Skip to Content

New J2Commerce 6.6.5 is out. Here is everything in the release.

See What’s New

Search

Start For Free
Account
Enter the email address on your account.
Forgot your username?
Enter your password.
Forgot your password?

Or continue with

Core Releases

Know what changed before you update.

Every release is grouped by what was added, changed and fixed, so you always know exactly what’s landing on your store before you update.

Read the Docs Start For Free
A hand holding a release checklist with every box ticked beside a laptop whose update progress bar is almost full.

Scope

What this changelog covers, and what it leaves out.

Core changes only. Extensions keep their own logs, and every security fix links to its advisory.

  • Core Only

    Everything in the core package. Every extension publishes its own changelog on its own listing, because they version independently of core.

  • Security Sits on Its Own Page

    Security fixes appear here as a one-line note that a fix was released. Severity, affected versions and credit are listed on the advisory page.

    Read the Security Advisories

  • Released, Not Planned

    Only released changes appear here. Planned work is on the public roadmap.

    See the Public Roadmap

Changelog

Latest J2Commerce core releases.

The latest published releases of J2Commerce 6: what was added, changed and fixed. The current release is 6.6.5.

Added

  • PR2614 – feat(products): add a Tag filter to the Products list
  • PR2617 – feat(filters): let plugins supply a filter group's values

Changed

  • PR2649 – refactor(core): leave plugin-owned product types to their plugins
  • PR2650 – chore(core): remove plugin-type layouts and strings core no longer uses

Fixed

  • PR2603 – fix(onboarding): show the en-US install result and keep step-1 defaults
  • PR2604 – fix(emails): use the [ORDERID] tag in the built-in order email strings
  • PR2607 – fix(setup-guide): keep dismissals across Options saves, add Disable Setup Wizard
  • PR2608 – fix(setup-guide): Disable Setup Wizard also hides the Setup Guide toolbar button and panel
  • PR2610 – fix(subtemplate): inherit the store Subtemplate when the menu item names none
  • PR2611 – fix(router): resolve a Category Alias to its own products menu first
  • PR2613 – fix(filters): honour Vendor Filter List Type on product listings
  • PR2615 – fix(filters): accessible active-filter chips and result-count updates
  • PR2618 – fix(templates): json_encode gallery and option script values
  • PR2619 – fix(orders): correctly fold payment-surcharge tax into order totals and tax display
  • PR2620 – fix(product price): timezone shift
  • PR2623 – fix(filters): per-group Clear controls as buttons
  • PR2624 – fix(templates): emit the option id as a number in the uikit option script
  • PR2625 – fix(filters): show per-group Clear when its group has a selection
  • PR2626 – fix(filters): render the uikit filter form once
  • PR2627 – fix(content): route flexivariable shortcode options correctly, add upc, group price/sku/upc
  • PR2628 – fix(filters): mobile Clear all stays in place; name the off-canvas panel
  • PR2630 – fix(dashboard): stop the notices carousel jumping when rotation toggles
  • PR2631 – fix(confirmation): hide Continue Shopping when no destination is configured
  • PR2632 – fix(content): add a Hide option for the product block on category views
  • PR2635 – fix(router): answer 404 for an unavailable products category
  • PR2636 – fix(orders): drop the "Order Note" label from order history rows
  • PR2637 – Fix(shipping rates): added cache headers to prevent changes from being hidden
  • PR2638 – Fix(email templates): images containing spaces are broken
  • PR2639 – fix(a11y): keep checkout focus and label the phone input
  • PR2640 – Fix double double-escaped &Itemid= in the cart form action and throughout the extension
  • PR2641 – fix(content plugin): added getArticleLink to link to the article properly when in com_content context
  • PR2642/2645 – Fix(email templates): added function setJ2cBodyField to keep TinyMCE's internal buffer in sync with the visual editor
  • PR2643 – fix(a11y): announce coupon errors, focus checkout step headings, label phone and address fields
  • PR2644 – fix(coupons): send translated text with coupon and voucher error events
  • PR2646 – fix(plugins): treat a Default plugin subtemplate like Auto in PluginLayoutTrait
  • PR2647 – feat(core): resolve product-type families through one extensible registry
  • PR2648 – perf(products): resolve product type labels once per request
  • PR2651 – fix(products): resolve variant list layouts through plugin-registered product form paths
  • PR2652 – fix(products): return 403 for a category outside the visitor's view levels
  • PR2653 – fewer Queries on Product Listings

Added

  • PR2427 (options) give a product option a description that renders under its label
  • PR2528 (email) add a Shipping Method condition to email templates
  • PR2585 (product-types) let plugin product types supply cart behavior and admin form
  • PR2586 (orders) list merchant-defined checkout fields on the admin order view
  • PR2592 (products) badge products only editors can see in storefront lists
  • PR2596 (coupons) warn on the coupons and vouchers lists when the feature is off

Changed

  • PR2435 (options) remove the time option type and convert existing ones to text
  • PR2553 (paypal) retire the unreferenced legacy notify entry file
  • PR2578 (config) label the image options tab "Images" and drop the Image Upload strings
  • PR2462 (build) give the CLI guard one home instead of eleven copies
  • PR2475 (fields) give the duallistbox twins one shared implementation

