October 2026 release
8 min
Release: 5.2.2610.481+sts
The following is a list of the release's bug fixes and enhancements. Some bug fixes may address existing support articles. A comprehensive list is at the bottom of this page.
The October 2026 release is now available for developers to download and work with locally or to request deployments.
Release highlights
- PunchOut inside procurement systems – Keep procurement-driven orders flowing by letting buyers shop your catalog without leaving SAP Ariba or other procurement systems that display suppliers in an iframe. Buyers now stay signed in to their PunchOut session inside the procurement system's frame, from the first page through checkout, when you turn on the new Allow PunchOut in an iframe setting. You stay in control of which procurement systems can frame your storefront by adding a frame-ancestors directive to your Content-Security-Policy. See Allow PunchOut in an iframe.
- Stronger storefront account protection – Reduce the risk of account takeover and unauthorized orders, and give your security team more control, with protections that are mostly on by default. Password reset now limits repeated failed attempts and can add a reCAPTCHA check, the Remember Me cookie is signed and tied to your website, and deactivating a user ends their API access immediately, including in the mobile app. Single sign-on (SSO) now links a first-time sign-in to an existing account only when the identity provider confirms the email address.
- Faster-loading web fonts – Speed up storefront page loads and reduce load on your servers by letting your content delivery network (CDN) cache the web fonts that Spire serves. Shoppers see your brand typography sooner and more reliably, because font URLs now use CDN-friendly paths and intermittent font 404 errors are fixed. Existing font URLs keep working, so no theme or configuration changes are needed.
- Self-service order and invoice exports – Give buyers their order and invoice data without asking a sales representative or administrator for a report. Buyers export their order or invoice history from the storefront to a comma-separated values (CSV) file. The file includes the records that match their filters, not just the rows on the current page. See Export order or invoice history.
Breaking changes
Medium risk
- In PunchOut requests, credential validation now runs earlier (the ValidateCredentials handlers moved from Order 700/800 to 550) and reads credentials from the raw XML via the new GetRequestCredentials pipeline, which may affect custom handlers ordered in between and custom pipes that modified Sender, From, or SharedSecret values.
Low risk
- Several unused parts of code were removed. They were public but we do not believe were used by anyone.
- Insite.Core.Interfaces.Dependency.DependencyExclude
- Insite.WIS.Broker.Plugins.WindowsIntegrationBroker.serviceProvider (Net8+ only)
- Insite.WIS.Broker.Plugins.WindowsIntegrationBroker.IsRegistered (Net8+ only)
Enhancements
- Added the Allow PunchOut in an iframe system setting (website-level, off by default), so PunchOut sessions work when a procurement system, such as SAP Ariba, renders your storefront in an iframe. When the setting is on, cookies written during a PunchOut session over HTTPS use SameSite=None and Secure. PunchOut requests are served without the X-Frame-Options header regardless of this setting. To prevent clickjacking, add a frame-ancestors directive that names the procurement system to the Content-Security-Policy setting. See Allow PunchOut in an iframe.
- Added rate limiting and optional reCAPTCHA protection to the reset password page, which protects storefront accounts from automated password guessing. Rate limiting is on by default. Adjust it with the Password Reset Rate Limiting Enabled, Password Reset Rate Limit Window Minutes, Max Password Reset Failures Per Ip, and Max Password Reset Failures Per User settings. To add reCAPTCHA, turn on Protect Reset Password Submit.
- Added the Maximum Storefront API Request Size (MB) system setting (global, default 30), which adds a layer of protection behind the web application firewall. Storefront API requests under /api/ with a larger body are rejected with HTTP 413. Admin, internal, upload, and integration endpoints are not affected.
- Added the Treat Storefront Email As Verified setting to the OpenID Connect and Windows single sign-on (SSO) settings (off by default). A first-time storefront SSO sign-in now links to an existing account with the same email only when the identity provider confirms that the email is verified, or when this setting is on. Turn it on only for a single-tenant identity provider that you control. See Set up OpenId Connect SSO.
- Restricted file uploads through the Media Manager, the Admin Console user files API, and Integration File Upload jobs to a list of approved file types, which helps prevent harmful files from being uploaded. For example, .xml, .html, .js, and .css files are not on the list. To allow another file type, add it to the Additional Media Manager Extensions setting. See Media library.
- Improved the security of the storefront Remember Me cookie, which is now signed, tied to the website, and sent only over HTTPS. After you upgrade, users who were remembered by the previous cookie must sign in again. Signing out or changing a password now ends the remembered sign-in on all of that user's browsers. See User security.
- Restricted the Spire access token handoff so that a token posted to the storefront is accepted only from pages of the same site, which protects storefront sign-in from cross-site requests. Custom integrations that post a token from another site must send it in the Authorization header to the /RedirectTo/MobileAuth/ endpoint instead.
- Improved how the Admin Console handles masked system settings, such as passwords and keys. Saved values are no longer sent to the browser, so they cannot be revealed with browser developer tools.
- Improved the Admin Console system settings search so it also matches section names. For example, searching for pdf now finds the settings in the PDFs section. Results that match a setting name appear first, and each result shows its section.
- Improved how Spire serves proxied web fonts so a content delivery network (CDN) can cache them, which speeds up page loads. Font and font CSS URLs now use the /.spire/content/font/ and /.spire/content/css/ paths, and the previous /.spire/fonts/ URLs still work. Failed font requests no longer return a one-year cache header. See Use web fonts.
- Added Export All to the Order History and Invoice History pages, so buyers analyze their history in a spreadsheet. The link downloads the records that match the page's filters as a comma-separated values (CSV) file. See Export order or invoice history.
- Improved the ETag cache so it is faster and more resilient under heavy load. Database deadlocks in the cache are now treated as cache misses instead of logged errors.
- Modified the Spire, Storefront API, Admin API, Integration API, and Database Updater Dockerfiles so their containers do not run as the root user, which helps them pass container security scans.
- Marked the IBusinessObject.SetProperty and GetProperty methods obsolete in debug builds of the Configured Commerce code base, to discourage new use of custom properties. Custom properties can cause performance issues. To add a property, use an extension table instead. See Entity extension considerations.
- Added a startup check that stops the application in non-development environments when no Spire client secret is configured, so the shared default secret is not used by accident. Set the SpireClientSecret environment variable, or set ACCEPT_RISKS_OF_USING_DEFAULT_SPIRE_CLIENT_SECRET to true to keep using the default secret.
- Improved security.
Bug fixes
- Fixed the issue where Bulk publish in Spire CMS listed pages from all websites when you were signed in to a subdomain site. It now lists only that site's pages.
- Fixed the issue where a buyer or requisitioner could remove their own role through the Account API and bypass order approval. Only users in roles that can update users can change a role, and other requests return 403 Forbidden.
- Fixed the issue where the password reset process returned different errors for unknown usernames, previously used passwords, and invalid tokens before it verified the reset token. It now returns a generic error until the token is verified.
- Fixed the issue where the server did not enforce the default password complexity requirements, such as a required special character, on sites that had never changed their password settings.
- Fixed the issue where users had to wait about two minutes after a temporary password was set before they could change it.
- Fixed the issue where users created by an Admin Console import that included a password could sign in before their accounts were activated.
- Fixed the issue where Spire storefronts intermittently returned 404 errors for web fonts because each server process cached fonts separately.
- Fixed the issue where Google Fonts rejected Spire's server-side requests because they included internal headers, which silently disabled the web font proxy.
- Fixed the issue where .NET 10 sites ignored the X-Frame-Options system setting and always sent SAMEORIGIN. When the setting is None, the header is now omitted.
- Fixed the issue where emails resent with Retry Email or Retry All Undelivered Emails in the Admin Console used the default SMTP configuration instead of the website's own SMTP settings.
- Fixed the issue where an Adyen credit card payment could succeed in Adyen while the order stayed in Pending payment. This occurred when the Adyen HMAC key was empty or invalid. Checkout now stops before payment and logs an error until a valid HMAC key is configured.
- Fixed the issue where eCheck payments failed on sites that use the Payment Service with the Braintree or Authorize.Net gateway. The Payment Service now stores the bank account with the gateway before it processes the payment.
- Fixed the issue where the Search Service could close a connection that a long-running operation was still using, which caused the operation to fail.
- *Fixed the issue where guest users could call the Payment Profile API and list saved payment cards. The API now returns 403 Forbidden for guest requests.
- *Fixed the issue where deactivated users, such as mobile app users, could keep calling APIs with tokens issued before they were deactivated. Deactivation now takes effect immediately.
- *Fixed the issue where a website that serves several domain names could send guest visitors on one domain a URL redirect meant for another domain. Guest page results are now cached separately for each domain.
- *Fixed the issue where Indexing disappeared from the Admin Console navigation when a custom search provider was selected.
- *Fixed the issue where product data requests could time out on sites with very large catalogs because of an inefficient database query plan.
- *Fixed the issue where the Credit Card Number and CVV fields displayed in the wrong place on the Add a Card form in My Account > Saved Payments. This affected sites that use the Payment Service.
- *Fixed the issue where Spire dropped the Domain attribute when it forwarded cookies from API responses during server-side rendering, so those cookies applied only to the exact storefront host.
- *Fixed the issue where Spire builds failed when a partner blueprint added a pnpm dependency that runs a build script.
- *Fixed the issue where files uploaded to /userfiles/_system/.well-known returned a 502 Bad Gateway error when requested at /.well-known/<filename> on .NET Framework 4.8 sites.
- *Fixed the CS0619 error that occurred when custom SEO Razor views on .NET Framework 4.8 sites failed to compile.
* These bug fixes were included in hotfixes and are available for 5.2.2609 STS.