GP247 security

🌐 Language: 🇻🇳 Tiếng Việt · 🇬🇧 English (current) · 🇯🇵 日本語

S-Cart releases and security

Introduction

This page is for S-Cart (3.x line) site owners and operators: it tells you what each release brings, which version to run and how to update. Latest release: S-Cart 3.5.0 (2026-11-03).

Run php artisan gp247:info (or composer show "gp247/*") and compare each line with the Recommended minimum column:

Package Recommended minimum Latest
gp247/core 3.6.0 3.9.0
gp247/front 3.2.3 3.5.2
gp247/shop 3.6.0 3.7.0
gp247/mcp 2.0.1 2.0.1
  • Below the "Recommended minimum" column → update when you can.
  • At or above it → your site has all the important improvements, even if you have not reinstalled S-Cart.

⚠️ Note: update all the packages together: gp247/mcp 2.0.1 needs gp247/core ≥ 3.9, gp247/shop 3.6.0 needs gp247/core ≥ 3.7, gp247/front 3.2.3 needs gp247/core ≥ 3.2.3. Which lines are still supported: see Support lifecycle.

Support lifecycle

Line Platform Status Security fixes until
3.x Laravel 13 · PHP 8.3+ ✅ Supported March 2028
2.x and earlier Laravel 12–13 ⛔ No longer supported —
  • New features go into the newest line only.
  • When a new line ships: the previous line gets critical bug fixes for 6 more months and security fixes until the time in the table — never past the security support of the Laravel version that line runs on.
  • Sites still on 2.x or earlier: they keep running but receive no more fixes. Move to 3.x with composer update and php artisan gp247:update — see the v3.0 notes.

Highlights

  • MCP server built into S-Cart — ask and manage your shop with the AI agent you already use (S-Cart 3.5)
  • The agent looks things up for you — sales, low stock, orders, customers, with the right permissions (S-Cart 3.5)
  • Write actions are always confirmed — preview before changing an order status or stock (S-Cart 3.5)

How to update

Step 1 — Back up the database and the site folder.

Step 2 — Update the code:

composer update gp247/core gp247/front gp247/shop gp247/mcp

A site installed before S-Cart 3.5.0 has no MCP server yet: run composer require gp247/mcp -W once instead of the command above.

Step 3 — Apply data, configuration and cache updates:

php artisan gp247:update

Step 4 — Check the versions again with php artisan gp247:info.

A release may need extra steps — see its 📋 To do when updating below. Step-by-step details: Updating GP247.

Releases

Newest first. An x.Y release brings new features; an x.y.Z release only fixes bugs.

S-Cart 3.5.0 — 2026-11-03

Built-in MCP server: ask and manage your shop with the AI agent you already use.

✨ New

  • MCP server built into S-Cart — connect Claude, Cursor or VS Code to your shop and ask in plain language; off by default (docs)
  • The agent looks things up for you — sales, low stock, orders, customers, recent changes; with the account's own permissions
  • Write actions are always confirmed — order status, shipping status, stock in/out: preview first, then confirm; off by default
  • The extension library shows "Core X.Y+" — see at once which core an extension needs
  • For developers: gp247:mcp-install / gp247:mcp-update / gp247:mcp-uninstall; gp247:info lists gp247/mcp; the minUpdateFrom manifest key replaces requireUpdateFrom (the old key is still read)

📋 To do when updating

  • (Site installed before S-Cart 3.5.0) run composer require gp247/mcp -W once, then php artisan gp247:update
  • (Using the McpServer plugin) gp247:update moves tokens, settings and permissions; then remove the plugin folder with php artisan gp247:ext-uninstall --type=plugin --key=McpServer --purge; the MCP screens are now under System config → MCP Server

Includes core 3.9.0 · front 3.5.2 · shop 3.7.0 · mcp 2.0.1 · GitHub Release

S-Cart 3.4.0 — 2026-11-02

Sell through your own app and sync with your ERP over the REST API.

✨ New

  • Sell through your own app — the store's app keeps the cart, places orders and pays online through the API; the site owner turns on "Orders via API" (docs)
  • Customer accounts in the app — sign up, password reset, profile, address book; long sign-ins with a refresh token
  • Sync with ERP and warehouse software — update order status, tracking numbers, prices and stock through the admin API, with the same permissions as the admin screens
  • Event log and webhooks — the ERP knows at once when orders, stock, products or customers change; off by default
  • Faster apps — fetch only the fields you need; unchanged data is not downloaded again (304)
  • For developers: an extension point for two-factor authentication (MFA) on API sign-in; Idempotency-Key against duplicate writes; an API deprecation policy; generate a TypeScript client from openapi.json

🐞 Fixes: out-of-stock products still showed the buy button; sign-up and password change accepted an empty password; the API answered 500 without an Accept header

📋 To do when updating

  • Run php artisan gp247:update — it creates the API session, event log and webhook tables and the sync indexes
  • (Stock management on without stock entered) turn off Stock management or turn on Allow selling when out of stock, otherwise the buy button disappears on products with 0 stock
  • (Several apps sharing one API account) the 1000 requests/minute limit now counts per account — split the accounts or raise GP247_API_THROTTLE

Includes core 3.8.0 · front 3.5.0 · shop 3.7.0 · GitHub Release

S-Cart 3.3.1 — 2026-10-29

A contact form with an inbox, and the REST API switched on and off from the admin.

✨ New

  • Contact inbox in the admin — read every message customers send, right in the admin
  • Turn the REST API on or off, and each API version, from the API management screen — no config file to edit (docs)
  • Failed login limit — stops admin password guessing
  • For developers: REST API v2 for products, orders, banners and pages (with filters and final price); every API response carries a request id for log lookups

🐞 Fixes: the social sharing image (og:image) used the wrong picture for a page; the admin order API answered 500; the web server follows the stable nginx channel and unused PHP features are turned off (running with Docker)

📋 To do when updating

  • Run php artisan gp247:update — it hashes API keys and gives old tokens an expiry
  • Rename GP247_API_LOGIN_THROTTLE → GP247_LOGIN_THROTTLE and GP247_API_LOGIN_IP_THROTTLE → GP247_LOGIN_IP_THROTTLE (the old names are no longer read)
  • Apps calling the API: log out with POST (GET is being retired), and move to API v2 over time
  • (Running with Docker) pull the new images and rebuild, following "Security updates" in DOCKER.md

Includes core 3.5.0 · front 3.3.0 · shop 3.3.1 · also covers 3.3.0 (2026-10-28) · GitHub Release

S-Cart 3.2 — 2026-10-23

Japanese, standard shipping with shipments, and a storefront theme that updates with the package.

✨ New

  • Standard shipping — carriers, shipments, wards; track deliveries right in the order (docs)
  • Japanese and the Japanese yen (JPY) ready on a fresh install — sell to the Japanese market (docs)
  • The GP247Front theme runs straight from the package — composer update brings the new look, publish only the files you want to change (docs)
  • Payment instructions at checkout — customers know how to pay by bank transfer (docs)
  • Wishlist and compare right on the product page
  • For developers: plugins can add storefront blocks and extension points without owning a template; a "Check before use" box tells what a plugin still needs configured

🐞 Fixes: wishlist/compare buttons on product cards were not visible; "too many redirects" when removing from the wishlist; page links stacked vertically

📋 To do when updating

  • Sites that published the whole theme can run php artisan gp247:template-prune GP247Front --dry-run to hand unchanged files back to the package

Includes core 3.2.0 · front 3.2.0 · shop 3.2.0 · GitHub Release

S-Cart 3.1 — 2026-10-03

Payment requests outside the cart, and stored passwords and payment keys encrypted.

✨ New

  • Payment requests — send online payment links, record money in/out by hand, refund, with no order needed (docs)
  • SMTP passwords and payment gateway keys encrypted in the database, with a key rotation command (docs)
  • Plugins per store — configure and enable them separately (multi-store sites) (docs)
  • Admin action log — see who changed what
  • For developers: gp247:doctor reports PHP files with a BOM; error reports say which site they came from

🐞 Fixes: Email/SMTP settings did not always save; customers without an email were reported as duplicates; order-total promotion codes were not applied

📋 To do when updating

  • Run php artisan gp247:update
  • (Running with Docker) the production stack refuses to start while .env still holds the sample passwords

Includes core 3.1.0 · front 3.0.0 · shop 3.1.0 · GitHub Release

Older releases

Release Date Summary
S-Cart 3.0.1 2026-09-04 Old sc:* commands removed, use the gp247:* commands — command list
S-Cart 3.0 2026-08-30 Start of the 3.x line: a payment ledger per order, discounts taken before tax — v3.0 notes

Security

Keeping a site secure is more than updating — configuration, encryption keys, backups, accounts and incident response are covered in GP247 system security.

GP247 reviews security regularly, and improvements ship in every release. The simplest way to keep your site safe is to run at least the versions in Recommended versions and update when a new release comes out.

Server software (PHP, web server)

Flaws in PHP and the web server are fixed by their own vendors, not by a GP247 release — keep them up to date as well.

Issue Severity Fixed in PHP
PHP2Shell — remote code execution (CVE-2026-109618, CVE-2026-109619) · 2026-10-21 Critical 8.3.36 · 8.4.27 · 8.5.12

What to do

  • Check your PHP version: php -v, or Admin → Server info.
  • PHP from the official releases (php.net, the official Docker images, most control panels that let you pick a version): move to the fixed version of your branch, or later.
  • PHP managed by your Linux distribution (Ubuntu, Debian, RHEL…) or hosting provider: these vendors often patch an older version number, so the number alone does not tell you whether you are safe — install the latest operating system updates, or ask your provider whether CVE-2026-109618 and CVE-2026-109619 are patched.
  • Cannot update yet: set session.upload_progress.enabled = Off in php.ini (GP247 does not use this feature) and restart PHP. It lowers the risk; it does not replace the update.
  • Running with Docker: follow "Security updates" in DOCKER.md.

Reporting a vulnerability

If you find a vulnerability, please email support@gp247.net — do not open a public GitHub issue, so the problem is not exposed before a fix is released.

📅 Last updated: 2026-11-04 · ✍️ Author: GP247