Skip to content

Bagisto

Developer Productivity

An open‑source Laravel‑based eCommerce framework for building online stores quickly

PHP Latest v2.4.5 · 1d ago Security brief →

Features

  • Built on Laravel (PHP) and Vue.js for modern web development
  • Accelerates store creation and migration from physical to online commerce
  • Suitable for businesses of any size with straightforward setup

Recent releases

View all 29 releases →
Review required
v2.4.5 New feature

EU withdrawal + PhonePe

No immediate action
v2.3.19 Breaking risk

CSV images + PayPal refunds + SEO locales + Order

v2.4.4 Mixed
Notable features
  • Added a “Sales By Coupon” report to admin sales dashboard with coupon-code badge, order drill‑down list and links to cart rule edit page
  • Enabled column sorting on all reporting list pages (Sales, Customers, Products) with sort direction indicators
Full changelog

:sparkles: Features

  • #10832 - Added a "Sales By Coupon" report to the admin sales reporting dashboard, with a coupon-code badge linking to the corresponding cart rule edit page and a drill-down "View Details" listing showing each order that used a coupon (order ID linking to the order detail, coupon code linking to the cart rule).

:bug: Bug Fixings

  • Fixed wrong "From" and "To" dates on the admin Bookings data grid and calendar view caused by the Carbon 3 timezone behavior change in the Laravel 12 upgrade. Carbon::createFromTimestamp() now returns UTC by default instead of the app timezone, so the booking timestamps are explicitly converted via ->timezone(config('app.timezone')) in BookingDataGrid and BookingController.

  • Optimized cart rule evaluation to reduce repeated database lookups during cart total calculation, improving cart and checkout performance.

  • Refined the admin cart-rule create/edit pages with a clearer Coupon section, a context-aware Actions card, and a dedicated Generated Coupons datagrid with a modal-based bulk-code generator.

  • Refined the storefront cart and onepage checkout summaries with + / indicators, a collapsed dual tax-mode display, an expandable Discount breakdown, and a modernized applied-coupon pill.

  • #8738 - Added column sorting on every reporting list page (Sales / Customers / Products) with sort direction indicators in the column header, fixing the previously non-functional click target.

v2.4.3 Bug fix

Minor fixes and improvements.

Full changelog

:bug: Bug Fixings

All booking product bug fixes from the 2.3 branch into 2.4. Key highlights:

  • Added admin-side order creation support for booking products across appointment, event, rental, default, and table sub-types.
  • Fixed booking slot overlap detection and corrected the calendar window generation for appointment bookings.
  • Fixed display pricing for rental and event sub-types with a "starting from" price on listings and corrected strike-through pricing.
  • Hardened cart handling for booking items (quantity updates, missing-ticket guards, inverted rental range checks).
  • Fixed booking product import by updating the data-transfer sample files and correcting the importer for booking attributes.
v2.3.18 Breaking risk
Security fixes
  • #11258 User enumeration vulnerability in customer resend-verification endpoint
  • #11220 SQL injection in DataGrid sort column and path traversal via ImageCache
Notable features
  • Booking product import via CSV/XLS/XLSX/XML
  • Booking availability visual indicators on date picker
  • Fixed booking cancellation respecting allow_cancellation flag
Full changelog

:bug: Bug Fixings

  • Added Booking product support to the DataTransfer (import) package. Booking products can now be imported via CSV/XLS/XLSX/XML using a new booking_options column that follows the existing pipe/key=value convention (same pattern as bundle_options / configurable_variants). The column encodes the product-level config, type-specific config, and slot or ticket records in pipe-separated sections. All five booking subtypes are supported: default (one/many), appointment, event (with tickets + translations), rental (daily/hourly), and table. Updated the sample product files in all four formats with one example per booking subtype.

  • #11258 - Fixed user enumeration vulnerability (CWE-204) in the customer resend-verification endpoint where a missing null-check leaked email existence via differential HTTP responses. Added rate limiting on the route.

  • #11273 - Reworked the Sales → Booking → Calendar event detail modal to focus on booking information. Removed the ordered amount (Price), added the product name, and now reuses the same booking attributes (From/Till, Location, Ticket, Number of Bookings, etc.) that are shown in the cart and order views — rendered in the same logical order (When → Where → What → How many). The underlying booking query no longer pulls the grand total and now joins order_items.additional and the localized product name.

