Spree 6.0.3

A patch release for Spree 6.0. PayPal is back as an official payment provider that ships with Spree, AI agents connected to your store can now run every back-office action the Admin API offers, product lists show stock totals, and saving a product no longer drops categories or tags added elsewhere.

npx spree upgrade

✨ New features

• PayPal for Spree 6. The spree_paypal_checkout gem now ships with Spree at the same version. It offers PayPal, Pay Later, Venmo and guest card payments in PayPal's window, honors your capture setting, and registers its own webhooks, so you only enter a client id and secret. Add it with spree add paypal. #15031 by @mad-eel
• AI agents can run every back-office action. Agents connected through the MCP server or the dashboard assistant can now approve returns, claims and exchanges, clone products, resend invitations and run every other Admin API action, with no extra setup. They can also reach records nested under another one, such as an order's items or a promotion's rules, and set up promotions with rules and actions. #15086 #15094 #15079
• Agents ask for approval only where it matters. Uploading a file, starting an import or creating an export is no longer flagged as destructive, so agent apps can treat them as safe while still asking before deletes, refunds and other changes. #15107
• Activate, archive or draft one product through the API. New Admin API endpoints move a single product's status and send the matching product event, so webhook subscribers hear about the change. #15092

🧭 Admin dashboard improvements

• Stock totals on product lists. The admin products list and the seller panel's products list show each product's units in stock across all its variants. The Admin and Seller APIs return the same figure as total_on_hand. #15106 #15109
• Category mapper preview. The Sellers section shows where the Spree Enterprise page for mapping each seller's own categories to your marketplace's categories will appear once installed. #15111 by @mad-eel

🐛 Bug fixes

• Saving a product keeps the categories, collections and tags added after the page was opened, from another tab, a bulk action or an import. #15111 by @mad-eel
• The admin dashboard works when opened over plain HTTP at an address other than localhost, such as a server's IP address; saving no longer fails with "crypto.randomUUID is not a function". #15087
• A signed-in customer subscribing to the newsletter with their own email in different letter case is subscribed straight away, without a confirmation email. #15115
• Changing a product's status from two places at once sends one product event, not two. #15097
• The translations dialog keeps the paragraphs and line breaks of the original text. #15066
• Addresses keep the original letter case of their company name when the app encrypts that field. #15102 by @mad-eel
• Removing a product from carts no longer fails for a cart that was checked out in the meantime. #15082
• An address the geocoder cannot find is reported as a warning instead of an error. #15100

⬆️ Upgrading from 5.6

• Stores that take PayPal on 5.6 can now upgrade to 6.0. The 5.6 → 6.0 upgrade adds two optional steps: migrate_paypal_payments gives existing PayPal payments the 6.0 shape, and register_paypal_webhooks sets up each payment method's webhook. A store already on 6.0 runs them by name with spree upgrade --step <name>; the PayPal section of the upgrade guide has the details. #15031 by @mad-eel

🛠 Developer experience

• Typelizer 0.14. spree_api now requires Typelizer ~> 0.14.0. Update it together with Spree (bundle update spree typelizer if you update by hand). Typelizer no longer reads DISABLE_TYPELIZER or ENABLE_TYPELIZER; Spree sets the new TYPELIZER switch itself, so remove the old variables. #15114
• Ruby 4.0. spree_core now depends on ostruct, so apps on Ruby 4.0 boot without adding it themselves. #15099
• SDK extensions. client.extend() with defineStoreExtension, defineAdminExtension or defineSellerExtension adds a typed namespace for an extension's own endpoints to an SDK client, sharing its auth, locale and retries. The new spree sdk generate command in @spree/cli writes that client from the extension's OpenAPI document. #15113
• Document an extension's Admin API. The rswag helpers now ship in spree_api (Spree::Api::TestingSupport::Openapi.configure, admin_operation), and rake spree:openapi:generate writes an extension's own openapi/admin.yaml with only its own filter tables. Its operations become agent tools like core's. #15095 #15116
• Extension hooks. Spree::Dependencies.register lets an extension put its own workflows behind a key a store can swap; Spree.cart_copiers copies an extension's cart records onto the order a cart becomes; and the orders.complete.validate hook can refuse an order's placement under its row lock. #15112 #15078 #15075
• spree add paypal installs spree_paypal_checkout at your project's Spree version or newer. This is the first Spree 6 release of the gem, so a project on 6.0.0 to 6.0.2 upgrades Spree to 6.0.3 first. #15031 by @mad-eel

📚 Documentation

• The Docker deployment guide explains how published ports bypass host firewalls and how to keep the database and cache private, and mounts the Postgres 18 data volume where the image expects it. #15088 #15081
• The Admin API reference documents ten more actions, payments' can_void and can_capture, and the digital link endpoint. #15093 #15072

📦 Package versions

Full Changelog: v6.0.2...v6.0.3