chore(elasticsearch-plugin): Update ElasticSearch supported version from v7.9.1 to v8.13.1

.github/workflows/build_and_test.yml

@@ -14,38 +14,43 @@ on:
       - minor
 env:
   CI: true
-  node: 20.x
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [ 18.x, 20.x, 22.x ]
     steps:
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ env.node }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ env.node }}
-    - name: npm install
-      run: |
-        npm install
-        npm install --os=linux --cpu=x64 sharp
-    - name: Build
-      run: npm run build
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - name: npm install
+        run: |
+          npm install
+          npm install --os=linux --cpu=x64 sharp
+      - name: Build
+        run: npm run build
   unit-tests:
     name: unit tests
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [ 18.x, 20.x, 22.x ]
     steps:
-      - uses: actions/checkout@v3
-      - name: Use Node.js ${{ env.node }}
-        uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.node }}
+          node-version: ${{ matrix.node }}
       - name: npm install
         run: |
           npm install
           npm install --os=linux --cpu=x64 sharp
       - name: Build
-        run: lerna run ci
+        run: npx lerna run ci
       - name: Unit tests
         run: npm run test
   e2e-tests:
@@ -94,23 +99,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        db: [sqljs, mariadb, mysql, postgres]
+        node: [ 18.x, 20.x, 22.x ]
+        db: [ sqljs, mariadb, mysql, postgres ]
     steps:
-      - uses: actions/checkout@v3
-      - name: Use Node.js ${{ env.node }}
-        uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.node }}
+          node-version: ${{ matrix.node }}
       - name: npm install
         run: |
           npm install
           npm install --os=linux --cpu=x64 sharp
       - name: Build
-        run: lerna run ci
-      - name: df
-        run: |
-          df -h
-          docker system df
+        run: npx lerna run ci
       - name: e2e tests
         env:
           E2E_MYSQL_PORT: ${{ job.services.mysql.ports['3306'] }}

.github/workflows/publish_and_install.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        node-version: [18.x, 20.x]
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        node-version: [18.x, 20.x, 22.x]
       fail-fast: false
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
     - name: Install Verdaccio
@@ -55,7 +55,7 @@ jobs:
       run: |
         nohup verdaccio --config $HOME/.config/verdaccio/config.yaml &
         wait-on http://localhost:4873
-        lerna publish prepatch --preid ci --no-push --no-git-tag-version --no-commit-hooks --force-publish "*" --yes --dist-tag ci --registry http://localhost:4873
+        npx lerna publish prepatch --preid ci --no-push --no-git-tag-version --no-commit-hooks --force-publish "*" --yes --dist-tag ci --registry http://localhost:4873
     - name: Install via @vendure/create
       run: |
         mkdir -p $HOME/install

