https://vulnerability.circl.lu/sightings/feed 2026-09-05T19:39:49.981472+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9f6367fa-80a1-4e62-9d55-80f4f01c3f97/export 2026-09-05T19:39:50.002613+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9f6367fa-80a1-4e62-9d55-80f4f01c3f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/f775ce5075a476e3404ee4217fd5619b", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd73Testing**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - *fix(attributes): stop recreating existing attribute\\_category rows on PUT* [\\#7863](https://github.com/Wishibam/Marketplace-api/pull/7863)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - *fix(dashboard): v2 remove retailer logo* [\\#7860](https://github.com/Wishibam/Marketplace-api/pull/7860)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\u2600\ufe0fIn review**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83c\udf89 Reviewed pas Merg\u00e9**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - *:bug: OMS processingAt message keep showing on reserved shipment after split* [\\#7848](https://github.com/Wishibam/Marketplace-api/pull/7848)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n - [VIA - Chasin - nouvelle API stock](https://trello.com/c/ZxWVFDDZ/2472-via-chasin-nouvelle-api-stock) **\ud83d\ude80Testing BACK / FLUX / CLIENT**\n - *feat(feedTransformer): bataviastad chasin stock feed* [\\#7853](https://github.com/Wishibam/Marketplace-api/pull/7853)\n - [Dashboard - Rendre les \u00e9l\u00e9ments clickables](https://trello.com/c/kkX44d75/2506-dashboard-rendre-les-%C3%A9l%C3%A9ments-clickables) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): v2 click on row actions* [\\#7868](https://github.com/Wishibam/Marketplace-api/pull/7868)\n - [FACTURATION - Retours templates](https://trello.com/c/FC1bOPBb/2507-facturation-retours-templates) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *Fix/invoice items pagination* [\\#7872](https://github.com/Wishibam/Marketplace-api/pull/7872)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n - *feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es* [\\#7859](https://github.com/Wishibam/Marketplace-api/pull/7859)\n - *:sparkles: feat: Index push-error flag on ES product documents* [\\#7861](https://github.com/Wishibam/Marketplace-api/pull/7861)\n - *fix(attributes): require a non-empty value to satisfy a required attr\u2026* [\\#7864](https://github.com/Wishibam/Marketplace-api/pull/7864)\n - *:bug: fix: invalidate missing-mapping cache after retailer snapshot* [\\#7871](https://github.com/Wishibam/Marketplace-api/pull/7871)\n - *fix: remove useless sync sftp command with alwaysdata* [\\#7875](https://github.com/Wishibam/Marketplace-api/pull/7875)\n - *:bug: Fix: 403 on feed read from scaleway* [\\#7876](https://github.com/Wishibam/Marketplace-api/pull/7876)\n - *:wrench: chore: remove leftover Heroku config and HireFire* [\\#7877](https://github.com/Wishibam/Marketplace-api/pull/7877)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n - *fix(dashboard): top retailer when members has multiple retailers* [\\#7865](https://github.com/Wishibam/Marketplace-api/pull/7865)\n - *:sparkles: feat: add dry-run and limit options to request-missing-invoices* [\\#7866](https://github.com/Wishibam/Marketplace-api/pull/7866)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n\n### [PR #7853](https://github.com/Wishibam/Marketplace-api/pull/7853) \u2014 feat(feedTransformer): bataviastad chasin stock feed\n\nD\u00e9ployer cette PR sur la PROD MP -> https://github.com/Wishibam/Infrastructure/pull/495\n\n### [PR #7859](https://github.com/Wishibam/Marketplace-api/pull/7859) \u2014 feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es\n\n - Ajouter les mappings manquants `console wishibam:merchandising:update-mappings`\n - R\u00e9indexer quand possible `console wishibam:merchandising:build-index`\n", "creation_timestamp": "2026-09-03T15:31:01.933316Z"} 