Vendure Releases

GET https://watchchangelog.com/api/v1/entries?source=vendure.releases

{
  "source": "vendure.releases",
  "vendor": "Vendure",
  "id": "tag:github.com,2008:Repository/136938012/v3.7.2",
  "published_at": "2026-08-06T17:52:20.000Z",
  "title": "v3.7.2",
  "url": "https://github.com/vendurehq/vendure/releases/tag/v3.7.2",
  "summary": "Vendure v3.7.2 is a patch release containing fixes for four reported vulnerabilities (one critical, one high, two medium), a set of channel-scoping fixes on entity update and delete paths, a rewrite of the BullMQ job list query, and a round of dashboard fixes One of the security fixes changes behaviour for delegated admin accounts — see Behaviour Changes below. Security Fixes for the following reported vulnerabilities are in 3.7.2. If you are on an earlier 3.x version, upgrade. Severity Vulnerability Advisory Critical Privilege escalation to SuperAdmin: an administrator holding only the delegated UpdateAdministrator permission could reset any other administrator's password — including the SuperAdmin's — and log in as them GHSA-v85r-wfgv-jcqc High Broken access control: the Admin API adjustDraftOrderLine mutation was reachable by unauthenticated callers, who could change line quantities and custom fields on orders they did not own GHSA-hc75-2v4j-x372 Medium Cross-channel delete IDOR: a channel-restricted administrator could delete another channel's promotions and facet values by enumerating ids GHSA-fp4j-ff6j-9793 Medium Cross-channel write IDOR: a channel-restricted administrator could modify another channel's assets and stock locations by enumerating ids GHSA-rgjm-ff27-p2hf Our thanks to the researchers who reported these responsibly. Core Channel-scope guard on StockLocation and Asset update() ( #5017 ) and on the FacetValue , ProductOption and Promotion delete paths ( #5043 ), closing the remaining cases where a channel-restricted administrator could modify or delete an entity in another channel. Assign new variants to all of the product's channels ( #4699 ). Record numeric stockOnHand at the active channel's stock location rather than the global default ( #4970 ). Hydrate relations that are missing from only some array elements ( #4986 ) — EntityHydrator sampled only the first element of an array relation, so unevenly-loaded relations were reported as present and left unloaded. Prevent a route-scoped beforeListen body parser from disabling body parsing on every other route ( #5029 ). Resolve Administrator on API-key sessions via the key owner ( #4727 ). Guard relation custom field resolution against a missing entity id ( #5006 ). Guard mergeDeep against undefined array elements ( #4961 ). Dashboard Support assigning multiple channels in bulk actions ( #4687 ). Fix stock location deletion, and add stock transfer on delete ( #4918 ). Make Japanese and Korean selectable and complete their translations ( #5077 ). Activate the fallback locale before extensions load ( #5061 ). Compile config outside the type: module package ( #4913 ), fixing dashboard builds failing on Windows/pnpm with exports is not defined in ES module scope . Don't persist empty translations for unfilled languages ( #4962 ). Preserve numeric-looking values in string list inputs ( #4988 ). Search product variants by name or SKU in relation selectors ( #4990 ). Fix required-field validation on the channel create form ( #4198 ). Refresh customer history after updating a customer ( #4998 ). Add a password visibility toggle to all password fields ( #4969 ). Clear asset selection after a bulk action completes ( #4941 ). Admin UI: fix the missing currency button on initial load ( #5002 ). Job Queue The BullMQ jobs list query had several defects in its Lua script and index maintenance ( #5014 ): jobs were silently dropped from pages when the result set spanned both list-stored and sorted-set-stored states (the skip offset was applied twice), ordering mixed raw delayed scores with plain timestamps, and the query crashed on queues with more than roughly 8000 waiting jobs. Behaviour Changes No breaking API changes, but the fix for GHSA-v85r-wfgv-jcqc tightens updateAdministrator : an administrator can now only update another administrator if they hold all of the target's permissions on all of the target's channels, so updating a SuperAdmin requires a SuperAdmin caller. If you have delegated the UpdateAdministrator permission to a role that edits higher-privileged accounts, those operations will now be