spree_core 5.4.1 → 5.4.3

data/config/initializers/carmen.rb

@@ -0,0 +1,23 @@
+# Patches Carmen::Querying#normalise_name to avoid the deprecated
+# ActiveSupport::Multibyte::Chars API (mb_chars), which will be removed in
+# Rails 8.2.
+#
+# In Ruby 2.4+, String#downcase is already Unicode-aware, making the mb_chars
+# call redundant. Since Spree requires Ruby >= 3.2, we can drop it safely.
+#
+# This patch can be removed once the upstream gem is fixed.
+#
+# See: https://github.com/carmen-ruby/carmen/issues/304
+require 'carmen'
+
+module Spree
+  module CarmenQueryingPatch
+    private
+
+    def normalise_name(name)
+      name.downcase.unicode_normalize(:nfkc)
+    end
+  end
+end
+
+Carmen::Querying.prepend(Spree::CarmenQueryingPatch)

data/config/locales/en.yml

@@ -299,6 +299,11 @@ en:
           attributes:
             currency:
               must_match_order_currency: Must match order currency
+        spree/market:
+          attributes:
+            base:
+              cannot_destroy_default_market: Cannot delete the default market.
+              cannot_destroy_last_market: Cannot delete the only market.
         spree/market_country:
           attributes:
             country:
@@ -1311,6 +1316,9 @@ en:
     inventory_error_flash_for_insufficient_quantity: An item in your cart has become unavailable.
     inventory_state: Inventory State
     invitation_accepted: Invitation accepted!
+    invitation_expired:
+      body: This invitation link is no longer valid. Please ask the person who invited you to send a new one.
+      heading: Invitation invalid or expired
     invitation_mailer:
       greeting: Hi %{user_name},
       invitation_accepted:
@@ -1342,7 +1350,6 @@ en:
     items_in_rmas: Items in Return Authorizations
     items_reimbursed: Items reimbursed
     items_to_be_reimbursed: Items to be reimbursed
-    join_slack: Join Slack
     key: Key
     kind: Kind
     label: Label

data/db/migrate/20260424000001_add_unique_index_to_spree_payments_response_code.rb

@@ -0,0 +1,51 @@
+class AddUniqueIndexToSpreePaymentsResponseCode < ActiveRecord::Migration[7.2]
+  def up
+    # Remove duplicate payments per (order, payment_method, response_code),
+    # preferring to keep completed payments over incomplete ones.
+    # Among same-state duplicates, keeps the most recent (highest id).
+    # Uses derived table for MySQL compatibility.
+    execute <<~SQL
+      DELETE FROM spree_payments
+      WHERE response_code IS NOT NULL
+        AND id NOT IN (
+          SELECT keeper_id FROM (
+            SELECT (
+              SELECT id FROM spree_payments p2
+              WHERE p2.order_id = p1.order_id
+                AND p2.payment_method_id = p1.payment_method_id
+                AND p2.response_code = p1.response_code
+              ORDER BY
+                CASE p2.state
+                  WHEN 'completed' THEN 0
+                  WHEN 'pending'   THEN 1
+                  WHEN 'processing' THEN 2
+                  ELSE 3
+                END,
+                p2.id DESC
+              LIMIT 1
+            ) AS keeper_id
+            FROM spree_payments p1
+            WHERE p1.response_code IS NOT NULL
+            GROUP BY p1.order_id, p1.payment_method_id, p1.response_code
+          ) AS keeper_ids
+        )
+    SQL
+
+    if ActiveRecord::Base.connection.adapter_name == 'Mysql2'
+      # MySQL doesn't support partial indexes, but treats NULL as distinct
+      # in unique indexes so multiple payments with NULL response_code are allowed
+      add_index :spree_payments, [:order_id, :payment_method_id, :response_code],
+                unique: true,
+                name: 'idx_payments_order_method_response_code'
+    else
+      add_index :spree_payments, [:order_id, :payment_method_id, :response_code],
+                unique: true,
+                where: 'response_code IS NOT NULL',
+                name: 'idx_payments_order_method_response_code'
+    end
+  end
+
+  def down
+    remove_index :spree_payments, name: 'idx_payments_order_method_response_code'
+  end
+end

data/db/migrate/20260424100000_add_processing_groups_to_spree_imports.rb

@@ -0,0 +1,6 @@
+class AddProcessingGroupsToSpreeImports < ActiveRecord::Migration[7.2]
+  def change
+    add_column :spree_imports, :processing_groups_count, :integer, default: 0
+    add_column :spree_imports, :completed_groups_count, :integer, default: 0
+  end
+end

data/db/migrate/20260504103113_add_type_to_spree_payment_setup_sessions.rb

@@ -0,0 +1,6 @@
+class AddTypeToSpreePaymentSetupSessions < ActiveRecord::Migration[7.2]
+  def change
+    add_column :spree_payment_setup_sessions, :type, :string
+    add_index :spree_payment_setup_sessions, :type
+  end
+end

data/db/sample_data/orders.rb

@@ -122,7 +122,7 @@ if method
       source: credit_card.clone,
       payment_method: method
     ).first_or_create!
-    payment.update_columns(state: 'pending', response_code: '12345')
+    payment.update_columns(state: 'pending', response_code: "BGS-#{SecureRandom.hex(6)}")
   end
 end
 

data/lib/generators/spree/dummy/dummy_generator.rb

@@ -106,7 +106,7 @@ module Spree
     def inject_yaml_permitted_classes
       inside dummy_path do
         inject_into_file 'config/application.rb', %Q[
-    config.active_record.yaml_column_permitted_classes = [Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone]
+    config.active_record.yaml_column_permitted_classes = [Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone, ActiveSupport::TimeZone, Time]
         ], after: /config\.load_defaults.*$/, verbose: true
       end
     end

data/lib/spree/core/configuration.rb

@@ -117,6 +117,9 @@ module Spree
       preference :gift_card_batch_web_limit, :integer, default: 500 # number of gift card codes to be generated in the web process, more than this will be generated in a background job
       preference :gift_card_batch_limit, :integer, default: 50_000
 
+      # imports
+      preference :large_import_threshold, :integer, default: 500 # imports with more rows than this skip per-row UI broadcasts and use bulk processing
+
     end
   end
 end

data/lib/spree/core/engine.rb

@@ -47,7 +47,7 @@ module Spree
         app.config.spree = Environment.new(SpreeCalculators.new, SpreeValidators.new, Spree::Core::Configuration.new, Spree::Core::Dependencies.new)
 
         app.config.active_record.yaml_column_permitted_classes ||= []
-        app.config.active_record.yaml_column_permitted_classes.concat([Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone])
+        app.config.active_record.yaml_column_permitted_classes.concat([Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone, ActiveSupport::TimeZone, Time])
         Spree::Config = app.config.spree.preferences
         Spree::RuntimeConfig = app.config.spree.preferences # for compatibility
         Spree::Dependencies = app.config.spree.dependencies
@@ -289,13 +289,10 @@ module Spree
           Spree::Addresses::PhoneValidator
         ]
 
-        # Attach event log subscriber if enabled
-        if Spree::Config.events_log_enabled
-          Spree::EventLogSubscriber.attach_to_notifications
-        end
-
         # Add core event subscribers
         # Other engines add their subscribers in their own after_initialize blocks
+        # Note: Spree::EventLogSubscriber is attached in to_prepare (below) so it
+        # survives Zeitwerk code reloads in development.
         Spree.subscribers.concat [
           Spree::ExportSubscriber,
           Spree::ReportSubscriber,

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.1'.freeze
+  VERSION = '5.4.3'.freeze
 
   def self.version
     VERSION

data/lib/spree/events/adapters/active_support_notifications.rb

@@ -12,7 +12,7 @@ module Spree
       #
       # @example Publishing an event
       #   adapter = ActiveSupportNotifications.new(registry)
-      #   adapter.publish('order.complete', { id: 1 })
+      #   adapter.publish('order.completed', { id: 1 })
       #
       class ActiveSupportNotifications < Base
         NAMESPACE = 'spree'

data/lib/spree/events/adapters/base.rb

@@ -43,13 +43,13 @@ module Spree
 
         # Publish an event to all matching subscribers.
         #
-        # @param event_name [String] the event name (e.g., 'order.complete')
+        # @param event_name [String] the event name (e.g., 'order.completed')
         # @param payload [Hash] the event payload (should be serializable)
         # @param metadata [Hash] additional metadata for the event
         # @return [Spree::Event] the published event
         #
         # @example
-        #   adapter.publish('order.complete', order.serializable_hash, { user_id: 1 })
+        #   adapter.publish('order.completed', order.serializable_hash, { user_id: 1 })
         #
         def publish(event_name, payload, metadata = {})
           raise NotImplementedError, "#{self.class}#publish must be implemented"
@@ -67,7 +67,7 @@ module Spree
         # @option options [Boolean] :async (true) whether to run async via ActiveJob
         #
         # @example
-        #   adapter.subscribe('order.complete', MySubscriber)
+        #   adapter.subscribe('order.completed', MySubscriber)
         #   adapter.subscribe('order.*', AuditLogger, async: false)
         #
         def subscribe(pattern, subscriber, options = {})

data/lib/spree/events/registry.rb

@@ -15,7 +15,7 @@ module Spree
     # @example
     #   registry = Spree::Events::Registry.new
     #   registry.register('order.*', MySubscriber, async: true)
-    #   registry.subscriptions_for('order.complete') # => [Subscription]
+    #   registry.subscriptions_for('order.completed') # => [Subscription]
     #
     class Registry
       # Immutable subscription data using Ruby 3.2+ Data class

data/lib/spree/events.rb

@@ -28,9 +28,15 @@ module Spree
   #
   module Events
     class << self
+      # Reference to the AS::N subscription created by Spree::EventLogSubscriber.
+      # Stored here (on a module in lib/, not reloaded by Zeitwerk) so that code
+      # reloads in development don't orphan the subscription and cause events to
+      # be logged multiple times.
+      attr_accessor :log_subscription
+
       # Publish an event to all matching subscribers
       #
-      # @param name [String] The event name (e.g., 'order.complete')
+      # @param name [String] The event name (e.g., 'order.completed')
       # @param payload [Hash] The event payload (should be serializable)
       # @param metadata [Hash] Additional metadata for the event
       # @return [Spree::Event] The published event

data/lib/spree/testing_support/factories/payment_factory.rb

@@ -3,7 +3,7 @@ FactoryBot.define do
     order         { create(:order, total: amount) }
     amount        { 45.75 }
     state         { 'checkout' }
-    response_code { '12345' }
+    response_code { "BGS-#{SecureRandom.hex(6)}" }
 
     payment_method { create(:credit_card_payment_method, stores: [order.store]) }
     association(:source, factory: :credit_card)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.4.1
+  version: 5.4.3
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-14 00:00:00.000000000 Z
+date: 2026-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -590,16 +590,16 @@ dependencies:
   name: pagy
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '43.0'
+        version: '43.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '43.0'
+        version: '43.3'
 description: Spree Models, Helpers, Services and core libraries
 email: hello@spreecommerce.org
 executables: []
@@ -865,6 +865,7 @@ files:
 - app/jobs/spree/gift_cards/bulk_generate_job.rb
 - app/jobs/spree/images/save_from_url_job.rb
 - app/jobs/spree/imports/create_rows_job.rb
+- app/jobs/spree/imports/process_group_job.rb
 - app/jobs/spree/imports/process_rows_job.rb
 - app/jobs/spree/payments/handle_webhook_job.rb
 - app/jobs/spree/products/auto_match_taxons_job.rb
@@ -1051,6 +1052,7 @@ files:
 - app/models/spree/payment_session.rb
 - app/models/spree/payment_sessions/bogus.rb
 - app/models/spree/payment_setup_session.rb
+- app/models/spree/payment_setup_sessions/bogus.rb
 - app/models/spree/payment_source.rb
 - app/models/spree/permission_sets/base.rb
 - app/models/spree/permission_sets/configuration_management.rb
@@ -1150,6 +1152,7 @@ files:
 - app/models/spree/role_user.rb
 - app/models/spree/search_provider/base.rb
 - app/models/spree/search_provider/database.rb
+- app/models/spree/search_provider/filters_result.rb
 - app/models/spree/search_provider/meilisearch.rb
 - app/models/spree/search_provider/search_result.rb
 - app/models/spree/shipment.rb
@@ -1216,6 +1219,7 @@ files:
 - app/paginators/spree/shared/paginate.rb
 - app/presenters/spree/csv/coupon_code_presenter.rb
 - app/presenters/spree/csv/customer_presenter.rb
+- app/presenters/spree/csv/formula_sanitizer.rb
 - app/presenters/spree/csv/gift_card_presenter.rb
 - app/presenters/spree/csv/metafields_helper.rb
 - app/presenters/spree/csv/newsletter_subscriber_presenter.rb
@@ -1365,6 +1369,7 @@ files:
 - config/importmap.rb
 - config/initializers/active_storage.rb
 - config/initializers/acts_as_taggable_on.rb
+- config/initializers/carmen.rb
 - config/initializers/friendly_id.rb
 - config/initializers/inflections.rb
 - config/initializers/mobility.rb
@@ -1509,6 +1514,9 @@ files:
 - db/migrate/20260402000002_add_color_code_to_spree_option_values.rb
 - db/migrate/20260403000000_add_market_to_spree_orders.rb
 - db/migrate/20260408000001_add_unique_index_to_spree_zone_members.rb
+- db/migrate/20260424000001_add_unique_index_to_spree_payments_response_code.rb
+- db/migrate/20260424100000_add_processing_groups_to_spree_imports.rb
+- db/migrate/20260504103113_add_type_to_spree_payment_setup_sessions.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
 - db/sample_data/metafield_definitions.rb
@@ -1739,9 +1747,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.3
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.4.1
+  source_code_uri: https://github.com/spree/spree/tree/v5.4.3
 post_install_message:
 rdoc_options: []
 require_paths: