Spree Commerce

This release includes a huge number of fixes and improvements from the Spree community and a security patch - we recommend upgrading as soon as possible!

Security

• GHSA-p6pv-q7rc-g4h9 CSV Formula Injection in CSV exports, Customer CSV affected, as this one uses information from signups (Medium severity)

Other changes

Core

• Prevent deletion of default and last market in store by @damianlegawiec in https://github.com/spree/spree/pull/13961
• Fixed: Add type column to spree_payment_setup_sessions for STI support https://github.com/spree/spree/commit/bd8b058c755436571721b6b1e21dda8dda7891d5
• Fix orphaned inventory units when destroying line items on completed orders https://github.com/spree/spree/commit/f0bef2f1769c17ec25ff0ba75ff8fd5a8127d950
• Fixed undefined method ‘update_thumbnail!’ for nil https://github.com/spree/spree/commit/30ac12e5d0e66758d889c39c6e0f5262b9837e78
• Sanitize CSV export output to avoid CSV formula injection attacks https://github.com/spree/spree/commit/36c0617958522da76fdf1433cc6e3fa19fca9b73

API

• Fixed tags in Products Serializer (both Store API and Admin API) https://github.com/spree/spree/commit/c0d8f85b0126f63489aec53281149e46fb6f2ce8
• Fix handling auth/capture flow in Payment Sessions webhooks flow https://github.com/spree/spree/commit/a6242f8d9553e5ef9a409b4e11126fec85458547

Admin

• Fix tailwind look up paths in other gems https://github.com/spree/spree/commit/1fe8b9d5c31a68742cd805b43ebbccfc6fe64c66
• Auto-generate gift card codes when not provided https://github.com/spree/spree/commit/5ad9f34e95a08a1660b8371414a65acaa48be3b2
• Change invalid/expired invitation handling to render 404 page https://github.com/spree/spree/commit/3feaf1496022c1a4c8eb82bbf98d679348c9480e
• Update all badges when shipping to improve UX https://github.com/spree/spree/commit/01510fe1877cce43c9bd10426af777ac880f24d5
• improve admin product bulk actions permissions https://github.com/spree/spree/commit/57997d8d5523f9676c85cf3dc0188081ba218bc4
• State Based Zone -> update states on country change https://github.com/spree/spree/commit/c2fd1a1cd5aa1a51eb8ead0ef49016326f9482b2
• make admin line item partial more robust for spree multi vendor https://github.com/spree/spree/commit/e323fcf67ddccf8b6fd09d796eaf2a564a79ec9f
• FIX datetime filter to respect EOD https://github.com/spree/spree/commit/79c8d0d9238813a95b50d4583093f96826e18427

Emails

• Include gift card in order email https://github.com/spree/spree/commit/13b46262501939fd2581759b75d11c646f590006

Documentation

• Use correct even names in docs, specs, examples, comments. https://github.com/spree/spree/commit/2e565b9eac08d3557013374e3148a1d189982a92

Installation

npx create-spree-app@latest my-store

Updating

1. Update gems

bundle update

2. Run DB migrations

This release includes a small database migration as well:

bin/rake spree:install:migrations
bin/rails db:migrate

Feedback / Support

Join our Discord server to chat with Spree core team members and other Spree developers!

Full Changelog: https://github.com/spree/spree/compare/v5.4.2…v5.4.3