chore: next version release

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@shopware/api-client@1.7.0

Minor Changes

• #2702 44ece9d Thanks @mkucmus! - Added isTimeoutError() to tell a request that ran into fetchOptions.timeout apart from other errors. Such a request rejects without an HTTP status, so instanceof ApiClientError does not match it. The request may already have reached the API and been processed, so the server-side outcome is unknown, and a mutation must not be retried without checking.

  A per-request signal no longer switches off timeout. Both are combined, so whichever fires first aborts the request. Before, ofetch ignored timeout as soon as a signal was set. Combining needs AbortSignal.any, so runtimes without it keep the old behaviour. The admin client forwards the signal and timeout to its token refresh as well.

  A timeout is now validated before it is used. It is rounded up to whole milliseconds and capped at the largest value a timer can hold, and a value that is not a finite positive number is ignored instead of failing the request. A per-request timeout: undefined now falls back to the client timeout instead of dropping it.

Patch Changes

• #2708 4b43e64 Thanks @patzick! - Add WithApiOverrides to merge local operation or schema overlays onto the types shipped with the client.

@shopware/nuxt-module@1.6.0

Minor Changes

• #2693 9d4710c Thanks @mkucmus! - apiClientConfig.timeout now works. Set it in milliseconds under runtimeConfig.apiClientConfig or runtimeConfig.public.apiClientConfig, next to headers, and the plugin forwards it to the API client. Unset by default. Only a positive number arms it, and a numeric string is coerced. Any other value is ignored and logged once as a warning naming the config path the value came from, instead of being dropped silently. It aborts a request whose response headers do not arrive in time, including one still opening its connection. It does not abort a response that stalls after its headers arrived, unless the call passes its own signal.

  apiClientConfig under the shopware module options is deprecated, and now works as a fallback. It had never been read before, so a value set there in the past becomes active with this release. It is read last, only when neither runtimeConfig path holds a valid value, and Nuxt warns at build time when a timeout is set there. Move to runtimeConfig.apiClientConfig; the fallback goes away in the next major.

Patch Changes

• Updated dependencies [44ece9d, 0df4c17, 4b43e64]:
  • @shopware/api-client@1.7.0
  • @shopware/composables@1.13.1

@shopware/api-gen@1.5.3

Patch Changes

• Updated dependencies [44ece9d, 4b43e64]:
  • @shopware/api-client@1.7.0

@shopware/cms-base-layer@4.0.1

Patch Changes

• Updated dependencies [44ece9d, 0df4c17, 4b43e64]:
  • @shopware/api-client@1.7.0
  • @shopware/composables@1.13.1

@shopware/composables@1.13.1

Patch Changes

• #2700 0df4c17 Thanks @mdanilowicz! - Refresh the cart after register()

  useUser().register() changed the session context without refreshing the cart, while login() and logout() both did. Registration is the first point at which the backend learns the customer's billing country, which drives tax rates, shipping surcharges and customer-group prices, so the cart totals held in useCart() could stay at their pre-registration values while the order was placed at the recalculated ones.

  register() now awaits refreshCart() after refreshSessionContext(), so a caller that awaits register() cannot observe the pre-registration totals afterwards. Note this makes register() resolve slightly later than before, and a failing cart refresh now rejects register() even though the customer was created — the same property refreshSessionContext() on the preceding line already had.

  login() and logout() still call refreshCart() without awaiting it and are unchanged here.

• Updated dependencies [44ece9d, 4b43e64]:

  • @shopware/api-client@1.7.0

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontends-starter-template-extended	Ready	Preview	Sep 10, 2026 6:21pm UTC
frontends-vue-starter-template	Ready	Preview	Sep 10, 2026 6:21pm UTC

[cursor]

Stale comment

Security review

No medium, high, or critical findings.

