| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-22 | 1.5 kB | |
| v2.3.2 source code.tar.gz | 2026-10-22 | 25.0 MB | |
| v2.3.2 source code.zip | 2026-10-22 | 31.1 MB | |
| Totals: 3 Items | 56.1 MB | 1 | |
TL;DR
đź”’ This is a security release!
Fixes the following vulnerabilities:
- Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
- A disabled API stays reachable through a percent-encoded path
- Host header injection in the shop password reset e-mail link when the channel has no hostname
- Unpublished product reviews disclosed through the Shop API item endpoint
- Promotion and coupon usage limit bypass via race condition in Sylius 2.3
- Channel-based payment method restriction bypass on shop payment request API endpoint
What's Changed
- [PaymentBundle] Return the latest payment request when several match the action, payment and method by @GSadee in https://github.com/Sylius/Sylius/pull/19302
- [UPMERGE] 2.2 -> 2.3 by @SyliusBot in https://github.com/Sylius/Sylius/pull/19305
- [UPMERGE] 2.2 -> 2.3 by @SyliusBot in https://github.com/Sylius/Sylius/pull/19308
Full Changelog: https://github.com/Sylius/Sylius/compare/v2.3.1...v2.3.2
