This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+12 more
ReleasePort's take
Moderate signalv2.3.19 patches four targeted bugfixes: PayPal refund crashes, product image persistence on CSV re-import, locale-aware channel field saves, and order reordering when customers are deleted.
Why it matters: Patch v2.3.19 to fix PayPal refund crashes, product image persistence on CSV re-import, locale-aware channel field saves, and customer deletion edge cases. Routine operational patch.
Summary
AI summaryFixed product image updates on CSV re-import, PayPal refund crash handling, channel SEO locale switching, and admin order reorder when customer deleted.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Channel translatable fields now save correctly per-locale with locale-switcher Channel translatable fields now save correctly per-locale with locale-switcher Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Product importer now updates images on CSV re-import with same SKUs Product importer now updates images on CSV re-import with same SKUs Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Refunds no longer crash on orders placed via PayPal Smart Button Refunds no longer crash on orders placed via PayPal Smart Button Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Admin reorder redirects with error when customer has been deleted Admin reorder redirects with error when customer has been deleted Source: llm_adapter@2026-05-21 Confidence: high |
— |
Full changelog
:bug: Bug Fixings
-
#10422 - Fixed channel Home Page SEO (and other translatable channel fields: name, description, maintenance mode text) only saving for the admin's UI locale. The channel edit page was missing the locale-switcher dropdown that every other translatable resource (categories, products, CMS pages) uses, so admins had no way to change the per-locale binding away from English. Added the standard locale-switcher dropdown listing every system locale; switching reloads with
?locale=<code>and the form binds, validates, and saves only that locale's translation row. Admins can pre-fill SEO for any system locale, including locales not yet attached to the channel — translations are stored against the locale code regardless of channel-locale attachment. -
#10490 - Fixed product images not being updated when re-importing a CSV with the same SKUs but new image filenames. The Product importer used to skip image processing entirely for already-existing SKUs, so updates were silently ignored. The importer now treats the CSV
imagescolumn as the source of truth on every run: existing image rows and stored files for the affected products are removed before the new images from the CSV are inserted. -
#11294 - Fixed a refund-time crash ("Trying to access array offset on value of type null") on orders placed via the PayPal Smart Button. A race condition in the checkout UI left the regular Place Order button briefly visible while the cart's payment method was being switched to
paypal_smart_button; clicking it created an order with the PayPal method but no captured PayPalorderID, so the later refund hit a nulladditionalpayload. The selected payment method is now tracked client-side immediately on radio change (via a newpayment-method-selectedevent) so the Smart Button replaces the Place Order button without waiting for the cart round-trip, the standardstoreOrderendpoint now rejects carts whose payment method ispaypal_smart_button, and the refund listener no-ops the PayPal API call when the capturedorderIDis missing so the local refund record still succeeds. -
#11242 - Fixed an exception ("Attempt to read property
addresseson null") when an admin attempted to reorder an order whose customer had since been deleted. The admin reorder action now checks for a missing customer and redirects back to the order view with a clear flash message instead of letting the null reach the create-order page.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Bagisto
Leading Laravel open source e-commerce framework with multi-inventory sources, taxation, localization, dropshipping and more exciting features.
Related context
Related tools
Beta — feedback welcome: [email protected]