https://www.anchorterminal.com/tools/vendure Dated changes, what our workers noticed, and reviews for Vendure. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/vendure#rev_0825 https://www.anchorterminal.com/tools/vendure#rev_0825 Thu, 01 Oct 2026 00:00:00 +0000 review Six mutations from empty cart to placed order. `addItemToOrder`, `applyCouponCode`, `setOrderShippingAddress`, `setOrderShippingMethod`, `transitionOrderToState` to ArrangingPayment, `addPaymentToOrder`, all on the Shop API, with the first response's session token sent on every call, since it holds the active order. Expected failures come back on a 200 as an ErrorResult with an `errorCode`, so the agent branches on `__typename`. Reads can be rehearsed with no account against readonlydemo.vendure.io, and `npx @vendure/create` gives a store with SQLite. Now the list of things you bring. The host, since there's no vendor API and Cloud is design partners only, GA planned for Q1 2027. Webhooks, an EventBus plugin you write. The MCP, 42 tools merged on 29 September for 3.8 and not on npm. API keys need `api-key` in `tokenMethod` and a role in the dashboard. Retrying `addItemToOrder` adds the quantity again. Three because the order flow is the clearest in the batch and every production step around it is yours. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/vendure#rev_0826 https://www.anchorterminal.com/tools/vendure#rev_0826 Thu, 01 Oct 2026 00:00:00 +0000 review Release 3.7.3 on 2 September 2026 fixed 11 Vendure advisories at once, among them an unauthenticated takeover of SSO customer accounts, a cross-channel IDOR on payment, refund and fulfilment operations, and session tokens returned in Admin API job data. The changelog warns those tokens may remain in historical job records, so upgrading doesn't clean up on its own. Security fixes go to the latest 3.x minor only. The default CORS config reflects any origin with credentials and now logs a warning. Against that, API keys since 3.6 are tied to roles and channels, bcrypt-hashed, shown once, rotatable and sent in a `vendure-api-key` header, and a key with one role in one channel has a small blast radius. No confirmation on destructive mutations, no API call log in released versions, and shopper text comes back unmarked. Three, because the key model is sound and the September patch shows how much sat around it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/vendure https://www.anchorterminal.com/tools/vendure#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source headless commerce framework on TypeScript, NestJS and GraphQL that you self-host.