v2.3.6

Mercur v2.3.6

A big one. Split orders finally get payments of their own, so refunds and
cancellations work through the stock Medusa routes. Product descriptions get
a rich text editor, and the sidebar collapses to an icon rail. We bumped
Medusa to 2.21.2 and moved to zod 4 — plus a long list of new extension
points and fixes.

⚠️ Before you upgrade

• Medusa 2.21 and zod 4 (#1554, #1614). Every @medusajs/* pin moves to
  2.21.2 and the workspace runs on zod 4. In your own validators, rewrite
  single-argument z.record(value) to z.record(key, value).
• The built-in notifications bell is gone (#1572). Notifications is no
  longer exported from @mercurjs/admin or @mercurjs/vendor, and the
  Cmd/Ctrl+N shortcut is removed. Register your own widget on the new
  topbar.after zone instead.
• Panels sign in with bearer tokens (#1631). Both panels drop the cookie
  session, so everyone is logged out once after upgrading. Custom page
  clients should send getAuthHeaders() from @mercurjs/admin /
  @mercurjs/vendor instead of credentials: 'include'.
• Admin product delete goes through the change pipeline (#1583).
  DELETE /admin/products/:id now returns an error when the product has a
  pending product change.
• Run migrations — PayoutAccount.data gets a default (#1582).

✨ Highlights

💳 Per-order payments for split orders

When a cart's payment is captured, it is now split: every seller order gets
its own payment collection with a captured payment for its share, pointing at
the same charge. Refunding and canceling a split order work through the stock
Medusa routes and workflows, capped at the order's share. Canceling before
capture leaves the authorization for the cart's other orders. Orders captured
before this release are not split retroactively. (#1627)

✍️ Rich text product descriptions

Product descriptions can mix formatted text and images. RichTextEditor and
the RichText renderer ship in @mercurjs/dashboard-shared and are used
across product create, edit and detail in both panels. Descriptions are
sanitized on write and on the storefront; existing plain-text descriptions
keep working, and there is no migration. (#1584)

🧭 Sidebar: icon rail and nav groups

The sidebar collapses to an icon rail with tooltips instead of disappearing,
and useSidebar / useCollapsedSidebar let a page drive it. _navigation.ts
gains a groups API, so you can declare groups and assign items to them in
both the main and settings sidebars. (#1559, #1586, #1621, #1629)

📝 Extendable registration and invitation

A plugin can add fields to the vendor register and invite forms and act on
them on the server: createSellerAccountWorkflow gets a validate hook,
and acceptMemberInviteWorkflow gets validate and memberInviteAccepted,
with additional_data accepted on invite acceptance. Plugin vendor routes
exporting AUTHENTICATE = false now skip vendor auth. (#1591, #1613)

🧩 More extension points

• paymentCaptured and paymentRefunded hooks on the capture and refund
  workflows, plus returnReceived and commissionLinesUpserted (#1558).
• payoutCreated hook on createPayoutWorkflow (#1580).
• fulfillmentDelivered hook on markOrderFulfillmentAsDeliveredWorkflow
  (#1607).
• topbar.before / topbar.after widget zones in both panels (#1572).
• Extensions can add tabs to the admin store detail page via
  stores.detail.tabs.* and a label on defineWidgetConfig (#1609).
• Per-card locations.list.item widget zone on the locations list (#1620).
• Custom-fields list filters can replace or remove built-in filters (#1634).
• Deleting a product now soft-deletes its seller offers (#1583).
• Offer inventory items inherit the variant's shipping and customs
  attributes (#1624).

Platform

• Bump Medusa to 2.21.2 and move the workspace to zod 4 (#1554, #1614).

🐛 Fixes

• Keep admin and vendor logins independent when both panels share one API
  host (#1631).
• Return the existing order group when a cart is completed again, instead of
  placing duplicate orders (#1603).
• Preserve other sellers' prices when one seller updates an offer price
  (#1550).
• Restore Medusa middlewares on product routes Mercur does not override —
  fixes 500s on variant batch, options and product-variant routes (#1553).
• Stop showing a published, allowlisted product to its creator once it is
  restricted to other stores (#1552).
• Keep order group seller_count and total independent of list filters
  (#1632), and make sorting by display_id work (#1633).
• Forward order list filters to the API in the vendor panel (#1556).
• Apply Medusa patches on import, so blocks imported in medusa-config.ts
  see the patched workflows (#1573).
• Return a proper 400 instead of a 500 when a payout account is created
  without data (#1582).
• Scaffold new projects from the template of the pinned release tag, so
  create-mercur-app no longer produces projects that fail to boot (#1623).
• Resolve the local CLI directly for codegen — no more slow npx on every
  boot in monorepos (#1619).
• Detect Medusa's Stripe card provider on the storefront (#1581) and
  self-host the Funnel Display font (#1611).
• Restore dropped placeholders and Trans tags in admin and vendor locales
  (#1612).
• Use the outline star for the vendor reviews sidebar item (#1608).
• Resolve the repository root dynamically in the dev scripts (#1618).
• Bump sanitize-html to 2.17.7 (#1625).

🙌 New contributors

• @theluckystrike made their first contribution in #1612 — thank you!
• @mahdi2k1 made their first contribution in #1618 — thank you!

Full Changelog: v2.3.5...v2.3.6