5.7.1

• Fixed a bug where guest customers couldn’t load credentialed carts with a valid token. (#4225)
• Fixed a bug where Quantity fields’ input values could become jumbled within inventory modals. (#3920)
• Fixed a bug where the “Variant Search” product condition rule wasn’t returning any results. (#4339)
• Fixed a bug where variant field layout tabs displayed incorrectly within slideouts. (#4335)
• Fixed a PHP error that could occur when serializing a line item object. (#4337)
• Fixed a performance issue that occurred when resaving products in multi-site installs. (#4305)

5.7.0

Store Management

• Order edit screens now show notices to store administrators if there was a fluke with the order, such as a coupon/discount’s total usage being exceeded or inventory dropping below zero.
• Added the “Contains Purchasables” order condition rule. (#4242)
• Added the “Has Admin Notices” order condition rule.
• Added deletion blockers for users with existing orders or subscriptions.
• The “Share cart…” order element action now generates a secure tokenized URL.
• The inventory screen now has a “View” menu for showing/hiding table columns. (#4193)

Administration

• Craft Commerce user permissions are now organized into conceptual groups.
• Product permissions have been split into separate “View”, “Create”, “Save”, and “Delete” permissions.
• Added the loadCartUrlExpiry setting, for controlling how long cart load links remain valid (seven days by default).

Development

• The commerce/cart/get-cart action now supports a peek param, which returns cart info without creating a new cart or setting cookies. (#4263)
• The commerce/cart/load-cart action now returns JSON responses for application/json requests.

Extensibility

• Added craft\commerce\base\ShippingMethod::clearMatchingShippingRuleCache().
• Added craft\commerce\controllers\CartController::actionCartChallenge().
• Added craft\commerce\controllers\CartController::actionCartSent().
• Added craft\commerce\controllers\CartController::actionEmailChallenge().
• Added craft\commerce\controllers\OrdersController::actionGetLoadCartUrl().
• Added craft\commerce\controllers\OrdersController::actionGetShippingMethodOptions().
• Added craft\commerce\controllers\OrdersController::actionReassign().
• Added craft\commerce\controllers\OrdersController::actionReassignModal().
• Added craft\commerce\controllers\OrdersController::actionRemoveCustomerData().
• Added craft\commerce\controllers\OrdersController::actionRemoveCustomerDataModal().
• Added craft\commerce\controllers\SubscriptionsController::actionDeleteSubscriptions().
• Added craft\commerce\controllers\SubscriptionsController::actionDeleteSubscriptionsModal().
• Added craft\commerce\db\Table::CATALOG_PRICING_QUEUE.
• Added craft\commerce\elements\Order::getAdminNotices().
• Added craft\commerce\elements\Order::getCustomerDeleted().
• Added craft\commerce\elements\Order::hasAdminNotices().
• Added craft\commerce\elements\Order::hasPurchasables().
• Added craft\commerce\elements\Order::hasPurchasables().
• Added craft\commerce\elements\Order::setCustomerDeleted().
• Added craft\commerce\elements\conditions\orders\ContainsPurchasablesConditionRule.
• Added craft\commerce\elements\conditions\orders\HasAdminNoticesConditionRule.
• Added craft\commerce\elements\db\OrderQuery::$containsPurchasables.
• Added craft\commerce\elements\db\OrderQuery::$containsPurchasables.
• Added craft\commerce\elements\db\OrderQuery::$hasAdminNotices.
• Added craft\commerce\elements\db\OrderQuery::containsPurchasables().
• Added craft\commerce\elements\db\OrderQuery::containsPurchasables().
• Added craft\commerce\elements\db\OrderQuery::hasAdminNotices().
• Added craft\commerce\elements\deletionblockers\OrderCustomersDeletionBlocker.
• Added craft\commerce\elements\deletionblockers\SubscriptionCustomersDeletionBlocker.
• Added craft\commerce\enums\ContainsPurchasablesMatch.
• Added craft\commerce\enums\ContainsPurchasablesMatch.
• Added craft\commerce\enums\OrderNoticeType.
• Added craft\commerce\events\PaymentCurrencyRateEvent.
• Added craft\commerce\models\OrderNotice::$noticeType.
• Added craft\commerce\models\Settings::$loadCartUrlExpiry.
• Added craft\commerce\records\CatalogPricingQueue.
• Added craft\commerce\services\Carts::getLoadCartUrl().
• Added craft\commerce\services\Carts::peekCart().
• Added craft\commerce\services\CatalogPricing::deleteCatalogPricingQueueRowById().
• Added craft\commerce\services\CatalogPricing::releaseCatalogPricingQueueRowById().
• Added craft\commerce\services\CatalogPricing::reserveCatalogPricingQueueRow().
• Added craft\commerce\services\Orders::reassignOrders().
• Added craft\commerce\services\Orders::removeCustomerData().
• Added craft\commerce\services\PaymentCurrencies::EVENT_DEFINE_PAYMENT_CURRENCY_RATE.
• Added craft\commerce\services\PaymentCurrencies::getRateFor().
• Added craft\commerce\services\ProductTypes::getCreatableProductTypeIds().
• Added craft\commerce\services\ProductTypes::getViewableProductTypeIds().
• Added craft\commerce\services\ProductTypes::getViewableProductTypes().
• Added craft\commerce\services\ShippingRuleCategories::getAllShippingRuleCategoriesData().
• craft\commerce\elements\Order::clearNotices() now has a $noticeTypes argument.
• craft\commerce\elements\Order::getLoadCartUrl() now returns a secure tokenized URL.
• craft\commerce\elements\Order::getNotices() no longer returns admin notices. Use getAdminNotices() instead.
• craft\commerce\elements\Subscription::getSubscriber() now returns ?User instead of User.
• Deprecated craft\commerce\services\ProductTypes::getEditableProductTypeIds(). getViewableProductTypeIds() should be used instead.
• Deprecated craft\commerce\services\ProductTypes::getEditableProductTypes(). getViewableProductTypes() should be used instead.
• Deprecated craft\commerce\services\ProductTypes::hasPermission(). $user->can() should be used instead.

