spree_core 5.5.2 → 5.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c50d137ef2f51b5fbdb5c343c360d805fe8839978386c08902ff3f29873c7e56
-  data.tar.gz: f495c858e04f2c469323c744c5bcdff4c3d23891b85771f44082dc104922de21
+  metadata.gz: d1bfb936ec246953ec3805bd017b32594f42bb168c5373dd3ed86d4a219efd6d
+  data.tar.gz: 273695ba130dafae60be7bb880cb6bae32722d82bf8dc3d49ee11943049c1c65
 SHA512:
-  metadata.gz: 96e1c8a7b981d143e5aab043ce6d236cd55627ddc28f1e29e573c873440e7515787e0f64f016409b54001c4313eca64b9f71f9f4641ddf3e021741c80300717d
-  data.tar.gz: 6810ea91184c9646922ba3dba4973fd337dfc4068513ead2cc3d198bb5f316798f4f1810eb51b08b50381eecb8603c378d56c3ef5b162c38f6d0f1cb62caf519
+  metadata.gz: 412b093fc9621b695691bcbd3b3b9cb4335d42f17fe62b81b820ed67acabdabbc9b16954ae4331cac03d58fabb43217b72d68dd1bc4992d6ee13f203fcad4b71
+  data.tar.gz: 9e325093542d1a77466ff4780e61aae47d309daeba2f583723f00bb83c906f26ee085512b1bb85caae53d4c731f1a2ff309541878c675a2736f397e98931001d

data/app/jobs/spree/imports/process_group_job.rb

@@ -1,6 +1,10 @@
 module Spree
   module Imports
     class ProcessGroupJob < Spree::Imports::BaseJob
+      # Rows are loaded in slices so a large group never holds every ImportRow
+      # (and its raw CSV data) in memory for the whole job.
+      ROWS_BATCH_SIZE = 100
+
       def perform(import_id, row_ids)
         import = Spree::Import.find(import_id)
         Spree::Current.store = import.store
@@ -8,16 +12,23 @@ module Spree
         mappings = import.mappings.mapped.to_a
         schema_fields = import.schema_fields
         large = import.large_import?
-        # Skip rows already completed on a prior attempt so retries don't double-process them.
-        rows = import.rows.where(id: row_ids).pending_and_failed.order(:row_number)
 
-        if large
-          Spree::Events.disable do
-            rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
-          end
-        else
-          rows.each do |row|
-            row.process!(mappings: mappings, schema_fields: schema_fields)
+        row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
+          # Skip rows already completed on a prior attempt so retries don't double-process them.
+          rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
+          # Share the already-loaded import across rows: each row's processor reads
+          # `row.import` (store, ability, lookup cache), and without this every row
+          # lazily loads its own Import instance and rebuilds all of that per row.
+          rows.each { |row| row.association(:import).target = import }
+
+          if large
+            Spree::Events.disable do
+              rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
+            end
+          else
+            rows.each do |row|
+              row.process!(mappings: mappings, schema_fields: schema_fields)
+            end
           end
         end
 

data/app/jobs/spree/imports/process_rows_job.rb

@@ -2,6 +2,7 @@ module Spree
   module Imports
     class ProcessRowsJob < Spree::Imports::BaseJob
       BATCH_SIZE = 100
+      UNGROUPED_KEY = '__ungrouped__'.freeze
 
       def perform(import_id)
         import = Spree::Import.find(import_id)
@@ -27,20 +28,27 @@ module Spree
 
         import.rows.pending_and_failed.order(:row_number).pluck(:id, :data).each do |id, data|
           parsed = JSON.parse(data)
-          key = parsed[file_column].to_s.strip.downcase.presence || '__ungrouped__'
+          key = parsed[file_column].to_s.strip.downcase.presence || UNGROUPED_KEY
           groups[key] << id
         rescue JSON::ParserError
-          groups['__ungrouped__'] << id
+          groups[UNGROUPED_KEY] << id
         end
 
+        # Rows without a group value don't depend on each other, so they don't have
+        # to share a single job — split them into bounded batches. Real groups stay
+        # intact: their rows must run sequentially (product row before variant rows).
+        ungrouped = groups.delete(UNGROUPED_KEY)
+        batches = groups.values
+        ungrouped&.each_slice(BATCH_SIZE) { |row_ids| batches << row_ids }
+
         # Set count before enqueuing so workers can't complete prematurely
         import.update_columns(
-          processing_groups_count: groups.size,
+          processing_groups_count: batches.size,
           completed_groups_count: 0,
           updated_at: Time.current
         )
 
-        groups.each_value { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
+        batches.each { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
       end
 
       def dispatch_batched(import)

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Spree
+  # Keeps single-use credentials out of the persisted webhook delivery log.
+  #
+  # Some events must carry a live credential to their subscriber — a storefront
+  # that owns its transactional emails needs the real password reset token to
+  # build the email. Delivering it over TLS to a merchant-configured endpoint is
+  # intended; keeping a readable copy in `spree_webhook_deliveries.payload` is
+  # not, because that column is queryable and is served back through the Admin
+  # API delivery log.
+  #
+  # Sensitive values are therefore replaced with {REDACTION_PLACEHOLDER} before
+  # the record is written, and re-attached in memory at send time so the
+  # outgoing request body is unchanged.
+  module WebhookPayloadRedaction
+    extend ActiveSupport::Concern
+
+    # Payload keys under `data` whose values are live credentials.
+    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token].freeze
+
+    REDACTION_PLACEHOLDER = '[REDACTED]'
+
+    # Splits a payload into the version safe to persist and the secrets held
+    # back from it.
+    #
+    # @param payload [Hash] the full event payload
+    # @return [Array(Hash, Hash)] redacted payload, and the extracted secrets
+    #   keyed as they appeared under `data`
+    def self.split(payload)
+      secrets = {}
+
+      redacted = transform_data_hashes(payload) do |data|
+        data.to_h do |key, value|
+          if SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && value.present?
+            secrets[secret_key_for(key)] = value
+            [key, REDACTION_PLACEHOLDER]
+          else
+            [key, value]
+          end
+        end
+      end
+
+      secrets.empty? ? [payload, {}] : [redacted, secrets]
+    end
+
+    # Re-attaches previously extracted secrets to a redacted payload.
+    #
+    # @param payload [Hash] the redacted payload
+    # @param secrets [Hash] secrets returned by {split}
+    # @return [Hash] the payload as it should go over the wire
+    def self.merge(payload, secrets)
+      return payload if secrets.blank?
+
+      transform_data_hashes(payload) do |data|
+        data.to_h do |key, value|
+          secret = secrets[secret_key_for(key)]
+          [key, secret.presence || value]
+        end
+      end
+    end
+
+    # Applies +block+ to every `data` hash on the payload.
+    #
+    # Both key forms are visited rather than only the first match: a payload
+    # carrying `:data` *and* `'data'` would otherwise leave one of them
+    # unredacted.
+    def self.transform_data_hashes(payload)
+      return payload unless payload.is_a?(Hash)
+
+      [:data, 'data'].reduce(payload) do |result, data_key|
+        data = result[data_key]
+        next result unless data.is_a?(Hash)
+
+        result.merge(data_key => yield(data))
+      end
+    end
+    private_class_method :transform_data_hashes
+
+    # Secrets are keyed by name alone. They cross an ActiveJob serialization
+    # boundary, which coerces symbol keys to strings, so the key form at split
+    # time cannot be relied on to still match at merge time.
+    def self.secret_key_for(key)
+      key.to_s
+    end
+    private_class_method :secret_key_for
+  end
+end

data/app/models/spree/import.rb

@@ -245,6 +245,15 @@ module Spree
       @current_ability ||= Spree.ability_class.new(user, { store: store })
     end
 
+    # Per-instance cache shared by row processors within a single processing job.
+    # Group jobs funnel every row through the same Import instance, so lookups of
+    # shared records (tax/shipping categories, option types, metafield definitions)
+    # resolve once per job instead of once per row.
+    # @return [Hash]
+    def row_lookup_cache
+      @row_lookup_cache ||= {}
+    end
+
     def event_serializer_class
       'Spree::Api::V3::ImportSerializer'.safe_constantize
     end

data/app/models/spree/webhook_delivery.rb

@@ -7,6 +7,11 @@ module Spree
     belongs_to :webhook_endpoint, class_name: 'Spree::WebhookEndpoint'
     delegate :url, to: :webhook_endpoint
 
