v0.20.0 v2.3.2
microsoft/markitdownAug 31, 2026 → Aug 31, 20260 days between releases
What's New
Fixes critical BOLA vulnerability preventing unauthorized vendor account takeover via API routes.
Breaking Changes
- Vendor API routes now strictly scope to the authenticated seller, breaking access to other users' data.
- GET /vendor/stores endpoint now requires member authentication.
New Features
- CLI builds admin dashboard extensions with custom entry points.
- Attribute edits now go through the product-change diff pipeline.
- create-mercur-app pins generated projects to the CLI's release channel.
Improvements
- Vendor stores query selectable fields restricted to enhance security.
- Split-order payment status reporting improved to prevent double-counting.
Bug Fixes
- Fixed critical broken-access-control vulnerability allowing account takeover.
- Fixed split-order payment status reporting to prevent double-counting.
Upgrade Notes
This is a critical security release; all marketplaces running 2.3.1 or earlier must upgrade immediately. Existing integrations relying on accessing other sellers' data via vendor/sellers/:id will break. Unauthenticated access to vendor/stores is no longer permitted.
The Two Releases
v0.20.0
Aug 31, 2026· 2 months ago
This release introduces a new invoicing recipient system for On-Premise Business users alongside various quality-of-life improvements and performance enhancements.
Full release notesv2.3.2
Aug 31, 2026· 2 months ago
A critical security release fixing a broken-access-control vulnerability in the vendor API, alongside features for attribute edits, CLI dashboard building, and various fixes.
Full release notes