  • #10695 - Booking product availability is now visually indicated on the date picker. Weekdays with no slots configured, dates outside the available_from/available_to window, and dates blocked by prevent_scheduling_before are now grayed out in the calendar, so customers no longer have to click each date to check availability. Applies to default, appointment, table, and rental booking types.

  • #11263 - Fixed the Cancel Order option ignoring the booking allow_cancellation flag. The flag is now snapshotted on the bookings record at order placement time, so later product edits never affect placed orders. For mixed orders, cancelling now skips only the non-cancellable booking items and cancels the rest — the Cancel button remains available as long as the order has at least one cancellable item. Amber informational banners explain this behaviour on both admin and customer order views, and a separate banner on the product view warns customers before checkout.

  • #11262 - Fixed booking products allowing checkout beyond available quantity. The compareOptions comparator for booking products now matches on booking slot/date/renting-type so repeated additions of the same slot merge into a single cart item, correctly triggering the out-of-stock validation.

  • #11261 - Fixed the Reorder button being visible in admin and customer order views for booking products that are out of stock. The Booking type now implements a proper isSaleable() check based on booking quantity, event ticket stock, and the product's availability window. Booking items are also skipped during reorder with an info message, since their original slot data is typically expired.

  • #11260 - Fixed event booking showing the "sold out" toast when the requested quantity exceeded the available stock. A dedicated exceeds_available message is now shown with the remaining ticket count when stock is still available.

  • #11259 - Fixed the "Start time must be less than end time" toast appearing for valid multi-day slots (e.g., Saturday to Sunday) on default booking products. Time comparison now runs only for same-day slots, and the frontend overlap check handles cross-week ranges correctly.

  • #11251 - Fixed a system crash when viewing refund details after refunding a table booking product. The Booking product type was marked as composite, causing the refund view to look for child items that do not exist.

  • #11250 - Fixed a system crash when viewing refund details after refunding an appointment booking product, caused by the same composite product misconfiguration.

  • #11240 - Updated the event booking product page to display the combined ticket price (base product price + ticket type price) so customers can see the actual amount payable per ticket.

  • #11239 - Fixed incorrect slot selection time and date displayed in the cart, customer orders, and admin section for default booking products. Timestamps are now converted using the configured application timezone to match the slot selected by the customer.

  • #11238 - Fixed incorrect slot duration and time visibility in the cart, customer orders, and admin section by casting slot timestamps to integer and applying consistent timezone conversion across all booking attribute formatters.

  • #11236 - Fixed an issue with incorrect slot visibility on the product page for table booking products when the selected weekday or date was out of range.

  • #11235 - Fixed an issue causing incorrect slot visibility based on selected day and date in appointment booking.

  • #11234 - Fixed product categories being silently cleared when saving the product while viewing a channel whose root category differs from another channel's. The edit form now preserves categories outside the current channel's tree via hidden inputs so sync() no longer drops them.

  • #11232 - Fixed guest limit and booking slot details not being visible in the cart for table booking products. The cart attributes now include charged-per type (per table/per guest) and guest limit when applicable.

  • #11230 - Fixed irrelevant slot time displayed in the cart for hourly rental bookings by casting timestamps to integer and applying timezone conversion consistently.

  • #10902 - Updated appointment booking products to display only available time slots.

  • #10739 - Fixed booking information not being displayed properly on the product view page when the booking information was edited on the product edit page. Null guards were added so storefront views do not fail when slot relations are missing.

  • #10738 - Fixed the "Slots Time Duration" functionality not working correctly for the "One Booking for Many Days" default booking configuration. Overlapping multi-day slot ranges are now matched against the selected day of week and cross-day slots are no longer silently dropped by the backend overlap validator.

  • #10708 - Fixed event booking cart allowing quantity to exceed the ticket limit. A max-value constraint was added to the quantity changer based on the ticket's available quantity.

  • #10697 - Fixed incorrect alert message being shown when a rental product was unavailable. Type-specific error messages are now returned for rental, event, and other booking types.

  • #10696 - Fixed the end date not being displayed for "One Booking for Many Days" booking products on the storefront. Multi-day slot labels now include the day and date along with the time.

  • #10683 - Fixed duplicate slot timing being shown for the same day on booking products. The slot calculation helper now deduplicates slots by timestamp and performs sorting once after slot generation completes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
26,941
Forks
3,138
Languages
PHP Blade TypeScript

Community & Support

Beta — feedback welcome: [email protected]