+    # Credentials stripped from the persisted payload. Never written to the
+    # database — held in memory on a single delivery instance, assigned by
+    # WebhookDeliveryJob when it runs. See {Spree::WebhookPayloadRedaction}.
+    attr_accessor :payload_secrets
+
     validates :event_name, presence: true
     validates :payload, presence: true
 
@@ -64,6 +69,23 @@ module Spree
       webhook_endpoint.check_auto_disable! unless is_success
     end
 
+    # Payload as it should be sent over the wire.
+    #
+    # Re-attaches any credentials withheld from the persisted column. Once this
+    # record has been reloaded from the database those secrets are gone for
+    # good, so a redelivery sends the redacted placeholder — single-use tokens
+    # are not replayable anyway.
+    #
+    # This is deliberate: keeping a recoverable copy would put the credential
+    # back at rest, which is what redaction exists to prevent. If a delivery is
+    # lost (worker crash between creation and delivery), the customer requests
+    # a new reset, which mints a fresh token.
+    #
+    # @return [Hash]
+    def deliverable_payload
+      Spree::WebhookPayloadRedaction.merge(payload, payload_secrets)
+    end
+
     # Create a new delivery with the same payload and queue it.
     # Used to retry failed deliveries manually.
     #

data/app/presenters/spree/data_feeds/google_presenter.rb

@@ -3,6 +3,22 @@ require 'nokogiri'
 module Spree
   module DataFeeds
     class GooglePresenter < BasePresenter
+      # Optional Google Merchant Center product attributes sourced from
+      # metafields. See https://support.google.com/merchants/answer/7052112
+      OPTIONAL_ATTRIBUTES = %w[
+        brand gtin mpn identifier_exists condition adult multipack is_bundle
+        age_group color gender material pattern size size_type size_system
+        product_length product_width product_height product_weight
+        google_product_category product_type sale_price sale_price_effective_date
+        cost_of_goods_sold unit_pricing_measure unit_pricing_base_measure
+        shipping shipping_label shipping_weight shipping_length shipping_width
+        shipping_height ships_from_country transit_time_label max_handling_time
+        min_handling_time tax tax_category energy_efficiency_class
+        min_energy_efficiency_class max_energy_efficiency_class
+        gtin_source expiration_date custom_label_0 custom_label_1 custom_label_2
+        custom_label_3 custom_label_4 mobile_link additional_image_link
+      ].freeze
+
       # @return [String] RSS XML feed for Google Merchant Center
       def call
         builder = Nokogiri::XML::Builder.new do |xml|
@@ -59,10 +75,21 @@ module Spree
 
       def build_optional_attributes(xml, product)
         product.public_metafields.each do |metafield|
-          xml['g'].send(metafield.metafield_definition.key.parameterize.underscore, metafield.value)
+          key = metafield.metafield_definition.key.parameterize.underscore
+          next unless OPTIONAL_ATTRIBUTES.include?(key)
+
+          append_g_element(xml, key, metafield.value)
         end
       end
 
+      def append_g_element(xml, name, value)
+        parent = xml.parent
+        node = Nokogiri::XML::Node.new(name, parent.document)
+        node.namespace = parent.namespace_scopes.find { |ns| ns.prefix == 'g' }
+        node.content = value
+        parent << node
+      end
+
       def format_title(product, variant)
         parts = [product.name]
         variant.option_values.each do |option_value|

data/app/services/spree/imports/row_processors/base.rb

@@ -20,6 +20,15 @@ module Spree
 
         private
 
+        # Memoizes a shared-record lookup (including nil misses) in the import's
+        # per-job cache so repeated rows don't re-run the same query.
+        def cached_lookup(*key)
+          cache = import.row_lookup_cache
+          return cache[key] if cache.key?(key)
+
+          cache[key] = yield
+        end
+
         def build_schema_hash(row, mappings, schema_fields)
           attributes = {}
           schema_fields.each do |field|

data/app/services/spree/imports/row_processors/product_variant.rb

@@ -123,12 +123,16 @@ module Spree
 
         def prepare_shipping_category
           shipping_category_name = attributes['shipping_category'].strip
-          Spree::ShippingCategory.find_by(name: shipping_category_name)
+          cached_lookup(:shipping_category, shipping_category_name) do
+            Spree::ShippingCategory.find_by(name: shipping_category_name)
+          end
         end
 
         def prepare_tax_category
           tax_category_name = attributes['tax_category'].strip
-          Spree::TaxCategory.find_by(name: tax_category_name)
+          cached_lookup(:tax_category, tax_category_name) do
+            Spree::TaxCategory.find_by(name: tax_category_name)
+          end
         end
 
         def prepare_option_value_variants
@@ -171,27 +175,39 @@ module Spree
         # surfaces via the DB unique index (RecordNotUnique) or the AR uniqueness
         # validator (RecordInvalid with a :taken error on the relevant attribute).
         def find_or_create_option_type!(presentation)
-          Spree::OptionType.search_by_name(presentation).first || Spree::OptionType.create!(presentation: presentation)
-        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
-          raise unless uniqueness_conflict?(e, :name)
+          cached_lookup(:option_type, presentation) do
+            begin
+              Spree::OptionType.search_by_name(presentation).first || Spree::OptionType.create!(presentation: presentation)
+            rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+              raise unless uniqueness_conflict?(e, :name)
 
-          Spree::OptionType.search_by_name(presentation).first!
+              Spree::OptionType.search_by_name(presentation).first!
+            end
+          end
         end
 
         def find_or_create_option_value!(option_type, presentation)
-          option_type.option_values.search_by_name(presentation).first || option_type.option_values.create!(presentation: presentation)
-        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
-          raise unless uniqueness_conflict?(e, :name)
+          cached_lookup(:option_value, option_type.id, presentation) do
+            begin
+              option_type.option_values.search_by_name(presentation).first || option_type.option_values.create!(presentation: presentation)
+            rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+              raise unless uniqueness_conflict?(e, :name)
 
-          option_type.option_values.search_by_name(presentation).first!
+              option_type.option_values.search_by_name(presentation).first!
+            end
+          end
         end
 
         def find_or_create_product_option_type!(option_type)
-          Spree::ProductOptionType.find_or_create_by!(product: product, option_type: option_type)
-        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
-          raise unless uniqueness_conflict?(e, :product_id)
+          cached_lookup(:product_option_type, product.id, option_type.id) do
+            begin
+              Spree::ProductOptionType.find_or_create_by!(product: product, option_type: option_type)
+            rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+              raise unless uniqueness_conflict?(e, :product_id)
 
-          Spree::ProductOptionType.find_by!(product: product, option_type: option_type)
+              Spree::ProductOptionType.find_by!(product: product, option_type: option_type)
+            end
+          end
         end
 
         # RecordNotUnique is always a uniqueness conflict; RecordInvalid only when the
@@ -245,11 +261,13 @@ module Spree
             namespace, key = product.extract_namespace_and_key(full_key)
 
             # Find or initialize metafield definition
-            metafield_definition = Spree::MetafieldDefinition.find_by(
-              namespace: namespace,
-              key: key,
-              resource_type: product.class.name
-            )
+            metafield_definition = cached_lookup(:metafield_definition, namespace, key, product.class.name) do
+              Spree::MetafieldDefinition.find_by(
+                namespace: namespace,
+                key: key,
+                resource_type: product.class.name
+              )
+            end
 
             next unless metafield_definition
 

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.5.2'.freeze
+  VERSION = '5.5.4'.freeze
 
   def self.version
     VERSION

data/lib/spree/permitted_attributes.rb

@@ -256,7 +256,7 @@ module Spree
     @@stock_item_attributes = [:variant_id, :stock_location_id, :backorderable, :count_on_hand, { metadata: {} }]
 
     @@stock_location_attributes = [
-      :name, :active, :address1, :address2, :city, :zipcode, :company,
+      :name, :admin_name, :active, :address1, :address2, :city, :zipcode, :company,
       :backorderable_default, :state_name, :state_id, :country_id, :phone,
       :propagate_all_variants
     ]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.5.2
+  version: 5.5.4
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -930,6 +930,7 @@ files:
 - app/models/concerns/spree/user_reporting.rb
 - app/models/concerns/spree/user_roles.rb
 - app/models/concerns/spree/vat_price_calculation.rb
+- app/models/concerns/spree/webhook_payload_redaction.rb
 - app/models/spree/ability.rb
 - app/models/spree/address.rb
 - app/models/spree/adjustable/adjuster/base.rb
@@ -1818,9 +1819,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.5.2
+  source_code_uri: https://github.com/spree/spree/tree/v5.5.4
 post_install_message:
 rdoc_options: []
 require_paths: