order completes without a gateway.
• Customer wallet is spendable store credit at checkout (hold-based double-spend protection, single-currency rule). Loyalty fixed-value rewards credit store credit exactly once (DB-enforced).
• Tender-aware refunds: value returns to the gift card before the gateway; refunds to a dead/expired card mint a replacement. Automatic loyalty clawback + affiliate reversal on full refunds.

🤖 Agentic Commerce (AI Shopping) — opt-in, built-in

• Off by default; every agent surface returns 404 until a merchant deliberately enables it.
• Discovery + read-only catalogue over the Universal Commerce Protocol (/.well-known/ucp) and a storefront MCP endpoint (search_catalog/get_product).
• Agent auth via HTTP Message Signatures (RFC 9421): directory-resolved keys, trust-on-first-use with per-assistant spending caps, and a tamper-evident append-only activity log.
• UCP checkout sessions place real, paid orders through the same pricing/tax/shipping/payment paths (no parallel checkout), with AP2 merchant-signed mandates (SD-JWT) as dispute evidence. Optional ACP product feed.
• Plain-language AI Shopping admin: readiness verdict, per-product visibility switch, assistant registry, emergency stop.

🧪 Built-in Test Gateway

• A fully local simulated payment provider (magic cards for success/decline/insufficient-funds/3-DS/AVS, webhook-delayed capture) with a strict validation mode enforcing what real gateways require (email, name, ISO-2 country, phone, per-currency minimums, zero-decimal correctness). Auto-installed, active only in sandbox mode.

🔑 Scoped API tokens & analytics

• Merchant API tokens can be granted Read or Read & Write access to specific admin APIs from a grouped scope picker. Fail-closed and least-privilege: a token reaches only what it holds a scope for and never exceeds its creator's role.
• New web traffic analytics API (GET /api/admin/analytics/traffic/) reachable by a scoped token.

🛒 Checkout

• Session-auth storefront cart/checkout (guest cart merges into the account on login), reworked express checkout (email-first, collapsible summary, pre-mounted default provider), auto-selected shipping method, digital/booking-only carts skip shipping steps, and voucher entry in the payment section across all templates.

Security

Independent cryptographic + security review of Agentic Commerce (SSRF-guarded key fetches, double-charge/price-drift protection, signature-verified rate-limited agent activity, private keys never exposed). CSRF enforced for session-auth storefront APIs. Least-privilege API tokens (fail-closed). Bundled component packages are checksum-verified. Dependency refresh incl. Django and Pillow security releases.

⚠️ Breaking changes

• Gift cards are tenders, not discounts (full-balance settlement; historical figures preserved).
• Headless TypeScript SDK / React hooks → 2.0.0 (tender endpoints, loyalty redemption by UUID).

---

Full details in CHANGELOG.md under [1.7.0]. Licensed under AGPL-3.0-or-later.

v1.6.0 — quality hardening + targeted stability fixes

Historical note (2026-07-15): This release was rewritten with
git filter-repo on 2026-07-15 to remove a set of Spwig HQ-internal
apps (developer_portal/, license_checkout/, marketplace_checkout/,
and four companion files in accounts/) that shipped in the OSS
distribution by mistake, starting with v1.5.7. Runtime behavior for
Community installs is unchanged — the removed code was gated behind
SPWIG_IS_HQ and never activated on Community builds. The v1.6.0
tag now points at the rewritten commit; older releases (v1.5.7,
v1.5.8, v1.5.9) were similarly rewritten.

---

A quality-hardening release. Continuous integration now enforces
formatting, linting, and typing across the codebase, and a batch of
targeted stability improvements ship alongside.

Fixed

• Address updates on the customer profile no longer surface an error
  under specific data shapes.
• POS manager admin now filters on the correct hashed credential.
• Product admin search restored on catalogs that store the
  description field outside the primary record.
• Order statistics computation is now robust against multi-currency
  amounts.
• Email unsubscribe footer no longer duplicates when the sending
  template already contains one.
• Affiliate program email templates are now discoverable through the
  admin template registry.
• Smart-defaults service correctly resolves order fields on the
  current schema.
• Guest activation and email-unsubscribe redirects now resolve to
  the storefront home.
• Site settings change form: four inline style attributes moved to
  CSS, restoring strict-CSP compliance.
• Page-builder structure view now stays in sync when the wrapper is
  clicked.
• Broader import correctness across page builder, catalog, email
  system, and orders admin code paths.

