LoginSign Up
← Back to all sparks
V

Virto Commerce

E-COMM
Velocity5.0

Open source B2B commerce platform on .NET

virtocommerce.com ↗

Virto Commerce adds sign-in audit logging and tightens user deletion security while patching a repeated-sign-in UI loop across all active branches.

ecommerceb2b-commerceaudit-loggingsecurityextensibilitylts-maintenance
◆Current state
Virto Commerce is maintaining three concurrent LTS branches (3.1007.x, 3.1039.x, 3.1060.x) alongside the main 3.107x line. This week added a sign-in audit log, fixed user deletion to accept only user ID rather than username (closing an implicit security gap), introduced module pipeline hooks for post-routing and post-authentication extensibility, and bounded the API key lookup cache. A UI $digest loop that fired on repeated same-tab sign-ins was patched across all branches.
◆Where it's heading
The sign-in audit log and user-deletion ID-only fix indicate Virto Commerce is addressing enterprise compliance and security requirements — likely responding to customer requests in its B2B headless commerce positioning. Module pipeline hooks after routing and authentication expand the extensibility surface meaningfully for self-hosted deployments that need custom middleware or authorization layers. The heavy multi-LTS maintenance load reflects an enterprise customer base slow to upgrade.
◆Prediction
Expect broader audit log coverage for other sensitive actions — profile changes, role assignments, order modifications — as the compliance story gets built out. The multi-LTS pattern suggests a formal LTS support timeline announcement may be coming to rationalize the maintenance load.

◆Recent moves

  1. 1d ago

    Virto Commerce 3.1071.0: sign-in audit log

    Sign-in audit log added to the platform — the first explicit audit trail for authentication events, fitting the B2B enterprise compliance direction evident in recent security-focused changes.

    View source ↗
  2. 4d ago

    3.1007.27

    Backport to the 3.1007 LTS branch of the $digest loop fix that caused UI lockup on repeated same-tab sign-ins.

    View source ↗
  3. 4d ago

    3.1039.12

    Backport to the 3.1039 LTS branch of the same $digest loop sign-in fix — same change as 3.1007.27.

    View source ↗
  4. 4d ago

    3.1070.0

    Main-branch patch for the $digest loop bug on repeated same-tab sign-ins — UI fix with no capability change.

    View source ↗
  5. 10d ago

    3.1060.2

    Module pipeline hooks added after routing and authentication events open a new extensibility surface for custom middleware; bounded API key cache reduces hot-path allocations; user deletion locked to ID-only closes a quiet security gap.

    View source ↗
  6. 10d ago

    3.1069.0

    User deletion now accepts only user ID, never username — a targeted security hardening that prevents accidental or malicious deletion by a predictable identifier.

    View source ↗