: Staging
: Production
✨ New
Control public seller registration
Marketplace operators can now disable public seller sign-ups, giving you full control over who can become a seller on your platform.
GraphQL introspection controls
Added the ability to disable GraphQL introspection on a per-marketplace basis, enhancing API security for production environments.
File-based secret configuration
Configuration secrets can now be read from mounted files (using <NAME>_FILE environment variables), making it easier to integrate with container orchestration platforms and secret management systems.
🪲 Fixed
Fixed a security issue where the customerUpdate mutation could be used to modify staff or superuser accounts.
Fixed an issue where email change confirmation links were sent to the old email address instead of the new one when updating staff accounts.
🪲 Fixed
Fixed a security issue where users could attach another user's checkout to their account.
Fixed an issue where users could add notes to checkout lines they don't own.