@salesforce/retail-react-app 9.2.0-nightly-20260501083602 → 9.2.0-preview.0

package/CHANGELOG.md

@@ -1,11 +1,12 @@
-## v9.2.0-dev (Mar 20, 2026)
+## v9.2.0-preview.0 (May 01, 2026)
 - Update MRT Data Store configuration comments to use new environment variable names (`MRT_DATA_STORE_DEFAULTS` instead of `PWAKIT_MRT_DATA_STORE_DEFAULTS`). Local data store now provided by `@salesforce/mrt-utilities` via conditional exports. [#3811](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3811)
-- Add opt-in `app.mrtDataStore.enabled` to `config/default.js` (default `false`). Set to `true` or use `PWAKIT_MRT_DATA_STORE_ENABLED=true` to resolve MRT Data Store custom preferences during SSR. Local defaults without DynamoDB: `PWAKIT_MRT_DATA_STORE_DEFAULTS` and related env vars (see `config/default.js` comments).
+- Add opt-in `app.mrtDataStore.enabled` to `config/default.js` (default `false`). Set to `true` or use `PWAKIT_MRT_DATA_STORE_ENABLED=true` to resolve MRT Data Store custom preferences during SSR. Local defaults without DynamoDB: `PWAKIT_MRT_DATA_STORE_DEFAULTS` and related env vars (see `config/default.js` comments). [#3787](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3787)
 - Allow auth related cookies domain to be set via config [#3782](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3782)
 - [Bugfix] Fix per-page express checkout toggles using `expressOnCheckoutPagesEnabled` from Shopper Configurations API. Express payment buttons on PDP, minicart, cart, and checkout can now be individually controlled via Business Manager. [#3775](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3775)
 - [Bugfix] Fix alert description text styling on subscribe form to not override default alert styles [#3780](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3780)
 - [Bugfix] Add `return_url` for express checkout payment confirmation, required by redirect-based payment methods like Amazon Pay [#3803](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3803)
 - Update `app/ssr.js` guidance for the SLAS private-client proxy: replace the deprecated `applySLASPrivateClientToEndpoints` example with a pointer to `slasPrivateClientAllowList` [#3802](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3802)
+- Add support for HttpOnly session cookies [#3804](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3804)
 
 ## v9.1.1 (Mar 20, 2026)
 - Add base path prefix to support multiple MRT environments under 1 domain [#3614](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3614)

package/app/components/_app-config/index.jsx

@@ -31,7 +31,8 @@ import {
 import {getConfig} from '@salesforce/pwa-kit-runtime/utils/ssr-config'
 import {
     getEnvBasePath,
-    slasPrivateProxyPath
+    slasPrivateProxyPath,
+    slasPublicProxyPath
 } from '@salesforce/pwa-kit-runtime/utils/ssr-namespace-paths'
 import {createUrlTemplate} from '@salesforce/retail-react-app/app/utils/url'
 import createLogger from '@salesforce/pwa-kit-runtime/utils/logger-factory'
@@ -67,7 +68,8 @@ const AppConfig = ({children, locals = {}}) => {
     const {correlationId} = useCorrelationId()
     const headers = {
         'correlation-id': correlationId,
-        sfdc_user_agent: sfdcUserAgent
+        sfdc_user_agent: sfdcUserAgent,
+        'x-site-id': locals.site?.id
     }
 
     const commerceApiConfig = locals.appConfig.commerceAPI
@@ -92,6 +94,7 @@ const AppConfig = ({children, locals = {}}) => {
     const redirectURI = `${appOrigin}${getEnvBasePath()}/callback`
     const proxy = `${appOrigin}${getEnvBasePath()}${commerceApiConfig.proxyPath}`
     const slasPrivateClientProxyEndpoint = `${appOrigin}${getEnvBasePath()}${slasPrivateProxyPath}`
+    const slasPublicClientProxyEndpoint = `${appOrigin}${getEnvBasePath()}${slasPublicProxyPath}`
 
     const pageDesignerParams = locals.pageDesignerParams || {}
 
@@ -112,11 +115,17 @@ const AppConfig = ({children, locals = {}}) => {
             // Make sure to also enable useSLASPrivateClient in ssr.js when enabling this setting.
             enablePWAKitPrivateClient={false}
             privateClientProxyEndpoint={slasPrivateClientProxyEndpoint}
+            publicClientProxyEndpoint={slasPublicClientProxyEndpoint}
             // Uncomment 'hybridAuthEnabled' if the current site has Hybrid Auth enabled. Do NOT set this flag for hybrid storefronts using Plugin SLAS.
             // hybridAuthEnabled={true}
             cookieDomain={commerceApiConfig.cookieDomain}
             logger={createLogger({packageName: 'commerce-sdk-react'})}
             pageDesignerParams={pageDesignerParams}
+            enableHttpOnlySessionCookies={
+                typeof window !== 'undefined'
+                    ? window.__MRT_ENABLE_HTTPONLY_SESSION_COOKIES__ === 'true'
+                    : process.env.MRT_ENABLE_HTTPONLY_SESSION_COOKIES === 'true'
+            }
         >
             <MultiSiteProvider site={locals.site} locale={locals.locale} buildUrl={locals.buildUrl}>
                 <StoreLocatorProvider config={storeLocatorConfig}>

package/config/default.js

@@ -133,6 +133,8 @@ module.exports = {
     ],
     ssrParameters: {
         ssrFunctionNodeVersion: '24.x',
+        // Store the session cookies as HttpOnly for enhanced security.
+        enableHttpOnlySessionCookies: false,
         proxyConfigs: [
             {
                 host: 'kv7kzm78.api.commercecloud.salesforce.com',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/retail-react-app",
-  "version": "9.2.0-nightly-20260501083602",
+  "version": "9.2.0-preview.0",
   "license": "See license in LICENSE",
   "author": "cc-pwa-kit@salesforce.com",
   "ccExtensibility": {
@@ -46,10 +46,10 @@
     "@loadable/component": "^5.15.3",
     "@peculiar/webcrypto": "^1.4.2",
     "@salesforce/cc-datacloud-typescript": "1.1.2",
-    "@salesforce/commerce-sdk-react": "5.2.0-nightly-20260501083602",
-    "@salesforce/pwa-kit-dev": "3.18.0-nightly-20260501083602",
-    "@salesforce/pwa-kit-react-sdk": "3.18.0-nightly-20260501083602",
-    "@salesforce/pwa-kit-runtime": "3.18.0-nightly-20260501083602",
+    "@salesforce/commerce-sdk-react": "5.2.0-preview.0",
+    "@salesforce/pwa-kit-dev": "3.18.0-preview.0",
+    "@salesforce/pwa-kit-react-sdk": "3.18.0-preview.0",
+    "@salesforce/pwa-kit-runtime": "3.18.0-preview.0",
     "@salesforce/storefront-next-runtime": "0.1.1",
     "@tanstack/react-query": "^4.28.0",
     "@tanstack/react-query-devtools": "^4.29.1",
@@ -110,8 +110,8 @@
     },
     {
       "path": "build/vendor.js",
-      "maxSize": "392 kB"
+      "maxSize": "395 kB"
     }
   ],
-  "gitHead": "62e557dc3f3656871255ea02661d681aeff4ec30"
+  "gitHead": "75dd6afbf5269009754337c2cddc5bc0c508e3b3"
 }