spree

⚠️ This security release is recommended for all Spree 4.0 installations ⚠️

Fixes security issue ensuring that doorkeeper_token is valid when authenticating requests in API v2 calls

⚠️ This security release is recommended for all Spree 3.7 installations ⚠️

Fixes security issue ensuring that doorkeeper_token is valid when authenticating requests in API v2 calls

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

API

• API v2 - added Address Book API endpoints https://github.com/spree/spree/pull/10485
• API v2 - added Store API endpoint https://github.com/spree/spree/pull/10453
• API v2 - fixed - set order state to delivery if selected shipping rate is changed https://github.com/spree/spree/pull/10480

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Core

• incorporate cache_version in Variant#in_stock method https://github.com/spree/spree/pull/10281

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Core

• Added ability to conditionally disable Variant SKU uniqueness validation with Spree::Config[:disable_sku_validation] preference https://github.com/spree/spree/commit/76834ebb7e9e409c1a0766e6459d5629852a65e6
• Lock thor at 0.20.3 https://github.com/spree/spree/commit/d1e427daf2a2fdceabb512984fa1214c87d30c6c

Storefront

• Added Spree::Config[:additional_filters_partials] fo eary customization of Products list filters https://github.com/spree/spree/commit/ff7d78af6fc4bf8a85c283a8ce85d85ea2715cc4
• Added product_add_to_cart event triggering when adding products to cart for GA / Analytics integration https://github.com/spree/spree/commit/b3e3466469314499ad8f0942611e8c1c6e63d6c4
• Fix missing product added modal when related products are loaded https://github.com/spree/spree/commit/f16fa8ffba86d0a0b6a8545481209085d2f0f001
• Fix close button on gallery modal https://github.com/spree/spree/commit/4c446fb71258d19e28331411f37455deb5b39c75
• Fix use Spree.ready instead of document.ready on checkout address book https://github.com/spree/spree/commit/1dec26a2bdfc4c734cfecf40a377960b709bf03b
• Fix frontend product partial nil price ternary operator bug https://github.com/spree/spree/commit/08bcf15f7096ead0fd52a3d6fee29bc134a9e101

API

• API v2 - added checkout rescue from GatewayError https://github.com/spree/spree/commit/d4895b40be19829c20f93df50b95190352abc493
• Fixed API V2 Storefront Shipping Rates GET request crashes the server https://github.com/spree/spree/pull/9912

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Core

• Update kaminari to 1.2.1 to fix GHSA-r5jw-62xg-j433 https://github.com/spree/spree/commit/600ebf6cc000b95bcb0e86847eff8d32ea5378af
• Use Spree Dev Tools in extension generator https://github.com/spree/spree/commit/f4a5e56f8e26e0fd012e9bed142491ba49d6e8d0
• Fixes Spree Related Products compatibility with Spree Globalize https://github.com/spree/spree/commit/e4b62ab8ed68d3d0c870f98aa1ee6e91f6533a53
• Fixes ProductFinder#by_options to return AR relation rather than array https://github.com/spree/spree/commit/4373f06669b8715cbd00ad038e54836bf6ba1e77

Storefront

• Fixes checkout progress line https://github.com/spree/spree/commit/b962998d02ed6b28b8e054302152e254c06b1fe8

API v2

• Added concat taxons filter for Products endpoint https://github.com/spree/spree/commit/1e70f2598293cf3b65bc8a468b3fc00f867f6a3a
• Fixed: added missing description attribute for Taxon serializer https://github.com/spree/spree/commit/f385f03eeda1a399356d12448c090c924d7c4154

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Core

• Fixed Rails 6.0.3 compatibility https://github.com/spree/spree/commit/61fedae14c910046a44c5f5b01b844a3985d63b3
• Fixed Enable product filtering within multiple taxons https://github.com/spree/spree/commit/10eb67413fd25a742f90ec666109af2e0eec1a83
• Added Taxon#cached_self_and_descendants_ids method for greater performance https://github.com/spree/spree/commit/f7c9e9dde0140431d5e87214f74d4ad84335a7f2
• Fixed: line item adjustment consider ineligible order adjustments bug https://github.com/spree/spree/commit/e180e7d8765d61e62e8b559e5a3ed597eadd5b1c

