CoCart Community v4.9.7 closes a REST authentication gap first introduced in 4.9 and we’ve applied the same fix directly to each affected release.
CoCart v4.9.5 is a small, focused security release. If you’re wondering whether this needs careful staging before you roll it out — it doesn’t. Read on for what changed and why it’s safe to update today. What the Security Patch Does This release hardens how the cart session handler validates the cart key, however it’s…
CoCart Plus 1.6.0 is ready, and it brings login security, richer product data, and a batch of REST API fixes worth knowing about before you upgrade.
4.9 is the biggest release in a while: conditional-request caching via ETags, a dedicated settings page for the first time, a required PHP version bump, and one default-behavior change that existing integrations should check before updating.
This release hardens the login endpoint with a set of new permission and IP-detection hooks, restricts item keys to a safer maximum length, and — across four follow-up patches — fixes a cluster of Session API bugs along with a fatal error in the database update scheduler.
To comply with WordPress directory trademark guidelines, we’ve updated the plugin name from “Headless WooCommerce Made Easy with CoCart” to “Headless eCommerce API for Developers – CoCart”. This is purely a branding change—everything else works exactly the same.