Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes

.env.docker

@@ -22,6 +22,10 @@ DC_N1_NEXT_PUBLIC_META_PIXEL_ID=
 DC_N1_NEXT_PUBLIC_GOOGLE_ADS_ID=
 DC_N1_NEXT_PUBLIC_HEUREKA_API_KEY=
 DC_N1_NEXT_PUBLIC_LEADHUB_TRACKING_ID=
+# Optional N1-specific overrides of the shared email inputs.
+DC_N1_RESEND_API_KEY=
+DC_N1_RESEND_FROM_EMAIL=
+DC_N1_CONTACT_EMAIL=
 
 # Herbatika storefront container
 DC_HERBATIKA_PUBLIC_PORT=3001
@@ -31,7 +35,6 @@ DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_BACKEND_URL=http://localhost:9000
 DC_HERBATIKA_MEILISEARCH_HOST=http://medusa-meilisearch:7700
 DC_HERBATIKA_NEXT_PUBLIC_PACKETA_WIDGET_COUNTRIES=sk
 DC_HERBATIKA_NEXT_PUBLIC_PACKETA_WIDGET_API_KEY=
-DC_HERBATIKA_PAYLOAD_BASE_URL_INTERNAL=http://payload:8083
 DC_HERBATIKA_NEXT_PUBLIC_PAYLOAD_BASE_URL=http://localhost:8083
 DC_HERBATIKA_MEILISEARCH_SEARCH_API_KEY=MEILISEARCH_SEARCH_READONLY_KEY_FOR_FRONTEND
 DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY=
@@ -45,9 +48,15 @@ DC_MEDUSA_COOKIE_SECURE=
 DC_MEDUSA_COOKIE_SAME_SITE=
 DC_MEDUSA_ADMIN_DISABLED_FOR_BACKEND_BUILD=0
 DC_STOREFRONT_URL=http://localhost:3001
-DC_STORE_CORS="http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001,http://localhost:8000,http://127.0.0.1:8000,http://localhost:8080,http://127.0.0.1:8080,https://n1.medusa.localhost,http://localhost:9004,https://docs.medusajs.com"
-DC_ADMIN_CORS="http://localhost:5173,https://admin.medusa.localhost,http://localhost:9000,https://docs.medusajs.com"
-DC_AUTH_CORS="http://localhost:5173,https://admin.medusa.localhost,http://localhost:9000,https://docs.medusajs.com"
+DC_STORE_NAME="NewEngine Store"
+DC_STORE_CORS="http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001,http://localhost:8000,http://127.0.0.1:8000,http://localhost:8080,http://127.0.0.1:8080,https://n1.medusa.localhost,http://localhost:9004"
+DC_ADMIN_CORS="http://localhost:5173,https://admin.medusa.localhost,http://localhost:9000"
+DC_AUTH_CORS="http://localhost:5173,https://admin.medusa.localhost,http://localhost:9000"
+DC_PRODUCT_REVIEW_REQUEST_MESSAGE="Napiš recenzi produktu"
+DC_PRODUCT_REVIEW_REQUEST_DELAY_MINUTES=10080
+DC_PRODUCT_REVIEW_TOKEN_EXPIRY_DAYS=90
+DC_WORKFLOW_QUEUE_RUNNER_BATCH_SIZE=500
+DC_WORKFLOW_QUEUE_RUNNER_SCHEDULE="0 * * * *"
 DC_SENTRY_DSN=
 DC_SENTRY_NAME=
 DC_SENTRY_TRACES_SAMPLE_RATE=0.1
@@ -61,6 +70,10 @@ DC_FEATURE_PAYMENT_QR_ENABLED=0
 DC_SUPERADMIN_EMAIL=
 DC_SUPERADMIN_PASSWORD=
 DC_INITIAL_PUBLISHABLE_KEY_NAME="Storefront Publishable Key"
+# Optional Medusa-specific overrides of the shared email inputs.
+DC_MEDUSA_BE_RESEND_API_KEY=
+DC_MEDUSA_BE_RESEND_FROM_EMAIL=
+DC_MEDUSA_BE_RESEND_WEBHOOK_SECRET=
 
 # PayKit payment providers
 DC_FEATURE_PAYKIT_ENABLED=0
@@ -87,8 +100,11 @@ DC_COMGATE_PAYMENT_LABEL=
 DC_STRIPE_API_KEY=
 DC_STRIPE_WEBHOOK_SECRET=
 
-# Optional Herbatica seed XML sources. Keep empty unless running seedHerbatica.
+# Herbatica seed sources. Products and categories have repository fixture
+# fallbacks, reviews are optional, and manufacturers must be set explicitly
+# before running seedHerbatica.
 DC_HERBATICA_CATEGORIES_XML_PATH=
+DC_HERBATICA_MANUFACTURERS_CSV_PATH=
 DC_HERBATICA_REVIEWS_XML_PATH=
 DC_HERBATICA_XML_PATH=
 

.gitignore

@@ -34,8 +34,7 @@ node_modules
 npm-debug.log
 testem.log
 /typings
-tsconfig.tsbuildinfo
-tsconfig.type-tests.tsbuildinfo
+*.tsbuildinfo
 storybook-static
 /reports/
 

.mise.toml

@@ -21,7 +21,7 @@ run = "mise run dev:internal:down"
 
 [tasks."dev:down:volumes"]
 description = "Stop the local compose stack and remove named volumes"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} down -v --remove-orphans --timeout ${COMPOSE_STOP_TIMEOUT:-60}"
+run = "bash ./scripts/dev/run-compose.sh down -v --remove-orphans --timeout ${COMPOSE_STOP_TIMEOUT:-60}"
 
 [tasks."dev:resources"]
 description = "Start and wait for manifest-defined shared resources"
@@ -91,6 +91,14 @@ run = "bash ./scripts/dev/run-pnpm-toolchain.sh pnpm --filter medusa-be update -
 description = "Update @medusajs/* packages inside the Medusa backend workspace"
 run = "bash ./scripts/dev/run-pnpm-toolchain.sh pnpm --filter medusa-be update '@medusajs/*' --latest"
 
+[tasks."dev:deps:peers:check"]
+description = "Check workspace peer dependency contracts without changing dependencies"
+run = "bash ./scripts/dev/run-pnpm-toolchain.sh pnpm peers check"
+
+[tasks."dev:deps:dedupe:check"]
+description = "Report compatible dependency convergence without changing the lockfile"
+run = "bash ./scripts/dev/run-pnpm-toolchain.sh pnpm dedupe --check"
+
 [tasks."dev:deps:npkill"]
 description = "Interactively clean node_modules trees inside the repo pnpm toolchain container"
 run = "PNPM_TOOLCHAIN_TTY=1 bash ./scripts/dev/run-pnpm-toolchain.sh pnpx npkill -x -D -y"
@@ -105,15 +113,15 @@ run = "bash ./scripts/dev/run-prod-stack.sh --no-cache"
 
 [tasks."dev:medusa:user:create"]
 description = "Create a Medusa admin user in the running local stack (requires EMAIL and PASSWORD)"
-run = """bash -lc 'test -n \"${EMAIL:-}\" && test -n \"${PASSWORD:-}\" || { echo \"EMAIL and PASSWORD are required.\" >&2; exit 1; }; docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be exec medusa user -e \"$EMAIL\" -p \"$PASSWORD\"'"""
+run = """bash -lc 'test -n \"${EMAIL:-}\" && test -n \"${PASSWORD:-}\" || { echo \"EMAIL and PASSWORD are required.\" >&2; exit 1; }; bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be exec medusa user -e \"$EMAIL\" -p \"$PASSWORD\"'"""
 
 [tasks."dev:medusa:migrate"]
 description = "Run Medusa migrations against the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run migrate"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run migrate"
 
 [tasks."dev:medusa:migration:generate"]
 description = "Generate a Medusa migration in the running local stack (requires MODULE)"
-run = """bash -lc 'test -n \"${MODULE:-}\" || { echo \"MODULE is required.\" >&2; exit 1; }; docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run migrate:generate-only \"$MODULE\"'"""
+run = """bash -lc 'test -n \"${MODULE:-}\" || { echo \"MODULE is required.\" >&2; exit 1; }; bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run migrate:generate-only \"$MODULE\"'"""
 
 [tasks."dev:medusa:oas"]
 description = "Generate combined Medusa OAS with backend and Symmy plugin API docs (OAS_OUT_DIR defaults to .oas/)"
@@ -125,23 +133,23 @@ run = "bash ./scripts/dev/minio-init.sh"
 
 [tasks."dev:medusa:meili:reseed"]
 description = "Rebuild Medusa search documents in the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run addInitialSearchDocuments"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run addInitialSearchDocuments"
 
