Download Latest Version v3.7.3 source code.zip (48.7 MB)
Email in envelope

Get an email when there's a new version of Vendure Core

Home / v3.7.3
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-09-02 21.1 kB
0
v3.7.3 source code.tar.gz 2026-09-02 45.9 MB
0
v3.7.3 source code.zip 2026-09-02 48.7 MB
0
Totals: 3 Items   94.7 MB 0

Vendure v3.7.3 is a patch release containing fixes for eleven reported vulnerabilities (four critical, two high, five medium), the seller Order channel-scoping work for multi-vendor setups, corrections to how shipping lines are handled when a shipping method is deleted or unassigned, monorepo support in the CLI, and a batch of dashboard fixes.

Several of the security fixes change behaviour. If you run a multi-channel deployment, or you register an external/SSO authentication strategy, read Behaviour Changes below before upgrading.

Security

Fixes for the following reported vulnerabilities are in 3.7.3. If you are on an earlier 3.x version, upgrade.

Severity Vulnerability Advisory
Critical Unauthenticated account takeover: any customer account created through an external/SSO authentication strategy could be taken over by "registering" that account's email address with an attacker-chosen password GHSA-wr5h-x3x6-4h23
Critical Cross-channel payment IDOR: an administrator scoped to one channel could issue refunds and perform payment and fulfillment transitions against orders belonging to another channel, moving money out of another tenant's payment gateway GHSA-7qvr-c5vf-xxfh
Critical Cross-channel entity capture: an administrator could assign a Product, Collection, Facet, ProductOptionGroup or ProductVariant belonging to another channel into their own channel, gaining ongoing edit and delete control over it GHSA-422x-jq57-j238
High Cross-channel data disclosure: the duplicateEntity mutation copied the source entity without a channel filter, so an administrator could obtain a full copy of an entity from a channel they cannot access GHSA-f94w-2928-x43p
High Administrator directory disclosure: a channel-scoped administrator could read the whole administrator directory through the Admin API, including names, email addresses and role permissions of staff belonging only to other channels GHSA-37j3-p93w-fq6w
Critical Cross-channel channel management: an administrator holding UpdateChannel or DeleteChannel could rename or permanently delete any channel in the system, regardless of which channels their role was scoped to GHSA-22x4-937q-5fr5
Medium Cross-channel catalog write: a channel-scoped administrator could pass the id of a ProductOptionGroup belonging to another channel to createProductOption, linking a new option into another channel's option group GHSA-gg28-cx38-jxxr
Medium Account enumeration by login timing: the mitigation added in 3.5.3 did not cover accounts which exist but have no native password, so those accounts still answered measurably faster than a non-existent address GHSA-c63h-3vvx-48ph
Medium Permissive CORS default: the default configuration reflects any Origin back with Access-Control-Allow-Credentials: true, and Apollo's CSRF prevention was disabled, allowing Login CSRF and cross-origin response reading GHSA-vr2h-89r2-9rwv
Medium Session token disclosure via job data: the serialized RequestContext stored in job data contained the session token, which any administrator holding ReadSettings or ReadSystem could read and reuse GHSA-32jm-mf7r-7qw5
Medium Stored XSS via SVG upload: @vendure/asset-server-plugin served uploaded SVG files inline with an executable content type, so a malicious upload executed script when its URL was opened GHSA-f4r3-h6jf-4m29

file-type has also been bumped to ^21.3.1 in both @vendure/core and @vendure/asset-server-plugin (#5099) to pick up the fix for GHSA-5v7r-6r5c-r473, an infinite loop on malformed ASF input. This bump renames four MIME types — see Migration below.

Our thanks to the researchers who reported these responsibly.

Core

  • Seller Order channel scoping for multi-vendor setups (#5100, closes [#4117]) — price adjustments are now applied in the seller's channel, shipping lines are preserved when an order is split, shipping promotions are re-applied to seller orders, and the transaction is preserved when scoping the seller order context.
  • Shipping lines are no longer removed from an order when the shipping method is deleted, and active orders are recalculated when a shipping method is unassigned from a channel (#4492, [#4494]).
  • Preserve OrderLine relation custom fields when merging orders (#5151).
  • Enqueue the apply-collection-filters job after the transaction commits (#5195), so the worker no longer reads a collection that is not yet visible.
  • Filter the SQLite search index by the request currency (#5149).
  • Prevent exponential re-merge of shared entity references during hydration (#5085).
  • Prevent a NaN discount amount on a cancelled modified OrderLine (#5101).
  • Price every ProductVariant in relation arrays, avoiding a spread RangeError on large arrays (#5058).
  • Check every element in isTranslatable and harden translateDeep against holes in arrays (#5059).
  • Propagate field descriptions to generated Filter and Sort parameters (#5065, closes [#5032]).
  • Invalidate the stock location channel id cache correctly, and handle invalidation failures (#5087, closes [#3324]).
  • Guard the initial job-queue status update, log the real error details, and release the concurrency slot even when the update fails (#5167, [#5168]).
  • Use the default Channel context when creating an Asset from a file stream (#4662).
  • Assign the SuperAdmin and Customer roles in ChannelService.create() (#5095).
  • Enforce the channel permission check on Promotion assign and remove (#5072), and guard against removing promotions from the default channel (#5096).
  • Enforce channel scope on ProductVariant soft-deletion (#5049).
  • Update better-sqlite3 for Node 24 (#5146).