CHANGELOG.md

@@ -1,3 +1,83 @@
+## <small>3.0.4 (2024-10-04)</small>
+
+
+#### Fixes
+
+* **admin-ui-plugin** Implement rate limiting on static server ([9516c71](https://github.com/vendure-ecommerce/vendure/commit/9516c71))
+* **admin-ui** Add padding to default relation custom field  dropdown ([02e68e0](https://github.com/vendure-ecommerce/vendure/commit/02e68e0))
+* **admin-ui** Add support for custom fields on CustomerGroup list ([7128a33](https://github.com/vendure-ecommerce/vendure/commit/7128a33))
+* **admin-ui** Enable selective loading of custom fields ([9d7744b](https://github.com/vendure-ecommerce/vendure/commit/9d7744b)), closes [#3097](https://github.com/vendure-ecommerce/vendure/issues/3097)
+* **admin-ui** Fix bad locale detection regex ([f336d7f](https://github.com/vendure-ecommerce/vendure/commit/f336d7f))
+* **admin-ui** Lazy-load only selected custom fields in list views ([690dd0f](https://github.com/vendure-ecommerce/vendure/commit/690dd0f)), closes [#3097](https://github.com/vendure-ecommerce/vendure/issues/3097)
+* **admin-ui** Unsubscribe from alerts when logging out (#3071) ([f38340b](https://github.com/vendure-ecommerce/vendure/commit/f38340b)), closes [#3071](https://github.com/vendure-ecommerce/vendure/issues/3071) [#2188](https://github.com/vendure-ecommerce/vendure/issues/2188)
+* **asset-server-plugin** Do not return raw error message on error ([801980e](https://github.com/vendure-ecommerce/vendure/commit/801980e))
+* **core** Correctly parse numeric sessionDuration and verificationTokenDuration values (#3080) ([98e4118](https://github.com/vendure-ecommerce/vendure/commit/98e4118)), closes [#3080](https://github.com/vendure-ecommerce/vendure/issues/3080)
+* **core** Fix issues caused by f235249f ([5a4299a](https://github.com/vendure-ecommerce/vendure/commit/5a4299a))
+* **core** Fix RequestContext race condition causing null activeOrder ([f235249](https://github.com/vendure-ecommerce/vendure/commit/f235249)), closes [#2097](https://github.com/vendure-ecommerce/vendure/issues/2097)
+* **core** Handle empty state for product and variant id filter (#3064) ([9a03c84](https://github.com/vendure-ecommerce/vendure/commit/9a03c84)), closes [#3064](https://github.com/vendure-ecommerce/vendure/issues/3064)
+* **core** Prevent theoretical polynomial regex attack ([9f4a814](https://github.com/vendure-ecommerce/vendure/commit/9f4a814))
+* **core** Remove duplicate call in applyCouponCode resolver ([bffc58a](https://github.com/vendure-ecommerce/vendure/commit/bffc58a))
+* **core** Replace insecure randomness with secure randomBytes ([cb556d8](https://github.com/vendure-ecommerce/vendure/commit/cb556d8))
+* **payments-plugin** Use default channel in Stripe webhook calls to reach all orders (#3076) ([8434111](https://github.com/vendure-ecommerce/vendure/commit/8434111)), closes [#3076](https://github.com/vendure-ecommerce/vendure/issues/3076)
+
+#### Perf
+
+* **core** Fix performance when using FacetValue-based checks ([a735bdf](https://github.com/vendure-ecommerce/vendure/commit/a735bdf))
+* **admin-ui** List views only load the visible custom fields, closes [#3097](https://github.com/vendure-ecommerce/vendure/issues/3097)
+
+## <small>3.0.3 (2024-09-11)</small>
+
+
+#### Fixes
+
+* **admin-ui** Display up to 3 decimal places in OrderSummary tax rate ([13a1b21](https://github.com/vendure-ecommerce/vendure/commit/13a1b21)), closes [#3051](https://github.com/vendure-ecommerce/vendure/issues/3051)
+* **core** Fix regression in correctly setting OrderLine.featuredAsset ([7d070f2](https://github.com/vendure-ecommerce/vendure/commit/7d070f2))
+
+## <small>3.0.2 (2024-09-10)</small>
+
+
+#### Fixes
+
+* **admin-ui** Fix removing coupon code from draft order ([04340f1](https://github.com/vendure-ecommerce/vendure/commit/04340f1)), closes [#2969](https://github.com/vendure-ecommerce/vendure/issues/2969)
+* **core** Fix search indexing issue when working with multiple channels (#3041) ([75ed6e1](https://github.com/vendure-ecommerce/vendure/commit/75ed6e1)), closes [#3041](https://github.com/vendure-ecommerce/vendure/issues/3041) [#3012](https://github.com/vendure-ecommerce/vendure/issues/3012)
+* **core** Prevent exposure of private custom fields via JSON type ([042abdb](https://github.com/vendure-ecommerce/vendure/commit/042abdb)), closes [#3049](https://github.com/vendure-ecommerce/vendure/issues/3049)
+* **elasticsearch-plugin** Fix search multichannel indexing issue ([9d6f9cf](https://github.com/vendure-ecommerce/vendure/commit/9d6f9cf)), closes [#3012](https://github.com/vendure-ecommerce/vendure/issues/3012)
+
+#### Perf
+
+* **core** Fix slow `order` query for postgres v16 ([1baa8e7](https://github.com/vendure-ecommerce/vendure/commit/1baa8e7)), closes [#3037](https://github.com/vendure-ecommerce/vendure/issues/3037)
