| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-22 | 1.2 kB | |
| v2.2.12 source code.tar.gz | 2026-10-22 | 24.9 MB | |
| v2.2.12 source code.zip | 2026-10-22 | 30.8 MB | |
| Totals: 3 Items | 55.7 MB | 0 | |
TL;DR
🔒 This is a security release!
Fixes the following vulnerabilities:
- Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
- A disabled API stays reachable through a percent-encoded path
- Host header injection in the shop password reset e-mail link when the channel has no hostname
- Unpublished product reviews disclosed through the Shop API item endpoint
- Channel-based payment method restriction bypass on shop payment request API endpoint
What's Changed
- [PaymentBundle] Return the latest payment request when several match the action, payment and method by @GSadee in https://github.com/Sylius/Sylius/pull/19302
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.2.11...v2.2.12