Performance

  • Remove the per-request stock query stampede (#5224). MultiChannelStockLocationStrategy is the default since 3.1.0 and sits on the read path of every storefront product query. Its stock location channel id cache had no in-flight de-duplication, so every stock level on a page missed the cache before any of them had populated it and each issued its own query.

Dashboard

  • Entity selectors refetch on mount, so a newly created entity appears without a page reload (#5190, closes [#5177], [#5178], [#5182]).
  • The channel switcher refreshes after channels are deleted, and the active channel is recovered when the current one is deleted (#5181, [#5228]).
  • Source root resolution for extension compilation: compiled files stay inside outputPath for upward imports, the tsconfig baseUrl is remapped when the source root widens, and the filesystem root is preserved in commonAncestorDir (#5090, closes [#5086]).
  • Transform JSX when compiling the Vendure config and plugin config imports (closes [#3726]).
  • Manual payments: the transaction ID is now optional (#5027), the add-payment option is matched exactly (#5175), and the dialog close button works (#5133).
  • Treat readonly custom fields as optional in the Zod schema (#5057, closes [#5045]).
  • Use updateActiveAdministrator on the profile page, so an administrator without UpdateAdministrator can still edit their own profile (#5055).
  • Remove the arbitrary maximum of 1000 on promotion usage limits (#5226).
  • Forward transformQueryKey and view options from ListPage (#5066).
  • Refresh the tax category selector after mutations (#5178).
  • Show a loading indicator while assets upload.

CLI

  • Resolve hoisted dependencies in monorepo workspaces (#5141, closes [#4842]). Dependency checks now use require.resolve, detect the monorepo root, and walk up to the workspace root when a local node_modules is absent.

@vendure/create

  • Add a TanStack Start storefront option (#5144).
  • Defer the open import to avoid a Yarn PnP crash on Node 22 (#5207).
  • New projects are scaffolded with an explicit CORS origin allowlist read from a CORS_ORIGINS environment variable.

Asset Server Plugin

  • Add a background colour query parameter for transparent images (#4999).

Additions

  • apiOptions.csrfPrevention enables Apollo Server's built-in CSRF prevention on both APIs. It defaults to false; see Behaviour Changes for what enabling it requires of your clients.
  • Create a customer and address inline on a draft order (#4952).
  • Select multiple channels in the assign-to-channel follow-up dialog (#5036).

Behaviour Changes

No breaking API changes, but several of the security fixes tighten behaviour that was previously permissive.

Customer registration. registerCustomerAccount no longer stores the supplied password when an account already exists for that email address through another authentication strategy and has no password yet. A verification token is emailed to the address instead, and the password is set by passing that token to verifyCustomerAccount. This happens whatever the value of authOptions.requireVerification, so such a customer cannot log in immediately after registering. The caller-supplied firstName, lastName, phoneNumber and custom fields are now ignored whenever a User already exists for the email address.

Channel scoping. The following now throw when the target entity is not visible in the active channel, where they previously succeeded: duplicateEntity, the assign-to-channel and remove-from-channel mutations, updateChannel and deleteChannel, createProductOption, and the Order payment, refund, fulfillment and customer note operations. deleteProductVariant and deleteProductVariants now throw EntityNotFoundError for an id that is unknown or not in the active channel, where they previously returned DELETED silently. If you have delegated these permissions to channel-scoped roles which operate across channels, those operations will now be rejected.

Administrator visibility. The administrators and administrator queries now only return administrators whose roles the caller has authority over. A channel-scoped administrator no longer sees staff belonging only to other channels.

Asset serving. The asset server now sends X-Content-Type-Options: nosniff and a Content-Security-Policy on every asset, and serves markup assets (SVG, HTML, XML) with Content-Disposition: attachment. Opening such an asset's URL directly now downloads it rather than rendering it. Images embedded with <img src> are unaffected.

CORS and CSRF. Vendure now logs a warning at startup when apiOptions.cors reflects any origin together with credentials: true, which is the default. Set an explicit origin allowlist in production. The new apiOptions.csrfPrevention option defaults to false, so nothing changes unless you enable it. If you do, every client which uploads files or uses GET for queries must send the Apollo-Require-Preflight header. @vendure/admin-ui, @vendure/dashboard and @vendure/testing already do; a custom admin client built on apollo-upload-client does not unless you add it.

Migration

No database migrations are required. Upgrade all @vendure/* packages together to 3.7.3.

Two things to check after upgrading:

Job data may contain session tokens. The Admin API no longer returns the session token in job data, but tokens written before the upgrade are still present in existing job records. Purge settled job data and consider invalidating existing administrator sessions. The change which stops RequestContext.serialize() persisting the token in the first place alters the type of RequestContext.session, so it lands in the next minor release rather than this patch.

file-type v21 renames four MIME types to their IANA registrations: audio/x-flac becomes audio/flac, video/x-matroska becomes video/matroska, application/x-apache-arrow becomes application/vnd.apache.arrow.file, and application/x-parquet becomes application/vnd.apache.parquet. If you list any of the old values explicitly in assetOptions.permittedFileTypes, update them, otherwise those uploads will be rejected. The default wildcard config (image/*, video/*, audio/*, .pdf) is unaffected.

What's Changed

New Contributors

Full Changelog: https://github.com/vendurehq/vendure/compare/v3.7.2...v3.7.3

Source: README.md, updated 2026-09-02