v2.3.2: Vendor API security fix

Mercur v2.3.2 is a security and hardening release fixing a broken access control vulnerability in the vendor API. All marketplaces running 2.3.1 or earlier should upgrade.

Security

The /vendor/sellers/:id route subtree accepted any authenticated vendor's request without checking that the id belonged to their own store. Any vendor could target another seller's id to read that store's full record (profile, payment details, tax details), overwrite its profile, and manage its team members – including inviting themselves in. In effect, full account takeover of any other vendor's store.

Every /vendor/sellers/:id handler is now scoped to the authenticated seller, member-management routes bind to the caller's own seller, and GET /vendor/stores now requires authentication.

Upgrade now: `` npm install @mercurjs/core@2.3.2 ` Bump every @mercurjs/*` package to 2.3.2 together – they're released in lockstep.

What's New

Other

• Attribute edits now go through the product-change diff pipeline, the same way product edits do.
• CLI now builds admin dashboard extensions, and a package can ship its own entry point.
• create-mercur-app pins generated projects to the CLI's release channel – scaffolding @rc no longer mixes in the latest packages.

What's Fixed

Admin & Vendor Panels

• RouteDrawer dialogs have an accessible title.
• DataGrid column resizing works again.
• The NoRecords empty state grows instead of overflowing.
• dashboard-sdk resolves plugin roots via Node and no longer emits a top-level await.
• Fixed attribute possible-values pagination.
• The admin invite form now carries the roles field, so invited admins aren't locked out.

Storefront

• Cart shipping profiles are validated against the offer, and shipping-method cleanup is derived from offers rather than products.
• Dropped the unused next-intl dependency.
• Split-order payment status is reported correctly on the admin and store order routes.
• Payment statuses are no longer double-counted.
• Core now owns the payment webhook so carts complete as split orders.
• Created offer prices are attributed by rule instead of position.
• New scoped-axis option values are associated with their product.
• The pending product-change guard is actor-scoped.

Other

• react-router-dom is now a peer dependency.
• Fixed plugin:build racing itself for src/admin/index.mjs.
• Removed five dead algolia.intermediate.* subscribers from the Algolia block.
• Rewrote the architecture docs around layers and extension zones.