[-] LiteCart 2.7.1

Security release mainly containing security enhancements and fixes.

[-] LiteCart 2.7.0

! Fix #539 - Docker container fail: mysqli readiness probe with timeout
! Security improvements and enhancements
+ Add MCP Server with support for tools and resources
+ Add URL type Domain + Path
+ Add price history collection as enforced by EU Omnibus directive
+ Add EU law enforced withdrawal button
+ Add auto-install via CLI installer on first Docker start
+ Add CSRF protection for all state-changing requests
+ Add Docker development environment, default to utf8mb4
+ Add escape_attr() used by addons that are 3.0 compliant
+ Ability to open original logotype in Appearance
+ Add support for rlink() params
* Add X-Robots-Tag: noindex to search page
* Fix category picker search only matching direct children of the current parent
* Fix restricted admins getting Access Denied on JSON/picker helpers
* Don't inject the lightbox for AJAX/XHR requests (prevents recursive loads)
* Fix sessioin issues (non-HTTPS and hen and the egg problem)
* Fix compact_category_tree CSS/JS selectors missing .card-body
* Fix CLI installer failing with undefined client_ip and relative paths
* Fix #498 - Geo Zones: pending Add row dropped silently on Save
* Fix #501 - category attributes filter crashes on non-array input
* Fix race condition in cache cleaner job
* Catch UnexpectedValueException instead of is_dir guard
* Fix issue #334 - Image meta rotation
* Fix featherlight loader white background
* Harden HTTP security headers, add per-user error display toggle
* Rename DB_SERVER_SECRET to HMAC_KEY_REMEMBER_ME
* Replace SHA1 remember-me with HMAC-SHA256 tokens
* Fix passing an invalid charset
* Fix list missing entity translations if a row with language code is missing in _info table
* Fix issue #405 - Remove duplicate categoryPicker
* Fix header warning when accessing install.php after installation
* Fix array values in radio and checkbox
* Fix issue #394 - Add unique key for product_id and filename
* Fix PHP warning on array options
* Fix warning if manipulated session ids
* Polish JSON-LD schema
+ Fix multibyte safe word wrapping for SMTP delivery
* Fix Product Picker
+ Fix #544 - Detect truncated POST and show actionable warning
* Fix for PHP 8.5 - Function imagedestroy() is deprecated since 8.5, as it has no effect since PHP 8.0

[-] LiteCart 2.6.3

+ Allow trailing slash on Contact Us
+ Minify scripts and update checksums
+ Switch JS "eval" string for window function ref
* Adjust feedback for missing Imagick support
* Developer related updates and adjustments
* Ensure RGB colorspace to avoid issues with CMYK as reported in AVIF...
* Fix a bunch of Imagick transparency issues
* Fix add missing handling fee
* Fix colorat out of bounds during GD trim() image
* Fix delete vmod
* Fix header overwrite issue
* Fix inability to input price in cents e.g. 0.95
* Fix installed version vmod comparison
* Fix issue #361 - Sort products
* Fix issue #363 - Add missing index for date_created
* Fix issue #364 - media max-width
* Fix issue #366 - Add index for category_id in lc_products_to_catego...
* Fix issue #366 - Add missing indexes for lc_products_campaigns
* Fix issue #367 - PHP 5.6.x compatibility
* Fix issue #368 - Fill whitespace color
* Fix issue #369 …
* Fix missing group by
* Fix obsolete use of route::indentify()
* Fix overwrite image
* Fix select manufacturer width
* Fix set name and sku
* Fix uglify script command
* Fix undefined constant error
* Fix unintentional bold
* Fix unreliable parse_url()
* Merge pull request #358 from IBBoard/customer-service-with-slash
* Move session security timestamp setting
* Remove some more special characters from path friendly name
* Rename DEVELOPERS.md to CONTRIBUTING.md
* Replace en-dash and m-dash with hyphens in urls/filenames
* Set checkout to 1280 wide instead of 1440
* Update form function type to new syntax
* Updates for PHP 8.4
* Use blank layout for error page in backend
Released Oct 17 2025

[-] LiteCart 2.6.2
Download

+ Who Purchased report
+ Add url() to form functions
* Fix shipping and payment fee in RTL
* Fix rename enable/disable vMod
* Fix loading of multiple custom attributes
* Fix check products for options during attribute deletion
* Fix product attribute index
* Fix PHP warning for missing HTTP POST param
* Fix domestic name alias
* Fix search params when setting sort parameter
* Fix vMod filename when downloading
* Fix issue #354 - Tax calculation does not take campaign price into consideration
* Fix dock under parent
* Fix early word wrapping should be handled in sending component instead
* Fix halt on invalid characters causing MySQL to panic
* Fix CLI installer
* Fix issue #356
* Fix PHP notice when no payment option was set
* Fix admin session language
* Fix sub page nesting
* Ensure loading of lightbox components
* Remove last empty line from CSV
* Log last email errors to entity
* Unset memory_limit during error log processing
* Payson discontinued by Svea
* Ability to set no thousands separator
* Split long lines into segments
* Add ability to filter Most Sold Products by manufacturer or country
* Ability to filter Most Shopping Customers by country
* Ability to filter Monthly Sales by country
* Clean up orphan product attributes
* Add installation parameter validations just in case something malicious is being passed
* Swap sprintf() to strtr() to prevent crashing with UTF-8 byte characters
* Pass given parameters as query parameters if the process method is HTTP GET
- Remove CSV as a selectable storage engine
- Remove CSS framework example file
Released Mar 11 2025

[-] LiteCart 2.6.1
Download

+ Highlight critically logged errors in Log Viewer
+ Add og:imagewidth and og:image:height
+ Add CAPTCHA when unsubscribing from newsletter
+ Also match phone number when searching for orders
+ Show elapsed script time in error log
+ Highlight and prioritize critical errors in error log viewer
* Cache variables rather than output for manufacturer links
* Cirumvent floating point precision problem for form input decimal fields
* Adjust long script execution time logging
* Adjustments for PHP 8.4 compatibility
* Adjust Featherlight gutter for mobile
* Fix settings key name causing merchant's order copy to not being sent
* Fix country reference when setting store_zone_code
* Fix postcode for Nicaragua
* Fix error reporter background job firing abnormally or not at all
* Fix similar products not displaying
* Fix update weight and dimensions when editing order items
* Fix textarea height in Edit vMod
* Fix dark mode input text color and polishing
* Fix delete translations accidentally removing too many on the page
* Fix thumbnail name when one side is omitted
* Fix settings key name causing order copies not being sent properly
* Prioritize critical errors in reports
* Update to latest font versions
* Update Twitter icon with X
* Update error handler
- Remove obsolete enable crypto causing error causing smtp to fail
- Remove stream context from http wrapper as not fully implemented
- Remove Not Found logging and reporting
- Remove site manifest to get rid of app install banner
Released Dec 2 2024