v3.7.2

Vendure v3.7.2 is a patch release containing fixes for two reported vulnerabilities (one critical, one high), a set of channel-scoping fixes on entity update and delete paths, a rewrite of the BullMQ job list query, and a round of dashboard fixes

One of the security fixes changes behaviour for delegated admin accounts — see Behaviour Changes below.

Security

Fixes for the following reported vulnerabilities are in 3.7.2. If you are on an earlier 3.x version, upgrade.

Severity	Vulnerability	Advisory
Critical	Privilege escalation to SuperAdmin: an administrator holding only the delegated UpdateAdministrator permission could reset any other administrator's password — including the SuperAdmin's — and log in as them	GHSA-v85r-wfgv-jcqc
High	Broken access control: the Admin API adjustDraftOrderLine mutation was reachable by unauthenticated callers, who could change line quantities and custom fields on orders they did not own	GHSA-hc75-2v4j-x372

Our thanks to the researchers who reported these responsibly.

Core

• Channel-scope guard on StockLocation and Asset update() (#5017) and on the FacetValue, ProductOption and Promotion delete paths (#5043), closing the remaining cases where a channel-restricted administrator could modify or delete an entity in another channel.
• Assign new variants to all of the product's channels (#4699).
• Record numeric stockOnHand at the active channel's stock location rather than the global default (#4970).
• Hydrate relations that are missing from only some array elements (#4986) — EntityHydrator sampled only the first element of an array relation, so unevenly-loaded relations were reported as present and left unloaded.
• Prevent a route-scoped beforeListen body parser from disabling body parsing on every other route (#5029).
• Resolve Administrator on API-key sessions via the key owner (#4727).
• Guard relation custom field resolution against a missing entity id (#5006).
• Guard mergeDeep against undefined array elements (#4961).

Dashboard

• Support assigning multiple channels in bulk actions (#4687).
• Fix stock location deletion, and add stock transfer on delete (#4918).
• Make Japanese and Korean selectable and complete their translations (#5077).
• Activate the fallback locale before extensions load (#5061).
• Compile config outside the type: module package (#4913), fixing dashboard builds failing on Windows/pnpm with exports is not defined in ES module scope.
• Don't persist empty translations for unfilled languages (#4962).
• Preserve numeric-looking values in string list inputs (#4988).
• Search product variants by name or SKU in relation selectors (#4990).
• Fix required-field validation on the channel create form (#4198).
• Refresh customer history after updating a customer (#4998).
• Add a password visibility toggle to all password fields (#4969).
• Clear asset selection after a bulk action completes (#4941).
• Admin UI: fix the missing currency button on initial load (#5002).

Job Queue

The BullMQ jobs list query had several defects in its Lua script and index maintenance (#5014): jobs were silently dropped from pages when the result set spanned both list-stored and sorted-set-stored states (the skip offset was applied twice), ordering mixed raw delayed scores with plain timestamps, and the query crashed on queues with more than roughly 8000 waiting jobs.

Behaviour Changes

No breaking API changes, but the fix for GHSA-v85r-wfgv-jcqc tightens updateAdministrator: an administrator can now only update another administrator if they hold all of the target's permissions on all of the target's channels, so updating a SuperAdmin requires a SuperAdmin caller. If you have delegated the UpdateAdministrator permission to a role that edits higher-privileged accounts, those operations will now be rejected. Grant the role the necessary permissions, or perform the update as a SuperAdmin.

Migration

No migrations or config changes are required. Upgrade all @vendure/* packages together to 3.7.2.

