LoginSign Up
← Back to all sparks
V

Virto Commerce

E-COMM
Velocity6.3

Open source B2B commerce platform on .NET

virtocommerce.com ↗

Virto Commerce spends two days backporting a CVE fix and a new auth connection string.

ecommerce platformoauthsecurity patchesbackportsauthentication
◆Current state
Virto Commerce ships numbered platform releases several times a week plus backports. Earlier in November 3.1095.0 and 3.1096.0 let admins register OAuth applications, including AI agent clients, and added a consent page. On November 12 and 13 the main line (3.1098.0, 3.1099.0) and the 3.1076, 3.1039 and 3.1010 support branches got a SignalR Redis bump for a CVE and support for a separate security database connection string.
◆Where it's heading
The OAuth and agent-client work is followed by maintenance spread across four supported branches at once. Security fixes land on old branches within a day, which matters to the long-running B2B installs Virto targets.
◆Prediction
Expect the next main-line releases to build on the OAuth application work, with backports continuing on the 3.1076 and 3.1039 branches.

◆Recent moves

  1. 18h ago

    3.1010.1 reads a separate auth database connection string

    The oldest supported branch gets support for a dedicated VirtoCommerce.Auth connection string. Part of a four-branch backport the same afternoon.

    View source ↗
  2. 18h ago

    3.1039.19 backports the auth database connection string

    The 3.1039 branch gets the separate security database connection string and a CI workflow update. Backport only.

    View source ↗
  3. 18h ago

    3.1076.15 backports the auth database connection string

    Same change as 3.1099.0 on the 3.1076 support branch. Maintenance.

    View source ↗
  4. 19h ago

    3.1099.0 lets the security database use its own connection string

    The main line can now read the security database from a dedicated connection string, letting operators split auth data from the commerce database. A deployment option, then backported to three older branches.

    View source ↗
  5. 1d ago

    3.1076.14 patches a SignalR Redis CVE

    The 3.1076 branch bumps SignalR.StackExchangeRedis to 10.0.15 for CVE-2026-114147. A same-day security backport.

    View source ↗
  6. 1d ago

    3.1039.18 patches a SignalR Redis CVE

    The 3.1039 branch gets the same SignalR Redis bump for CVE-2026-114147. Security backport only.

    View source ↗