2026-09-03T15:31:01.933316+00:00 https://vulnerability.circl.lu/sighting/7ca71e8f-16aa-4f16-b6c1-b639bb424276/export 2026-09-05T19:39:50.004672+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7ca71e8f-16aa-4f16-b6c1-b639bb424276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/cdb6c1578002fa5c20605d26c9477fdf", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd73Testing**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - *fix(attributes): stop recreating existing attribute\\_category rows on PUT* [\\#7863](https://github.com/Wishibam/Marketplace-api/pull/7863)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - *fix(dashboard): v2 remove retailer logo* [\\#7860](https://github.com/Wishibam/Marketplace-api/pull/7860)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\u2600\ufe0fIn review**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83c\udf89 Reviewed pas Merg\u00e9**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - *:bug: OMS processingAt message keep showing on reserved shipment after split* [\\#7848](https://github.com/Wishibam/Marketplace-api/pull/7848)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n - [VIA - Chasin - nouvelle API stock](https://trello.com/c/ZxWVFDDZ/2472-via-chasin-nouvelle-api-stock) **\ud83d\ude80Testing BACK / FLUX / CLIENT**\n - *feat(feedTransformer): bataviastad chasin stock feed* [\\#7853](https://github.com/Wishibam/Marketplace-api/pull/7853)\n - [Dashboard - Rendre les \u00e9l\u00e9ments clickables](https://trello.com/c/kkX44d75/2506-dashboard-rendre-les-%C3%A9l%C3%A9ments-clickables) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): v2 click on row actions* [\\#7868](https://github.com/Wishibam/Marketplace-api/pull/7868)\n - [FACTURATION - Retours templates](https://trello.com/c/FC1bOPBb/2507-facturation-retours-templates) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *Fix/invoice items pagination* [\\#7872](https://github.com/Wishibam/Marketplace-api/pull/7872)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n - *feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es* [\\#7859](https://github.com/Wishibam/Marketplace-api/pull/7859)\n - *:sparkles: feat: Index push-error flag on ES product documents* [\\#7861](https://github.com/Wishibam/Marketplace-api/pull/7861)\n - *fix(attributes): require a non-empty value to satisfy a required attr\u2026* [\\#7864](https://github.com/Wishibam/Marketplace-api/pull/7864)\n - *:bug: fix: invalidate missing-mapping cache after retailer snapshot* [\\#7871](https://github.com/Wishibam/Marketplace-api/pull/7871)\n - *fix: remove useless sync sftp command with alwaysdata* [\\#7875](https://github.com/Wishibam/Marketplace-api/pull/7875)\n - *:wrench: chore: remove leftover Heroku config and HireFire* [\\#7877](https://github.com/Wishibam/Marketplace-api/pull/7877)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n - *fix(dashboard): top retailer when members has multiple retailers* [\\#7865](https://github.com/Wishibam/Marketplace-api/pull/7865)\n - *:sparkles: feat: add dry-run and limit options to request-missing-invoices* [\\#7866](https://github.com/Wishibam/Marketplace-api/pull/7866)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n\n### [PR #7853](https://github.com/Wishibam/Marketplace-api/pull/7853) \u2014 feat(feedTransformer): bataviastad chasin stock feed\n\nD\u00e9ployer cette PR sur la PROD MP -> https://github.com/Wishibam/Infrastructure/pull/495\n\n### [PR #7859](https://github.com/Wishibam/Marketplace-api/pull/7859) \u2014 feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es\n\n - Ajouter les mappings manquants `console wishibam:merchandising:update-mappings`\n - R\u00e9indexer quand possible `console wishibam:merchandising:build-index`\n", "creation_timestamp": "2026-09-03T15:04:25.809194Z"} 2026-09-03T15:04:25.809194+00:00 https://vulnerability.circl.lu/sighting/dd252517-4043-4da4-afcb-3c7053b73d49/export 2026-09-05T19:39:50.004965+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dd252517-4043-4da4-afcb-3c7053b73d49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/1d4452988e55a5a37ddb2803de07e1a8", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\u2600\ufe0fIn review**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - *fix(attributes): stop recreating existing attribute\\_category rows on PUT* [\\#7863](https://github.com/Wishibam/Marketplace-api/pull/7863)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - *fix(dashboard): v2 remove retailer logo* [\\#7860](https://github.com/Wishibam/Marketplace-api/pull/7860)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\u2600\ufe0fIn review**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\u2600\ufe0fIn review**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\u2600\ufe0fIn review**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - *:bug: OMS processingAt message keep showing on reserved shipment after split* [\\#7848](https://github.com/Wishibam/Marketplace-api/pull/7848)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n - [VIA - Chasin - nouvelle API stock](https://trello.com/c/ZxWVFDDZ/2472-via-chasin-nouvelle-api-stock) **\ud83c\udf89 Reviewed pas Merg\u00e9**\n - *feat(feedTransformer): bataviastad chasin stock feed* [\\#7853](https://github.com/Wishibam/Marketplace-api/pull/7853)\n - [Dashboard - Rendre les \u00e9l\u00e9ments clickables](https://trello.com/c/kkX44d75/2506-dashboard-rendre-les-%C3%A9l%C3%A9ments-clickables) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *feat(dashboard): v2 click on row actions* [\\#7868](https://github.com/Wishibam/Marketplace-api/pull/7868)\n - [FACTURATION - Retours templates](https://trello.com/c/FC1bOPBb/2507-facturation-retours-templates) **\ud83e\udd73Testing**\n - *Fix/invoice items pagination* [\\#7872](https://github.com/Wishibam/Marketplace-api/pull/7872)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n - *feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es* [\\#7859](https://github.com/Wishibam/Marketplace-api/pull/7859)\n - *:sparkles: feat: Index push-error flag on ES product documents* [\\#7861](https://github.com/Wishibam/Marketplace-api/pull/7861)\n - *fix(attributes): require a non-empty value to satisfy a required attr\u2026* [\\#7864](https://github.com/Wishibam/Marketplace-api/pull/7864)\n - *:bug: fix: invalidate missing-mapping cache after retailer snapshot* [\\#7871](https://github.com/Wishibam/Marketplace-api/pull/7871)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n - *fix(dashboard): top retailer when members has multiple retailers* [\\#7865](https://github.com/Wishibam/Marketplace-api/pull/7865)\n - *:sparkles: feat: add dry-run and limit options to request-missing-invoices* [\\#7866](https://github.com/Wishibam/Marketplace-api/pull/7866)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n\n### [PR #7853](https://github.com/Wishibam/Marketplace-api/pull/7853) \u2014 feat(feedTransformer): bataviastad chasin stock feed\n\nAjouter un cron avec la commande suivante:\n```\nwishibam:feed-convert:chasin --api-key=xxxxxx --ftp-user=wishibam_batavia_chasin --ftp-pass='xxxxxx'\n```\n\n### [PR #7859](https://github.com/Wishibam/Marketplace-api/pull/7859) \u2014 feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es\n\n - Ajouter les mappings manquants `console wishibam:merchandising:update-mappings`\n - R\u00e9indexer quand possible `console wishibam:merchandising:build-index`\n", "creation_timestamp": "2026-09-02T14:23:37.133007Z"} 2026-09-02T14:23:37.133007+00:00 https://vulnerability.circl.lu/sighting/1c3f890e-6827-4c8e-a317-1df709b73934/export 2026-09-05T19:39:50.005203+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1c3f890e-6827-4c8e-a317-1df709b73934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/2c99af768b253ca6c76aa64a596d5d86", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\u2600\ufe0fIn review**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - *fix(attributes): stop