What's Changed

• docs: Add missing 3.7.1 changelog entries by @michaelbromley in #4971
• fix(core): Guard mergeDeep against undefined array elements by @grolmus in #4961
• fix(core): Record numeric stockOnHand at active channel's stock location by @grolmus in #4970
• chore(dev-server): Add worktree-safe Portless workflow by @dlhck in #4978
• fix(dashboard): add password visibility toggle to all password fields by @latifniz in #4969
• fix(dashboard): Clear asset selection after bulk action completes by @latifniz in #4941
• test(core): Add unit tests for default shipping line assignment strategy by @GabrielRoc in #4926
• test(core): Add unit tests for default shipping calculator by @GabrielRoc in #4925
• test(core): Add unit tests for contains-products promotion condition by @GabrielRoc in #4881
• test(core): Add unit tests for customer-group promotion condition by @GabrielRoc in #4883
• test(core): Close branch coverage gaps in order tax calculation strategies by @GabrielRoc in #4924
• test(core): Add unit tests for has-facet-values promotion condition by @GabrielRoc in #4882
• test(core): Add unit tests for minimum-order-amount promotion condition by @GabrielRoc in #4880
• perf(dev-server): Reduce agent dev startup builds by @dlhck in #4989
• fix(dashboard): Fix required-field validation on the channel create form by @biggamesmallworld in #4198
• feat(core): expand telemetry to schema v2 with heartbeat and new signals by @dlhck in #4933
• fix(dashboard): Refresh customer history after updating customer by @oliverstreissi in #4998
• docs(core): Document creating a RequestContext for a specific user by @grolmus in #5008
• fix(dashboard): Preserve numeric-looking values in string list inputs by @kwerie in #4988
• fix(core): Guard relation custom field resolution against a missing entity id by @brmk in #5006
• fix(core): Assign new variants to all product channels by @Ryrahul in #4699
• fix(dashboard): Don't persist empty translations for unfilled languages by @grolmus in #4962
• fix(job-queue-plugin): Fix BullMQ job list query pagination, ordering & index maintenance by @michaelbromley in #5014
• chore: Lint pull request titles by @dlhck in #5016
• fix(core): Resolve Administrator on API-Key sessions via key owner by @kevmtt in #4727
• docs(core): Fix description for inner workings of DefaultMoneyStrategy by @SiebelsTim in #4929
• docs(dashboard): Document contributing UI translations to the Dashboard by @grolmus in #5010
• docs: direct security reports to GitHub advisories by @dlhck in #5020
• fix(dashboard): search product variants by name or SKU in relation selectors by @casperiv0 in #4990
• docs: Add missing path import to importing-data test-data example by @grolmus in #5021
• fix(core): Prevent route-scoped beforeListen parser from disabling body parsing by @michaelbromley in #5029
• fix(core): Add channel-scope guard to StockLocation & Asset update() by @Ryrahul in #5017
• fix(core): Hydrate relations missing from only some array elements by @ryandiginomad in #4986
• fix(dashboard): Fix stock location deletion and add stock transfer on delete by @biggamesmallworld in #4918
• fix(create): Read the server port from VENDURE_SERVER_PORT by @michaelbromley in #5046
• fix(core): Add channel-scope guard to delete paths & cross-channel re… by @Ryrahul in #5043
• fix(dashboard): Compile config outside the type:module package by @TheStreamCode in #4913
• fix(admin-ui): Fix missing currency button on initial load (#4140) by @supermadu7 in #5002
• fix(dashboard): Activate fallback locale before extensions by @dlhck in #5061
• feat(dashboard): support assigning multiple channels in bulk actions by @casperiv0 in #4687
• docs: Update docker-compose commands to docker compose syntax by @imanali2237 in #4910
• fix(cli): Exclude translatable fields from top-level input type | #4373 by @SupunGeethanjana in #4505
• fix(dashboard): Omit source line numbers from i18n catalogs by @michaelbromley in #5075
• fix(dashboard): Make Japanese and Korean selectable and complete their translations by @michaelbromley in #5077

New Contributors

• @brmk made their first contribution in #5006
• @imanali2237 made their first contribution in #4910
• @SupunGeethanjana made their first contribution in #4505

Full Changelog: v3.7.1...v3.7.2