This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+12 more
Summary
AI summaryInstaller .env parser now correctly handles values containing '=' without truncation.
Full changelog
:pencil2: Changes
-
Security fixes.
-
Added a "remove item" affordance to the storefront quantity selector: on the cart and mini-cart, when a line item's quantity reaches the minimum (1) the minus icon is replaced with a trash icon that removes the item. Enabled via an opt-in
removableprop on thequantity-changercomponent (default off), so add-to-cart quantity selectors on product, bundle, grouped, booking, and wishlist pages keep their existing behavior. -
Fixed the installer's
.envparser (EnvironmentManager::getEnvVariable()) truncating environment values that contain an=(e.g.DB_PASSWORD="examplePassword="), which caused database authentication failures duringphp artisan bagisto:installeven though the same.envworked with standard Laravel commands. Values are now split on the first=only; the parser also preserves spaces inside quoted values and matches keys exactly instead of by substring. -
Made sitemaps channel-wise: a sitemap can now be assigned to one or more channels (via a new
sitemap_channelspivot table), and the sitemap files are generated per channel — each using that channel's hostname, root-category subtree, and channel-scoped products and CMS pages, written undersitemaps/<channel-code>/. The admin sitemap listing shows the associated channels and a per-channel "Link for Google" for each entry.
Security Fixes
- Security fixes applied (no CVE ID provided)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Bagisto
Leading Laravel open source e-commerce framework with multi-inventory sources, taxation, localization, dropshipping and more exciting features.
Related context
Related tools
Beta — feedback welcome: [email protected]