v2.3.2

# v2.3.2

A security and hardening release. **All marketplaces running 2.3.1 or earlier should upgrade.**

## 🔒 Security

This release fixes a **critical broken-access-control (BOLA/IDOR)** vulnerability in the vendor API, privately reported by **[@hackchang](https://github.com/hackchang)** under coordinated disclosure. Thank you.

**The issue:** the `/vendor/sellers/:id` route subtree operated on the URL `id` parameter without binding it to the authenticated seller. Any authenticated vendor could target another seller's id to read that store's full record (profile, payment details, professional/tax details), overwrite its profile, and manage its team members — invite themselves in, change roles, remove members. In effect, full account takeover of any other vendor's store.

**Weakness:** CWE-639 / CWE-862 · **Severity:** Critical (CVSS 3.1 ~9.3, `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`)

**What changed:**
- Every `/vendor/sellers/:id` handler is now scoped to the authenticated seller; a mismatched id no longer resolves (#1449)
- Member-management routes bind `member_id` to the caller's own seller
- `GET /vendor/stores` now requires member authentication (#1450)
- The vendor stores query has its selectable fields restricted (#1453)

A GitHub Security Advisory with a CVE request is being published from the repository's Security tab, with @hackchang credited as reporter.

## ✨ Features

- **Attribute edits now go through the product-change diff pipeline**, the same way product edits do (#1444)
- **CLI builds admin dashboard extensions**, and a package can ship its own entry point (#1424)
- **`create-mercur-app` pins generated projects to the CLI's release channel** (#1459) — scaffolding with `@rc` no longer mixes in `latest` packages

## 🐛 Fixes

**Checkout & orders**
- Core owns the payment webhook so carts complete as split orders (#1418)
- Split-order payment status is reported correctly on the admin and store order routes (#1458)
- Payment statuses are no longer double-counted (#1399) — thanks @shin4141
- Cart shipping profiles are validated against the offer (#1417), and shipping-method cleanup is derived from offers rather than products (#1455)

**Offers & attributes**
- Created offer prices are attributed by rule instead of position (#1397)
- New scoped-axis option values are associated with their product (#1454)
- Attribute possible-values pagination fixed (#1447) — thanks @adeaviladev01
- The pending product-change guard is actor-scoped (#1443)

**Dashboards**
- `RouteDrawer` dialogs have an accessible title (#1415)
- The admin invite form carries the roles field, so invited admins aren't locked out (#1420)
- `DataGrid` column resizing works (#1452)
- The `NoRecords` empty state grows instead of overflowing (#1456)
- `react-router-dom` is a peer dependency (#1426)
- `dashboard-sdk` resolves plugin roots via Node and no longer emits top-level `await` (#1429)
- `plugin:build` no longer races itself for `src/admin/index.mjs` (#1427)

**Other**
- Algolia block: the five dead `algolia.intermediate.*` subscribers removed (#1416) — thanks @Roshan931
- Storefront drops the unused `next-intl` dependency (#1457)
- Architecture docs rewritten around layers and extension zones (#1412)

## 📦 Upgrading

```bash
npm install @mercurjs/core@2.3.2
```

Bump every `@mercurjs/*` package to `2.3.2` together — they are released in lockstep. Newly scaffolded projects from `templates/basic` pin to `2.3.2` automatically.

## New Contributors

- @shin4141 — #1399
- @Roshan931 — #1416
- @adeaviladev01 — #1447
- @hackchang — security report (no PR)

**Full Changelog**: https://github.com/mercurjs/mercur/compare/v2.3.1...v2.3.2