Saleor

v3.23.18 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 12d Productivity & Wikis

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

cart checkout commerce composable e-commerce ecommerce

+12 more

graphql headless headless-commerce multichannel oms order-management payments pim python shop shopping-cart store

Affected surfaces

auth

Summary

AI summary

Fixed confirmAccount() from re‑activating disabled accounts.

Type	Severity	Summary	CVE
Feature	Medium	Adds different scopes to account management tokens (e.g., password reset, account confirmation). Adds different scopes to account management tokens (e.g., password reset, account confirmation). Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Adds ability to edit `Shop.name` via the `shopSettingsUpdate()` mutation. Adds ability to edit `Shop.name` via the `shopSettingsUpdate()` mutation. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Fixes `confirmAccount()` allowing operation on disabled accounts and inadvertently re‑activating them. Fixes `confirmAccount()` allowing operation on disabled accounts and inadvertently re‑activating them. Source: llm_adapter@2026-07-14 Confidence: low	—
Bugfix	Medium	Prevents `confirmAccount()` from running on disabled accounts and re‑activating them. Prevents `confirmAccount()` from running on disabled accounts and re‑activating them. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—

Full changelog

Added different scopes to account management tokens (password reset, account confirmation, etc.) by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19447
Added ability to edit Shop.name via the shopSettingsUpdate() mutation by @lkostrowski in https://github.com/saleor/saleor/pull/19468
Fixed confirmAccount() being runnable against disabled accounts & subsequently re-activating disabled accounts by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19463

Full Changelog: https://github.com/saleor/saleor/compare/3.23.17...3.23.18

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Saleor

Get notified when new releases ship.

About Saleor

Django based open-sourced e-commerce storefront.