Storefront

• Adds the ability to configure site-wide products filters via Spree::Frontend::Config[:products_filters] https://github.com/spree/spree/commit/11097f3b38ab4a6bc55d8c3c6c078c9814f143a7
• Fixed: product cache key contains promotion class name and its address in memory https://github.com/spree/spree/commit/f062733b2f4da6ae7ace0965a331a5cf39956c04
• Fixed: By default return Products sorted by their position when Taxon is selected https://github.com/spree/spree/commit/36b058d092103e24a00f6648cc46fe16c2f61279
• Fixed: JSON LD product SKU https://github.com/spree/spree/commit/64968a8ae4d6e7bce78a3f3b0da55a93be561984
• Fixed: going back to checkout on Safari bug https://github.com/spree/spree/commit/01b262088ef04429592ae8d98779bdef04c1a785
• Performance improvements: https://github.com/spree/spree/commit/c0b05194b9d63adb589ffc1ba1d346c4db588f49 https://github.com/spree/spree/commit/af8e3197a23d31e3afe3981dd88b94d6d2fb9cde https://github.com/spree/spree/commit/b5a9004cad74169244bd94481d822ee6ce3d73c0 https://github.com/spree/spree/commit/9170969702ccdcb5b308f9e4c474b68315ac8bb4 https://github.com/spree/spree/commit/620b36b70e6d2fdc44bf01421b2fca40bd0b0b65

API

• Fixed: Add record_type: address to cart_serializer, and fix rspec https://github.com/spree/spree/commit/df38336f76bb19307364239d4dff5a04f38807e1
• Fixed: requesting products from multiple taxon in API v2 https://github.com/spree/spree/commit/ebfa08004a814befb7434e568b6576c7cff8e2fb

This release contains a small number of fixes to make Spree compatible with Ruby 2.7 🚀

Still, the minimum ruby version requirement is Ruby 2.5.

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Storefront

• Fixes clear all button overlapping filters on older devices like iPhone 6 https://github.com/spree/spree/commit/45eb2845c2377578107b185ede562789e10260cf
• Reduces continue shopping button margin on an empty cart page to fit smaller desktop screens https://github.com/spree/spree/commit/bb0aacbac7a0c7c83688b705cee79006f93875dd
• Enhanced PLP customization with SASS variables https://github.com/spree/spree/commit/3b215fc176d5a1e8eb22a8a573b3d8eadeb34942

Admin Panel

• fixed for displaying color option in Variants autocomplete https://github.com/spree/spree/commit/801ea582e2499011efa8381765716f09ede8ba30

Core

• Product Finder: when filtering by Taxon, always return products from child taxons also https://github.com/spree/spree/commit/dd4ed3716465aa99ee9b4a501ed4433ad8433f5b
• Added BaseHelper#maximum_quantity method https://github.com/spree/spree/commit/a5eccd76da787e5bf10ee74cf2425e1412e12701
• Added Spree::DatabaseUtitlies to handle maximum integer value validation https://github.com/spree/spree/commit/f88f57e026950769df8d8c6e129dbc112c8ba5ad
• Fixed LineItem#quantity maximum value validation https://github.com/spree/spree/commit/f5cbf8df4817e70dd96d78c8de7e2c8079022e0d
• Fixed Zone#kind method https://github.com/spree/spree/commit/631e78f4f98e3dd676b31208de2cc2eee8bde31d

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Storefront

• Always return distinct products list and fix 50x errors with sorting options https://github.com/spree/spree/commit/be3bf5b746c000f6447624b0b43db34a73878f9f

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Storefront

• Replaced require_tree with declarative requirements to allow developers can override individual JS files in their projects https://github.com/spree/spree/commit/041b286a761626e2756050ba47592787c08a3bd3
• Fixed account section customization via SASS variables https://github.com/spree/spree/commit/7046a92679cc9a3e82da5a0f911f7313d3a8cfbf

Admin Panel

• fixed user autocomplete for multiple records https://github.com/spree/spree/commit/1327dbc437b603e973d9dfe71afc60c081ceead0

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Storefront

• Prevent £ and € symbols showing as a HTML string of characters with products in other currencies https://github.com/spree/spree/commit/7a0d900d55d9a6de69c5e495188d4334b16fe568
• Use only allowed addresses on Checkout (those that match selected checkout zone) https://github.com/spree/spree/commit/a03bf930c8140296aa047ca03bcbf60a4b07c34b
• Fixed caching for different languages https://github.com/spree/spree/commit/42ce278648b6bcaa7d7ec2b1f7c0e11bc415eb97
• Fixed caching issues for product search results https://github.com/spree/spree/commit/9c51142f3376ea8ff8da8401d2324fc600dc0a6d
• Fixed multiple issues with mobile navigation on smaller screens
• Fixed rapidly clicking on Quantity + or - zoom in the page on mobile issue - https://github.com/spree/spree/commit/604e9317a7067610f03364a58f7c1b7845842894

Core

• Fixed extension generator runtime https://github.com/spree/spree/commit/c978b3c775b27b6a814d4cf388ec54088dea7b5a

Full changelog

https://github.com/spree/spree/compare/v4.1.0...v4.1.1

Major/New Features

Spree 4.1 comes with a completely new mobile-first ultra-fast Storefront which you can easily customize to your brand or business requirements. The new Storefront UI was open-sourced by Spark Solutions team built upon experiences from dozens of eCommerce projects. Special thanks go to Matthew Kennedy for helping out!