This is a Changesets release PR (changeset-release/main, 6de2e771). It consumes .changeset/slim-api-types.md and applies patch version bumps plus CHANGELOG/README “Latest changes” updates for @shopware/api-client 1.6.1, @shopware/api-gen 1.5.3, @shopware/cms-base-layer 4.0.1, @shopware/composables 1.13.1, and @shopware/nuxt-module 1.5.3.

There is no runtime, config, lockfile, or dependency-graph change, so no new attacker-controlled input path or supply-chain surface.

No prior automation security threads to re-validate.

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

[cursor]

Stale comment

Security review

No medium, high, or critical findings.

Re-reviewed after synchronize (9e3a004). This remains a Changesets release PR: it consumes .changeset/api-client-timeout-signal.md and .changeset/slim-api-types.md, then applies version + CHANGELOG/README “Latest changes” updates for @shopware/api-client 1.7.0, @shopware/api-gen 1.5.3, @shopware/cms-base-layer 4.0.1, @shopware/composables 1.13.1, and @shopware/nuxt-module 1.5.3.

There is still no runtime, config, lockfile, or dependency-graph change in this diff, so no new attacker-controlled input path or supply-chain surface. The timeout/signal and type-override work already landed on main (#2702, #2708) and is not introduced here.

Prior automation review had no finding threads to re-validate.

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

[cursor]

Stale comment

Security review

No medium, high, or critical findings.

Re-reviewed after synchronize (d8f8bbf). This remains a Changesets release PR: it consumes .changeset/api-client-timeout-signal.md, .changeset/slim-api-types.md, and .changeset/olive-pandas-wait.md, then applies version + CHANGELOG/README “Latest changes” updates for @shopware/api-client 1.7.0, @shopware/api-gen 1.5.3, @shopware/cms-base-layer 4.0.1, @shopware/composables 1.13.1, and @shopware/nuxt-module 1.6.0.

There is still no runtime, config, lockfile, or dependency-graph change in this diff, so no new attacker-controlled input path or supply-chain surface. The timeout/signal, type-override, and apiClientConfig.timeout work already landed on main (#2702, #2708, #2693) and is not introduced here.

Prior automation review had no finding threads to re-validate.

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

[cursor]

Stale comment

Security review

No medium, high, or critical findings.

Re-reviewed after synchronize (e31ff06). This remains a Changesets release PR: it consumes .changeset/api-client-timeout-signal.md, .changeset/slim-api-types.md, and .changeset/olive-pandas-wait.md, then applies version + CHANGELOG/README “Latest changes” updates for @shopware/api-client 1.7.0, @shopware/api-gen 1.5.3, @shopware/cms-base-layer 4.0.1, @shopware/composables 1.13.1, and @shopware/nuxt-module 1.6.0.

There is still no runtime, config, lockfile, or dependency-graph change in this diff, so no new attacker-controlled input path or supply-chain surface. The timeout/signal, type-override, and apiClientConfig.timeout work already landed on main (#2702, #2708, #2693) and is not introduced here.

Prior automation review had no finding threads to re-validate.

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}

[cursor]

Security review

No medium, high, or critical findings.

Re-reviewed after synchronize (c18dc2d). This remains a Changesets release PR: it consumes .changeset/api-client-timeout-signal.md, .changeset/slim-api-types.md, .changeset/olive-pandas-wait.md, and .changeset/lucky-carrots-refresh.md, then applies version + CHANGELOG/README “Latest changes” updates for @shopware/api-client 1.7.0, @shopware/api-gen 1.5.3, @shopware/cms-base-layer 4.0.1, @shopware/composables 1.13.1, and @shopware/nuxt-module 1.6.0.

There is still no runtime, config, lockfile, or dependency-graph change in this diff, so no new attacker-controlled input path or supply-chain surface. The timeout/signal, type-override, apiClientConfig.timeout, and register() cart-refresh work already landed on main (#2702, #2708, #2693, #2700) and is not introduced here.

Prior automation review had no finding threads to re-validate.

  

_{Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge}