Download Latest Version
v2.2.8 source code.zip (30.8 MB)
Get an email when there's a new version of Sylius
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-06-02 | 3.0 kB | |
| v2.2.6 source code.tar.gz | 2026-06-02 | 24.8 MB | |
| v2.2.6 source code.zip | 2026-06-02 | 30.8 MB | |
| Totals: 3 Items | 55.6 MB | 0 | |
TL;DR
🔒 This is a security release!
Fixes the following vulnerabilities:
- IDOR on Shop Payment Request endpoints in API
- Channel-based payment method restriction bypass on shop account orders API endpoint
- Cart FormComponent allows modification or deletion of an already-completed order
Details
- #18989 Fix modals appearing behind backdrop on sticky page-header (@bartek-sek)
- #18990 Fix attribute card style for product show (@shochdoerfer)
- #18988 BUGFIX: Expose ShippingMethod *DeliveryTimeDays in admin API (@daniellienert)
- #19009 [ApiBundle][Tests] Add regression test for anonymous cart pickup wit… (@Wojdylak)
- #19012 [ApiBundle] Fix "Undefined array key 0" in PathPrefixProvider when path equals API route (@michalkaczmarek-bitbag)
- #19001 Bugfix/csrf token (@michalkaczmarek-bitbag)
- #19017 Add appendError method to ResponseCheckerInterface (@Prometee)
- #19018 [ApiBundle] Fix 404 on GET /shop/products/{code} when all associated products are disabled (@michalkaczmarek-bitbag)
- #19024 [2.2] [AttributeBundle] make Add and Delete button translatable in product attribute select type (@crydotsnake)
- #19025 [API] Add regression tests for cross-customer cart item access (@GSadee)
- #19026 [API] Slim down Swagger UI override and drop broken auto-auth JS (@GSadee)
- #19038 [2.1] Prevent stale cart LiveComponents from mutating completed orders (@TheMilek)
- #19039 [2.1][API] Enforce channel eligibility check when changing payment method via account endpoint (@TheMilek)
- #19040 [2.1] Check payment request ownership (@TheMilek)
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.2.5...v2.2.6