Fixed

  • PR2411 (layouts) search the framework folder as a fallback, not as an override
  • PR2414 (product) scope the variant lookup key to the option controls
  • PR2418 (options) edit option parameters as real fields, not a raw JSON string
  • PR2419 (options) read and repair option_params that was encoded more than once
  • PR2425 (cart) hold both variant-resolution branches to the same rule
  • PR2426 (modules) restore the J2Commerce name prefix on core module display names
  • PR2428 (layouts) dispatch tag listings through the tag layout chain
  • PR2429 (layouts) realign the shadowed plugin list layouts with the copies that execute
  • PR2437 (product) resolve a variant from a checkbox option selection
  • PR2438 (build) set core.quotepath=off on ls-files; align four uikit layouts with their bs5 twin
  • PR2440 (options) render the number, email and url option types
  • PR2441 (language) translate the four field-validation messages into the shipped locales
  • PR2442 (schema) give every hasVariant Product an image and a real name
  • PR2444 (schema) quote the price and stock state the product page shows
  • PR2445 (products) source the brand description article from the manufacturer
  • PR2446 (options) load and render every option type as a child option
  • PR2447 (schema) resolve the system plugin's Offer through the shared helper
  • PR2449 (build) finish two parity sets left partly done
  • PR2452 (build) print the remediation the delta-naming rule actually asks for
  • PR2453 (fields) let the form say which shipping methods it excludes
  • PR2458 (installer) make the package's renamed-file cleanup work, and keep it safe
  • PR2460 (fields) log the exception instead of showing it in the dropdown
  • PR2463 (installer) make the declared version floors actually apply
  • PR2464 (helpers) hold an article to one standard, and log what the shopper must not read
  • PR2465 (products) send the caught driver message to the log, as the siblings do
  • PR2466 (flexivariable) bind the asset handler to a dispatched event
  • PR2468 (schema) build the product URL with the router alone
  • PR2470 (views) let a listing's own metadata win over the menu item
  • PR2471 (fields) square DuallistboxField's script block up with its twin
  • PR2473 (fields) guard the duallistbox script encoding and finish the twins' parity
  • PR2476 (language) keep the Terms Text example literal and restore ar-AA specifiers
  • PR2477 (orders) restore adding a product from the order editor
  • PR2479 (orders) read the charged amount in the ledger fallback, not order_total
  • PR2482 (checkout) match saved-address pickers to the step's address type
  • PR2483 (checkout) always ask a guest for an email on the guest form
  • PR2484 (checkout) render payment card icons on custom subtemplates
  • PR2485 (payment) give the offline payment plugins one rule for merchant text
  • PR2486 (options) translate option and filter names in the admin views
  • PR2490 (layouts) resolve the framework in two shims that are given none
  • PR2491 (paypal) record captures and refunds in the order transaction ledger
  • PR2492 (options) keep option value ids when switching an option between list and color types
  • PR2494 (checkout) check the format of email custom fields on the server
  • PR2495 (install) apply the safehtml filter to offline payment texts saved before #2485
  • PR2496 (options) translate stored option and filter names only when they are language keys
  • PR2499 (products) check the form token in the two read-only product-form AJAX tasks
  • PR2500 (checkout) trim surrounding whitespace from email addresses
  • PR2502 (shipping) translate stored shipping method and fee names only when they are language keys
  • PR2506 (payment) translate payment method display names only when they are language keys
  • PR2507 (tax) translate stored tax titles only when they are language keys
  • PR2508 (cart) escape totals row labels on the cart, checkout and cart module
  • PR2510 (cart) name and escape the discount remove links, drop text-muted from the cart module
  • PR2513 (myprofile) replace the add-card button with gateway card actions
  • PR2514 (options) offer only published options on the storefront
  • PR2516 (language) add the 48 missing site strings to the non-English locales
  • PR2517 (language) complete the site sys.ini locales and localize the coupon percentage
  • PR2518 (options) index optionvalues, load traits once, bound option ordering
  • PR2525 (options) bind reused traits to their product, keep model errors generic
  • PR2529 (emails) let Email Template Mode decide the default substitution
  • PR2531 (dashboard) warn when Strict Routing is off
  • PR2533 (order) fall back to the product's images when a line has no thumbnail
  • PR2534 (confirmation) honour the configured Continue Shopping destination
  • PR2536 (emailtemplates) show a language value's real characters in the editor canvas
  • PR2537 (checkout) gate the order emails on the order's own state
  • PR2540 (config) give the url settings the validate/filter their type implies
  • PR2541 (email) align the third Email Template Mode reader and collapse a repeated predicate
  • PR2543 (email) return false when no email template resolves
  • PR2544 (checkout) resolve the finalization test by lifecycle type
  • PR2546 (models) quote ordering identifiers and cast product ids
  • PR2547 (emailtemplates) name the fancy selects, reuse the payment label
  • PR2551 (emailtemplates) null-coalesce the unguarded trims in check()
  • PR2552 (orders) resolve the remaining status-id literals by lifecycle type
  • PR2555 (language) translate the 163 missing core keys into all 20 locales
  • PR2556 (emailtemplates) run the template validations on every write path
  • PR2557 (dashboard) split the core template notices and make the notice scroller operable
  • PR2559 (vouchers) hold the redemption totals to the ledger's reading
  • PR2561 (task) resolve the order-cleanup status by lifecycle type
  • PR2563 (language) translate the dashboard notice labels into the remaining locales
  • PR2564 (paypal) delegate outcome status to the core resolver
  • PR2565 (paypal) resolve order states through the shared helper
  • PR2566 (queues) let the configured retention window own completed rows
  • PR2568 (paypal) align the error surface, state guard and entry guards
  • PR2569 (queues) hold the completion and purge paths to one definition
  • PR2572 (plugins) resolve plugin layouts through the core override contract
  • PR2575 (plugins) resolve plugin layout roots from JPATH_THEMES and recognize Subtemplate field
  • PR2577 (admin) use the translated plugin name in list checkbox labels
  • PR2579 (queues) batch the dead purge and floor the log retention window
  • PR2582 (stubs) resolve payment scaffold layouts through the plugin layout resolver
  • PR2583 (onboarding) offer en-US when the administrator default is not en-US
  • PR2584 (checkout) follow the store's Allow Registration setting for checkout accounts
  • PR2588 (orders) shipping card after-event name, sidebar card headings and button names
  • PR2589 (install) sync core email and invoice templates on a fresh install
  • PR2590 (app_diagnostics) clear outdated carts in bounded batches
  • PR2593 (media) surface the real reason for a file not to be uploaded
  • PR2595 (coupons) show the stored discount type in the coupons list
  • PR2598 (shortcode) add missing j2commerce-product-XX to the container so that options affect the price
  • PR2599 (emails) apply the order email link target to [INVOICE_URL]
  • PR2600 (emails) link order emails straight to the confirmation page
  • PR2602 (checkout) unique confirm-password id, labeled login fields, step headings

Added

  • PR 2362 (orders) Edit an order line's options from the order editor
  • PR 2363 (menus) Product Tags View and Product Tag Alias menu item types
  • PR 2364 (orders) Change an order line's variant and ask for options when adding a product
  • PR 2373 (tags) Per-tag overrides for Product Tags View settings
  • PR 2386 (images) Generate local thumbnails from remotely hosted images

Fixed

  • PR 2365 (dates) Let a language pack's own calendar render printed dates
  • PR 2367 (products) Route product edit to the article editor
  • PR 2369 (products) Sort listings by the price each product card shows
  • PR 2371 (orders) Tick "same as billing" when the order has no shipping address
  • PR 2372 (orders) Hold the saved customer language to the languages the form offers
  • PR 2374 (core) Hold subtemplate names and language tags to the values their pickers offer
  • PR 2375 (menus) Remove the Product tab from the Product Tags View menu item
  • PR 2376 (cart) Tax the discounted price when a coupon applies
  • PR 2377 (checkout) Translate the terms text and follow the default subtemplate
  • PR 2378 (content) Leave an article's own text to com_content in shortcodes
  • PR 2379 (products) Render the product title heading level as a number from 1 to 6
  • PR 2381 (router) Let a category's View Type decide its view
  • PR 2382 (products) Keep the menu item's ordering when filtering the list
  • PR 2383 (core) Truncate descriptions safely, add recalculated-totals event
  • PR 2385 (products) Store all six additional-image columns as keyed JSON objects
  • PR 2387 (images) Connect remote image requests to the checked address
  • PR 2389 (cart) Load the existing cart without creating one on voucher reads
  • PR 2390 (products) Serve the generated derivative in the gallery thumbnail strip
  • PR 2392 (email) Keep conditional-comment keywords through the tag sweep
  • PR 2397 (reports) Hold the report export to exportorders and guard the plugin handlers
  • PR 2399 (seo) Name the page itself in the canonical on tag and category listings
  • PR 2401 (routing) Fail closed when a category ancestor alias does not resolve
  • PR 2402 (orders) Persist the totals the recalculation event returns
  • PR 2405 (tags, categories) Order trending products by the product hit counter
  • PR 2406 (tags) Load the parent tag's products only in the products display mode

Added

  • PR 2004 (dashboard): shared icon-class and mode badge for plugin quick icons
  • PR 2069 (customfields): hold a text field to a character set and a length
  • PR 2075 (dashboard): add a database health card with one-click repairs
  • PR 2076 (orders): let a plugin add columns to the admin order list
  • PR 2081 (fa_IR): Persian translations for system plugin language files
  • PR 2089 (dashboard): report the remaining order children that outlive their order
  • PR 2121 (build): add three pre-build check scripts
  • PR 2135 (api): complete the warehouse fulfilment routes with label creation (#1187)
  • PR 2152 (orders): give each order status its own lifecycle classification
  • PR 2155 (orderstatuses): save the status type per row and expose it as a form field
  • PR 2160 (orderstatuses): add the approved status type and label complete as paid
  • PR 2164 (orderstatuses): let plugins register their own status types
  • PR 2169 (schemaorg): emit Organization-level ShippingService on the policy page
  • PR 2183 (schemaorg): let one review provider contribute, chosen by plugin order
  • PR 2203 (shipping): add display image and description to free and standard shipping (fixes #2073)
  • PR 2212 (templates): add a Duplicate bulk action to the email and invoice template lists
  • PR 2233 (setup-guide): flag built-in order statuses that have no lifecycle type
  • PR 2239 (email): show the translated subject and edit it through a language-override dialog
  • PR 2241 (email): resolve language tokens in the body editor and edit them in place
  • PR 2246 (invoice): show print template wording, not tokens
  • PR 2271 (core): tracking scripts with value tokens on checkout and confirmation
  • PR 2311 (core): Shared SubtemplateHelper for layout override resolution
  • PR 2348 (core): Relocate customer file storage from the Options screen
  • PR 2351 (products): Duplicate a product and its article

