v2.3.5

# Mercur v2.3.5

A patch release focused on security. We closed three authorization gaps in the
Store and Vendor APIs and patched critical Next.js advisories in the
storefront. Plugins also get new seams on the order detail page, plus a fix for
the vendor onboarding currency select.

## ⚠️ Before you upgrade

- **`POST /store/carts/:id/line-items` no longer accepts `unit_price` or
  `compare_at_unit_price`** (#1546). Requests that send either field now get a
  `400`. Line prices always come from the offer, so remove these fields from
  any storefront or integration that sends them.

## 🔒 Security issues addressed

- **Client-supplied cart prices.** A shopper could set `unit_price` when adding
  a line item. The price was treated as custom, skipped recalculation and
  carried into the order and payment authorization. These fields are now
  rejected. (#1546)
- **Cross-product variant edits.** `POST` and `DELETE
  /vendor/products/:id/variants/:variant_id` didn't check that the variant
  belonged to the product in the path. A change request could update or delete
  a variant (including its images) on a different product. Both routes now
  return `404` when the variant isn't on that product. (#1545)
- **Customer group membership.** `POST /vendor/customer-groups/:id/customers`
  checked that the seller owned the group but not the customers. A vendor could
  add or remove any customer on the platform, including other sellers'
  customers. Every `add` and `remove` ID is now checked, and the route returns
  `404` if any customer isn't linked to the seller. (#1544)
- **Next.js RCE advisories in the storefront.** Bumped `next` to 15.5.24 in
  `apps/storefront`. This resolves GHSA-2xp9-vwfh-vxw4 (unauthenticated RCE in
  the Image Optimization API with AVIF files) and GHSA-p293-qw3h-jr36
  (unauthenticated RCE on Windows-hosted servers). If your storefront is based
  on ours, bump `next` there too. (#1542)

We recommend all marketplaces upgrade.

## ✨ Highlights

### 🧩 Order detail extension points
Plugins such as disputes can now act on an order without forking its sections.
This works in both panels. (#1530)
- **Action locks.** `actionLocks` in `defineCustomFieldsConfig` can disable
  *Edit order*, *Return*, *Exchange* and *Claim*. The string you return becomes
  the disabled action's tooltip.
- **Line-item zone.** A new `orders.detail.item` widget zone on each summary
  row receives `{ order, item }`.
- **Timeline entries.** `activity` adds your own entries to the order activity
  timeline.

Nothing changes unless a plugin configures these.

## 🐛 Fixes

- Return supported currencies from `GET /vendor/stores`, so the vendor
  onboarding Currency select is populated again on Medusa 2.20 (#1543)

**Full Changelog**: https://github.com/mercurjs/mercur/compare/v2.3.4...v2.3.5