This patch release includes Security fixes plus general improvements. All users are strongly encouraged to upgrade immediately.

Security Fixes

• https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j (spree_api gem)
• https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9 (spree_storefront gem)

Supported Versions

Security patches are available for all currently supported Spree versions:

| Version | Patched Release | EOL Date | |---------|-----------------|----------| | 5.0 | 5.0.7 | March 2028 | | 4.10 | 4.10.2 | September 2027 |

If you're running an unsupported version, please upgrade as soon as possible. Unsupported versions will not receive security patches. Need help upgrading? Contact the Spree team.

Upgrade

bundle update

Other changes

Core

• Fixed incorrect total applied store credit by @resool in https://github.com/spree/spree/pull/13512
• Manually specify event_serializer_class for Reports/Exports/Imports by @damianlegawiec in https://github.com/spree/spree/pull/13523

Admin

• Replace partials with helper methods for rendering admin navigation by @damianlegawiec in https://github.com/spree/spree/pull/13519
• Fixed admin table search field losing focus after loading search res… by @damianlegawiec in https://github.com/spree/spree/pull/13522

Storefront

• fix mobile nav initial transform by @dimidev in https://github.com/spree/spree/pull/13515

Full Changelog: https://github.com/spree/spree/compare/v5.3.1...v5.3.2