Changed

  • PR 1998 (cart): memoise the cart-count read per request
  • PR 2003 (checkout): plans for the order write and checkout step sequencing
  • PR 2008 (fr_FR): Change keys related to 'Passer à la caisse'
  • PR 2028 (checkout): assert the payment step the state machine already records
  • PR 2109 (lib): update the vendored phpseclib to 3.0.57
  • PR 2113 (language): use American spelling in the en-US strings
  • PR 2167 (vendor): bump Swiper, GrapesJS and Uppy to current
  • PR 2286 (vendor): refresh Fancybox to 6.1.15 and Uppy to 6.0.1
  • PR 2115 (lib): drop the composer dependency the library never loaded
  • PR 2123 (build): stop bundling admin language files the installer never reads
  • PR 2216 (vouchers): retire the per-voucher email body fields in favour of the Email Hub template
  • PR 2225 (templates): wire the check-out UI on the email and invoice template lists and retire their access column
  • PR 2234 (orders): remove the Additional Information blocks that repeat the order's own address
  • PR 2242 (orders): prune the retired order customfields layout on upgrade and restore the billing email input

Fixed

  • PR 1989 (minicart): hydrate the badge in both counting modes
  • PR 1999 (shipping): hold rate quoting to the caller's context
  • PR 2000 (cart): write the shared destination keys only from a submitted estimate
  • PR 2001 (content): let the category product block survive the core copy-back
  • PR 2002 (checkout): ship-to symmetry, address review and step-load failures
  • PR 2009 Fix missing AfterAddOrderItem order events
  • PR 2010 (templates): keep loop and conditional markers inside their table
  • PR 2015 (print-templates): make file-based bodies selectable and register the fee tags
  • PR 2016 (print): route printed dates through one helper that follows the site language
  • PR 2018 (orders): hold the orderinfos write and the order write to one standard
  • PR 2019 (myprofile): render the orders and downloads lists from one template on every refresh
  • PR 2020 (myprofile): escape the order status name in the single order view
  • PR 2021 (controllers): flush queued response headers on the AJAX exit paths
  • PR 2022 (product-form): prefix the admin product-form element ids (#2007)
  • PR 2024 (checkout): hold the checkout steps to one server-side sequence
  • PR 2026 (orders): carry checkout custom fields through to the order record
  • PR 2029 (admin): hold duplicate ids, id prefixing and DOM building to one standard
  • PR 2033 (invoice): hold both print body sources to one contribution point
  • PR 2034 (print-templates): hold the packing slip picker and renderer to one tag list
  • PR 2036 (myprofile): hold every typed order-history row to one standard on the site view
  • PR 2037 (checkout): keep one copy of what the payment-step merge duplicated
  • PR 2038 (checkout): complete the payment-step assertion merge (#2028)
  • PR 2039 (admin): hold script-block encoding to one standard (fixes #2032)
  • PR 2040 (admin): hold the template shortcode picker to one output standard
  • PR 2041 (core): fall back to a placeholder when a stored image file is absent
  • PR 2043 (admin): hold the shortcode trait options to the same output standard
  • PR 2044 (admin): give the template picker cards a native control
  • PR 2045 (admin): hold email template conditionals to one wrapper standard
  • PR 2046 (admin): hold the product AJAX exits to one response standard
  • PR 2047 (admin): hold the menu module empty guard to the array it receives
  • PR 2051 (admin): hold template marker unwrapping to one standard
  • PR 2052 (payment_paypal): hold the five gateway response reads to one parse standard
  • PR 2053 (admin): hold four product AJAX tasks to the controller's own capability helper
  • PR 2055 (products): hold both bulk variant deletes to the same table list
  • PR 2057 (admin): hold both article-resolving product tasks to the controller's own helper
  • PR 2058 (admin): hold the remaining admin JSON exits to one response standard
  • PR 2059 (products): hold the product cascade to the tables its children own
  • PR 2060 (customfields): merge plugin area toggles into the stored field_display
  • PR 2062 (products): hold every product listing to the detail view preview standard
  • PR 2064 (admin): route the remaining admin badges through the badge_style helper
  • PR 2068 (config): default the order email link to the confirmation page
  • PR 2077 (language): align the Persian folder names with what the manifests declare
  • PR 2080 (products): let a caller opt out of the draft-preview branch in ProductVisibilityHelper
  • PR 2082 (inventory): give the cart-quantity helpers one owner for the rule
  • PR 2084 (language): declare the locale folders the extensions already ship
  • PR 2085 (cart): give the cart-quantity helpers a read-only resolver and an ownership predicate
  • PR 2086 (delete): cascade child rows when a parent record is removed
  • PR 2088 (customfields): hold the third address writer and the field preview to the shared standard
  • PR 2094 (orders): keep one list of what belongs to an order
  • PR 2095 (zones): store zone names as letters, not HTML codes
  • PR 2096 (images): emit product image URLs through one helper
  • PR 2097 (seo): give every frontend view a canonical URL
  • PR 2098 (carts): decline the unsupported carts delete task instead of failing hard
  • PR 2100 (carts): decline the remaining unsupported carts list tasks
  • PR 2104 (products): report the shipping column from the sellable variants
  • PR 2105 (shipping): resolve the free shipping destination the way sibling plugins do
  • PR 2107 (carts): bring the two admin cart controller surfaces in line with their siblings
  • PR 2108 (language): restore American spellings in the en-US source strings
  • PR 2110 (finder): clean product search links and let CLI indexing complete
  • PR 2111 (carts): bring three more admin cart surfaces in line with their siblings
  • PR 2118 (core): make CLI search indexing safe and stop storing an absolute image URL
  • PR 2124 (payment_paypal): bring every locale up to the full key set
  • PR 2125 (content): report a generic error instead of the exception text
  • PR 2126 (language): deploy J2Commerce strings for a language pack installed later
  • PR 2129 (products): resolve the subtemplate name against the installed set
  • PR 2136 (core): fall back to the product name when a stored image alt is blank
  • PR 2137 (system): hold the product offer and the product node to one standard
  • PR 2138 (schemaorg): declare the product context so schema overrides reach the page
  • PR 2143 (products): order the AJAX product pages the way the rendered page does (fixes #2140)
  • PR 2144 (api): record a bought-but-unstored shipping label on the order (fixes #2128)
  • PR 2147 (checkout): build the AJAX entry point from the site root
  • PR 2148 (products): keep one ordering allow-list and one derivation across the site models
  • PR 2150 (products): route the listing pagination links to the listing itself
  • PR 2151 (checkout): resolve the empty-cart destination once for cart and checkout
  • PR 2153 (product): assign the back link the templates already render
  • PR 2154 (orders): give the label-purchase lock its own column
  • PR 2156 (orderstatuses): pass the status type select its attributes as attributes
  • PR 2158 (orderstatus): resolve the status type field to its select class
  • PR 2159 (product): resolve the tax profile field to its select class
  • PR 2161 (orders): write only the shipping fields the save was given
  • PR 2165 (paypal): give the webhook status outcomes their own settings
  • PR 2166 (checkout): read the upload response off the XHR the callback receives
  • PR 2168 (config): give My Profile visibility and download grants their own status params
  • PR 2175 (language): translate the split order-status params in the remaining locales
  • PR 2176 (schemaorg): read a stored override from the sibling context
  • PR 2178 (schemaorg): publish only review markup that is eligible
  • PR 2181 (setup-guide): hold the wizard offcanvas to one dark token set
  • PR 2182 (language): bring every locale back to the en-US key set (fixes #2174)
  • PR 2185 (a11y): announce Setup Wizard check status and group progress
  • PR 2188 (schemaorg): dispatch one payload shape for onJ2CommerceSchemaReviewsPrepare
  • PR 2191 (schemaorg): normalise every string the product node carries before it joins the graph
  • PR 2192 (email): read order line options the way the order views read them
  • PR 2193 (schemaorg): run the review eligibility filter on the live product path
  • PR 2196 (config): seed the download status window so it is never empty
  • PR 2197 (schemaorg): hold the Organization policy entry to the product node normalise pass
  • PR 2198 (schemaorg): run the review eligibility filter on every dispatch site (fixes #2194)
  • PR 2199 (core): bring the 2026-09-05 review advisories to sibling parity
  • PR 2201 (core): hold the remaining setup, catalogue and gateway-return surfaces to the standard their siblings already meet
  • PR 2202 (pricing): persist a cleared advanced-price date range
  • PR 2205 (shipping): bring the shipping method params and cart selector to sibling parity
  • PR 2207 (core): escape stored values in toolbar titles and route core log entries to the registered category
  • PR 2214 (core): honour the cart plugin result contract on every product behaviour
  • PR 2215 (paypal): route plugin log entries to the registered category and hold payload logging to one standard
  • PR 2219 (schema): ship a schema update delta for the template table audit and checkout columns
  • PR 2223 (vouchers): let Save as Copy insert a new record instead of updating the source
  • PR 2227 (paypal): resolve webhook orders by the key the event carries and hold the sibling handlers to one standard
  • PR 2229 (email): derive the transactional shortcode vocabulary from the substitution map
  • PR 2230 (paypal): serve the webhook from the endpoint that exists and stop scaffolding the one that does not
  • PR 2237 (paypal): resolve order states by type and make the webhook path f…
  • PR 2238 (paypal): resolve order states by type and make the webhook path fail loudly instead of answering 200
  • PR 2240 (templates): hold both admin template lists to one output-encoding standard
  • PR 2243 (email): hold the tag-delimiter encoder to the two families processTags reads
  • PR 2245 (vouchers): hold the API create verb to the insert path
  • PR 2247 (core): translate the setup-guide task actions, classify Confirmed
  • PR 2251 (templates): reach Sync Core from an empty template list
  • PR 2252 (core): let Sync Core restore templates it can no longer find
  • PR 2253 (core): supply the insert column the email template table has no default for
  • PR 2260 (core): degrade the override editor to a textarea when it cannot render
  • PR 2262 (templates): render preset totals through [TOTALS] (fixes #2257)
  • PR 2263 (Content plugin) Fixed options|cart shortcodes so that when cart is called, options are showing properly and usable through the cart form
  • PR 2264 (router): prefer the visitor's language when resolving menu items (fixes #2261)
  • PR 2265 (core): state the presentation columns on both Sync Core write paths
  • PR 2266 (lang): give colliding module parameter labels distinct wording
  • PR 2267 (language): correct six German totals labels in the admin
  • PR 2270 (core): show the database health card while its check run is in flight
  • PR 2275 (language): translate the tracking-script strings into the remaining locales
  • PR 2276 (email): place template CSS in the head, keep colour edits in the export, name the core template rows
  • PR 2277 (core): carry the tracking snippet forward when a save omits its key (fixes #2272)
  • PR 2279 (email): name a Save as Copy template as the merchant's own
  • PR 2281 (core): hold checkout and cart AJAX to the visitor's language (#2280)
  • PR 2282 (build): fail the SQL lint when the two newest-delta sorts disagree
  • PR 2283 (core): encode the calculator's AJAX base the way the checkout does
  • PR 2285 (core): bring the cart calculator's JS in line with the project rules
  • PR 2288 (core): resolve the database health setup-guide flag per store
  • PR 2289 (core): request the messages asset the storefront JS already calls
  • PR 2291 (core): load the content plugin's assets through StrapperHelper
  • PR 2292 (core): report what a shopper can still add, not raw stock
  • PR 2293 (core): wrap bare tracking JavaScript in a script tag
  • PR 2294 (build): package git-tracked files only
  • PR 2295 (build): CLI-only guard and unquoted git paths in build tools
  • PR 2296 (checkout): Admit the on-site gateway's confirmation hand-off
  • PR 2298 (checkout): Give the confirmation hand-off claim a lifetime
  • PR 2299 (build): Scope the package-surface check to the core ship set
  • PR 2300 (cart): Dispatch j2commerce:cart:updated after a quantity change
  • PR 2301 (flexivariable): Route the variant manager's messages through language strings
  • PR 2302 (products): Render the cart button from the selected variant's stock
  • PR 2304 (products): Announce cart-button changes and share the remainder message
  • PR 2305 (images): Escape image alt text once, in the helper
  • PR 2306 (images): Pass the Builder image style through getProductImage()
  • PR 2307 (dashboard): Treat any held quantity as stale in the health check
  • PR 2308 (dashboard): Drop the orders-without-items health check and report failed checks
  • PR 2312 (checkout): Persist the customer note before an off-site gateway redirect
  • PR 2313 (checkout): Bound the customer note and report a failed write
  • PR 2315 (content): Write article product-form render errors to the com_j2commerce log
  • PR 2317 (content): Render every {j2commerce} shortcode option
  • PR 2319 (email): Size the store logo with an HTML height and centre it
  • PR 2322 (content): Unique ids for a repeated shortcode, name the quickview button
  • PR 2324 (cart): Carry a re-ordered line's recorded data forward
  • PR 2325 (content): Scope the gallery swap, guard the indexer strip
  • PR 2326 (email): Constrain the producers of the scalar brand shortcodes
  • PR 2328 (email): Pair the attribute escaper with encodeTagDelimiters
  • PR 2329 (options): Hold the option layouts to the standard their bootstrap5 twin already meets
  • PR 2332 (options): Wrap the price prefix in the uikit option layouts
  • PR 2334 (options): Wrap three merchant fields the sibling branches already wrap
  • PR 2339 (options): Cast the option identifiers in the uikit layouts
  • PR 2341 (checkout): Branch the shipping step on the identity
  • PR 2343 (checkout): Guard the guest billing validator on the identity
  • PR 2344 (email): Size the logo by attribute and resolve the site root from live_site
  • PR 2345 (options): Route the option layouts through the shared emitters
  • PR 2346 (email): Keep the SSL upgrade on a configured site root, and scope the width cleanup
  • PR 2349 (customfields): Compare the option label against an empty string
  • PR 2352 (language): Translate the duplicate-product error into the shipped locales
  • PR 2354 (products): keep a disabled product attached to its article
  • PR 2355 (products): require product-edit permission for the frontend state sync

Added

  • PR1509 – Build script: add option to release with a specific version number
  • PR1514 – Products (hardening): apply listing predicates to the filter bar queries
  • PR1516 – Products (hardening): scope option-based variant resolution to the requested product
  • PR1518 – ArticleHelper (hardening): bind the view levels in the association access filter
  • PR1588 – Order Confirmation page: add CSS classes to blocks for targeting via CSS
  • PR1598 – Products list: add the same batch actions as the articles list
  • PR1612 – Filters: let a filter group choose the control it renders (checkbox, radio, select, etc.)
  • PR1625 – Products: filter the list by filter values and batch them onto products
  • PR1627 – Config: let the store owner load Font Awesome from the component
  • PR1630 – Admin: give the products list the same check-in bulk action as its siblings
  • PR1631 – Admin: show the checked-out lock on the extension-backed lists
  • PR1691 – Setup: relocate uploads left in the pre-6.3 folder
  • PR1705 – Task: let app plugins run periodic work without their own task plugin
  • PR1714 – Quickicons: give the grid the same destinations as the menu
  • PR1722 – Products: let display parameters decide whether list options start collapsed
  • PR1731 – i18n: carry the scheduledTick strings into every bundled locale
  • PR1735 – Product detail: sticky product detail column option
  • PR1762 — let the country list be cleared the way it is filled (geozone)
  • PR1792 — reach a line item's article the way every other surface does (order,product)
  • PR1843 — show the payment method's linked article on the confirmation page
  • PR1878 — link cart and checkout line items to the product page
  • PR1882 — let the order email link open the order confirmation page
  • PR1886 — add a sortable, filterable language column to the admin orders list
  • PR1911 — make the reporting order statuses configurable and hold every tile to them
  • PR1923 — hold per-shopper state out of the shared page cache
  • PR1931 — translate the image regeneration strings into the remaining locales
  • PR1936 — Generate minified media twins inside the package zips
  • PR1939 — Add missing feedback when quantity min/max reached
  • PR1950 — let getTopProducts() rank by revenue as well as units
  • PR1960 — filter the customer list by order count and acquisition date
  • PR1977 — mark guest orders and filter the list by customer type
  • PR1978 — surface the customer note front-end and flag it in the admin

Changed

  • PR1796 — stop tracking the installer's admin language copies
  • PR1812 — remove five Options fields that nothing reads
  • PR1847 — prune schema update files the package no longer ships
  • PR1864 — stop writing the legacy order_state column
  • PR1503 – Geozone: move edit-form queries into the model, return JSON from the zone endpoint
  • PR1623 – Products: drive the batch dialog from a bound form
  • PR1634 – Orders / Advanced Pricing: drive the batch dialogs from bound forms
  • PR1636 – Inventory / Custom Fields: drive the last two batch dialogs from bound forms
  • PR1645 – JS: build the static button and placeholder content as DOM nodes
  • PR1646 – Report_products: drop the template nothing renders
  • PR1650 – JS: build the product option and variant rows as DOM nodes
  • PR1657 – Zones / Options: serve zone data as JSON and build the selects as options
  • PR1661 – Zones: serve every zone lookup from one endpoint
  • PR1665 – JS: build the fixed-markup sites as DOM nodes
  • PR1666 – JS: build the data-driven markup as DOM nodes
  • PR1672 – JS: build the admin preview markup as DOM nodes
  • PR1674 – JS: route server-rendered HTML through the shared DOM helper
  • PR1683 – JS: adopt the variant list through the shared DOM helper
  • PR1687 – Reports: finish the banned-pattern sweep in the report plugins
  • PR1698 – Voucher: give the model a rejection type only it can throw
  • PR1702 – Coupon: give the model a rejection type only it can throw
  • PR1704 – JS: adopt the server-rendered fragments through the shared DOM helper
  • PR1737 – Gallery: hold the pristine slides as nodes
  • PR1820 — translate the paymentupdate menu item type strings into the remaining locales (i18n)
  • PR1902 — correct what generateToken() says it builds the token from (docs)

Fixed

  • PR1492 – Language: separate placeholders welded into adjacent words
  • PR1494 – Language: retranslate values whose placeholder was injected inside a word
  • PR1495 – Reports: remove two legacy report events with no dispatcher
  • PR1497 – ArticleHelper: call Associations and drop deprecated getQuery(true)
  • PR1499 – ArticleHelper: narrow SELECT * and use the core category service
  • PR1502 – Routing: guard every Route::_() call that feeds a string return type
  • PR1506 – PlatformHelper: make the helper constructible without a web application
  • PR1510 – Products: keep the category on AJAX refresh with the sidebar hidden
  • PR1511 – Products: enforce publish state on product listings and dedupe UIkit filter markup
  • PR1515 – Products: sell in-stock variants again and keep non-Gregorian price dates
  • PR1520 – ProductHelper: stop building pagination in the product hydrator off the web
  • PR1521 – Cart: attribute fee tax to order_surcharge so order_total reconciles
  • PR1523 – Orders: stop double-counting fees when recalculating order totals
  • PR1524 – Email: account for order_credit in the order totals table
  • PR1525 – Orders: keep the order-level item tax when no per-line tax was recorded
  • PR1526 – Escape translations in scripts to avoid breaking the code due to quotes; checkout scrolls to error
  • PR1527 – mod_products: require a published, accessible category in the module product query
  • PR1529 – Variants: preserve stored child-variant params on product save
  • PR1530 – mod_relatedproducts: gate related products by article access, category state and publish window
  • PR1531 – Fixed wrong casing for usergrouplist
  • PR1533 – Product: apply the listing visibility predicates across frontend product surfaces
  • PR1534 – Language: make the dashboard date-range string positional
  • PR1535 – Language: carry the template-sync and queue strings into the admin mirrors
  • PR1536 – Confirmation: require the order token for guest access to a confirmation
  • PR1537 – Cart: apply the listing visibility predicates on the site add-to-cart path
  • PR1542 – Gallery: keep the product thumbnail strip square
  • PR1543 – Router: resolve alias segments within the request language
  • PR1544 – Cart: drop cart lines whose product no longer resolves
  • PR1548 – Cart: clear the announced-unavailable list when a guest cart migrates on login
  • PR1551 – Order: let the order history helper carry a params payload
  • PR1552 – Plugin: hint the real event classes on the content plugin save and delete handlers
  • PR1554 – Fixed collapse missing argument for UIkit
  • PR1555 – Content: resolve the shortcode product through the shared visibility helper
  • PR1556 – Cart: apply the controller's internal-redirect guard to the add-to-cart return path
  • PR1559 – Helper: align SelectHelper list queries with the live schema
  • PR1566 – Checkout: reuse a prior order only while it still matches the cart
  • PR1569 – Shipping: honour the auto-select shipping setting when ordering rates
  • PR1572 – Inventory: dispatch the stock events before the manage-stock gate
  • PR1574 – Inventory: count only live baskets toward held stock
  • PR1577 – Fix: test email template only sends body of the Joomla editor
  • PR1578 – Fix: many text elements not editable in the Visual Editor, preventing translations/text modifications
  • PR1584 – Product: encode merchant-authored values at every attribute emission
  • PR1585 – Currency: encode the stored currency fields where format() reads them
  • PR1586 – Templates: hold both halves of an image tag to the same standard
  • PR1587 – Cart: measure per-customer sale limits against the shopper's own basket
  • PR1590 – Checkout: dispatch BeforeAddOrderItem when writing order items
  • PR1592 – Orders: restore order-item columns a BeforeAddOrderItem handler leaves unusable
  • PR1594 – SEO: let the store publish one product surface and point the other at it
  • PR1595 – Fix: render content plugin tags in content and product views
  • PR1596 – Inventory: give the order-side stock check a seam for lines whose stock lives elsewhere
  • PR1597 – Fix image orientation for images without the right orientation
  • PR1603 – Filters: reconcile filter-group values on save instead of recreating them
  • PR1604 – Filters: derive price-slider bounds from the listing query itself
  • PR1606 – Filters: let Back walk a filtered listing instead of leaving it
  • PR1607 – Downloads: let composite product types contribute their own download rows
  • PR1609 – Filters: scope the sidebar to the listing and narrow on every group
  • PR1610 – Content: wrap list-surface product images in a product link
  • PR1611 – Content: let the plugin's own image and shortcode params take effect
  • PR1614 – Filters: remove a group's values and product pairs with the group
  • PR1615 – Content: let the category add-to-cart display setting reach the layouts
  • PR1617 – Filters: expose the group input type and dress its controls to match
  • PR1619 – Content: give the shortcode option-block setting a consumer
  • PR1621 – Checkout: keep the order in step with a cart that changes on confirm
  • PR1626 – Products: serve each Products controller only what its surface offers
  • PR1632 – Checkout: file uploads against the paid order; replay payment selection on both confirm passes
  • PR1638 – UI: replace the banned text-muted class with text-body-secondary across the component
  • PR1640 – Export: hold every CSV export to the same cell handling
  • PR1655 – JS: announce injected variant rows on the container that changed
  • PR1656 – Vendor: handle marketplace custom fields when saving vendors and manufacturers
  • PR1660 – Product: emit variant editor translations as JavaScript literals
  • PR1663 – Product: stop the option editors offering an option already on the product
  • PR1664 – Queue: carry the queue item under both payload keys and surface the release reason
  • PR1667 – Product: align the product controller and option editors with their siblings
  • PR1671 – Product: keep a product from carrying the same option twice
  • PR1673 – Email: name the shipping method when shipping is free
  • PR1675 – System: give the com_j2commerce log category somewhere to write
  • PR1677 – Uploads: hold every customer-upload surface to the configured file path
  • PR1678 – Product: keep a browser-added option row off an existing option's key
  • PR1682 – Admin: answer the remaining error paths the way their siblings do
  • PR1684 – Uploads: record the resolved storage root and name it in the tree README
  • PR1685 – Admin: hold the last error paths to the shape their siblings use
  • PR1686 – Checkout: resolve the upload cart ID where the cart resolves it
  • PR1692 – Cart: let the voucher model say which of its own rejections applied
  • PR1694 – Checkout: let the address save error stand on its own
  • PR1697 – Uploads: attach checkout uploads to the order and hold upload gates to their contract
  • PR1700 – Checkout: give each of the three open controller paths one answer
  • PR1707 – Uploads: give the relocation tool the order line it was missing
  • PR1710 – Inventory: give the inventory list one row per product
  • PR1712 – Product: let drag position own option-value ordering
  • PR1713 – Setup: hold the attachment migration screen to the level of its action
  • PR1715 – Reorder: hold the replayed order line to the predicates the add path carries
  • PR1716 – Setup: state the upload rate limit check as a pending schema update
  • PR1719 – Templates: return the inlined email body and resolve template references consistently
  • PR1723 – Packingslip: read the slip CSS from the record its body came from
  • PR1727 – Checkout: hold the same-as-billing control to the store's shipping-address setting
  • PR1728 – Checkout: record the same-as-billing ship-to the way the order reads it
  • PR1730 – Email: resolve inline image references through the shared template resolver
  • PR1736 – Variants: route every option-value key through one normaliser
  • PR1738 – Variants: hold the variant write tasks to the checks their twins carry
  • PR1739 – Checkout: hold the address resolver to the account it was called for
  • PR1740 – Templates: constrain the email body source and drop compat6-only Filesystem imports
  • PR1741 – Gallery: let one place own the escaping in the view_images templates
  • PR1742 – Checkout: keep a persisted order's discount accounting in step with its cart
  • PR1743 — hold every shipping_values writer to one rate standard
  • PR1744 — give each discount and shipping method its own name
  • PR1745 — bring every locale to full parity with the en-US source
  • PR1746 — the dot for stocks shows even when the label is empty in product view
  • PR1747 — match core envelope-sender handling so PHP mail() accepts the message
  • PR1749 — hold the site templates to the icon sets the component ships
  • PR1764 — give the inventory list the article state the products list carries
  • PR1766 — give the shipping row the tax lookup the product lines use
  • PR1768 — let the Stock Status flag decide sellability
  • PR1769 — hold the checkout, the saved order and the confirmation page to one total
  • PR1770 — give the order-out-of-date refusal a way back
  • PR1771 — give a coupon the signal every cart surface refreshes on
  • PR1772 — give every cart line the product's tax profile
  • PR1773 — hold the quantity-limit message to the fact it can state
  • PR1775 — hold the mail test screens and the cron row to the level of their actions
  • PR1776 — tax a cart line on the same terms it is charged
  • PR1777 — give every order surface the same download links
  • PR1779 — settle the cart's tax on the basis the order persists
  • PR1782 — store a coupon's dates in the frame the form already delivered
  • PR1784 — render each copy of an order in the locale its reader uses
  • PR1785 — hold the variants panel to what it knows
  • PR1786 — give every shipped locale the order-email strings it renders
  • PR1794 — resolve the taxed address on the basis the store selected
  • PR1795 — let a recalculated order record a tax of nothing
  • PR1797 — price a checkbox option from the whole selection it holds
  • PR1798 — carry the checked-out modal into the twenty remaining locales
  • PR1799 — honour the Auto subtemplate option in product modules
  • PR1800 — let a shipping rate state a tax of nothing
  • PR1802 — price shipping for the destination the order is going to
  • PR1803 — build the option-update query string from the form's own parameters
  • PR1813 — let the configured repeat count govern the retry ceiling
  • PR1814 — give each Options field one default instead of two
  • PR1816 — hold the menu item type list to the extensions a site runs
  • PR1818 — honour the Automatic Currency Updates setting on the scheduled run
  • PR1819 — honour the Show Product Thumbnails in Emails option
  • PR1821 — let the stored Catalogue Mode setting govern the cart buttons
  • PR1823 — dispatch one hook set across all three categories subtemplates
  • PR1825 — keep one price visibility rule across every surface
  • PR1826 — honour the tax address and voucher-to-shipping options
  • PR1827 — cover every allowed download root, not just one
  • PR1828 — keep one rule for granting an order's downloads
  • PR1833 — hold the serve endpoint to the same order-status rule as the listing
  • PR1834 — count a download with one statement rather than a read and a write
  • PR1835 — report what the deny writer did, and clear the rules a removed file leaves
  • PR1836 — name the directories where the per-file rules are read by nothing
  • PR1837 — 'cash on delivery' does not properly apply taxes when surcharge is added and tax is selected
  • PR1841 — restore the add-to-cart control on an unhandled failure
  • PR1844 — read the redirect key the add-to-cart response actually sends
  • PR1845 — attach the cart redirect only when the add succeeded
  • PR1849 — show the discount amount the moment a coupon or voucher is applied
  • PR1854 — let the order-totals remove link reach the coupon and voucher handlers
  • PR1855 — read the joined status name instead of the legacy order_state column
  • PR1857 — serve order_state from the joined status name and deprecate it
  • PR1871 — resolve variant option values through the product table
  • PR1873 — apply the site-name page-title setting once, everywhere
  • PR1875 — let a product's own metadata win over the menu item
  • PR1877 — load the component admin strings outside the component
  • PR1879 — generate per-account credentials for seeded users
  • PR1883 — hold plain telephone input to E.164 bounds, not a country's
  • PR1884 — collect payment-area custom fields the same way every other area does
  • PR1885 — load the component's own language dir when rendering mail
  • PR1887 — parse telephone values against the store default country
  • PR1888 — bring the register address handler in line with the component's input handling
  • PR1889 — render custom field tags in emails and printed documents
  • PR1890 — resolve categoryalias menu links without a redirect
  • PR1892 — restore the variant pricing modal after the panel moved to ajax
  • PR1897 — normalise plugin quick icon and message results before use
  • PR1898 — clear the literal timestamp default a reset leaves behind
  • PR1900 — hold the order-link tags to the same rule as the download links
  • PR1903 — give the download-links append its own parameter
  • PR1904 — let the invoice and packing-slip helpers state who the document is for
  • PR1905 — encode the tag delimiters with the tag values
  • PR1908 — hold the raw-list tags carrying order text to the same delimiter rule
  • PR1913 — hold the fallback items tables to the same delimiter rule
  • PR1915 — gate the app list links on the edit permission like its sibling lists
  • PR1918 — hold the plugin links to the permissions their destination enforces
  • PR1919 — hold the remaining raw-list builders to the same delimiter rule
  • PR1920 — hold the extension models' writes to the scope their reads declare
  • PR1921 — read the check() and store() results so a refused write is reported
  • PR1927 — Surcharge is missing from emails/printed orders + tax amount is missing shipping tax amount
  • PR1928 — resolve image derivatives at render time and index the raw path
  • PR1930 — gate site media uploads on com_j2commerce
  • PR1933 — reindex the product image list so it encodes as an array
  • PR1934 — emit variable products as a ProductGroup and drop the unused group-level offer
  • PR1935 — hold the uploader's remove path to the extension allowlist its write path applies
  • PR1937 — shortcode_subtemplate is not used in shortcodes (Content plugin)
  • PR1938 — right-align the result count on each filter row
  • PR1941 — keep the option steps to the variable product type
  • PR1946 — hold the cart stock check to the shopper's own basket
  • PR1947 — resolve one address per email in a subquery instead of grouping the list
  • PR1949 — age the cart sweep by modified_on and build its cutoff in UTC
  • PR1951 — Allow file uploads when fileMode=1
  • PR1954 — scope the variant delete cascade to the product being deleted
  • PR1955 — send the declared headers on the cron endpoint, and hold its two display surfaces to matching standards
  • PR1961 — escape the queue key where the field builds its markup
  • PR1964 — round-trip the cron trigger value from its display field
  • PR1967 — compare the payment hash with hash_equals()
  • PR1969 — hold the diagnostic body to one level
  • PR1970 — write component params one member at a time
  • PR1972 — log the exception text instead of rendering it
  • PR1975 — give the guest order lookup a way out
  • PR1980 — bring three admin surfaces into line with their siblings
  • PR1981 — give payment instructions their own home instead of the customer note
  • PR1982 — hold queue_key and its payment consumer to one standard
  • PR1984 — show the shipping tracking number in the customer's order view

Added

  • PR1297 — Self-service Payment Update view (frontend)
  • PR1302 — Admin Orders CSV export with filterable offcanvas UI
  • PR1303 — Translate Orders CSV export strings into 19 locales
  • PR1306 — Dispatch AfterDisplayLineItemTitle event in confirmation and order views
  • PR1311 — Voucher balance adjustments, ledger, and customer gift card API
  • PR1315 — Dispatch AfterDisplayLineItemTitle consistently in emails and admin edit views
  • PR1316 — Language file update (com_j2commerce.ini)
  • PR1321 — Functional admin order editing with AJAX tab navigation
  • PR1322 — AJAX admin order editing (items, addresses, discounts, fees, stock)
  • PR1324 — Coupon picker modal field for reuse in any extension form
  • PR1326 — Unified My Profile payment-methods tab with provider badges/actions
  • PR1327 — Support plugin-injected tax profiles in the admin field and list
  • PR1328 — Apply default tax profile when a new product is created
  • PR1329 — Warn on dashboard when a required J2Commerce menu is missing
  • PR1331 — Apply category default tax profile to new content products
  • PR1332 — Warn on dashboard when a required-menu view has no menu item
  • PR1334 — Admin manual order creation, editing wizard, and Take Payment
  • PR1336 — Add en-US/en-GB strings for order export and voucher history
  • PR1338 — Add 20-locale translations for order-management strings
  • PR1345 — Add onJ2CommerceAfterStockAdjust event for stock mutations
  • PR1346 — Add onJ2CommerceBeforeAddOrderItem seam for per-variant tax
  • PR1372 — Add a [TOTALS] placeholder for order emails and invoices
  • PR1395 – (orders) Add a Print Packing Slip option to the front-end order view
  • PR1443 – (acl) Add editproducts and editsetup, and enforce them
  • PR1451 – (acl) Give order export its own capability and an audit trail
  • PR1485 – (geozone) Add every enabled country to a geo zone in one step

Changed

  • PR1316 — Language string updates
  • PR1337 — Update Swiper to 14.0.6 and GrapesJS to 0.23.2
  • PR1396 – (checkout) Build injected checkout markup as DOM instead of innerHTML
  • PR1399 – (user-plugin) Move the registration country/zone cascade to shared media JS
  • PR1402 – (filters) Encode the full quote set in the chip builder's escape helper
  • PR1403 – (myprofile) Match only tab toggles when resolving the hash deep-link
  • PR1404 – Improve backend access
  • PR1405 – (acl) Converge the custom-action seed outside the installer postflight
  • PR1408 – Streamline cart migration (guest→logged in, logged in→logged in, empty after order placed)
  • PR1426 – Move Terms & Conditions checkbox enforcement in confirm payment block
  • PR1470 – List views: enhance input handling and improve price range calculations
  • PR1464 – (reports) Retire the superseded report CSV writer
  • Thanks to Brian Teeman, Morteza Honar, Elisa Foltyn and Angie Radtke for their contributions.

Fixed

  • PR1294 — Round order money fields to currency scale so balances reconcile
  • PR1295 — Shipping methods can "bleed" to the cart page after being visible in checkout
  • PR1296 — Payment labels should be identical all the way to the confirmation email
  • PR1298 — Sync pt-BR language files to canonical en-US
  • PR1300 — Render plugin-provided HTML in Producttags view
  • PR1301 — Return JSON on CSRF failure for AJAX confirmPayment posts
  • PR1305 — Dispatch dashboard plugin tabs inside the open uitab tabset
  • PR1307 — Confirm free orders and drop duplicate register address fields
  • PR1312 — Avoid Bootstrap dependencies in product pages where filters are used
  • PR1313 — Keep batch-actions dialog template inside adminForm
  • PR1314 — Add missing voucher history empty state and fix view property visibility
  • PR1317 — Force Bootstrap 5 framework for admin custom field rendering
  • PR1318 — Correct shipping address display and add core template sync tool
  • PR1319 — Cart does not empty after an order has been placed despite the option being set
  • PR1320 — Log order-status field load errors instead of surfacing exception text
  • PR1323 — Add missing voucher ledger files referenced by merged voucher PRs
  • PR1325 — Log coupon-field DB lookup errors instead of surfacing exception text
  • PR1333 — verify address ownership before update in CustomerModel
  • PR1335 — Checkout payment images, date pickers, payment-step custom fields
  • PR1339 — Reconcile partial-payment confirmation summary line items
  • PR1340 — Version 6.5.0 + missing language file load of com_j2commerce in plugins
  • PR1341 — Correct German coupon strings from Gutschein to Rabatt
  • PR1342 — In CheckoutController::confirmPayment(), sendOrderEmails() is called twice for free orders
  • PR1344 — Vouchers are not applied in the cart + don't show the correct remaining balance in the cart if adjusted
  • PR1347 — Category params are missing
  • PR1348 — 'Not Taxable' and 'Use Global' or '-- select --' all have no value. Set 'Not Taxable' to 0
  • PR1355 — PayPal - use ConfigHelper::pricesIncludeTax() to ensure tax is not added when it is included in the price.
  • PR1358 — MyProfile order - removed inline color style
  • PR1363 — Verify address ownership before writing the session id
  • PR1364 — Correct the alert-link selector so alert links pick up the alert text colour
  • PR1365 — Add cart-item-uniqueness hook so plugins can separate lines
  • PR1367 — Allow-list ORDER BY columns in the site product models
  • PR1368 — Restrict unserialize() to arrays in cart and order item paths
  • PR1369 — Correct two German strings that read wrong in the storefront
  • PR1370 — Constrain session address lookups to the current user
  • PR1374 — Guard the cart item signature read against a non-scalar value
  • PR1375 — Make the storefront Popular sort survive the round trip
  • PR1376 — Keep the reserved signature key out of caller-supplied params
  • PR1377 — Render order_shipping_tax in confirmation and order-view totals
  • PR1378 – Add Persian translations for modules and library (see Other)
  • PR1390 – (core) Consolidated hardening across admin, checkout, uploads and overrides
  • PR1391 – (packing-slip) Strip price tags before processTags() substitution
  • PR1400 – (myprofile) Drive the order print modal with the API its template family rendered
  • PR1401 – (myprofile) Escape quotes in the AJAX row builder and stop the hash aborting the handler
  • PR1409 – (acl) Guard the seed's row writes against a concurrent save
  • PR1412 – (inventory) Reserve stock at Pending and move it on model status changes
  • PR1415 – (inventory) Decide both sides of a status transition with one predicate
  • PR1417 – (inventory) Derive both ends of a stock transition from one set of holding states
  • PR1422 – (inventory) Record whether an order holds stock instead of inferring it
  • PR1424 – (inventory) Make the order status transition a compare-and-swap
  • PR1425 – PayPal Guest Checkout does not show the confirmation page
  • PR1427 – Test if there are options before creating a select from them and avoid empty ones
  • PR1428 – Do not create collapsible button if options are not taken into account (file, image…)
  • PR1429 – (checkout) Re-assert the app-plugin order veto at confirm submit
  • PR1430 – (inventory) Record the signed stock movement instead of clamping the debit
  • PR1431 – (orders) Require editorders on the AJAX status change
  • PR1434 – (inventory) Converge the stock_committed seed from the component boot
  • PR1436 – (api) Require editorders on the fulfilment status change
  • PR1437 – (orders) Put the remaining mutating order tasks behind editorders
  • PR1439 – (api) Authorise every J2Commerce Web Services route
  • PR1440 – Fix order URL to download items and action button styles when doing a search
  • PR1442 – Fixed labels do not refresh when reset (chip clears)
  • PR1444 – (orders) Close the three ACL asymmetries around the order gates
  • PR1445 – Fix UI Out of Stock button so that it does not get duplicated with the out of stock label
  • PR1447 – (installer) Guard the install debug log and stop logging exception text
  • PR1458 – (relatedproducts) Scope the AJAX module lookup to this module and the viewer
  • PR1459 – (products) Drop the grid cell when a product type renders nothing
  • PR1460 – (categories) Let the category app accordion use the full form width
  • PR1461 – (api) Make a core.manage revoke mean the same thing over the API
  • PR1462 – (acl) Compare the seed's guarded rows byte for byte
  • PR1465 – (acl) Stop the installer re-seeding permissions an administrator cleared
  • PR1466 – (acl) Gate the dashboard and analytics figures on one action
  • PR1468 – (acl) Extend the write gate to the controllers it had missed
  • PR1469 – (api) Pair the bulk list routes with the export capability
  • PR1471 – Fix Stock not updating when switching variants on the frontend
  • PR1474 – (acl) Align three permission and filter checks with their neighbours
  • PR1476 – (installer) Confine the attachment path and keep exception text out of the trace
  • PR1479 – (installer) Only protect an upload tree J2Commerce owns, close the relocation window
  • PR1480 – fix(core) Align the download root guard with the other readers of the same param
  • PR1481 – Fix content plugin: duplicate content + access to editable content
  • PR1483 – (checkout) Give the checkout error alerts language keys
  • PR1486 – (language) Number the placeholders a translator cannot reorder
  • PR1487 – (language) complete the shipped locales against the en-US source
  • PR1488 – repair the pt-BR quality defects the inventory documented
  • PR1490 – Fixed missing option to show UPC in product display settings

Added

  • PR1253 – Missing frontend translation keys added
  • PR1254 – Manufacturer filter restriction and AJAX sidebar state seeding
  • PR1256 – Product search results page heading
  • PR1258 – Persian translations for some J2C plugins
  • PR1259 – Product search-results strings translated to 20 locales
  • PR1260 – Checkout-context injection for pseudo-checkout apps
  • PR1262 – Decouple checkout charge amount from order_total via amount_due_now
  • PR1270 – Shared order-transaction ledger
  • PR1274 – Ledger payment strings added to all core locales
  • PR1276 – Persian translations for J2C plugins (extended)

Changed

  • PR1266 – Match category list views in structure and behavior (Bootstrap5 + UIKit)
  • PR1267 – Additional cleanup for tag and category views (Bootstrap5/UIKit consistency)
  • PR1281 – Flag orphaned menu items on dashboard with one-click unpublish
  • PR1283 – Ship lib_j2commerceflow shared flow/journey UI SDK
  • PR1284 – process queue across all types, release unhandled items

Fixed

  • PR1251 – Checkbox for agreeing to terms and conditions not working properly
  • PR1252 – Descriptions not showing in category views and modules
  • PR1255 – Finder product links now inherit article access (not product access)
  • PR1257 – Product gallery thumbnails kept square
  • PR1261 – Flexivariable SKU/UPC AJAX update uses textContent instead of innerHTML
  • PR1264 – Replace innerHTML/outerHTML/insertAdjacentHTML with inert DOM APIs (XSS hardening)
  • PR1265 – Repair {j2commerce} cart shortcode rendering
  • PR1268 – Price filter not functioning properly in category list view
  • PR1269 – Repair fulfilment API POST id resolution and displayItem signature
  • PR1271 – ShippingStandard::calculateShippingTax() always used exclusive formula incorrectly
  • PR1272 – Render plugin email tags in template preview and test send
  • PR1273 – Repair dead inline help on product, vendor and manufacturer edit screens
  • PR1275 – Currency-aware ledger rounding and batched seeding
  • PR1277 – webhook_id never differentiated by sandbox/live mode
  • PR1278 – send_default_email_template defaults to 0 (like config.xml)
  • PR1280 - sending notifications from PayPal
  • PR1282 - space/none thousands separator and space before post symbol
  • PR1285 - render gateway payment form on zero-total context checkouts
  • PR1286 - surface gateway error detail in payment methods manager
  • PR1287 - clear cart for on-site gateways that finalize inline
  • PR1288 - correct German mistranslation of Tax labels in de-DE
  • PR1290 - reuse existing vendor rows on sample data re-install
  • PR1292 - reuse existing manufacturers, options, categories on sample data re-install

Added

  • PR1243 — Add Persian (fa_IR) translations for all J2Commerce components and modules
  • PR1246 — API: expose linked com_content article and custom fields (jcfields) on product item endpoint (GET /v1/j2commerce/products/{id})

Changed

  • PR1235 — Sync Products Tags model/view documentation to match Products (add missing use statements)
  • PR1241 — Drop redundant COM_J2COMMERCE_* key copies from mod_j2commerce_quickicons language files (21 languages affected)

Fixed

  • PR1230 — Replace deprecated text-muted with text-body-secondary in order view (Bootstrap 5 compat)
  • PR1234 — Replace deprecated Toolbar::getInstance() in 3 toolbar Field classes
  • PR1236 — Display price now uses display options for tax information
  • PR1238 — Live tracking-number display after AJAX save + always show manual tracking editor on shippable orders
  • PR1239 — Require core.edit ACL on all 7 order AJAX endpoints (not just CSRF token)
  • PR1240 — Drop bogus Content-Type: application/json on body-less GET in doTask() (fixes 415 on WAF-hardened servers)
  • PR1242 — Swap deprecated CMS HttpFactory for framework HttpFactory in GeocodingHelper (Joomla 7 prep)
  • PR1244 — Follow-up to #1236: missing frontend language keys for include/exclude tax; remove duplicate info from displayPrice()
  • PR1245 — Fix inconsistencies between product display and cart with inclusive/exclusive prices; fix adding tax twice; coupon tax handling
  • PR1247 — Fix accented characters in any language will be safely escaped as proper JS string literals
  • PR1249 — Fix: Cannot enter multiple admin emails in the store configuration
  • PR1250 — Fix: wrong casing in ShippingToolbar field name

Added

  • PR1196 – add web-services API component + fulfilment endpoints
  • PR1203 – checkout collapsible custom fields behind an "Add" link
  • PR1204 – add CustomizeRenderLayout instrumentation seam to ProductLayoutService
  • PR1207 – Add Persian (fa-IR) translation: pkg_j2commerce.sys.ini
  • PR1211 – Add Persian (fa-IR) translation: com_j2commerce.ini
  • PR1212 – checkout add paymentMethodsOnly task for fast payment-list refresh
  • PR1214 – add feed + JSON product views
  • PR1216 – Add Persian (fa-IR) translation: administrator/components/com_j2commerce/language/
  • PR1217 – show payment-method description subtitle in checkout
  • PR1224 – dispatch onJ2CommerceAfterSaveTrackingNumber on tracking save

Changed

  • PR1221 – normalize subtemplate resolution + uikit3 → uikit folder rename
  • PR1181 – refactor(lib): remove bundled Amazon Pay SDK from shared library

Fixed

  • PR1183 – convert gateway amounts by currency_value for multi-currency orders
  • PR1186 – payment_paypal charge renewal_order_total not renewal_amount
  • PR1191 – checkout: only clear cart when order reaches a placed state
  • PR1192 – missing COM_J2COMMERCE_CART_RETURN key
  • PR1198 – Fix clearContentCaches catches Throwable instead of Exception
  • PR1199 – import j2commerce plugin group before queue dispatch
  • PR1200 – retry failed queue rows in QueueHelper::claimBatch
  • PR1202 – set value_field on queue filter SQL fields
  • PR1209 – checkout: re-sync confirmation to the finalized order for offsite gateways
  • PR1213 – deterministic order-history sort with id tiebreak
  • PR1218 – cart respect config_including_tax in line-item price display
  • PR1220 – Fix capitalization in LocalizationData type
  • PR1223 – add order-status strings for 3rd-party extensions
  • PR1226 – tax surface plugin-injected tax profiles in product/category dropdowns

Added

  • PR1178 - Add missing Iran province Alborz
  • PR1172 - onJ2CommerceGetAnalyticsChartTabs plugin event
  • PR1173 - Build: persistent dev-build counter, strip 4th version segment
  • PR1174 - Plugin extension points for order summary + payment info
  • PR1175 - Generic plugin hooks for protected file download

Fixed

  • PR1177 - TaxProfile field None option + Linux casing in scaffold stubs

Update J2Commerce through the Joomla updater.

Read the Security Advisories Browse Extensions

Download J2Commerce 6 and start selling today.