Download Latest Version v3.7.1 source code.zip (48.6 MB)
Email in envelope

Get an email when there's a new version of Vendure Core

Home / v3.6.5
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-07-01 8.5 kB
0
v3.6.5 source code.tar.gz 2026-07-01 45.7 MB
0
v3.6.5 source code.zip 2026-07-01 48.3 MB
0
Totals: 3 Items   94.0 MB 0

Highlights

This is a security patch release. It fixes three security advisories — a stored XSS in the Admin Dashboard, an unauthenticated denial-of-service affecting SQLite-backed instances, and a data-exposure issue in Shop API list queries — alongside a solid batch of dashboard and core fixes. If you're running 3.6.x, we recommend upgrading. Thanks to those who disclosed the security issues responsibly, and to everyone who reported bugs and sent in PRs.

Security

Three advisories are addressed in this release. Upgrading to 3.6.5 applies all three fixes.

  • Stored XSS in the Admin Dashboard (GHSA-xhq9-whgq-49j5) -- certain stored entity content rendered in the dashboard could carry unsanitised HTML. Rendering has been hardened so stored content can no longer execute script.
  • Denial-of-service on SQLite (GHSA-jgm3-qmp2-c4p7) -- a crafted list-query filter could trigger catastrophic backtracking and tie up the server. Input handling in the affected filter has been hardened. This only affects instances using the SQLite driver, which is intended for development and testing; production deployments on PostgreSQL or MySQL/MariaDB are unaffected.
  • Data exposure in Shop API list queries (GHSA-xf65-r35x-wmmv) -- under certain filter combinations, Shop API list queries could return entities that should not be publicly visible. List-query scoping has been corrected so only intended results are returned.

Core fixes

Notable fixes to the core:

  • Channel scoping enforced on entity updates (#4821) -- update operations now consistently respect channel scoping, tightening isolation between channels in multi-channel setups.
  • Draft orders excluded from promotion usage limits (#4854) -- draft orders were being counted toward a promotion's usage limit, which could exhaust it prematurely. They're no longer counted.
  • Reliable search index writes (#4809) -- DefaultSearchPlugin could hit duplicate-key errors while writing index entries under some conditions. Index writes are now handled without those collisions.
  • Bounded i18next preload (#4824) -- prevented unbounded growth in the i18next preload set, which could accumulate memory over time.
  • StockLevel seeded on channel assignment (#4864) -- assigning a ProductVariant to a channel now seeds its StockLevel for that channel, so stock is tracked from the start.

Dashboard improvements

  • Draft orders (#4810, [#4834]) -- selecting a customer on a draft order now applies their default shipping and billing addresses.
  • List pages and filters (#4843, [#4845], [#4839]) -- enum fields are now supported in list filters and form defaults; the product multi-selector shows the full saved selection; and order-list state cells are guarded against an undefined state so the list renders cleanly.
  • Robustness (#4859, [#4851], [#4874]) -- the rich-text editor guards getHTML() against a destroyed instance; useUiLanguageLoader is stabilised to stop a render loop; and opening a detail entity that isn't in the active channel now redirects back to the list instead of erroring.
  • Assets (#4855, [#4439]) -- hard-loading /dashboard/assets now serves the SPA route correctly, and the asset picker dialog isolates its PageContext so it no longer interferes with the page behind it.
  • Layout and polish (#4829, [#4712]) -- PageBlock renders full-width with column="full", and the facet value chip's remove button stays visible on long values.
  • Internationalisation (#4838, [#4870]) -- added missing Russian translations for order actions, and fixed a nested t macro inside a plural for the job-cancel toasts.

What's Changed

New Contributors

Full Changelog: https://github.com/vendurehq/vendure/compare/v3.6.4...v3.6.5

Source: README.md, updated 2026-07-01