spree_core 5.4.2 → 5.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23692bda70e0c85ecff286d989063498e74adc2e2422ae21719da5c6b6e97c98
-  data.tar.gz: 132486aca06d2912f82a54593d57eb9c400768b1a45b5412af77b61f2c822ac5
+  metadata.gz: d8ff8a33cfaa4b9554bb3658995a2ed99d1715cb2365d3da012fce5dd2bbd518
+  data.tar.gz: fd19b449aa211be4cbec760db28e573064f9112d8c0922bf78517e51c0fc5002
 SHA512:
-  metadata.gz: 0dc0c862bb8c7313e53ac13b80fe2ce6dd697bfad36ed0841562220b12c5253e473ac5f2623e95ac038da6d8903b3a329a47a4dee813f47a37e498bde6a66bc4
-  data.tar.gz: facf65e2c8067fbd2cbba0c04ff49daadf53901b137a2a80ada8ae95e646f0ba2ae3df1a7def6651fc81c9aaf52d8d2268e9c86e42c982f4074b3560c7595d91
+  metadata.gz: 5a392b8f08c1732f3b661a8758d37d63ac70e2aa7cf39d01dff5521c0e3267b1ee87ed190ea2cdddf914c7bf83462ebb6c7809736b5243610ab6d5e55c411300
+  data.tar.gz: 841e2707d2535a628a1cc2c743d594276a1cda0a969dd243ed8d82329f53f5d96bda3433517e40d0e261ef79159a7faae9cb57ebb1c5975b6bd2ea00f17d7641

data/app/jobs/spree/events/subscriber_job.rb

@@ -10,7 +10,7 @@ module Spree
     # @example Direct usage (typically called by the adapter)
     #   Spree::Events::SubscriberJob.perform_later(
     #     'MySubscriber',
-    #     { name: 'order.complete', payload: {...}, ... }
+    #     { name: 'order.completed', payload: {...}, ... }
     #   )
     #
     class SubscriberJob < Spree::BaseJob

data/app/models/concerns/spree/publishable.rb

@@ -122,7 +122,7 @@ module Spree
 
     # Publish an event with this model's data
     #
-    # @param event_name [String] The event name (e.g., 'order.complete')
+    # @param event_name [String] The event name (e.g., 'order.completed')
     # @param payload [Hash, nil] Custom payload (defaults to event_payload)
     # @param metadata [Hash] Additional metadata
     # @return [Spree::Event] The published event

data/app/models/spree/asset.rb

@@ -153,31 +153,31 @@ module Spree
     end
 
     def increment_viewable_media_count
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         Spree::Variant.increment_counter(:media_count, viewable_id)
         Spree::Product.increment_counter(:media_count, viewable.product_id)
-      when 'Spree::Product'
+      when Spree::Product
         Spree::Product.increment_counter(:media_count, viewable_id)
       end
     end
 
     def decrement_viewable_media_count
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         Spree::Variant.decrement_counter(:media_count, viewable_id)
         Spree::Product.decrement_counter(:media_count, viewable.product_id)
-      when 'Spree::Product'
+      when Spree::Product
         Spree::Product.decrement_counter(:media_count, viewable_id)
       end
     end
 
     def update_viewable_thumbnail
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         viewable.update_thumbnail!
         viewable.product.update_thumbnail!
-      when 'Spree::Product'
+      when Spree::Product
         viewable.update_thumbnail!
       end
     end

data/app/models/spree/event.rb

@@ -6,20 +6,20 @@ module Spree
   # Events are immutable objects that carry information about something
   # that happened in the system. They contain:
   # - An id (UUID)
-  # - A name (e.g., 'order.complete', 'product.create')
+  # - A name (e.g., 'order.completed', 'product.created')
   # - A store_id (the store where the event originated)
   # - A payload (serialized data about the event)
   # - Metadata (contextual information like spree_version)
   #
   # @example Creating an event
   #   event = Spree::Event.new(
-  #     name: 'order.complete',
+  #     name: 'order.completed',
   #     payload: order.serializable_hash
   #   )
   #
   # @example Accessing event data
   #   event.id         # => "550e8400-e29b-41d4-a716-446655440000"
-  #   event.name       # => 'order.complete'
+  #   event.name       # => 'order.completed'
   #   event.store_id   # => 1
   #   event.payload    # => { 'id' => 1, 'number' => 'R123456' }
   #   event.created_at # => 2024-01-15 10:30:00 UTC
@@ -61,19 +61,19 @@ module Spree
     end
 
     # Returns the resource type from the event name
-    # @return [String] The resource type (e.g., 'order' from 'order.complete')
+    # @return [String] The resource type (e.g., 'order' from 'order.completed')
     def resource_type
       @resource_type ||= name.to_s.split('.').first
     end
 
     # Returns the action from the event name
-    # @return [String] The action (e.g., 'complete' from 'order.complete')
+    # @return [String] The action (e.g., 'completed' from 'order.completed')
     def action
       @action ||= name.to_s.split('.').drop(1).join('.')
     end
 
     # Checks if the event matches a pattern
-    # Supports wildcards: 'order.*' matches 'order.complete', 'order.cancel'
+    # Supports wildcards: 'order.*' matches 'order.completed', 'order.canceled'
     # @param pattern [String] The pattern to match against
     # @return [Boolean]
     def matches?(pattern)

data/app/models/spree/export.rb

@@ -83,10 +83,10 @@ module Spree
           batch.each do |record|
             if multi_line_csv?
               record.to_csv(store).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             else
-              csv << record.to_csv(store)
+              csv << Spree::CSV::FormulaSanitizer.row(record.to_csv(store))
             end
           end
         end

data/app/models/spree/exports/product_translations.rb

@@ -30,7 +30,7 @@ module Spree
           records_to_export.includes(scope_includes).find_in_batches do |batch|
             batch.each do |product|
               product.to_translation_csv(store, locales).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             end
           end

data/app/models/spree/gateway/bogus.rb

@@ -120,9 +120,14 @@ module Spree
       true
     end
 
+    def payment_setup_session_class
+      PaymentSetupSessions::Bogus
+    end
+
     def create_payment_setup_session(customer:, external_data: {})
-      payment_setup_sessions.create(
+      payment_setup_session_class.create(
         customer: customer,
+        payment_method: self,
         status: 'pending',
         external_id: "bogus_seti_#{SecureRandom.hex(12)}",
         external_client_secret: "bogus_seti_secret_#{SecureRandom.hex(8)}",

data/app/models/spree/line_item.rb

@@ -293,7 +293,7 @@ module Spree
     end
 
     def verify_order_inventory_before_destroy
-      Spree::OrderInventory.new(order, self).verify(target_shipment)
+      Spree::OrderInventory.new(order, self).verify(target_shipment, removing: true)
     end
 
     def update_adjustments

data/app/models/spree/market.rb

@@ -28,6 +28,7 @@ module Spree
     # Callbacks
     #
     before_save :ensure_single_default
+    before_destroy :ensure_can_be_deleted
 
     #
     # Scopes
@@ -80,12 +81,36 @@ module Spree
       @supported_locales_list ||= (supported_locales.to_s.split(',').map(&:strip) << default_locale).compact.uniq.sort
     end
 
+    # Returns true when the market is safe to delete. A market cannot be deleted
+    # if it is the default market or the only market in the store, since
+    # Spree::Current.currency would have no fallback.
+    #
+    # @return [Boolean]
+    def can_be_deleted?
+      !default? && !last_in_store?
+    end
+
     private
 
+    def last_in_store?
+      !self.class.where(store_id: store_id).where.not(id: id).exists?
+    end
+
     def ensure_single_default
       return unless default? && default_changed?
 
       self.class.where(store_id: store_id, default: true).where.not(id: id).update_all(default: false)
     end
+
+    def ensure_can_be_deleted
+      return if can_be_deleted?
+
+      if default?
+        errors.add(:base, :cannot_destroy_default_market)
+      else
+        errors.add(:base, :cannot_destroy_last_market)
+      end
+      throw(:abort)
+    end
   end
 end

data/app/models/spree/order_inventory.rb

@@ -17,13 +17,23 @@ module Spree
     # In case shipment is passed the stock location should only unstock or
     # restock items if the order is completed. That is so because stock items
     # are always unstocked when the order is completed through +shipment.finalize+
-    def verify(shipment = nil, is_updated: false)
+    def verify(shipment = nil, is_updated: false, removing: false)
       return unless order.completed? || shipment.present?
 
       units_count = inventory_units.reload.sum(&:quantity)
       line_item_changed = is_updated ? !line_item.saved_changes? : !line_item.changed?
 
-      if units_count < line_item.quantity
+      if removing
+        # When the line item is being destroyed, only remove existing inventory.
+        # Adding here would create units that the LineItem `dependent: :destroy`
+        # cascade can't see (set_up_inventory writes through shipment.inventory_units,
+        # leaving line_item.inventory_units stale), producing an orphaned unit.
+        #
+        # Bypass `remove` because it routes through `set_quantity_to_remove` which
+        # assumes a quantity-change scenario; here we want to drain everything tied
+        # to this line item regardless of `line_item.quantity`.
+        remove_all_units(units_count, shipment) if units_count.positive?
+      elsif units_count < line_item.quantity
         quantity = line_item.quantity - units_count
 
         shipment ||= determine_target_shipment
@@ -49,6 +59,18 @@ module Spree
       end
     end
 
+    def remove_all_units(quantity, target_shipment = nil)
+      if target_shipment.present?
+        remove_from_shipment(target_shipment, quantity)
+      else
+        order.shipments.each do |shipment|
+          break if quantity.zero?
+
+          quantity -= remove_from_shipment(shipment, quantity)
+        end
+      end
+    end
+
     def set_quantity_to_remove(units_count)
       if (units_count - line_item.quantity).zero?
         line_item.quantity

data/app/models/spree/payment_setup_sessions/bogus.rb

@@ -0,0 +1,4 @@
+module Spree
+  class PaymentSetupSessions::Bogus < PaymentSetupSession
+  end
+end

data/app/models/spree/shipment.rb

@@ -272,16 +272,22 @@ module Spree
     def manifest
       # Grouping by the ID means that we don't have to call out to the association accessor
       # This makes the grouping by faster because it results in less SQL cache hits.
-      inventory_units.group_by(&:variant_id).map do |_variant_id, units|
-        units.group_by(&:line_item_id).map do |_line_item_id, units|
+      inventory_units.group_by(&:variant_id).flat_map do |_variant_id, units|
+        units.group_by(&:line_item_id).filter_map do |_line_item_id, units|
+          line_item = units.first.line_item
+          # Defensively skip orphaned inventory units (line item destroyed
+          # without cascading) so a single bad row doesn't crash callers that
+          # rely on line_item being present (item_cost, item_weight, the admin
+          # shipment manifest view, etc.).
+          next if line_item.nil?
+
           states = {}
           units.group_by(&:state).each { |state, iu| states[state] = iu.sum(&:quantity) }
 
-          line_item = units.first.line_item
           variant = units.first.variant
           ManifestItem.new(line_item, variant, units.sum(&:quantity), states)
         end
-      end.flatten
+      end
     end
 
     def process_order_payments

data/app/models/spree/subscriber.rb

@@ -9,7 +9,7 @@ module Spree
   #
   # @example Basic subscriber
   #   class OrderCompletedNotifier < Spree::Subscriber
-  #     subscribes_to 'order.complete'
+  #     subscribes_to 'order.completed'
   #
   #     def call(event)
   #       order_id = event.payload['id']
@@ -19,7 +19,7 @@ module Spree
   #
   # @example Multi-event subscriber
   #   class OrderAuditLogger < Spree::Subscriber
-  #     subscribes_to 'order.complete', 'order.cancel', 'order.resume'
+  #     subscribes_to 'order.completed', 'order.canceled', 'order.resumed'
   #
   #     def call(event)
   #       AuditLog.create!(
@@ -41,11 +41,11 @@ module Spree
   #
   # @example Subscriber with method routing
   #   class PaymentSubscriber < Spree::Subscriber
-  #     subscribes_to 'payment.complete', 'payment.void', 'payment.refund'
+  #     subscribes_to 'payment.completed', 'payment.voided', 'refund.created'
   #
-  #     on 'payment.complete', :handle_complete
-  #     on 'payment.void', :handle_void
-  #     on 'payment.refund', :handle_refund
+  #     on 'payment.completed', :handle_complete
+  #     on 'payment.voided', :handle_void
+  #     on 'refund.created', :handle_refund
   #
   #     private
   #
@@ -64,7 +64,7 @@ module Spree
   #
   # @example Synchronous subscriber (runs immediately, not via ActiveJob)
   #   class CriticalOrderHandler < Spree::Subscriber
-  #     subscribes_to 'order.complete', async: false
+  #     subscribes_to 'order.completed', async: false
   #
   #     def call(event)
   #       # This runs synchronously
@@ -81,10 +81,10 @@ module Spree
       # @return [void]
       #
       # @example
-      #   subscribes_to 'order.complete'
-      #   subscribes_to 'order.complete', 'order.cancel'
+      #   subscribes_to 'order.completed'
+      #   subscribes_to 'order.completed', 'order.canceled'
       #   subscribes_to 'order.*'
-      #   subscribes_to 'order.complete', async: false
+      #   subscribes_to 'order.completed', async: false
       #
       def subscribes_to(*patterns, **options)
         @subscription_patterns ||= []
@@ -102,8 +102,8 @@ module Spree
       # @return [void]
       #
       # @example
-      #   on 'payment.complete', :handle_complete
-      #   on 'payment.void', :handle_void
+      #   on 'payment.completed', :handle_complete
+      #   on 'payment.voided', :handle_void
       #
       def on(pattern, method_name)
         @event_handlers ||= {}

