Pricing

CoCart Community 4.8 Release Notes

  • Release date: 4.8.0 shipped 22nd September, 2025; this post covers patches through 4.8.4 (21st April, 2026).
  • Backward compatible: Yes
  • Database/config update required: No
  • Minimum requirements: No change to minimum versions in this series.
  • Tested with: WooCommerce 10.7

Login endpoint: new permission and IP-detection hooks

The login endpoint’s permission handling got a full pass. It now loads the session handler during login operations, and JWT Auth integration runs earlier in the authentication order (previously deprioritized).

IP address detection (get_ip_address) was refactored for proper trusted-proxy support, reading additional headers for better accuracy. If you run CoCart behind a load balancer, CDN, or reverse proxy, this is directly relevant — you’ll likely want to register your proxy explicitly:

// Trust your load balancer / CDN's IP range so IP detection is accurate
add_filter( 'cocart_trusted_proxies', function( $proxies ) {
    $proxies[] = '203.0.113.0/24'; // replace with your proxy's IP/CIDR
    return $proxies;
});
// Optionally customize which headers are checked for the real client IP
add_filter( 'cocart_ip_headers', function( $headers ) {
    $headers[] = 'X-My-Custom-IP-Header';
    return $headers;
});

New hooks for controlling login access:

  • cocart_login_permission_callback — filter, run additional authentication checks after CoCart’s basic authorization on the login endpoint.
  • cocart_login_secure_auth_methods — filter, determines which authentication methods should skip those additional checks.
  • cocart_login_query_parameters — filter, add extra accepted query parameters to the login endpoint.
  • cocart_login_permission_granted — action, fires when login permission is granted.

Separately, item keys are now restricted to a maximum of 32 characters for tighter validation, and is_user_customer() was refactored to support user roles beyond just “customer” — useful if your store uses custom roles for B2B or wholesale accounts.

Session API fixes

4.8.1 (24th November) Fixed a cluster of Session API bugs:

  • Undefined-error responses when a session had no customer data, no applied coupons, or removed items.
  • Customer data not converting correctly.
  • The product object not passing through correctly for session items.
  • Damaged or empty cart sessions failing outright.

4.8.2 (20th January, 2026) A maintenance release:

  • Resolved PHP coding-standard issues surfaced by the WordPress Plugin Checker.
  • Tested with WordPress 6.9 and WooCommerce 10.4.

4.8.3 (26th January) A maintenance release:

  • Fixed customer address updates not persisting after the first one was placed.
  • Corrected error responses so all expected headers are returned
  • Updated broken external documentation links throughout the plugin.

4.8.4 (21st April) A maintenance release:

  • Fixed a fatal error caused by a sprintf() typo in the database update scheduler.
  • Corrected the Access-Control-Allow-Credentials CORS header being applied incorrectly.
  • Fixed an uncaught type error when Load Cart merged an empty cart value (reported by community member @allkhor).
  • Made the “Load Cart” deprecation warning only trigger when the cocart_load_cart_override hook was actually in use.

Breaking changes & deprecations

No breaking changes in this release series — it is a drop-in upgrade across 4.8.0 to 4.8.4

,