Demo

Try it for yourself, check out this fashion site demo: demo.spreecommerce.org

Mobile-first Storefront

We've redesigned the Storefront UI from scratch for the mobile. Fully responsive layout with mobile and tablet devices in mind. We've implemented all the best practices making it pretty and useful for the end-users.

iPhone, Android, iPad, desktop - no matter the device, the new storefront is ready to handle all of those, out of the box!

Easy customization

The new Spree UX is fully customizable so feel free to tweak it to your needs: the overall styling (colors, fonts, roundings, borders), header, footer, placeholder images and text, SEO settings.

To help you customize your eCommerce platform we’ve prepared:

• a slide deck with a step-by-step walkthrough
• a detailed technical how-to doc

Blazing fast performance

Performance is one of the leading factors in eCommerce conversion rates and SEO traffic. It was one of our goals to reduce page views loading times and make the UI snappy and responsive.

We've optimized both frontend and the backend. Eliminating n+1 queries, implementing full page caching, improving JavaScript evaluation time - it all resulted in amazing Google lighthouse scores, even on low performance hosting options and with poor mobile internet connections.

This leads to more conversions, more organic search traffic, more sales and more market value brought to the business owners.

SEO and structured data

We've greatly improved SEO support by implementing JSON-LD and OpenGraph support. At the same time keeping in line with all the SEO best practices to make your storefront no 1 in search results.

Turbolinks - single-page application without the hassle

Turbolinks makes navigating your web application faster. Get the performance benefits of a single-page application without the added complexity of a client-side JavaScript framework.

Of course, you can still combine it with React, Vue or Angular!

Easy migration path

Just follow Follow 4.0 to 4.1 upgrade guide to upgrade your current store to the new UI.

Contact

Feel free to reach out with questions or support requests,

This new Spree UX will be improved and optimized even more. We very much welcome your feedback and suggestions.

About Spark Solutions

Spark Solutions is a software development agency specialized in Ruby on Rails, Spree Commerce and Javascript development. We’ve been leading Spree open-source efforts since 2016 as its core team. We also do client work. Our project teams consist of UX and UI designers, Software Engineers, Testers and Project Managers practicing agile project delivery. We’ll integrate our team with yours to jointly architect, deliver, maintain and scale the software products you need. You drive the project with requirements and acceptance testing and we help you deliver faster using industry-standard project management and comms best practices.

Installation

Add Spree gems to Gemfile

gem 'spree', '~> 4.1'
gem 'spree_auth_devise', '~> 4.1'
gem 'spree_gateway', '~> 3.7'

Run bundle install

Note: if you run into Bundler could not find compatible versions for gem "sprockets": error message, please run

bundle update

Use the install generators to set up Spree

rails g spree:install --user_class=Spree::User
rails g spree:auth:install
rails g spree_gateway:install

Upgrade

Follow 4.0 to 4.1 upgrade guide

Full Changelog

You can view the full changes using Github Compare.

https://github.com/spree/spree/compare/v4.1.0.rc2...v4.1.0.rc3

https://guides.spreecommerce.org/release_notes/4_1_0.html

This security release is recommended for all Spree 4.0 installations

Fixes security issue with API v2 Order information https://github.com/spree/spree/pull/9662/commits/72e1d4427f3b214eda6e3931b335556ac2202105

An attacker could expose Order information using brute force to guess Order numbers. This patch fixes it by requiring Order token to obtain Order information from API v2 Order Status endpoint.

This security release is recommended for all Spree 3.7 installations

Fixes security issue with API v2 Order information https://github.com/spree/spree/pull/9662/commits/72e1d4427f3b214eda6e3931b335556ac2202105

An attacker could expose Order information using brute force to guess Order numbers. This patch fixes it by requiring Order token to obtain Order information from API v2 Order Status endpoint.

This patch release contains bug fixes backported from the master branch. We'd like to thank all the contributors who made this happen 👍

Core

• fixed Rails 5.2.4 compatibility issue https://github.com/spree/spree/commit/bbbbea7c490308ee13f723d4c97c34228b01bbbd https://github.com/spree/spree/issues/9644