spree_core 5.6.0.rc5 → 5.6.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b3d64f54fca96fb946e3ee9b49d80648677ce7f5c36d0d6bb10769bf8c98df9
-  data.tar.gz: 82a353e9cad247a2be8f909d569ab286f323a63fe04b1ef5676d66c72001fdf7
+  metadata.gz: 2118af5f16565f54bbb6e6bc66ed0db0bd44e8ad250b226dca1f2ae6dfd50dc9
+  data.tar.gz: 85cf95c960549e5557cb62c51d3b22516ce91d19b2532001c613fe2da036229c
 SHA512:
-  metadata.gz: ee39b451ea0e40f7ea1b0811ae858b7a58580952c943b3356a642acf3b04dc5a461c2ae8864db916a14f1dcbe4b46428b924e852fdb21e271d071e3917388561
-  data.tar.gz: a90ca190815ef4e7ba9fec0cfe9bce1902b4c00eb35c1cd27c64e2edbe20980d69353826c612b4534cea402723a0cb5db8e9f2da4aea5023d5e51e05764c2175
+  metadata.gz: 629b648d7bcc536638305dc942cc5fe8a08ddf9bcba35a7a4e132e84c72f486c106af32711d887b3b67097b35cac9b8664b3f8667630a6d90f56b3e1f815c974
+  data.tar.gz: 1077ccfe23cf6e5c98bd565a559551a344dec7ce20d0e3fe83b06dc9a8be02e74c5107d8edc48d2c0397c24248197d9097fdbb77896ed07b8f7bcd5da9a0d568

data/app/jobs/spree/imports/base_job.rb

@@ -10,6 +10,19 @@ module Spree
     # taxon creation races).
     class BaseJob < Spree::BaseJob
       queue_as Spree.queues.imports
+
+      private
+
+      def with_store_content_locale(store, &block)
+        locale = store&.default_locale
+        return yield if locale.blank?
+
+        previous_content_locale = Spree::Current.content_locale
+        Spree::Current.content_locale = locale
+        I18n.with_locale(locale, &block)
+      ensure
+        Spree::Current.content_locale = previous_content_locale unless locale.blank?
+      end
     end
   end
 end

data/app/jobs/spree/imports/create_categories_job.rb

@@ -9,9 +9,11 @@ module Spree
       def perform(product_id, store_id, taxon_pretty_names)
         product = Spree::Product.find(product_id)
         store = Spree::Store.find(store_id)
-        taxons = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_taxon(store, taxon_pretty_name) }
 
-        product.taxons = taxons
+        with_store_content_locale(store) do
+          taxons = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_taxon(store, taxon_pretty_name) }
+          product.taxons = taxons
+        end
       end
 
       private

data/app/jobs/spree/imports/process_group_job.rb

@@ -25,43 +25,45 @@ module Spree
         import = Spree::Import.find(import_id)
         Spree::Current.store = import.store
 
-        mappings = import.mappings.mapped.to_a
-        schema_fields = import.schema_fields
-        large = import.large_import?
-        grouped = import.group_column.present? && mappings.any? { |m| m.schema_field == import.group_column }
-        started_at = Time.current
-        processed_rows = []
+        with_store_content_locale(import.store) do
+          mappings = import.mappings.mapped.to_a
+          schema_fields = import.schema_fields
+          large = import.large_import?
+          grouped = import.group_column.present? && mappings.any? { |m| m.schema_field == import.group_column }
+          started_at = Time.current
+          processed_rows = []
 
-        row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
-          # Skip rows already completed on a prior attempt so retries don't double-process them.
-          rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
-          # Share the already-loaded import across rows: each row's processor reads
-          # `row.import` (store, ability, lookup cache), and without this every row
-          # lazily loads its own Import instance and rebuilds all of that per row.
-          rows.each { |row| row.association(:import).target = import }
+          row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
+            # Skip rows already completed on a prior attempt so retries don't double-process them.
+            rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
+            # Share the already-loaded import across rows: each row's processor reads
+            # `row.import` (store, ability, lookup cache), and without this every row
+            # lazily loads its own Import instance and rebuilds all of that per row.
+            rows.each { |row| row.association(:import).target = import }
 