+* **core** Omit ID encode/decode step if default EntityIdStrategy used ([ad30b55](https://github.com/vendure-ecommerce/vendure/commit/ad30b55))
+* **core** Optimizations to the addItemToOrder path ([70ad853](https://github.com/vendure-ecommerce/vendure/commit/70ad853))
+* **core** Optimize order operations ([e3d6c21](https://github.com/vendure-ecommerce/vendure/commit/e3d6c21))
+* **core** Optimize resolution of featuredAsset fields ([d7bd446](https://github.com/vendure-ecommerce/vendure/commit/d7bd446))
+* **core** Optimize setting active order on session ([c591432](https://github.com/vendure-ecommerce/vendure/commit/c591432))
+
+## <small>3.0.1 (2024-08-21)</small>
+
+
+#### Fixes
+
+* **admin-ui** Add missing and revise portuguese and brazilian portuguese translations (#3002) ([9b5911f](https://github.com/vendure-ecommerce/vendure/commit/9b5911f)), closes [#3002](https://github.com/vendure-ecommerce/vendure/issues/3002)
+* **admin-ui** Fix overflow in channel assignment block (#2984) ([0f8bdb5](https://github.com/vendure-ecommerce/vendure/commit/0f8bdb5)), closes [#2984](https://github.com/vendure-ecommerce/vendure/issues/2984)
+* **admin-ui** Make sku optional in create-product-variant-dialog (#3007) ([13fe069](https://github.com/vendure-ecommerce/vendure/commit/13fe069)), closes [#3007](https://github.com/vendure-ecommerce/vendure/issues/3007) [#2999](https://github.com/vendure-ecommerce/vendure/issues/2999)
+* **admin-ui** Use correct 24hr format for locale in dates (#2972) ([f078b41](https://github.com/vendure-ecommerce/vendure/commit/f078b41)), closes [#2972](https://github.com/vendure-ecommerce/vendure/issues/2972) [#2970](https://github.com/vendure-ecommerce/vendure/issues/2970)
+* **core** Allow fulfillment creation with deleted product variants (#2982) ([752c2b6](https://github.com/vendure-ecommerce/vendure/commit/752c2b6)), closes [#2982](https://github.com/vendure-ecommerce/vendure/issues/2982) [#2434](https://github.com/vendure-ecommerce/vendure/issues/2434)
+* **core** Fix EntityHydrator error on long table names (#2959) ([bcfcf7d](https://github.com/vendure-ecommerce/vendure/commit/bcfcf7d)), closes [#2959](https://github.com/vendure-ecommerce/vendure/issues/2959) [#2899](https://github.com/vendure-ecommerce/vendure/issues/2899)
+* **core** Fix NaN error thrown when modifying pro-rated discounted OrderLine to 0 (#3009) ([fa50770](https://github.com/vendure-ecommerce/vendure/commit/fa50770)), closes [#3009](https://github.com/vendure-ecommerce/vendure/issues/3009)
+* **core** Make firstName and lastName required in CreateCustomerAndUser method (#2996) ([0d8054d](https://github.com/vendure-ecommerce/vendure/commit/0d8054d)), closes [#2996](https://github.com/vendure-ecommerce/vendure/issues/2996)
+* **core** Resolve User.roles field in GraphQL APIs (#3011) ([8f99b2d](https://github.com/vendure-ecommerce/vendure/commit/8f99b2d)), closes [#3011](https://github.com/vendure-ecommerce/vendure/issues/3011)
+* **core** Return type of collection breadcrumb was missing slug (#2960) ([620eeb1](https://github.com/vendure-ecommerce/vendure/commit/620eeb1)), closes [#2960](https://github.com/vendure-ecommerce/vendure/issues/2960)
+* **create** Dynamically find open port if 3000 in use ([a40fbb1](https://github.com/vendure-ecommerce/vendure/commit/a40fbb1))
+* **create** Fix typo (#2994) ([999e89e](https://github.com/vendure-ecommerce/vendure/commit/999e89e)), closes [#2994](https://github.com/vendure-ecommerce/vendure/issues/2994)
+* **create** Update EmailPlugin config to use templateLoader API ([6708440](https://github.com/vendure-ecommerce/vendure/commit/6708440)), closes [#2981](https://github.com/vendure-ecommerce/vendure/issues/2981)
+* **payments-plugin** Fix Mollie not calling webhook on updated orders (#3014) ([694845f](https://github.com/vendure-ecommerce/vendure/commit/694845f)), closes [#3014](https://github.com/vendure-ecommerce/vendure/issues/3014) [#2941](https://github.com/vendure-ecommerce/vendure/issues/2941)
+* **payments-plugin** Mollie - add missing request when settled amount is 0 (#2993) ([afd6435](https://github.com/vendure-ecommerce/vendure/commit/afd6435)), closes [#2993](https://github.com/vendure-ecommerce/vendure/issues/2993)
+
+#### Perf
+
+* **core** Improve hydrator performance for customFields (#2961) ([f40761d](https://github.com/vendure-ecommerce/vendure/commit/f40761d)), closes [#2961](https://github.com/vendure-ecommerce/vendure/issues/2961)
+* **core** Refactor applyCollectionFiltersInternal method to improve performance (#2978) ([6eeae1c](https://github.com/vendure-ecommerce/vendure/commit/6eeae1c)), closes [#2978](https://github.com/vendure-ecommerce/vendure/issues/2978)
+
 ## 3.0.0 (2024-07-17)
 
