Skip to content

Bagisto

v2.4.8 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

b2b-ecommerce blockchain-ecommerce ecommerce ecommerce-framework ecommerce-platform headless-commerce
+12 more
laravel laravel-application laravel-ecommerce laravel-package multi-tenancy-plugin multi-tenant multi-vendor-ecommerce multivendor-ecommerce nft-marketplace opensource-ecommerce php php-ecommerce

Summary

AI summary

Installer .env parser now correctly handles values containing '=' without truncation.

Full changelog

:pencil2: Changes

  • Security fixes.

  • Added a "remove item" affordance to the storefront quantity selector: on the cart and mini-cart, when a line item's quantity reaches the minimum (1) the minus icon is replaced with a trash icon that removes the item. Enabled via an opt-in removable prop on the quantity-changer component (default off), so add-to-cart quantity selectors on product, bundle, grouped, booking, and wishlist pages keep their existing behavior.

  • Fixed the installer's .env parser (EnvironmentManager::getEnvVariable()) truncating environment values that contain an = (e.g. DB_PASSWORD="examplePassword="), which caused database authentication failures during php artisan bagisto:install even though the same .env worked with standard Laravel commands. Values are now split on the first = only; the parser also preserves spaces inside quoted values and matches keys exactly instead of by substring.

  • Made sitemaps channel-wise: a sitemap can now be assigned to one or more channels (via a new sitemap_channels pivot table), and the sitemap files are generated per channel — each using that channel's hostname, root-category subtree, and channel-scoped products and CMS pages, written under sitemaps/<channel-code>/. The admin sitemap listing shows the associated channels and a per-channel "Link for Google" for each entry.

Security Fixes

  • Security fixes applied (no CVE ID provided)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Bagisto

Get notified when new releases ship.

Sign up free

About Bagisto

Leading Laravel open source e-commerce framework with multi-inventory sources, taxation, localization, dropshipping and more exciting features.

All releases →

Related context

Beta — feedback welcome: [email protected]