3.9.7 v2.3.5
krahets/hello-algoSep 16, 2026 → Sep 17, 20261 day between releases
What's New
Security patch closes authorization gaps and blocks client-supplied cart prices.
Breaking Changes
- POST /store/carts/:id/line-items no longer accepts unit_price or compare_at_unit_price.
- Cross-product variant edits are now blocked by validating variant ownership.
- Customer group membership checks now require vendor validation.
New Features
- New extension points for order details including action locks and timeline entries.
- Action lock configuration for order actions.
- New widget zone for line-item details in order panels.
- Activity timeline injection for order history.
Improvements
- Next.js bumped to 15.5.24 to patch critical RCE advisories.
- Authorization gaps in Store and Vendor APIs have been closed.
Bug Fixes
- Fixed vendor onboarding currency select issue.
Upgrade Notes
Remove unit_price and compare_at_unit_price from cart line-item requests as prices are now sourced from offers. Ensure variant IDs in requests match the product path to avoid 404 errors. Update customer group membership logic to accommodate vendor validation requirements.
The Two Releases
3.9.7
Sep 16, 2026· 1 month ago
Minimal release notes: "- Support Angular 22.2 - Fix regressions in v3.9 🔗 [Changelog](https://github.com/prettier/prettier/blob/3.9.7/CHAN"
Full release notesv2.3.5
Sep 17, 2026· 1 month ago
A security-focused patch release closing authorization gaps in the Store and Vendor APIs and patching critical Next.js advisories.
Full release notes