v4.7.2

Security

• Users with UserManagement permissions can assign themselves the admin role or change an admin's password (GHSA-rw5f-4cm4-pc4m)
• Stored cross-site scripting in Solidus product descriptions (GHSA-x943-j5hw-mr2w)
• Missing authorization check on return item inventory units allows cancelling other customers' returns (GHSA-6p7r-vx57-9gw3)
• Checkout state skip via unvalidated state parameter (GHSA-qwqm-3jx5-rr8m)
• Customers can attach another user's stored gateway payment profile to their own payment (GHSA-vgwx-9pm9-8qvj)

Solidus Core

• [v4.7] Fall back to preference defaults for static preference sources by @solidus-bot[bot] in #6620
• [v4.7] Skip VAT price generation without a valid price by @solidus-bot[bot] in #6623
• [v4.7] Remove order.reload from Payment#gateway_options by @solidus-bot[bot] in #6630
• [v4.7] Touch taxons one at a time in id order by @solidus-bot[bot] in #6634
• [v4.7] Avoid N+1s when calling Spree::Taxon#pretty_name by @solidus-bot[bot] in #6642
• Revert "[v4.7] Avoid N+1s when calling Spree::Taxon#pretty_name" by @tvdeyen in #6646

Solidus API

• Get CI passing again for v4.7 by @jarednorman in #6625

Solidus Promotions

• [v4.7] Only mark zero-amount promotion adjustments for destruction by @solidus-bot[bot] in #6631

Full Changelog: v4.7.1...v4.7.2