v5.7.4 Banana

What's Changed

This release fixes security advisory: GHSA-7cqp-qvh5-7x85

User-facing changes 👀

None.

Experimental features for testing 🚧

• [Grid view] Display product as a grid by @rioug in #14345

Technical changes 🛠️

• [Security] Fix regexp escaping by @rioug in #14493
• Add security.md by @dacook in #14520
• Fix flaky admin login in system specs with a per-login Warden token by @maikels-agent in #14527
• Skip nodenv install when yarn is already available by @chahmedejaz in #14524
• Tighten customer account transaction permission by @rioug in #14526
• Include English locale digest in cache key to invalidate cached translations on locale file changes by @chahmedejaz in #14507

Dependencies 📦

• Bump json from 2.19.9 to 2.20.0 by @dependabot[bot] in #14516
• Bump webpack from 5.108.3 to 5.108.4 by @dependabot[bot] in #14521
• Bump webpack-cli from 7.1.0 to 7.2.1 by @dependabot[bot] in #14522
• Bump the "turbo_power" group with 2 updates across multiple ecosystems by @dependabot[bot] in #14523
• Bump the "shakapacker" group with 2 updates across multiple ecosystems by @dependabot[bot] in #14506
• Bump webpack-dev-server from 5.2.5 to 6.0.0 by @dependabot[bot] in #14515
• Bump webpack-sources from 3.5.0 to 3.5.1 by @dependabot[bot] in #14529
• Bump tom-select from 2.6.1 to 2.6.2 by @dependabot[bot] in #14532

Full Changelog: v5.7.3...v5.7.4