v2.4.9 (5th of August 2026) - Release

    Security fixes.

    Enhanced Data Transfer imports. Saving an import now runs it through to the end on its own — validate, fetch images, create, link, index — with a stepper and live progress for each phase, instead of a separate click per phase. Validation runs in windows, either browser-driven or dispatched across the queue workers, so a large file no longer has to be validated in one request. Product images can now come from links in the sheet, a ZIP uploaded with the import, or a directory on the server, saved on the import so reopening it restores the choice; links are fetched once each in a phase of their own before any row is written. The chosen image source is validated against the file, so a mismatch is reported during validation rather than silently importing every product without images. Also fixed a queued import re-dispatching its whole job chain on every poll, which ran the same rows two or three times over — booking the repeats as updates and deadlocking against itself — and fixed the runs that could stall for good in the image or create phase, which now complete what they can and report the batches that did not.

    Made the admin datagrid header consistent between the default grid and customized ones, and gave customized grids a proper card layout on small screens — the column header is dropped there, since filter and sort are reachable from the bar fixed to the foot of the screen. Loading placeholders were rebuilt to match the grid they stand in for, on both desktop and mobile, so the layout no longer shifts when the rows arrive.

    Fixed the admin product datagrid and storefront search failing when an Elasticsearch index is missing, by passing ignore_unavailable on the searches that address an index by name.

    Fixed top-left, top-right and the fallback position of the admin dropdown throwing at runtime — two adjacent template literals with no comma between them parse as a tagged template — and made the fit-toggle option apply to every position rather than only bottom-left.

    Fixed the WebMCP tool declarations rendering at the foot of every storefront page. The forms are read by agents rather than drawn, and only their submit buttons were hidden, so the two carrying a text input showed it; the whole block is hidden now, and the tools are still discovered exactly as before.

    Fixed the social-login icons sitting flush against the Sign In button on the customer login page. The partial is injected through an event, so it carries its own spacing rather than relying on whatever it lands under.

    Fixed the demo product descriptions showing \r and \n as text. The escapes had been written into the seed data as literal characters rather than line breaks; the paragraphs they were meant to mark are now real ones.

    Replaced the GDPR icon in the admin configuration listing, which was drawn as a leaf rather than a shield.

    Turned the speculation rules off by default. They have the browser fetch pages nobody has opened yet, which costs bandwidth and shows up as traffic on pages that were never visited, so a store now opts in.

    Fixed an inactive cart still being assigned from the session.

    Reworked the admin menu to support three levels, and tidied the category and role trees.

    Fixed assorted storefront UI issues on the product view and sub-category pages, back navigation on the RMA pages on mobile, and the position of the rule buttons on the cart-rule create page.

    Removed the operator selector from multiselect and checkbox conditions on cart rules, where it had no meaning.

    Refined Playwright testcases.

    #11400 [fixed] - Sanitized the product description in the JSON-LD rich-snippet output, which previously emitted it unescaped.

    #11387 [fixed] - Fixed the demo products being absent from the storefront when the install locale did not include English, while still listed in the admin. The seeder wrote each product's non-translatable attributes — status, visibility, price, sku and the variant options — only on the English pass, so choosing any other locale on its own left those values unwritten and every product failed the storefront's status and visibility checks.

    #11380 [fixed] - Fixed product duplication not carrying the customizable options, their labels, or their prices over to the copy. The label is a translated value held in its own table, so it needs replicating alongside the option rather than travelling with it — every locale's label is now copied.

2.4.8 (8th of July 2026) - Release

    Security fixes.

    Added a "remove item" affordance to the storefront quantity selector: on the cart and mini-cart, when a line item's quantity reaches the minimum (1) the minus icon is replaced with a trash icon that removes the item. Enabled via an opt-in removable prop on the quantity-changer component (default off), so add-to-cart quantity selectors on product, bundle, grouped, booking, and wishlist pages keep their existing behavior.

    Fixed the installer's .env parser (EnvironmentManager::getEnvVariable()) truncating environment values that contain an = (e.g. DB_PASSWORD="examplePassword="), which caused database authentication failures during php artisan bagisto:install even though the same .env worked with standard Laravel commands. Values are now split on the first = only; the parser also preserves spaces inside quoted values and matches keys exactly instead of by substring.

    Made sitemaps channel-wise: a sitemap can now be assigned to one or more channels (via a new sitemap_channels pivot table), and the sitemap files are generated per channel — each using that channel's hostname, root-category subtree, and channel-scoped products and CMS pages, written under sitemaps/<channel-code>/. The admin sitemap listing shows the associated channels and a per-channel "Link for Google" for each entry.

v2.4.7 (24th of June 2026) - Release

    Security fixes.

    "Apply Tax On" setting (Before/After Discount) under Sales → Taxes → Calculation Settings to control whether tax is calculated on the original product price or on the discounted price when a cart-rule/coupon discount is applied, plus an optional per-product tax breakdown in the cart and checkout summary.

    #11344 [fixed] - Fixed incorrect payment amounts for currencies whose ISO 4217 minor units are not two decimals in the Stripe and PayPal gateways. Currencies are now seeded with a decimal value (e.g. 0 for JPY/KRW, 3 for KWD/BHD, 2 by default); Stripe converts amounts to the smallest currency unit using 10 ^ decimal instead of a hardcoded × 100, and PayPal rounds to the currency's decimal places, preventing 100× overcharges on zero-decimal currencies and undercharges on three-decimal currencies.

    #11331 [fixed] - Replaced deprecated Venezuelan Bolivar currency code VEF with VES in seeders and installer configurations, ensuring correct exchange rate synchronization with modern exchange rate APIs.

    #11316 [fixed] - Fixed the rich-text (TinyMCE) sanitizer stripping tables and class/style attributes from product/category descriptions, CMS pages, and email templates on save, so tables and formatting inserted in the editor no longer disappear. The HTMLPurifier allowlist now permits table elements and class/style (with an expanded set of safe CSS properties) while still removing scripts, event handlers, javascript:/data: URLs, and unsafe CSS. Also fixed theme static-content custom CSS being corrupted by the HTML purifier — valid selectors such as the > child combinator were entity-encoded — by sanitizing it against </style> context breakout instead of running it through the HTML purifier.

    #10963 [fixed] - Fixed a required multiselect attribute on the product edit page failing validation on save until the field was manually re-interacted with, because the previously saved values were not registered with the form validator on page load.