 [tasks."dev:medusa:seed"]
 description = "Seed initial Medusa data in the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run seedInitialData"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run seedInitialData"
 
 [tasks."dev:medusa:seed:dev-data"]
 description = "Seed Medusa development data in the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run seedDevData"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run seedDevData"
 
 [tasks."dev:medusa:seed:n1"]
 description = "Seed N1-specific Medusa data in the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run seedN1"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run seedN1"
 
 [tasks."dev:medusa:seed:order-business-status-demo"]
 description = "Seed Medusa order business status demo orders in the running local stack"
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} exec medusa-be pnpm --filter medusa-be run seedOrderBusinessStatusDemo"
+run = "bash ./scripts/dev/run-compose.sh exec medusa-be pnpm --filter medusa-be run seedOrderBusinessStatusDemo"
 
 [tasks."dev:medusa:seed:herbatica-promos"]
 description = "Seed Herbatica with rebased promo windows (PROMO_REBASE_DAYS defaults to 30)"
@@ -242,12 +250,12 @@ run = "MEDUSA_E2E_DOWN_VOLUMES=1 bash ./scripts/e2e/medusa-be-http-local.sh down
 [tasks."dev:internal:resources:up"]
 description = "Start manifest-defined shared resource services"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} up -d --build $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase resources)"
+run = "bash ./scripts/dev/run-compose.sh up -d --build $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase resources)"
 
 [tasks."dev:internal:down"]
 description = "Gracefully stop and remove compose services before stepped startup"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} down --remove-orphans --timeout ${COMPOSE_STOP_TIMEOUT:-60}"
+run = "bash ./scripts/dev/run-compose.sh down --remove-orphans --timeout ${COMPOSE_STOP_TIMEOUT:-60}"
 
 [tasks."dev:internal:resources:wait"]
 description = "Wait for manifest-defined shared resource services to become healthy"
@@ -262,12 +270,12 @@ run = "bash ./scripts/dev/mise-dev-helpers.sh sync-meili-env"
 [tasks."dev:internal:backend:up"]
 description = "Start manifest-defined backend phase services"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase backend)"
+run = "bash ./scripts/dev/run-compose.sh up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase backend)"
 
 [tasks."dev:internal:backend:prepare"]
 description = "Run Medusa DB migrations before backend startup"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} run --rm --build --no-deps medusa-be pnpm --filter medusa-be run migrate"
+run = "bash ./scripts/dev/run-compose.sh run --rm --build --no-deps medusa-be pnpm --filter medusa-be run migrate"
 
 [tasks."dev:internal:backend:wait"]
 description = "Wait for manifest-defined backend phase services to become healthy"
@@ -277,7 +285,7 @@ run = "bash ./scripts/dev/mise-dev-helpers.sh wait-healthy $(bash ./scripts/dev/
 [tasks."dev:internal:frontend:up"]
 description = "Start manifest-defined frontend phase services"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase frontend)"
+run = "bash ./scripts/dev/run-compose.sh up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase frontend)"
 
 [tasks."dev:internal:frontend:wait"]
 description = "Wait for manifest-defined frontend phase services to become healthy"
@@ -287,7 +295,7 @@ run = "bash ./scripts/dev/mise-dev-helpers.sh wait-healthy $(bash ./scripts/dev/
 [tasks."dev:internal:operator:up"]
 description = "Start manifest-defined operator phase services"
 hide = true
-run = "docker compose -f docker-compose.yaml -p ${PROJECT_NAME:-new-engine} --profile operator up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase operator)"
+run = "bash ./scripts/dev/run-compose.sh --profile operator up -d --build --no-deps $(bash ./scripts/dev/mise-dev-helpers.sh services-for-phase operator)"
 
 [tasks."dev:internal:operator:wait"]
 description = "Wait for manifest-defined operator phase services to become healthy"

apps/frontend-demo/package.json

@@ -17,8 +17,8 @@
     "prebuild": "pnpm generate:categories"
   },
   "dependencies": {
-    "@medusajs/js-sdk": "2.15.2",
-    "@medusajs/types": "2.15.2",
+    "@medusajs/js-sdk": "2.17.2",
+    "@medusajs/types": "2.17.2",
     "@react-email/components": "^0.3.2",
     "@tanstack/react-query": "^5.90.10",
     "@tanstack/react-store": "^0.8.0",

apps/frontend-demo/src/types/generated-assets.d.ts

@@ -0,0 +1,57 @@
+declare module "*.jpg" {
+  const image: import("next/image").StaticImageData
+  export default image
+}
+
+declare module "*.webp" {
+  const image: import("next/image").StaticImageData
+  export default image
+}
+
+declare module "@/lib/static-data/categories" {
+  import type { Category, CategoryTreeNode } from "@/lib/server/categories"
+
+  export type LeafCategory = {
+    id: string
+    name: string
+    handle: string
+    parent_category_id: string | null
+  }
+
+  export type LeafParent = {
+    id: string
+    name: string
+    handle: string
+    children: string[]
+    leafs: string[]
+  }
+
+  export type FilteringStats = {
+    totalCategoriesBeforeFiltering: number
+    totalCategoriesAfterFiltering: number
+    categoriesWithDirectProducts: number
+    filteredOutCount: number
+  }
+
+  export type StaticCategoryData = {
+    allCategories: Category[]
+    categoryTree: CategoryTreeNode[]
+    rootCategories: Category[]
+    categoryMap: Record<string, Category>
+    leafCategories: LeafCategory[]
+    leafParents: LeafParent[]
+    generatedAt: string
+    filteringStats: FilteringStats
+  }
+
+  const data: StaticCategoryData
+
+  export default data
+  export const allCategories: Category[]
+  export const categoryTree: CategoryTreeNode[]
+  export const rootCategories: Category[]
+  export const categoryMap: Record<string, Category>
+  export const leafCategories: LeafCategory[]
+  export const leafParents: LeafParent[]
+  export const filteringStats: FilteringStats
+}

apps/herbatika/next.config.ts

@@ -1,6 +1,13 @@
 import { join } from "node:path"
 import type { NextConfig } from "next"
 
+type ImageRemotePattern = {
+  protocol: "http" | "https"
+  hostname: string
+}
+
+const LOOPBACK_IMAGE_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"])
+
 const resolveImageRemotePattern = (baseUrl: string | undefined) => {
   if (!baseUrl) {
     return []
@@ -27,6 +34,23 @@ const resolveMedusaImageRemotePattern = () =>
 const resolvePayloadImageRemotePattern = () =>
   resolveImageRemotePattern(process.env.NEXT_PUBLIC_PAYLOAD_BASE_URL)
 
+const imageRemotePatterns: ImageRemotePattern[] = [
+  {
+    protocol: "https",
+    hostname: "cdn.myshoptet.com", // Herbatika CDN
+  },
+  {
+    protocol: "https",
+    hostname: "images.unsplash.com",
+  },
+  ...resolveMedusaImageRemotePattern(),
+  ...resolvePayloadImageRemotePattern(),
+]
+
+const shouldDisableImageOptimization = imageRemotePatterns.some(
+  ({ hostname }) => LOOPBACK_IMAGE_HOSTNAMES.has(hostname)
+)
+
 const nextConfig: NextConfig = {
   reactStrictMode: true,
   output: "standalone",
@@ -52,18 +76,10 @@ const nextConfig: NextConfig = {
     ],
   },
   images: {
-    remotePatterns: [
-      {
-        protocol: "https",
-        hostname: "cdn.myshoptet.com", // Herbatika CDN
-      },
-      {
-        protocol: "https",
-        hostname: "images.unsplash.com",
-      },
-      ...resolveMedusaImageRemotePattern(),
-      ...resolvePayloadImageRemotePattern(),
-    ],
+    // Browser-facing loopback URLs cannot be resolved correctly by the Next
+    // image optimizer from inside Docker. Non-loopback deployments stay optimized.
+    unoptimized: shouldDisableImageOptimization,
+    remotePatterns: imageRemotePatterns,
     qualities: [40, 50, 60, 75, 90],
   },
 

apps/herbatika/package.json

@@ -24,8 +24,8 @@
     ]
   },
   "dependencies": {
-    "@medusajs/js-sdk": "^2.12.5",
-    "@medusajs/types": "^2.12.5",
+    "@medusajs/js-sdk": "^2.17.2",
+    "@medusajs/types": "^2.17.2",
     "@tanstack/react-form": "^1.27.4",
     "@tanstack/react-query": "^5.90.2",
     "@techsio/storefront-data": "workspace:*",
@@ -41,7 +41,7 @@
     "@biomejs/biome": "2.3.8",
     "@iconify/tailwind4": "^1.0.6",
     "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
+    "@types/node": "24.12.4",
     "@types/qrcode": "1.5.6",
     "@types/react": "^19",
     "@types/react-dom": "^19",