chore(release): S-Cart 3.5.1 — require core 3.10.2

S-Cart 3.5.1 — 2026-11-05
The admin now flags unsafe settings; the web installer is simpler.
Includes: core 3.10.2 · front 3.5.2 · shop 3.7.0 · mcp 2.0.1

✨ New

• System alerts — the dashboard summarises unsafe settings (debug, HTTPS, default admin password, MFA…) with a detail page and fix guides; Administrators only
• Web install finishes in one run — choose the admin username; the account entered in the installer replaces the default one
• Tidier two-column forms — "+ Create new" in the form header while editing; the list keeps its page and keyword (core admin screens)
• For developers: gp247:doctor runs the same security checks (WARN/PASS, exit code unchanged); other packages can add checks

🛡️ Third-party libraries (update now)

• livewire/livewire 4.4.8 — authorization bypass (GHSA-mhf7-xp6r-6qrc); core 3.10.2 now requires it
• symfony/mime 7.4.22 — email header injection (CVE-2026-45070); pulled by composer update

🔧 Improvements

• gp247:update keeps a single "System alerts" block
• The Remove button now clears leftover extension folders
• Searchable selects stay closed while you edit another row

⚠️ To do when updating

• Back up the database, then run composer update (pulls Livewire ≥ 4.4.8, symfony/mime ≥ 7.4.22) and php artisan gp247:update
• (Sites whose SESSION_DRIVER is not "file") every user signs in again once after the update