Download Latest Version v3.7.3 source code.zip (48.7 MB)
Email in envelope

Get an email when there's a new version of Vendure Core

Home / v3.7.2
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-08-03 10.6 kB
0
v3.7.2 source code.tar.gz 2026-08-03 45.9 MB
0
v3.7.2 source code.zip 2026-08-03 48.6 MB
0
Totals: 3 Items   94.5 MB 0

Vendure v3.7.2 is a patch release containing fixes for two reported vulnerabilities (one critical, one high), a set of channel-scoping fixes on entity update and delete paths, a rewrite of the BullMQ job list query, and a round of dashboard fixes

One of the security fixes changes behaviour for delegated admin accounts — see Behaviour Changes below.

Security

Fixes for the following reported vulnerabilities are in 3.7.2. If you are on an earlier 3.x version, upgrade.

Severity Vulnerability Advisory
Critical Privilege escalation to SuperAdmin: an administrator holding only the delegated UpdateAdministrator permission could reset any other administrator's password — including the SuperAdmin's — and log in as them GHSA-v85r-wfgv-jcqc
High Broken access control: the Admin API adjustDraftOrderLine mutation was reachable by unauthenticated callers, who could change line quantities and custom fields on orders they did not own GHSA-hc75-2v4j-x372

Our thanks to the researchers who reported these responsibly.

Core

  • Channel-scope guard on StockLocation and Asset update() (#5017) and on the FacetValue, ProductOption and Promotion delete paths (#5043), closing the remaining cases where a channel-restricted administrator could modify or delete an entity in another channel.
  • Assign new variants to all of the product's channels (#4699).
  • Record numeric stockOnHand at the active channel's stock location rather than the global default (#4970).
  • Hydrate relations that are missing from only some array elements (#4986) — EntityHydrator sampled only the first element of an array relation, so unevenly-loaded relations were reported as present and left unloaded.
  • Prevent a route-scoped beforeListen body parser from disabling body parsing on every other route (#5029).
  • Resolve Administrator on API-key sessions via the key owner (#4727).
  • Guard relation custom field resolution against a missing entity id (#5006).
  • Guard mergeDeep against undefined array elements (#4961).

Dashboard

  • Support assigning multiple channels in bulk actions (#4687).
  • Fix stock location deletion, and add stock transfer on delete (#4918).
  • Make Japanese and Korean selectable and complete their translations (#5077).
  • Activate the fallback locale before extensions load (#5061).
  • Compile config outside the type: module package (#4913), fixing dashboard builds failing on Windows/pnpm with exports is not defined in ES module scope.
  • Don't persist empty translations for unfilled languages (#4962).
  • Preserve numeric-looking values in string list inputs (#4988).
  • Search product variants by name or SKU in relation selectors (#4990).
  • Fix required-field validation on the channel create form (#4198).
  • Refresh customer history after updating a customer (#4998).
  • Add a password visibility toggle to all password fields (#4969).
  • Clear asset selection after a bulk action completes (#4941).
  • Admin UI: fix the missing currency button on initial load (#5002).

Job Queue

The BullMQ jobs list query had several defects in its Lua script and index maintenance (#5014): jobs were silently dropped from pages when the result set spanned both list-stored and sorted-set-stored states (the skip offset was applied twice), ordering mixed raw delayed scores with plain timestamps, and the query crashed on queues with more than roughly 8000 waiting jobs.

Behaviour Changes

No breaking API changes, but the fix for GHSA-v85r-wfgv-jcqc tightens updateAdministrator: an administrator can now only update another administrator if they hold all of the target's permissions on all of the target's channels, so updating a SuperAdmin requires a SuperAdmin caller. If you have delegated the UpdateAdministrator permission to a role that edits higher-privileged accounts, those operations will now be rejected. Grant the role the necessary permissions, or perform the update as a SuperAdmin.

Migration

No migrations or config changes are required. Upgrade all @vendure/* packages together to 3.7.2.

What's Changed

New Contributors

Full Changelog: https://github.com/vendurehq/vendure/compare/v3.7.1...v3.7.2

Source: README.md, updated 2026-08-03