What shipped in Vendure this summer
Summer is usually the quiet season. This one wasn't. Since the start of June we have merged more than 340 pull requests into Vendure Core, across one minor release and three patches. We also released a new open-source storefront starter, fixed 15 security advisories, and changed how we handle community contributions.
Here is the round-up, in case you have been away from the changelog.
v3.7 and the new CLI commands
Vendure Core v3.7 landed on 1 July with 152 commits from 34 contributors. Most of the work went into developer experience.
Three commands now run a project, so you no longer need your own ts-node and concurrently scripts:
vendure doctor checks a project and reports what is wrong with it: project layout, dependencies, config, schema and database. It takes --format json and --strict, so you can run it in CI.
The add, migrate, schema and codemod commands now fail fast when run in non-interactive mode. If you run Vendure commands in CI, or behind a coding agent, that is the change you will notice first.
New projects ship an AGENTS.md file, and one command installs Vendure skills for coding agents:
15 security advisories
In 3.7.2 and 3.7.3 we fixed 15 reported vulnerabilities and published them as GitHub security advisories, crediting the researchers who found them.
Most of the advisories related to weaknesses in the isolation between channels in a multi-channel Vendure installation, which could allow unintended access from one channel to another.
Michael, who has written most of Vendure over the past eight years, pointed out where they came from:
All of these vulnerabilities come from code that was written before AI, mainly by myself. And I am pretty sure the issues were discovered by AI.
Michael Bromley · CTO and co-founderThe usual story is that AI writes insecure code, but in this case it was totally the opposite. We wrote that code by hand years ago, and an agent is what found the flaws.
Some of these fixes change behaviour, particularly around delegated administrator accounts and external or SSO logins. Read the behaviour-change section of each release note first. If you are running any earlier 3.x version, upgrade to 3.7.3.
Thanks to everyone who reported responsibly.
Three patches
The same patches brought a longer list of fixes. Relation custom fields now resolve in batches per request, which cuts repeated database queries on large responses, and seller orders in multi-vendor setups keep their shipping lines when an order is split. The CLI also understands monorepos now, which matters if your Vendure app sits in a workspace alongside the rest of your packages. The release notes have the full list.
How we review your pull requests now
Community pull requests have arrived faster all year. The same tools that help us audit a codebase let anyone open a good-sized PR in an afternoon, and by the start of September our review queue had peaked at about 77 open pull requests.
So we changed the rule. When a pull request is worth having but needs work, we no longer request changes and wait. We make the changes ourselves, push them to the branch, and merge.
Waiting cost us more, because every round trip meant tracking a PR until the author replied and then re-reading the whole thing days later to judge it again. By 11 September the queue was down to 45.
If you have a PR open, you may find commits on your branch that you did not write. We would rather merge your work than leave it waiting on a review thread.
A storefront starter on TanStack Start
In August we released an open-source TanStack Start storefront starter under the MIT licence. It covers browsing, accounts, cart and checkout, with localisation included. There is a live demo, and the source is yours to fork.
We started measuring how the docs get used
As part of improving developer experience, we have been looking at what happens after someone lands on a docs page. Page views tell you that a page was opened, not whether it answered anything, so in August we added developer insights to the documentation site and the public Vendure Docs MCP server. They show which searches come back empty, which pages help, and where agent tool calls fail.
People are no longer the only readers. A developer opens the docs to learn a concept. An agent may read fifty pages during one task. We would rather decide what to rewrite from evidence, and that work starts in October.
Where to jump in
A lot of Vendure is built by people who do not work here. There are 34 issues labelled contributions welcome, which is the best place to start.
Work on v3.8 is under way in the open. Bug reports, reproductions and pull requests are all useful. So is telling us what you are building. Discord is the fastest way to reach us.
Share this article
Worth reading, once a month
Product updates, customer stories, and engineering thinking, delivered monthly.
You may also like
