Merge pull request #4250 from craftcms/4.11

4.11

Author: brandonkelly

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - '4.x'
+      - '4.11'
   pull_request:
 permissions:
   contents: read

CHANGELOG.md

@@ -2,8 +2,12 @@
 
 ## Unreleased
 
-- Fixed a [high-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) SQL injection vulnerability in the control panel. (GHSA-875v-7m49-8x88)
-- Fixed a [low-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) Information disclosure vulnerability in payment controller action. (GHSA-3vxg-x5f8-f5qf)
+- Craft Commerce now requires Craft CMS 4.17.9 or later.
+- Cart numbers are now generated using a cryptographically secure random number generator.
+- Cart controller actions that accept an explicit cart number are now rate limited to mitigate enumeration attacks.
+- Fixed a PHP error that could occur when using the manual gateway. ([#4245](https://github.com/craftcms/commerce/pull/4245))
+- Fixed a [high-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) SQL injection vulnerability. (GHSA-875v-7m49-8x88)
+- Fixed a [low-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) information disclosure vulnerability. (GHSA-3vxg-x5f8-f5qf)
 
 ## 4.10.2 - 2026-02-09
 

composer.json

@@ -22,19 +22,19 @@
   "prefer-stable": true,
   "require": {
     "php": "^8.0.2",
-    "craftcms/cms": "^4.9.4",
+    "craftcms/cms": "^4.17.9",
     "dompdf/dompdf": "^2.0.2",
     "ibericode/vat": "^1.2.2",
     "iio/libmergepdf": "^4.0",
     "moneyphp/money": "^4.2.0"
   },
   "require-dev": {
-    "codeception/codeception": "^4.0.0",
-    "codeception/module-asserts": "^1.0.0",
-    "codeception/module-datafactory": "^1.0.0",
-    "codeception/module-phpbrowser": "^1.0.0",
-    "codeception/module-rest": "^1.0.0",
-    "codeception/module-yii2": "^1.0.0",
+    "codeception/codeception": "^4.1.29",
+    "codeception/module-asserts": "^1.3.1",
+    "codeception/module-datafactory": "^1.1.0",
+    "codeception/module-phpbrowser": "^1.0.2",
+    "codeception/module-rest": "^1.4.2",
+    "codeception/module-yii2": "^1.1.5",
     "craftcms/ckeditor": "^3.0",
     "craftcms/ecs": "dev-main",
     "craftcms/phpstan": "dev-main",