System

• The commerce/cart/cart-challenge and commerce/downloads/pdf-challenge actions are now rate-limited based on IP.
• Improved the performance of shipping method and rule matching.
• Improved the performance of catalog pricing queue jobs.
• Cart load URLs are now generated with time-limited security tokens, which are now required when loading carts from non-authenticated requests.
• craft\commerce\services\Carts::getCart() now ensures the cart can always be recalculated. (#4332)
• Craft Commerce now requires Craft CMS 5.10.0 or later.
• Craft Commerce now requires ibericode/vat 2.0 or later.
• Craft Commerce now supports dompdf/dompdf 3.x, in addition to 2.x.
• Fixed a bug where variants with {id} in their Variant Title Format weren’t always getting created with the correct generated title. (#4308)

4.12.0

Store Management

• The “Share cart…” order element action now generates a secure tokenized URL.

Administration

• Added the loadCartUrlExpiry setting, for controlling how long cart load links remain valid (seven days by default).

Extensibility

• Added craft\commerce\controllers\CartController::actionCartChallenge().
• Added craft\commerce\controllers\CartController::actionCartSent().
• Added craft\commerce\controllers\CartController::actionEmailChallenge().
• Added craft\commerce\controllers\OrdersController::actionGetLoadCartUrl().
• Added craft\commerce\models\Settings::$loadCartUrlExpiry.
• Added craft\commerce\services\Carts::getLoadCartUrl().
• craft\commerce\elements\Order::getLoadCartUrl() now returns a secure tokenized URL.

System

• Cart load URLs are now generated with time-limited security tokens, which are now required when loading carts from non-authenticated requests.
• Fixed moderate-severity server-side template injection vulnerability. (#)
• PDF download URLs now use the code query param instead of token (#4303).

5.6.7

• Fixed a bug where purchasables’ stock caches weren’t getting cleared after orders were completed.
• Fixed a bug where InventoryRestockMovement would incorrectly validate movements with only one invalid transaction type.
• Fixed a bug where inventory search was case-sensitive on PostgreSQL. (#4326)
• Fixed an error that could occur when creating or editing a shipping rule. (#4321)
• Fixed a bug where some settings weren’t being saved to the project config. (#4324)

6.0.0-alpha.9

6.0.0-alpha.9

5.6.6.1

• Fixed a bug where Date Range widget settings could break when settings were reopened. (#4306)

5.6.6

• PDF download URLs now use the code query param instead of token (#4303).
• Fixed a bug where the debug toolbar could trigger cart recalculation in multi-site setups, potentially causing some line items to be removed from the cart. (#4317)
• Fixed a bug where Date Range widget settings could break when settings were reopened. (#4306)
• Fixed a bug where new orders created in the control panel could default to a non-primary site in multi-site/single-store installs. (#4310)
• Fixed a PHP error that could occur when opening a product with a provisional draft. (#4314)
• Fixed a bug where tax zones, shipping categories, and tax categories created via “Create” slideouts were saved to the primary store rather than the current store. (#4313)
• Fixed a SQL error that could occur when running project-config/apply if a PDF had an empty templatePath. (#4316)
• Fixed a bug where two simultaneous requests to manually complete an order could result in a coupon being used twice. (Hackrate#1343)
• Fixed a bug where fulfilling an order with purchasables in different inventory locations would only fulfil items from one location. (#4299)
• Fixed a PHP error that could occur when applying project config changes after updating.

5.6.5

• Cart requests that include a couponCode param are now rate-limited.
• Fixed a bug where redundant database queries could be executed when no subscription plans existed. (#4285)
• Fixed an error that occurred when executing a GraphQL query with relatedTo* arguments within hasProduct or hasVariant fields. (#4297)
• Fixed moderate-severity enumeration vulnerability. (GHSA-h5gm-x9wr-vhcm)
• Fixed low-severity business logic vulnerability. (GHSA-78vr-q6cf-c7p6)

4.11.2

• Cart requests that include a couponCode param are now rate-limited.
• Fixed moderate-severity enumeration vulnerability. (GHSA-h5gm-x9wr-vhcm)
• Fixed low-severity business logic vulnerability. (GHSA-78vr-q6cf-c7p6)

5.6.4

• Fixed a SQL error that occurred when processing a fulfillment on PostgreSQL. (#4291)
• Fixed a bug where custom field layout tabs were duplicated in the tab overflow menu on order edit pages. (#4293)
• Fixed a bug where the “Set default variant” action wasn’t immediately reflected in the variant index. (#4294)
• Fixed a PHP error that occurred when variants were missing an inventory item. (#3837)