v2.4.1
Release Notes — v2.4.1 (July 22, 2026)
Added
- Add request and response examples to the Swagger/OpenAPI docs for every Returns (RMA) and EU Withdrawal endpoint (shop and admin).
- Add the request body schema for creating and updating RMA reasons, rules, statuses and custom fields in the Swagger docs.
- Add
redirectandredirectUrlto the place-order response so clients can tell when the shopper must be sent to a payment page before the order exists. - Add
minPriceandmaxPriceto the storefront category response so REST clients can bound a price-range filter, matching what GraphQL already exposed. - Add
xlsandxlsxto every admin export endpoint (?format=), matching the formats the admin panel offers; exported values are now guarded against spreadsheet formula injection.
Changed
- Drop the hard Redis requirement: the API metadata/schema cache and rate-limit counters now follow the application's
CACHE_STORE(falling back tofile), so no separate cache service or extra configuration is needed. - Take the cart file-upload size limit from
php.iniand the staged-upload lifetime from the session lifetime, instead of package settings.
Fixed
- Fix GraphQL connection fields (e.g. cart
items { edges }) failing withField "items" of type "Iterable" must not have a sub selectionon some production PHP-FPM servers. - Fix RMA settings create and update responses showing a success
message; the confirmation message is now returned only on delete. - Restore backward compatibility with Bagisto cores below 2.4.5 by conditionally registering the EU Withdrawal endpoints only when the core module is present.
- Fix
paymentGatewayUrlcoming back empty for redirect payment methods (Stripe, Razorpay, PayPal Standard, PhonePe), leaving clients with nowhere to send the shopper.
Full Changelog: v2.4.0...v2.4.1