-          if large
-            Spree::Events.disable do
-              rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
-            end
-          elsif grouped
-            # A group is one product plus its variants: per-record lifecycle
-            # events (variant.created, price.created, product.updated per
-            # touch) are noise to subscribers — one product event is published
-            # for the whole group below. import_row.* events still flow.
-            Spree::Events.disable_lifecycle do
-              rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
-            end
-          else
-            rows.each do |row|
-              row.process!(mappings: mappings, schema_fields: schema_fields)
+            if large
+              Spree::Events.disable do
+                rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
+              end
+            elsif grouped
+              # A group is one product plus its variants: per-record lifecycle
+              # events (variant.created, price.created, product.updated per
+              # touch) are noise to subscribers — one product event is published
+              # for the whole group below. import_row.* events still flow.
+              Spree::Events.disable_lifecycle do
+                rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
+              end
+            else
+              rows.each do |row|
+                row.process!(mappings: mappings, schema_fields: schema_fields)
+              end
             end
+            processed_rows.concat(rows)
           end
-          processed_rows.concat(rows)
-        end
 
-        publish_group_events(processed_rows, started_at) if grouped
-        check_import_completion(import, large)
+          publish_group_events(processed_rows, started_at) if grouped
+          check_import_completion(import, large)
+        end
       end
 
       private

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -17,7 +17,7 @@ module Spree
     extend ActiveSupport::Concern
 
     # Payload keys under `data` whose values are live credentials.
-    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token].freeze
+    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token verification_token].freeze
 
     REDACTION_PLACEHOLDER = '[REDACTED]'
 

data/app/models/spree/digital_link.rb

@@ -46,9 +46,15 @@ module Spree
 
     # This method should be called when a download is initiated.
     # It returns +true+ or +false+ depending on whether the authorization is granted.
+    #
+    # The access-limit check and the counter increment run inside a row lock so
+    # concurrent requests sharing the same token cannot each pass the cap before
+    # any of them increments the counter (TOCTOU race).
     def authorize!
       ActiveRecord::Base.connected_to(role: :writing) do
-        authorizable? && increment!(:access_counter, touch: true)
+        with_lock do
+          authorizable? && increment!(:access_counter, touch: true)
+        end
       end
     end
 

data/app/models/spree/gift_card_batch.rb

@@ -62,7 +62,7 @@ module Spree
 
     def generate_code
       loop do
-        code = "#{prefix.downcase}#{SecureRandom.hex(3).downcase}"
+        code = "#{prefix.downcase}#{SecureRandom.hex(8).downcase}"
         break code unless Spree::GiftCard.exists?(code: code) || @gift_cards_to_insert.detect { |gc| gc[:code] == code }
       end
     end

data/app/models/spree/product.rb

@@ -24,6 +24,7 @@ module Spree
 
     acts_as_paranoid
     acts_as_taggable_on :tags, :labels
+    acts_as_taggable_tenant :store_id
     normalizes :name, with: ->(value) { value&.to_s&.squish&.presence }
 
     include Spree::ProductScopes

data/db/sample_data/wholesale.rb

@@ -43,29 +43,29 @@ unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::Custom
   rule.save!
 end
 
-if price_list.prices.none?
-  currency = store.default_currency
-  now = Time.current
-  rows = Spree::Variant.joins(:product)
-                       .where(spree_products: { store_id: store.id })
-                       .joins(:prices)
-                       .where(spree_prices: { currency: currency, price_list_id: nil })
-                       .pluck(:id, Spree::Price.arel_table[:amount])
-                       .to_h # one row per variant — last base price wins
-                       .filter_map do |variant_id, amount|
+# Same paths the admin UI uses: add_products materializes a blank row per
+# variant × supported currency (skipping rows that already exist), then trade
+# prices (40% off that currency's own retail price) fill in wherever a base
+# price exists and the row is still blank. Both steps are idempotent, so
+# re-running sample data converges partial state — new products, newly
+# supported currencies, or a previously interrupted run — without clobbering
+# hand-edited amounts.
+price_list.add_products(store.products.ids)
+
+blank_prices = price_list.prices.where(amount: nil).pluck(:id, :variant_id, :currency)
+if blank_prices.any?
+  base_amounts = Spree::Price.where(price_list_id: nil, variant_id: blank_prices.map { |_, variant_id, _| variant_id }.uniq)
+                             .pluck(:variant_id, :currency, :amount)
+                             .each_with_object({}) { |(variant_id, currency, amount), memo| memo[[variant_id, currency]] = amount }
+
+  rows = blank_prices.filter_map do |id, variant_id, currency|
+    amount = base_amounts[[variant_id, currency]]
     next if amount.blank?
 
-    {
-      variant_id: variant_id,
-      price_list_id: price_list.id,
-      amount: (amount * 0.6).round(2),
-      currency: currency,
-      created_at: now,
-      updated_at: now
-    }
+    { id: id, variant_id: variant_id, currency: currency, amount: (amount * 0.6).round(2) }
   end
 
-  Spree::Price.insert_all(rows) if rows.any?
+  price_list.bulk_update_prices(rows) if rows.any?
 end
 
 price_list.activate if price_list.can_activate?

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.6.0.rc5'.freeze
+  VERSION = '5.6.0.rc6'.freeze
 
   def self.version
     VERSION

data/lib/spree/upgrades/5_5_to_5_6/manifest.yml

@@ -57,3 +57,13 @@ steps:
     notes: |
       Recomputes the descendant-inclusive products_count counter cache on every
       taxon in batches.
+
+  - id: product_tag_tenants
+    name: "Backfill tenant on product taggings"
+    task: "spree:upgrade:backfill_product_tag_tenants"
+    notes: |
+      Sets the tenant column on existing Spree::Product taggings from each
+      product's store_id, so product tag autocomplete is bounded to the owning
+      store (matching Spree::Order). New product taggings tenant themselves;
+      only rows created before the upgrade need this. Until it runs, older
+      product tags are hidden from the store-scoped tag vocabulary.

data/lib/tasks/product_tag_tenants.rake

@@ -0,0 +1,26 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Backfills the +tenant+ column on existing +Spree::Product+ taggings from
+      each product's +store_id+, so product tag vocabulary is bounded to the
+      owning store (matching +Spree::Order+, which already tenants its taggings).
+
+      Run once after upgrading to the release that adds
+      +acts_as_taggable_tenant :store_id+ to +Spree::Product+. New product
+      taggings get their tenant automatically; only rows created before the
+      upgrade need this. Idempotent — re-running only touches rows still
+      missing a tenant.
+    DESC
+    task backfill_product_tag_tenants: :environment do
+      taggings = ActsAsTaggableOn::Tagging.arel_table.name
+      products = Spree::Product.table_name
+
+      updated = ActsAsTaggableOn::Tagging.
+                where(taggable_type: 'Spree::Product', tenant: nil).
+                joins("INNER JOIN #{products} ON #{products}.id = #{taggings}.taggable_id").
+                update_all("tenant = #{products}.store_id")
+
+      puts "  Backfilled tenant on #{updated} product tagging(s)."
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc5
+  version: 5.6.0.rc6
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-22 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1837,6 +1837,7 @@ files:
 - lib/tasks/markets.rake
 - lib/tasks/media.rake
 - lib/tasks/price_history.rake
+- lib/tasks/product_tag_tenants.rake
 - lib/tasks/products.rake
 - lib/tasks/publications.rake
 - lib/tasks/role_users.rake
@@ -1867,9 +1868,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc5
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc5
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc6
 post_install_message:
 rdoc_options: []
 require_paths: