chore(release): S-Cart 3.3.0 — require core 3.5, front 3.3, shop 3.3.1

S-Cart 3.3.0 — 2026-10-28

Includes: gp247/core 3.5.0 · gp247/front 3.3.0 · gp247/shop 3.3.1

This release contains security fixes — updating is recommended for every site.

⚠️ Security

• Admin login (core 3.5.0): the admin sign-in page limits repeated failed attempts.
• File manager (core 3.5.0): file manager write actions are accepted only from the admin itself, not from other sites.
• Cart and checkout (shop 3.3.1): zero or negative quantities are refused in the cart and at checkout.
• Admin REST API (core / front / shop 3.2.3): every admin API endpoint follows the roles and permissions of the matching admin screen, and an admin assigned to one store only sees that store's data.
• Public REST API (front / shop 3.2.3): only shows what the storefront shows (no cost price, stock or internal fields; no hidden or unapproved products).
• API sign-in (core / shop 3.2.3): login attempts are limited, every token expires, locked customer accounts cannot sign in.
• API keys (core 3.2.3 / 3.4.0): API Connection keys are stored hashed and shown only once; php artisan gp247:update removes the old plain-text copies. Tokens issued before 3.2.3 now get an expiry.

Minimum safe versions: see GP247 security releases.

✨ New

• REST API v2 (api/v2/..., core / front / shop 3.3.0): fixed response format {data, meta, links}, filters, sorting, search, language, effective price (price_final) and GET api/v2/front/meta. API v1 keeps working.
• Turn the API on and off from the API management screen (core 3.3.1): all at once, or per group (v1/v2 × admin/storefront).
• X-Request-Id on every API response, to match a client's error with the site log (core 3.4.0).
• Contact form (front): messages saved in an admin inbox, settings tab and notification mail.
• Website information is saved only when you press Save (core).

🐞 Fixes

• The page's own image is used for og:image when sharing (front).
• Admin screens of front and shop can be overridden from app/GP247 again; every core route goes through the override mechanism (core / front / shop).
• The admin order API no longer returns a server error (shop).

⚠️ Before and after updating

1. Back up your database — gp247:update removes the plain-text copies of API Connection keys and cannot restore them.
2. Update:

   composer update gp247/core gp247/front gp247/shop
   php artisan gp247:update

3. If you use the REST API, check these changes:
   • New installs have API v1 turned off; turn it on in Admin → API management if your app uses api/core or api/front.
   • API errors now use proper HTTP codes with the body {"error":1,"msg":…,"code":…}.
   • Tokens expire (7 days, 30 days with remember_me); apps must log in again when they receive 401. Tokens issued before 3.2.3 keep working for at least 7 days after the update.
   • Admin API calls need the permission of the matching admin screen.
   • Use POST logout (GET logout is deprecated).

Guides: API introduction · How to update GP247

Full changes since 3.2: core · front · shop