recreating existing attribute\\_category rows on PUT* [\\#7863](https://github.com/Wishibam/Marketplace-api/pull/7863)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\u2600\ufe0fIn review**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - *fix(dashboard): v2 remove retailer logo* [\\#7860](https://github.com/Wishibam/Marketplace-api/pull/7860)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\u2600\ufe0fIn review**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\u2600\ufe0fIn review**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - *:bug: OMS processingAt message keep showing on reserved shipment after split* [\\#7848](https://github.com/Wishibam/Marketplace-api/pull/7848)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n - [Dashboard - Rendre les \u00e9l\u00e9ments clickables](https://trello.com/c/kkX44d75/2506-dashboard-rendre-les-%C3%A9l%C3%A9ments-clickables) **\u2600\ufe0fIn review**\n - *feat(dashboard): v2 click on row actions* [\\#7868](https://github.com/Wishibam/Marketplace-api/pull/7868)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n - *feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es* [\\#7859](https://github.com/Wishibam/Marketplace-api/pull/7859)\n - *:sparkles: feat: Index push-error flag on ES product documents* [\\#7861](https://github.com/Wishibam/Marketplace-api/pull/7861)\n - *fix(attributes): require a non-empty value to satisfy a required attr\u2026* [\\#7864](https://github.com/Wishibam/Marketplace-api/pull/7864)\n - *:bug: fix: invalidate missing-mapping cache after retailer snapshot* [\\#7871](https://github.com/Wishibam/Marketplace-api/pull/7871)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n - *fix(dashboard): top retailer when members has multiple retailers* [\\#7865](https://github.com/Wishibam/Marketplace-api/pull/7865)\n - *:sparkles: feat: add dry-run and limit options to request-missing-invoices* [\\#7866](https://github.com/Wishibam/Marketplace-api/pull/7866)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n\n### [PR #7859](https://github.com/Wishibam/Marketplace-api/pull/7859) \u2014 feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es\n\n - Ajouter les mappings manquants `console wishibam:merchandising:update-mappings`\n - R\u00e9indexer quand possible `console wishibam:merchandising:build-index`\n", "creation_timestamp": "2026-09-02T08:36:53.447675Z"} 2026-09-02T08:36:53.447675+00:00 https://vulnerability.circl.lu/sighting/ad08fd9b-ae8c-440c-b4d0-ef38ed872802/export 2026-09-05T19:39:50.005403+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ad08fd9b-ae8c-440c-b4d0-ef38ed872802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/b87f083e6d466263aa676cff6fab300a", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\u2600\ufe0fIn review**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\u2600\ufe0fIn review**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\u2600\ufe0fIn review**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **\u2600\ufe0fIn review**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - *:bug: OMS processingAt message keep showing on reserved shipment after split* [\\#7848](https://github.com/Wishibam/Marketplace-api/pull/7848)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n - *feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es* [\\#7859](https://github.com/Wishibam/Marketplace-api/pull/7859)\n - *:sparkles: feat: Index push-error flag on ES product documents* [\\#7861](https://github.com/Wishibam/Marketplace-api/pull/7861)\n - *:sparkles: feat: add dry-run and limit options to request-missing-invoices* [\\#7866](https://github.com/Wishibam/Marketplace-api/pull/7866)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n\n### [PR #7859](https://github.com/Wishibam/Marketplace-api/pull/7859) \u2014 feat(merchandising): filtres Vente et Scoring, fix du filtre options sur valeurs mapp\u00e9es\n\n - Ajouter les mappings manquants `console wishibam:merchandising:update-mappings`\n - R\u00e9indexer quand possible `console wishibam:merchandising:build-index`\n", "creation_timestamp": "2026-08-31T14:32:18.497864Z"} 2026-08-31T14:32:18.497864+00:00 https://vulnerability.circl.lu/sighting/d97c583d-3537-4654-873c-2afea317b9bd/export 2026-09-05T19:39:50.005586+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d97c583d-3537-4654-873c-2afea317b9bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/058534b91a22bd624dfbf98d43249177", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd75 Retour de test**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [Retours dashboard - Ajouter un tableau top 10 des marques les plus demand\u00e9s en alerte stock (V2)](https://trello.com/c/JgADJ95G/2474-retours-dashboard-ajouter-un-tableau-top-10-des-marques-les-plus-demand%C3%A9s-en-alerte-stock-v2) **\ud83c\udf89 Reviewed pas Merg\u00e9**\n - *feat(dashboard): add top 10 retailer stock alerts endpoint* [\\#7751](https://github.com/Wishibam/Marketplace-api/pull/7751)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **In review WMS**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **In review WMS**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne -Partie 1-](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne-partie-1) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n - *:bug: fix: index option values in the organization locale, not the current one* [\\#7858](https://github.com/Wishibam/Marketplace-api/pull/7858)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-26T13:38:34.616489Z"} 2026-08-26T13:38:34.616489+00:00 https://vulnerability.circl.lu/sighting/f734fda3-5f73-4434-8583-7c955b2f3a3f/export 2026-09-05T19:39:50.005789+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f734fda3-5f73-4434-8583-7c955b2f3a3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/32dbf747a172f6fcbd9d33f7601b02a5", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd75 Retour de test**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **In review WMS**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **In review WMS**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne -Partie 1-](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne-partie-1) **\ud83d\udc8e\ud83d\udc8e\ud83d\udc8edoing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n - *fix(import): stop importing translations in locales missing from the organization* [\\#7856](https://github.com/Wishibam/Marketplace-api/pull/7856)\n - *feat(merchandising): filtres stock, diffusion limit\u00e9e et prix* [\\#7857](https://github.com/Wishibam/Marketplace-api/pull/7857)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-26T12:00:08.011884Z"} 2026-08-26T12:00:08.011884+00:00 https://vulnerability.circl.lu/sighting/9eaf6c88-6844-4c78-afc8-48a025500662/export 2026-09-05T19:39:50.005967+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9eaf6c88-6844-4c78-afc8-48a025500662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/ff093c32f17cede521e46812e6adf688", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd75 Retour de test**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **In review WMS**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **In review WMS**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne -Partie 1-](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne-partie-1) **\ud83e\udd73Testing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *Disabled MCP by default* [\\#7840](https://github.com/Wishibam/Marketplace-api/pull/7840)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n - *:bug: fix: stop hydrating import report errors on retailers list* [\\#7855](https://github.com/Wishibam/Marketplace-api/pull/7855)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-25T07:59:58.066656Z"} 2026-08-25T07:59:58.066656+00:00 https://vulnerability.circl.lu/sighting/b404c0e0-d679-493c-b702-e9a93957499a/export 2026-09-05T19:39:50.006150+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b404c0e0-d679-493c-b702-e9a93957499a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/312c3f50bce696ca594e8806df98ff03", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd73Testing**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd75 Retour de test**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **In review WMS**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne -Partie 1-](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne-partie-1) **\ud83e\udd73Testing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n - *fix: batch action view* [\\#7852](https://github.com/Wishibam/Marketplace-api/pull/7852)\n - *:bug: fix: batch the retailers list health queries (N+1)* [\\#7854](https://github.com/Wishibam/Marketplace-api/pull/7854)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-24T15:51:03.660246Z"} 2026-08-24T15:51:03.660246+00:00 https://vulnerability.circl.lu/sighting/7a78e6e4-eb8a-4b78-8838-2a9e793e2e4d/export 2026-09-05T19:39:50.006343+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7a78e6e4-eb8a-4b78-8838-2a9e793e2e4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53965", "type": "seen", "source": "https://gist.github.com/FR-Flo/05ac136c9c9ce0232c5ef40f4fb2c11f", "content": "## \ud83d\udd17 Companion release\n\nThis release ships alongside the **Marketplace-client (frontend)** release PR:\n\n- https://github.com/Wishibam/Marketplace-client/pull/4256\n\n- **Trello**\n - [Attributs required par cat\u00e9gorie](https://trello.com/c/2loCszpt/1854-attributs-required-par-cat%C3%A9gorie) **\ud83e\udd73Testing**\n - *Feat: Makes attributes required or not per categories* [\\#7474](https://github.com/Wishibam/Marketplace-api/pull/7474)\n - [\ud83d\udfe2 Int\u00e9gration des fanions promotionnels \u2014 Ajout image au tag de taxon (MP) (\u00e9volution n\u00b011)](https://trello.com/c/fNNkiR1c/2405-%F0%9F%9F%A2-int%C3%A9gration-des-fanions-promotionnels-ajout-image-au-tag-de-taxon-mp-%C3%A9volution-n11) **\ud83e\udd75 Retour de test**\n - *:sparkles: feat: fanions de taxon \u2014 images desktop/mobile (MP-api)* [\\#7617](https://github.com/Wishibam/Marketplace-api/pull/7617)\n - [MP - Cr\u00e9ation / modification m\u00e9thode de livraison - impossible de save](https://trello.com/c/Ud1DRxgj/2407-mp-cr%C3%A9ation-modification-m%C3%A9thode-de-livraison-impossible-de-save) **\ud83e\udd75 Retour de test**\n - *:bug: MP Fix Dpd class, file and discriminator name* [\\#7757](https://github.com/Wishibam/Marketplace-api/pull/7757)\n - [Ticket de caisse - pb de cache](https://trello.com/c/EwgktbXZ/2493-ticket-de-caisse-pb-de-cache) **\ud83e\udd75 Retour de test**\n - *:bug: fix: reset receipt cache between export Messenger messages* [\\#7791](https://github.com/Wishibam/Marketplace-api/pull/7791)\n - [\ud83d\ude84 Commande exp\u00e9di\u00e9e : l'interface part trop vite et garde l'ancien statut](https://trello.com/c/6QmFnpyb/2418-%F0%9F%9A%84-commande-exp%C3%A9di%C3%A9e-linterface-part-trop-vite-et-garde-lancien-statut) **In review WMS**\n - *:sparkles: OMS order, add \"inProcessing\" flag* [\\#7797](https://github.com/Wishibam/Marketplace-api/pull/7797)\n - [MP - Sur le marchand (listing & d\u00e9tails), mettre un lien qui redirige directement vers le marchand en front](https://trello.com/c/Z136lbnm/1296-mp-sur-le-marchand-listing-d%C3%A9tails-mettre-un-lien-qui-redirige-directement-vers-le-marchand-en-front) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add retailer eshop link* [\\#7822](https://github.com/Wishibam/Marketplace-api/pull/7822)\n - [Tag - Ajout du champ \"Visibilit\u00e9\" c\u00f4t\u00e9 MP](https://trello.com/c/zPFP31T9/2398-tag-ajout-du-champ-visibilit%C3%A9-c%C3%B4t%C3%A9-mp) **\ud83d\ude80\ud83d\ude80\ud83d\ude80A MEP**\n - *:sparkles: Add tag visibility field to retailer corner and category* [\\#7831](https://github.com/Wishibam/Marketplace-api/pull/7831)\n - [Nouvelle vue Enseigne -Partie 1-](https://trello.com/c/AVsRvxLu/2494-nouvelle-vue-enseigne-partie-1) **\ud83e\udd73Testing**\n - *:sparkles: OMS New enseigne view (front only) no interaction* [\\#7846](https://github.com/Wishibam/Marketplace-api/pull/7846)\n \n- **Misc**\n - *feat(shipping-method): expose the default return method flag on the API* [\\#7793](https://github.com/Wishibam/Marketplace-api/pull/7793)\n - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n - *:bug: WMS Log Message Container identifier* [\\#7810](https://github.com/Wishibam/Marketplace-api/pull/7810)\n - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)\n - *feat(mcp): add MCP server walking skeleton with list\\_organizations* [\\#7823](https://github.com/Wishibam/Marketplace-api/pull/7823)\n - *refactor(mcp): extract logic from ImportAction, RetailerNormalizer and RankProduct* [\\#7824](https://github.com/Wishibam/Marketplace-api/pull/7824)\n - *:sparkles: feat: compute product scoring on the fly (service + ES)* [\\#7825](https://github.com/Wishibam/Marketplace-api/pull/7825)\n - *:sparkles: feat: raise the ES pagination window beyond 10k documents* [\\#7826](https://github.com/Wishibam/Marketplace-api/pull/7826)\n - *feat(merchandising): supporter les tris du listing produit sur POST /merchandising* [\\#7827](https://github.com/Wishibam/Marketplace-api/pull/7827)\n - *feat(merchandising): actions de masse asynchrones avec lock par organisation* [\\#7828](https://github.com/Wishibam/Marketplace-api/pull/7828)\n - *Merge feat/mcp-walking-skeleton (simulate #7823 merge)* [\\#7832](https://github.com/Wishibam/Marketplace-api/pull/7832)\n - *feat(product-list): pipeline batch pour les actions de masse des listes produits* [\\#7833](https://github.com/Wishibam/Marketplace-api/pull/7833)\n - *feat(mcp): Add OAuth discovery* [\\#7834](https://github.com/Wishibam/Marketplace-api/pull/7834)\n - *:arrow\\_up: deps: bump mcp/sdk to 0.7.1 (CVE-2026-53965)* [\\#7838](https://github.com/Wishibam/Marketplace-api/pull/7838)\n - *:bug: fix: guard against null option name/value in CSV export* [\\#7841](https://github.com/Wishibam/Marketplace-api/pull/7841)\n - *:bug: fix: stream line item CSV export to fix memory exhaustion* [\\#7842](https://github.com/Wishibam/Marketplace-api/pull/7842)\n - *:arrow\\_up: deps: patch sodium\\_compat Ed25519 key validation vulnerability* [\\#7843](https://github.com/Wishibam/Marketplace-api/pull/7843)\n - *fix: attribut required category* [\\#7851](https://github.com/Wishibam/Marketplace-api/pull/7851)\n \n- **D\u00e9j\u00e0 en production**\n - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n - *feat: allow max product variation at 380* [\\#7829](https://github.com/Wishibam/Marketplace-api/pull/7829)\n - *:bug: fix: stop gating unmapped counters on product validity* [\\#7835](https://github.com/Wishibam/Marketplace-api/pull/7835)\n - *:bug: fix: repair missing-mapping counters behind the retailer list icon* [\\#7837](https://github.com/Wishibam/Marketplace-api/pull/7837)\n\n## POST MEP\n\n### [PR #7826](https://github.com/Wishibam/Marketplace-api/pull/7826) \u2014 :sparkles: feat: raise the ES pagination window beyond 10k documents\n\n```\n curl -X PUT \"http://localhost:9200/prod_product_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":200000}}'\n curl -X PUT \"http://localhost:9200/prod_variation_*/_settings\" -H 'Content-Type: application/json' -d '{\"index\":{\"max_result_window\":500000}}'\n\n V\u00e9rifier :\n curl \"http://localhost:9200/prod_product_*/_settings/index.max_result_window?flat_settings\"\n curl \"http://localhost:9200/prod_variation_*/_settings/index.max_result_window?flat_settings\"\n```\n\n### [PR #7828](https://github.com/Wishibam/Marketplace-api/pull/7828) \u2014 feat(merchandising): actions de masse asynchrones avec lock par organisation\n\n - ansible en prod \u00e7a https://github.com/Wishibam/Infrastructure/pull/467\n", "creation_timestamp": "2026-08-24T09:02:40.054168Z"} 2026-08-24T09:02:40.054168+00:00