Important:

This is a security release! It ships proper fixes from the PHP Group for the PHP CVEs addressed temporarily in v27.0.1 (by bumping to PHP v8.5.12). Please upgrade to it immediately.

Stripe Managed Payments

Stripe's Merchant of Record service, Stripe Managed Payments (formerly lemon squeezy) has been added as a payment method option.

As a merchant of record, Stripe handles the following for you:

• VAT/GST taxation and filing,
• fraud management,
• refunds,
• dispute reconciliation.

When using Stripe Managed Payments, Stripe is the entity selling the product, not you. This means bank statements show Stripe as the company the client paid to, and Stripe just pays out your cut. Before setting this up, you need to make your Stripe account eligible. Stripe Managed Payments costs an add-on 3.5% fee (accurate as of Oct 19).

Stripe Managed Payments does not support payouts. For that, you will have to configure regular Stripe.

Payment Gateways

• Stripe (regular) no longer has the "Sandbox Mode" toggle as part of its settings. Whether or not to use sandbox is detected automatically by the publishable key type (pk_test_... or pk_live_...).
• All payment settings are now shown, regardless of whether or not a gateway is enabled or not, mostly for convinience sake.
• Stripe and PayPal checkouts now list every cart item on its own line, instead of a single line for the whole order.
• Stripe can show a PayPal badge among its payment methods. It is hidden by default; show it under "Payment method badges" on the Payment Methods page if your Stripe account accepts PayPal.
• PayPal and PayPal Webscr can no longer be enabled at the same time.

Cart & Checkout

• When tax is added at checkout (Stripe Managed Payments), the cart now shows the subtotal with a "VAT/GST calculated at checkout" note.
• New theme setting, "Hide Gateway Name on Pay Button" (on by default): with a single gateway enabled, the checkout button reads just "Pay".

Categories

• Category names & descriptions can be translated into every store language.
• Category descriptions have been improved with a rich-text editor, and now support multi-line texts. They have also been made optional.
• The admin category tree has been restyled to match the other tables.
• The category description is shown above the product listing when browsing a single category.

Localization

• Bundle names and descriptions, custom page titles, sale campaign banners and payment gateway display names can be translated into every store language.

Admin Panel

• New "Light Store News" dashboard widget with announcements from the Light Store team.

Docker

• The store now uses Nginx / PHP-FPM to run the store (instead of the former FrankenPHP with implicit Caddy) and is pinned to the exact PHP version: 8.5.12 which contains the latest PHP CVE patches.
• Added a new "starting up" page that displays when the Docker containers are up, but the store is still running migrations or waiting for the database / Redis.

Technical Refactoring

• Bumped many Composer dependencies to their latest version.
• Removed unused dependencies and assets: Scramble, the media library package and leftover code editor assets.

Due to the recent vulnerabilities discovered in PHP (CVE-2026-109618 and CVE-2026-109619, rated CVSS v4.0 9.2), this security patch updates the FrankenPHP configuration to provide a provisional fix.

The CVEs allow remote code execution on your server, therefore, it is strongly recommended to upgrade to this release as soon as possible.

If you're on v26 or older, update your FrankenPHP configuration manually using this PoC repo provisional fix.

A note: The way we release Light Store has changed (since v26.1, but mentioning it here too). Major versions are now breaking and minor versions are not. This goes in contrast to the old way we've determined if the update is major is minor - which was by feature size and update frequency. This means that this update is breaking, and may require you reinstall your addons. This also means major updates will be sparser by nature. All data is still secure & kept between updates.

Gifting

Products & options can now be gifted using the gift button next to Add to Cart / Download button on the product page.

The recipient is notified via email and the in-built notification system.

Refunds

Orders can now be refunded from their page in the admin panel, entirely or one line at a time. Stripe, PayPal and Square are currently supported.

Refunding a line deactivates the buyer's license for it and takes the vendor's share back off their balance.

Initiating a full refund from PayPal, Stripe or Square is also handled in the store, if the webhook is properly configured.