data/app/presenters/spree/csv/formula_sanitizer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module CSV
+    # Neutralizes CSV formula injection (CWE-1236 / OWASP "CSV Injection")
+    # by prefixing cells that would otherwise be evaluated as a formula
+    # when the exported file is opened in Excel, Google Sheets, LibreOffice,
+    # or Numbers.
+    #
+    # The leading apostrophe is the OWASP-recommended marker — spreadsheets
+    # render the cell as plain text without displaying the apostrophe.
+    module FormulaSanitizer
+      TRIGGERS = ["=", "+", "-", "@", "\t", "\r", "\n"].freeze
+
+      module_function
+
+      def cell(value)
+        return value unless value.is_a?(String)
+        return value if value.empty?
+        return value unless TRIGGERS.include?(value[0])
+
+        "'#{value}"
+      end
+
+      def row(values)
+        values.map { |v| cell(v) }
+      end
+    end
+  end
+end

data/app/services/spree/credit_cards/destroy.rb

@@ -11,7 +11,7 @@ module Spree
           "#{self.class.name} is deprecated and will be removed in Spree 6.0. " \
           'Use card.destroy directly instead. Payment cleanup is now handled ' \
           'automatically by the before_destroy callback in PaymentSourceConcern.',
-          caller
+          caller_locations(2)
         )
 
         if card.destroy

data/app/services/spree/payments/handle_webhook.rb

@@ -28,6 +28,8 @@ module Spree
 
       private
 
+      # `Spree::Payment#confirm!` honors the payment method's `auto_capture?` setting:
+      # auto_capture → complete! + capture_event; otherwise → pend! (auth-only, payment_state=balance_due).
       def handle_success(payment_session, order, metadata)
         order.with_lock do
           # Idempotency: if the session was already completed (by the API
@@ -36,19 +38,10 @@ module Spree
             return success(payment_session)
           end
 
-          # Ensure payment record exists
           payment = payment_session.find_or_create_payment!(metadata)
-
-          # Mark payment as completed — the webhook confirms the gateway processed it
-          if payment.present? && !payment.completed?
-            payment.started_processing! if payment.checkout?
-            payment.complete! if payment.can_complete?
-          end
-
-          # Mark session as completed
+          payment.confirm! if payment.present? && !payment.completed?
           payment_session.complete if payment_session.can_complete?
 
-          # Complete order if not already done
           unless order.reload.completed?
             Spree::Dependencies.carts_complete_service.constantize.call(cart: order)
           end

data/app/subscribers/spree/event_log_subscriber.rb

@@ -9,7 +9,7 @@ module Spree
   # Rails.application.config.filter_parameters.
   #
   # @example Output
-  #   [Spree Event] order.complete | payload: {"id"=>1} | 0.5ms
+  #   [Spree Event] order.completed | payload: {"id"=>1} | 0.5ms
   #
   class EventLogSubscriber
     NAMESPACE = 'spree'

data/config/locales/en.yml

@@ -299,6 +299,11 @@ en:
           attributes:
             currency:
               must_match_order_currency: Must match order currency
+        spree/market:
+          attributes:
+            base:
+              cannot_destroy_default_market: Cannot delete the default market.
+              cannot_destroy_last_market: Cannot delete the only market.
         spree/market_country:
           attributes:
             country:
@@ -1311,6 +1316,9 @@ en:
     inventory_error_flash_for_insufficient_quantity: An item in your cart has become unavailable.
     inventory_state: Inventory State
     invitation_accepted: Invitation accepted!
+    invitation_expired:
+      body: This invitation link is no longer valid. Please ask the person who invited you to send a new one.
+      heading: Invitation invalid or expired
     invitation_mailer:
       greeting: Hi %{user_name},
       invitation_accepted:

data/db/migrate/20260504103113_add_type_to_spree_payment_setup_sessions.rb

@@ -0,0 +1,6 @@
+class AddTypeToSpreePaymentSetupSessions < ActiveRecord::Migration[7.2]
+  def change
+    add_column :spree_payment_setup_sessions, :type, :string
+    add_index :spree_payment_setup_sessions, :type
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.2'.freeze
+  VERSION = '5.4.3'.freeze
 
   def self.version
     VERSION

data/lib/spree/events/adapters/active_support_notifications.rb

@@ -12,7 +12,7 @@ module Spree
       #
       # @example Publishing an event
       #   adapter = ActiveSupportNotifications.new(registry)
-      #   adapter.publish('order.complete', { id: 1 })
+      #   adapter.publish('order.completed', { id: 1 })
       #
       class ActiveSupportNotifications < Base
         NAMESPACE = 'spree'

data/lib/spree/events/adapters/base.rb

@@ -43,13 +43,13 @@ module Spree
 
         # Publish an event to all matching subscribers.
         #
-        # @param event_name [String] the event name (e.g., 'order.complete')
+        # @param event_name [String] the event name (e.g., 'order.completed')
         # @param payload [Hash] the event payload (should be serializable)
         # @param metadata [Hash] additional metadata for the event
         # @return [Spree::Event] the published event
         #
         # @example
-        #   adapter.publish('order.complete', order.serializable_hash, { user_id: 1 })
+        #   adapter.publish('order.completed', order.serializable_hash, { user_id: 1 })
         #
         def publish(event_name, payload, metadata = {})
           raise NotImplementedError, "#{self.class}#publish must be implemented"
@@ -67,7 +67,7 @@ module Spree
         # @option options [Boolean] :async (true) whether to run async via ActiveJob
         #
         # @example
-        #   adapter.subscribe('order.complete', MySubscriber)
+        #   adapter.subscribe('order.completed', MySubscriber)
         #   adapter.subscribe('order.*', AuditLogger, async: false)
         #
         def subscribe(pattern, subscriber, options = {})

data/lib/spree/events/registry.rb

@@ -15,7 +15,7 @@ module Spree
     # @example
     #   registry = Spree::Events::Registry.new
     #   registry.register('order.*', MySubscriber, async: true)
-    #   registry.subscriptions_for('order.complete') # => [Subscription]
+    #   registry.subscriptions_for('order.completed') # => [Subscription]
     #
     class Registry
       # Immutable subscription data using Ruby 3.2+ Data class

data/lib/spree/events.rb

@@ -36,7 +36,7 @@ module Spree
 
       # Publish an event to all matching subscribers
       #
-      # @param name [String] The event name (e.g., 'order.complete')
+      # @param name [String] The event name (e.g., 'order.completed')
       # @param payload [Hash] The event payload (should be serializable)
       # @param metadata [Hash] Additional metadata for the event
       # @return [Spree::Event] The published event

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.4.2
+  version: 5.4.3
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-27 00:00:00.000000000 Z
+date: 2026-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1052,6 +1052,7 @@ files:
 - app/models/spree/payment_session.rb
 - app/models/spree/payment_sessions/bogus.rb
 - app/models/spree/payment_setup_session.rb
+- app/models/spree/payment_setup_sessions/bogus.rb
 - app/models/spree/payment_source.rb
 - app/models/spree/permission_sets/base.rb
 - app/models/spree/permission_sets/configuration_management.rb
@@ -1218,6 +1219,7 @@ files:
 - app/paginators/spree/shared/paginate.rb
 - app/presenters/spree/csv/coupon_code_presenter.rb
 - app/presenters/spree/csv/customer_presenter.rb
+- app/presenters/spree/csv/formula_sanitizer.rb
 - app/presenters/spree/csv/gift_card_presenter.rb
 - app/presenters/spree/csv/metafields_helper.rb
 - app/presenters/spree/csv/newsletter_subscriber_presenter.rb
@@ -1514,6 +1516,7 @@ files:
 - db/migrate/20260408000001_add_unique_index_to_spree_zone_members.rb
 - db/migrate/20260424000001_add_unique_index_to_spree_payments_response_code.rb
 - db/migrate/20260424100000_add_processing_groups_to_spree_imports.rb
+- db/migrate/20260504103113_add_type_to_spree_payment_setup_sessions.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
 - db/sample_data/metafield_definitions.rb
@@ -1744,9 +1747,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.3
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.4.2
+  source_code_uri: https://github.com/spree/spree/tree/v5.4.3
 post_install_message:
 rdoc_options: []
 require_paths: