v2.3.5: Security fixes across Store, Vendor & storefront

Mercur v2.3.5 is a patch release focused on security. We closed three authorization gaps in the Store and Vendor APIs and patched critical Next.js advisories in the storefront. Plugins also get new seams on the order detail page, plus a fix for the vendor onboarding currency select. We recommend all marketplaces upgrade.

Security

This release closes three authorization gaps in the Store and Vendor APIs, and patches two critical Next.js RCE advisories in the storefront.

Client-supplied cart prices (breaking). A shopper could set unit_price when adding a line item to their cart. The price was treated as custom, skipped recalculation, and carried through to the order and payment authorization. POST /store/carts/:id/line-items no longer accepts unit_price or compare_at_unit_price – line prices always come from the offer now. Remove these fields from any storefront or integration that sends them, or requests will get a 400.

Cross-product variant edits. POST and DELETE /vendor/products/:id/variants/:variant_id didn't check that the variant belonged to the product in the path, so a vendor could update or delete a variant – including its images – on a different product entirely. Both routes now return 404 when the variant isn't on that product.

Customer group membership. POST /vendor/customer-groups/:id/customers checked that the seller owned the group, but not the customers being added. A vendor could add or remove any customer on the platform, including other sellers' customers. Every customer ID is now checked, and the route returns 404 if any of them isn't linked to the seller.

Next.js RCE advisories. Bumped next to 15.5.24 in apps/storefront, resolving an unauthenticated RCE in the Image Optimization API (AVIF files) and an unauthenticated RCE on Windows-hosted servers. If your storefront is based on ours, bump next there too.

We recommend all marketplaces upgrade.

What's New

Order detail extension points

Plugins such as disputes can now act on an order without forking its sections. This works in both panels.

• actionLocks in defineCustomFieldsConfig can disable Edit order, Return, Exchange and Claim – the string you return becomes the disabled action's tooltip.
• A new orders.detail.item widget zone on each line-item row receives { order, item }.
• activity adds your own entries to the order activity timeline.

Nothing changes unless a plugin configures these.

What's Fixed

Vendor Panel

Returned supported currencies from GET /vendor/stores, so the vendor onboarding Currency select is populated again on Medusa 2.20.