Passkey Support

You can now have your users set up & login using passkeys. Passkeys are often unlocked via biometrics (Touch or Face ID, Windows Hello), password managers or physical keys. A passkey can be added from the profile "Account" page, under Security & Data.

Passkeys are offered as an alternative method to logging in, rather than a 2FA method, which means just the passkey is enough to log in. Because of this, password or 2FA code verification is required when setting up the passkey.

Admin Panel

• Each admin can now turn admin email notifications off for themselves, pick which kinds they are emailed about, or receive them as an hourly or daily summary instead of one email each, from Email notifications in the admin user menu.
• New Database page for superusers, under Health & Logs. Every query is recorded in the audit log.
• Superusers and admins can view the admin panel as a lower role from View as role in the user menu, to check what an admin or moderator can see and do. A banner shows the role being viewed and returns to your own.

Products Editing

• New Links tab on products, with a copyable product link, add to cart link and iframe embed code. Every product option also shows a copyable link that opens the product with that option selected.
• It is now possible to import only the description from BuiltByBit, by providing your API token + the BBB resource link, useful for updating the description to keep it in sync.

Orders

• Each line of an order now shows when the buyer first downloaded that product or option, to help decide on refunds. Only downloads from 27.0 on are recorded.

Telemetry

• Stores now send telemetry to the Light Store mirror: version, domain, environment, catalog size and sales info. It helps prioritize fixes and lets support look into problems without asking for access. Everything can be turned off, previewed or filtered granularly from admin settings.

User Roles

• User roles and granular permissions, deprecated since 26.2.0, have been removed. Staff levels now decide what someone can do in the admin panel, and team roles decide what they can do in a store.
  • Users on a custom role without a staff level lose admin access in 27.0. Set their staff level on 26.2 before upgrading.
  • The Default User Role setting has been removed. Every new account starts at the None staff level.
  • The role:assign and role:convert-admins commands have been removed. Use php artisan staff:set {email} {level}.
  • The REST API's user responses no longer include role. Read staff_level instead. User data exports carry staff_level in place of role too.

Storefront

• Every product has an add to cart link that puts it in the visitor's cart and opens the cart, ready to share anywhere.
• Products can be embedded on other websites as a small card with an iframe. Its button follows the add to cart link. Add ?theme=light or ?theme=dark to the iframe URL to force a color scheme.
• Opening a product page with ?optionId= selects that option and shows its description.
• The cart preselects the payment method the customer last paid with.
• Notifications are marked as read once they are seen: opening the notifications dropdown reads what it shows, and the notifications page reads the page you are on. The dropdown now lists recent notifications instead of only unread ones, and the Mark as read and Mark all as read buttons are gone.
• The notifications page is a bordered list instead of striped rows, unread titles are bold and a whole notification is clickable when it links somewhere.
• Fixed HTML in the top banner wrapping tag by tag on mobile instead of as one line of text.
• The /docs page and the Documentation Links setting have been removed. Link external documentation with a custom page in link mode instead.

Theming

• Theme inheritance: a theme extends another through extends in its theme.json and only holds the files it changes. php artisan make:theme now creates an empty theme extending default.
  • Theme views no longer run queries. Controllers and the new $storefront object hand them ready-to-render data.
  • Read the updated theming guide: https://docs.nortex.dev/docs/store/v27/theming

Theme API Changes

• Themes made on 26.x must be ported, as the views, their variables and components have changed. Follow the guide: https://docs.nortex.dev/docs/store/v27/theming#themes-from-26x

Addon API Changes

• App\Enums\Permission, App\Models\Role, User::role(), User::hasPermission() and the admins() scope have been removed. Check App\Enums\Ability through Gate::allows(Ability::...) or $user->hasAbility(...), and use isStaff() and the staff() scope.

Admin Panel

• New Backups settings tab: turn backups off entirely, set how long backups are kept and the maximum total size they may use, and also send them to S3 when S3 storage is on.
• Products can now be bulk assigned a category from the products table.
• Fixed the store switching to S3 storage before its configuration was complete. S3 is now only used once every required field is filled in.
• Fixed the Products page returning 403 for admins without a store. New Product now opens store registration for them instead.