rejected. Grant the role the necessary permissions, or perform the update as a SuperAdmin. Migration No migrations or config changes are required. Upgrade all @vendure/* packages together to 3.7.2. What's Changed docs: Add missing 3.7.1 changelog entries by @michaelbromley in #4971 fix(core): Guard mergeDeep against undefined array elements by @grolmus in #4961 fix(core): Record numeric stockOnHand at active channel's stock location by @grolmus in #4970 chore(dev-server): Add worktree-safe Portless workflow by @dlhck in #4978 fix(dashboard): add password visibility toggle to all password fields by @latifniz in #4969 fix(dashboard): Clear asset selection after bulk action completes by @latifniz in #4941 test(core): Add unit tests for default shipping line assignment strategy by @GabrielRoc in #4926 test(core): Add unit tests for default shipping calculator by @GabrielRoc in #4925 test(core): Add unit tests for contains-products promotion condition by @GabrielRoc in #4881 test(core): Add unit tests for customer-group promotion condition by @GabrielRoc in #4883 test(core): Close branch coverage gaps in order tax calculation strategies by @GabrielRoc in #4924 test(core): Add unit tests for has-facet-values promotion condition by @GabrielRoc in #4882 test(core): Add unit tests for minimum-order-amount promotion condition by @GabrielRoc in #4880 perf(dev-server): Reduce agent dev startup builds by @dlhck in #4989 fix(dashboard): Fix required-field validation on the channel create form by @biggamesmallworld in #4198 feat(core): expand telemetry to schema v2 with heartbeat and new signals by @dlhck in #4933 fix(dashboard): Refresh customer history after updating customer by @oliverstreissi in #4998 docs(core): Document creating a RequestContext for a specific user by @grolmus in #5008 fix(dashboard): Preserve numeric-looking values in string list inputs by @kwerie in #4988 fix(core): Guard relation custom field resolution against a missing entity id by @brmk in #5006 fix(core): Assign new variants to all product channels by @Ryrahul in #4699 fix(dashboard): Don't persist empty translations for unfilled languages by @grolmus in #4962 fix(job-queue-plugin): Fix BullMQ job list query pagination, ordering & index maintenance by @michaelbromley in #5014 chore: Lint pull request titles by @dlhck in #5016 fix(core): Resolve Administrator on API-Key sessions via key owner by @kevmtt in #4727 docs(core): Fix description for inner workings of DefaultMoneyStrategy by @SiebelsTim in #4929 docs(dashboard): Document contributing UI translations to the Dashboard by @grolmus in #5010 docs: direct security reports to GitHub advisories by @dlhck in #5020 fix(dashboard): search product variants by name or SKU in relation selectors by @casperiv0 in #4990 docs: Add missing path import to importing-data test-data example by @grolmus in #5021 fix(core): Prevent route-scoped beforeListen parser from disabling body parsing by @michaelbromley in #5029 fix(core): Add channel-scope guard to StockLocation & Asset update() by @Ryrahul in #5017 fix(core): Hydrate relations missing from only some array elements by @ryandiginomad in #4986 fix(dashboard): Fix stock location deletion and add stock transfer on delete by @biggamesmallworld in #4918 fix(create): Read the server port from VENDURE_SERVER_PORT by @michaelbromley in #5046 fix(core): Add channel-scope guard to delete paths & cross-channel re… by @Ryrahul in #5043 fix(dashboard): Compile config outside the type:module package by @TheStreamCode in #4913 fix(admin-ui): Fix missing currency button on initial load ( #4140 ) by @supermadu7 in #5002 fix(dashboard): Activate fallback locale before extensions by @dlhck in #5061 feat(dashboard): support assigning multiple channels in bulk actions by @casperiv0 in #4687 docs: Update docker-compose commands to docker compose syntax by @imanali2237 in #4910 fix(cli): Exclude translatable fields from top-level input type | #4373 by @SupunGeethanjana in #4505 fix(dashboard): Omit source line numbers from i18n catalogs by @michaelbromley in #5075 fix(dashboard): Make Japanese and Korean selectable and complete their translations by @michaelbromley in #5077 New Contributors @brmk made their first contribution in #5006 @imanali2237 made their first contribution in #4910 @SupunGeethanjana made their first contribution in #4505 Full Changelog : v3.7.1...v3.7.2",
  "tags": [
    "Vendure",
    "vendure.releases",
    "ecommerce",
    "headless",
    "graphql"
  ]
}