Download Latest Version
v2.2.8 source code.zip (30.8 MB)
Get an email when there's a new version of Sylius
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-06-02 | 1.1 kB | |
| v2.1.15 source code.tar.gz | 2026-06-02 | 24.8 MB | |
| v2.1.15 source code.zip | 2026-06-02 | 30.7 MB | |
| Totals: 3 Items | 55.5 MB | 0 | |
TL;DR
🔒 This is a security release!
Fixes the following vulnerabilities:
- IDOR on Shop Payment Request endpoints in API
- Channel-based payment method restriction bypass on shop account orders API endpoint
- Cart FormComponent allows modification or deletion of an already-completed order
Details
- #19038 [2.1] Prevent stale cart LiveComponents from mutating completed orders (@TheMilek)
- #19039 [2.1][API] Enforce channel eligibility check when changing payment method via account endpoint (@TheMilek)
- #19040 [2.1] Check payment request ownership (@TheMilek)
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.1.14...v2.1.15