Storefront

• Input fields now share one less rounded style across the store.
• Payment method badges in the cart now all have the same width, and the Link logo is no longer invisible in dark mode.

Addon Updating

• Addons can now be updated in one click. When a newer version of an installed addon is released, the Addons page can update to it automatically using the Update button.

Admin Panel

• Payouts awaiting review can now be marked as paid instead of sent, for stores you paid yourself.
• New shared admin notifications, also emailed to every admin: products awaiting approval, payout requests, audit log errors, failed jobs, stalled queues, enabled payment gateways missing required settings and new Light Store releases, plus a daily reminder for approvals and payouts waiting over a day.
• The settings page now has a search box.
• Global search now finds products, users, orders by number, licenses and coupons by code:

• Removed the Transactions page from the admin page. Orders can now be filtered by product, including purchases through its options.
• Fixed the Licenses page crashing when a license's product option had been removed.
• Removing a product option or option group now also deletes its licenses, files and cart items.
• Users now have a staff level: None, Moderator, Admin or Superuser.
  • Moderators handle approvals and reviews, and can view and ban users, orders, licenses and stores.
  • Admins also manage products, coupons, licenses, orders, stores, users, payouts, pages and media.
  • Superusers also manage settings, gateways, API keys, webhooks, backups, logs, mail templates, addons and staff levels (also via php artisan staff:set {email} {level}).
  • Existing Admin role users are now superusers.

Creator Panel

• Added a notification bell, listing the same notifications as the storefront's notifications page.
• Transactions now have a view page with the order, buyer, price, product, option and license. Option sales are listed under their product, and orders are shown by their order number.
• Fixed store owners and team managers losing access to Storefront, Payouts and webhooks after a store was saved in the admin panel. Existing members are no longer demoted to collaborators, and webhooks no longer require global webhook permissions.

Storefront

• Added custom error pages (404, 403, 500, 502, ...).
• The cart button now reads Pay with {gateway} (or Pay when checkout is unavailable) instead of "Checkout using", and hovering it while checkout is blocked shows why.
• Disabled products stay visible to their buyers, but can no longer be bought or downloaded.
• Fixed the visitor's language being detected when localization is disabled. The store now shows in English, and disabled languages are no longer picked from the browser.
• Fixed disabled currencies being picked from the visitor's country or by link.
• Fixed disabled OAuth providers still allowing sign-in when configured in the environment.
• Fixed the top banner reappearing after being dismissed.
• The mobile menu now has search, icons, an All Products link, the theme toggle and current page highlighting, and shows only the logo when one is set.
• Long titles in the welcome product carousel are now truncated.

Theme Manager

• The preview now renders the real page with your changes, so every setting previews, including ones that change page content. Navigating inside the preview keeps them applied.
• Changes are saved as a draft visible only to you until you Publish or Discard changes. Drafts survive closing the tab, and switching the text language no longer saves first.
• Replaced or removed images stay live until the change is published.
• Themes no longer need preview code. Custom themes can delete the message listener in layouts/app.blade.php and all data-theme-* and data-variant-* attributes.
• A dismissed top banner shows again when its text changes.
• New Secondary Color setting. The default headline and reviews header gradients now run from the primary to the secondary color.

Compliance

• EU, EEA and UK buyers can be asked to waive their 14-day right of withdrawal at checkout, enabled under Legal & Compliance settings. The buyer's country is detected automatically, can be corrected in the cart, and the receipt confirms the waiver.
• You can now restrict the countries you sell to under Legal & Compliance, by hand or from presets (EU, EEA, UK, US). Other buyers can browse but cannot check out without picking a listed country in the cart.
• Orders now also record the IP address country and the card or PayPal account country, reported by Stripe, PayPal or Square, shown on the admin order page for record keeping.
• Deleting an account now keeps its orders as tax records, detached from the account but keeping the buyer's checkout name, email and country. Licenses, reviews and other account data are still removed.