Changed

• Ruff format and prettier are now the enforced source-formatting
  standards; CI blocks on any drift.
• ESLint runs codebase-wide with strict enforcement and blocks CI
  on regressions.
• Contributors get instant local feedback via a .pre-commit-config.yaml
  in the repo — pre-commit install once, then formatting and
  linting apply on every commit.
• Unused import cleanup across the codebase reduces cognitive load
  during code review and speeds up cold Django startup marginally.

Tests

• Substantially expanded integration test coverage — new suites for
  preferences, custom fields, referrals, shipping, orders returns,
  and admin push notifications.
• End-to-end (Playwright) tests now run in a dedicated CI track,
  isolated from the unit / integration cluster.
• A dedicated CI step exercises 13 audited app-level test suites in
  addition to the main test run.

Contributors

• CONTRIBUTING.md now documents the Developer Certificate of Origin
  (DCO) sign-off requirement — please git commit -s your changes.

---

Full changelog: CHANGELOG.md

v1.5.9 — Storefront fixes + POS parked-cart cleanup

Historical note (2026-07-15): This release was rewritten with
git filter-repo on 2026-07-15 to remove a set of Spwig HQ-internal
apps (developer_portal/, license_checkout/, marketplace_checkout/,
and four companion files in accounts/) that shipped in the OSS
distribution by mistake. Runtime behavior for Community installs is
unchanged — the removed code was gated behind SPWIG_IS_HQ and never
activated on Community builds. This tag now points at the rewritten
commit; the original commit SHA is no longer reachable via the tag.

---

Bug-fix release addressing three regressions found during v1.5.8
canary deployment on the demo fleet, plus a missing Celery beat
schedule for expired POS parked carts.

Fixed

• Storefront add-to-cart 500. frontend-utils.js delegated
  showNotification() to AdminModal.toast(), but AdminModal
  only loads in the admin bundle — every storefront notification
  threw ReferenceError. Restored the inline DOM toast.
• Guest wishlist 401. WishlistViewSet.product_ids required
  authentication, but product-card.js hits it on every page for
  heart-button state including for guests. Now AllowAny, with an
  empty short-circuit for unauthenticated requests.
• Admin help search 500. Unquoted numeric YAML (9.99) in the
  price-charming topic keywords crashed the keyword iteration.
  Coerced iteration to str in both the classic search action and
  the semantic-search chunker.

Added

• Merchant help topics for voucher CSV/XLSX import (from 1.5.5) and
  hosted-services free tier (from 1.5.7).
• POS help topics updated after 1.5.8 removed the upgrade page.
• Hourly cleanup of expired POS parked carts. Runs at :15 with a
  55-minute expiry. Requires celery-beat restart on upgrade
  (installer/upgrader handles this automatically; source-form
  operators may need docker compose restart celery_beat).

Upgrade notes

No merchant action required for installer-based installs. Source-form
users: git pull && docker compose build && docker compose up -d,
then restart celery_beat to pick up the new schedule.

Full changelog: CHANGELOG.md

v1.5.8 - POS included in every edition

Historical note (2026-07-15): This release was rewritten with
git filter-repo on 2026-07-15 to remove a set of Spwig HQ-internal
apps (developer_portal/, license_checkout/, marketplace_checkout/,
and four companion files in accounts/) that shipped in the OSS
distribution by mistake. Runtime behavior for Community installs is
unchanged — the removed code was gated behind SPWIG_IS_HQ and never
activated on Community builds. This tag now points at the rewritten
commit; the original commit SHA is no longer reachable via the tag.

---

POS was previously a paid module. Starting with v1.5.8, it's part of the platform for every merchant. Community, Pro, Enterprise, all the same. Revenue moves entirely to Spwig-operated infrastructure: hosting, higher hosted-service tier limits, mail gateway, support.

No merchant action required. If you were running Community and clicking the "POS is a Pro feature" CTA, the CTA is gone and POS just works. If you were running Pro/Enterprise, POS keeps working exactly as before - nothing changes for paying merchants.

Full changelog: CHANGELOG.md