 Note: the changes in this release are identical to v2.3.0.

README.md

@@ -180,4 +180,4 @@ The reason we do not rely on Lerna to push the release to Git is that this repo
 
 ## License
 
-See [LICENSE.md](./LICENSE.md)
+See [LICENSE.md](./LICENSE.md).

SECURITY.md

@@ -3,8 +3,10 @@
 ## Supported Versions
 
 | Version | Supported          |
-| ------- | ------------------ |
-| 1.x.x   | :white_check_mark: |
+|---------|--------------------|
+| 3.x.x   | :white_check_mark: |
+| 2.x.x   | :white_check_mark: |
+| 1.x.x   | :x:                |
 | < 1.0   | :x:                |
 
 ## Reporting a Vulnerability

docs/docs/guides/deployment/deploy-to-digital-ocean-app-platform/index.md

@@ -187,6 +187,10 @@ The values starting with `${db...}` are automatically populated by App Platform
 to name your database something other than `db`.
 :::
 
+:::note
+When using the App Platform with a Dev Database, DigitalOcean only provides a self-signed SSL certificate. This may prevent the Vendure app from starting. As a workaround, you can add the environment variable `NODE_TLS_REJECT_UNAUTHORIZED` and set it to `0`.
+:::
+
 After saving your environment variables you can click through the confirmation screens to create the app.
 
 ## Create the worker resource
@@ -205,11 +209,37 @@ Again you can edit the plan, and the smallest Basic plan is fine for testing pur
 
 No new environment variables are needed since we'll be sharing the Global variables with the worker.
 
+## Enable access to the required routes
+
+To be able to access the UI and other routes, we need to declare them first.
+
+1. In the app dashboard, click on the **Settings** tab.
+2. Click on the **vendure-server** component.
+
+   ![Open server settings](./05-open-server-settings.webp)
+
+3. Scroll down to **HTTP Request Routes**.
+4. Click on **Edit**.
+5. Click on **+ Add new route** and fill in the form like this:
+
+   ![Admin app route](./06-admin-app-route.webp)
+
+6. Make sure to check the **Preserve Path Prefix** option.
+
+You need to do this for the following routes:
+- `/admin`
+- `/assets`
+- `/health`
+- `/admin-api`
+- `/shop-api`
+
+7. Click on **Save**.
+
 ## Test your Vendure server
 
 Once everything has finished deploying, you can click the app URL to open your Vendure server in a new tab. 
 
-![Open app](./05-open-app.webp)
+![Open app](./07-open-app.webp)
 
 :::info
 Append `/admin` to the URL to access the admin UI, and log in with the superadmin credentials you set in the environment variables.

docs/docs/guides/deployment/deploying-admin-ui.md

@@ -3,8 +3,18 @@ title: "Deploying the Admin UI"
 showtoc: true
 ---
 
+## Compiling the Admin UI
 
-If you have customized the Admin UI with extensions, you should [compile your extensions ahead of time as part of the deployment process](/guides/extending-the-admin-ui/getting-started/#compiling-as-a-deployment-step).
+If you have customized the Admin UI with extensions, you should compile your custom Admin UI app ahead of time
+before deploying it. This will bundle the app into a set of static files which are then served by the AdminUiPlugin.
+
+- [Guide: Compiling the Admin UI as a deployment step](/guides/extending-the-admin-ui/getting-started/#compiling-as-a-deployment-step).
+
+:::warning
+
+It is not recommended to compile the Admin UI on the server at runtime, as this can be slow and resource-intensive.
+Instead, compile the Admin UI ahead of time and deploy the compiled assets, as covered in the guide linked above.
+:::
 
 ## Setting the API host & port
 

docs/docs/guides/developer-guide/plugins/index.mdx

@@ -168,8 +168,6 @@ For any unit of functionality that you need to add to your project, you'll be cr
 For a complete working example of a Vendure plugin, see the [real-world-vendure Reviews plugin](https://github.com/vendure-ecommerce/real-world-vendure/tree/master/src/plugins/reviews)
 
 You can also use the [Vendure CLI](/guides/developer-guide/cli) to quickly scaffold a new plugin.
-
-If you intend to write a shared plugin to be distributed as an npm package, see the [vendure plugin-template repo](https://github.com/vendure-ecommerce/plugin-template)
 :::
 
 In this guide, we will implement a simple but fully-functional **wishlist plugin** step-by-step. The goal of this plugin is to allow signed-in customers to add products to a wishlist, and to view and manage their wishlist.
@@ -782,3 +780,9 @@ mutation RemoveFromWishlist {
   </TabItem>
 </Tabs>
 
+## Publishing plugins
+
+If you have created a plugin that you would like to share with the community, you can publish it to npm, and even
+have it listed on the [Vendure Hub](https://vendure.io/hub).
+
+For a full guide to publishing plugins, see the [Publishing a Plugin how-to guide](/guides/how-to/publish-plugin/).