LoginSign Up
← Back to all sparks
V

Virto Commerce

E-COMM
Velocity5.0

Open source B2B commerce platform on .NET

virtocommerce.com ↗

Virto ships several times a week, but the same fix lands three times under three version numbers.

ecommercedotnetmulti-branch-backportsmodular-platformaccess-control
◆Current state
Virto Commerce is publishing constantly and across parallel branches: 3.1053 through 3.1056 on the current line, plus backports onto 3.1039.x and 3.1007.x for customers pinned to older platforms. The recent content is a locked-down admin surface, an API that now returns a login redirect instead of a bare 401, a settings ValueType mismatch that was throwing 500s, and cache-accessor and contention fixes underneath.
◆Where it's heading
Two things are happening at once. The visible one is release hygiene: every fix is fanned out across supported branches within hours, which is what a platform with long-lived enterprise deployments has to do, and which makes the changelog look busier than the underlying change count. The structural one is that the platform keeps shedding built-in subsystems into installable modules — background job handling was pulled out of the core into its own module rather than remaining a platform dependency.
◆Prediction
Expect the multi-branch backport pattern to continue on every fix, and further platform subsystems to follow background jobs out of the core into optional modules that installs opt into.

◆Recent moves

  1. 1d ago

    Cache change token captured before load, not after

    Captures the cache change token before the load rather than after it, closing a window where a concurrent write could be missed. An internal correctness fix with no visible surface.

    View source ↗
  2. 2d ago

    3.1039.8 backports the settings type-mismatch 500 fix

    The settings ValueType fix backported to the 3.1039 line: a setting registered as one type but stored as another in the database or config no longer produces a 500. Same change as 3.1055.0, landed on an older supported branch the same day.

    View source ↗
  3. 2d ago

    Settings type mismatch no longer returns a 500

    A type mismatch between how a setting is registered and how it is stored was turning into a 500 error rather than being coerced or reported. This is the current-line version of the fix that also went to 3.1039.8.

    View source ↗
  4. 2d ago

    3.1007.23 backports admin UI access restrictions

    Admin UI access restrictions backported to the 3.1007 line, the oldest branch still receiving this change. That it reaches that far back indicates the project treats it as a hardening fix rather than a feature.

    View source ↗
  5. 2d ago

    3.1039.7 backports admin access limits and the 302 login redirect

    The 3.1039 branch picks up both changes together: restricted admin UI access and the API returning a 302 to the login page instead of a 401. Identical content to 3.1054.0 on the current line.

    View source ↗
  6. 2d ago

    Admin UI access restricted; API redirects to login instead of 401

    Admin UI access is now restricted, and unauthenticated API calls redirect to the login page rather than returning 401. The redirect helps browser flows but changes what API clients see on an expired session, which integrators will need to handle.

    View source ↗