Skip to content

v2.3.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 16:08
· 2 commits to main since this release
v2.3.2
80bd554
This commit was signed with the committer’s verified signature.
vholik Viktor Holik
GPG key ID: 91D3FBB57790D8CC
Verified
Learn about vigilant mode.

v2.3.2

A security and hardening release. All marketplaces running 2.3.1 or earlier should upgrade.

🔒 Security

This release fixes a critical broken-access-control (BOLA/IDOR) vulnerability in the vendor API, privately reported by @hackchang under coordinated disclosure. Thank you.

The issue: the /vendor/sellers/:id route subtree operated on the URL id parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

Weakness: CWE-639 / CWE-862 · Severity: Critical (CVSS 3.1 ~9.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

What changed:

  • Every /vendor/sellers/:id handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
  • Member-management routes bind member_id to the caller's own seller
  • GET /vendor/stores now requires member authentication (#1450)
  • The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @hackchang credited as reporter.

✨ Features

  • Attribute edits now go through the product-change diff pipeline, the same way product edits do (#1444)
  • CLI builds admin dashboard extensions, and a package can ship its own entry point (#1424)
  • create-mercur-app pins generated projects to the CLI's release channel (#1459) — scaffolding with @rc no longer mixes in latest packages

🐛 Fixes

Checkout & orders

  • Core owns the payment webhook so carts complete as split orders (#1418)
  • Split-order payment status is reported correctly on the admin and store order routes (#1458)
  • Payment statuses are no longer double-counted (#1399) — thanks @shin4141
  • Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

Offers & attributes

  • Created offer prices are attributed by rule instead of position (#1397)
  • New scoped-axis option values are associated with their product (#1454)
  • Attribute possible-values pagination fixed (#1447) — thanks @adeaviladev01
  • The pending product-change guard is actor-scoped (#1443)

Dashboards

  • RouteDrawer dialogs have an accessible title (#1415)
  • The admin invite form carries the roles field, so invited admins aren't locked out (#1420)
  • DataGrid column resizing works (#1452)
  • The NoRecords empty state grows instead of overflowing (#1456)
  • react-router-dom is a peer dependency (#1426)
  • dashboard-sdk resolves plugin roots via Node and no longer emits top-level await (#1429)
  • plugin:build no longer races itself for src/admin/index.mjs (#1427)

Other

  • Algolia block: the five dead algolia.intermediate.* subscribers removed (#1416) — thanks @Roshan931
  • Storefront drops the unused next-intl dependency (#1457)
  • Architecture docs rewritten around layers and extension zones (#1412)

📦 Upgrading

npm install @mercurjs/core@2.3.2

Bump every @mercurjs/* package to 2.3.2 together — they are released in lockstep. Newly scaffolded projects from templates/basic pin to 2.3.2 automatically.

New Contributors

Full Changelog: v2.3.1...v2.3.2

Contributors

Roshan931, hackchang, and 2 other contributors
Assets 2
Loading