* Lock markFulfillmentAsDeliveredWorkflow with fulifllment id
* Lock markOrderFulfillmentAsDeliveredWorkflow by orderId before calling markFulfillmentAsDeliveredWorkflow
* Add changeset
## Summary
Updated context passed for each variant when calculating prices so that `region` and `customer` coming from `setPricingContext` are not overriden if provided.
*Please provide answer here*
Otherwise you can't provide your own `region` and `customer` objects with additional information and you are left with the ones we pass as part of the cart object to the workflows that execute the hook.
*Please provide answer here*
Changed the order in which we define the default `region` and `cart` fields, taking their value from the cart, to before the destructured `setPricingContextResult`.
*Please provide answer here*
**Testing** — How have these changes been tested, or how can the reviewer test the feature?
*Please provide answer here*
---
## Examples
Provide examples or code snippets that demonstrate how this feature works, or how it can be used in practice.
This helps with documentation and ensures maintainers can quickly understand and verify the change.
```ts
// Example usage
```
---
## Checklist
Please ensure the following before requesting a review:
- [x] I have added a **changeset** for this PR
- Every non-breaking change should be marked as a **patch**
- To add a changeset, run `yarn changeset` and follow the prompts
- [ ] The changes are covered by relevant **tests**
- [x] I have verified the code works as intended locally
- [x] I have linked the related issue(s) if applicable
---
## Additional Context
fixes#13990
closes SUP-2647
---
> [!NOTE]
> Adjust pricing context merge order so `setPricingContext`-provided `customer` and `region` are not overridden when calculating variant prices.
>
> - **Core Flows (pricing)**:
> - In `packages/core/core-flows/src/cart/workflows/get-variants-and-items-with-prices.ts`, change merge order when building `baseContext` so `customer` and `region` from `setPricingContextResult` take precedence over cart-derived values when pricing variants.
> - **Changeset**:
> - Add patch changeset for `@medusajs/core-flows`.
>
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 010da7340909016692bea183d022dd0585abdb5a. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
* Add preprocess to version param to validate as number
* Add changeset
* Use the first version of the order as the starting node of activity to show correct total
* Add changeset
* Fetch first order version only if it's not the current version
* Remove conditionally rendered hook, use enable config
## Summary
**What** — What changes are introduced in this PR?
Include `material` field in the product detail summary UI section, to match the structure of the same edit UI, which includes the field.
**Why** — Why are these changes relevant or necessary?
Without this there is no UI to see the current value of the `material` field/
**How** — How have these changes been implemented?
Added a section row including the `material` field in the product detail summary section.
**Testing** — How have these changes been tested, or how can the reviewer test the feature?
Verified the field shos up as expected in the admin dashboard.
---
## Examples
Provide examples or code snippets that demonstrate how this feature works, or how it can be used in practice.
This helps with documentation and ensures maintainers can quickly understand and verify the change.
```ts
// Example usage
```
---
## Checklist
Please ensure the following before requesting a review:
- [x] I have added a **changeset** for this PR
- Every non-breaking change should be marked as a **patch**
- To add a changeset, run `yarn changeset` and follow the prompts
- [ ] The changes are covered by relevant **tests**
- [x] I have verified the code works as intended locally
- [x] I have linked the related issue(s) if applicable
---
## Additional Context
Add any additional context, related issues, or references that might help the reviewer understand this PR.
fixes#14019
closes SUP-2686
## Summary
**What** — What changes are introduced in this PR?
Allow users to delete other users and prevent them from deleting themselves.
**Why** — Why are these changes relevant or necessary?
Inability to delete other users causes old users that maybe don't work anymore with the business to have access still.
**How** — How have these changes been implemented?
Inverted the check in the admin delete user endpoint, to allow users deleting other users but themselves.
**Testing** — How have these changes been tested, or how can the reviewer test the feature?
Integration tests
---
## Examples
Provide examples or code snippets that demonstrate how this feature works, or how it can be used in practice.
This helps with documentation and ensures maintainers can quickly understand and verify the change.
```ts
// Example usage
```
---
## Checklist
Please ensure the following before requesting a review:
- [x] I have added a **changeset** for this PR
- Every non-breaking change should be marked as a **patch**
- To add a changeset, run `yarn changeset` and follow the prompts
- [x] The changes are covered by relevant **tests**
- [x] I have verified the code works as intended locally
- [x] I have linked the related issue(s) if applicable
---
## Additional Context
Add any additional context, related issues, or references that might help the reviewer understand this PR.
closes OPS-97
---
> [!NOTE]
> Enables deleting other users via admin DELETE endpoint while blocking self-deletion, with corresponding integration tests and changeset.
>
> - **Backend**
> - Update `DELETE /admin/users/:id` in `packages/medusa/src/api/admin/users/[id]/route.ts`:
> - Disallow self-deletion when `actor_id === id` with `NOT_ALLOWED` error.
> - Execute `removeUserAccountWorkflow` and return standard delete response.
> - **Tests**
> - Expand `integration-tests/http/__tests__/user/admin/user.spec.ts`:
> - Create a second admin user; delete it and verify auth identity `app_metadata` no longer includes `user_id`.
> - Confirm token still authenticates but access is revoked (401 on `/admin/users/me`).
> - Assert self-deletion returns 400 with message `"A user cannot delete itself"`.
> - **Changeset**
> - Add `.changeset/dull-plants-create.md` (patch for `@medusajs/medusa`).
>
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit f1f8252b91593b8a8fb03dc9d26460d09a10cfaa. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
## Summary
**What** — What changes are introduced in this PR?
Fix to prevent InfiniteList component from falling into an infinite loop of requests.
Before:
Uploading Grabación de pantalla 2025-11-03 a la(s) 11.34.55 p. m..mov…
**Why** — Why are these changes relevant or necessary?
The current dependency array of the useEffect in charge of issuing the next/previous fetch calls for pagination, include the functions from `useInfiniteQuery` in its dependency array as well as its body. This causes the component to render infinitely, as the functions reference change on every render.
**How** — How have these changes been implemented?
- Updated the problematic dependency array to not include these functions.
- Included a useEffect and refs for both functions to always have the latest value.
**Testing** — How have these changes been tested, or how can the reviewer test the feature?
Tested locally that the bug that was happening before the fix was mitigated and i was able to paginate correctly.
After fix:
https://github.com/user-attachments/assets/17d41bf9-6b3f-437b-b2ce-10e4dcbe248a
---
## Examples
Provide examples or code snippets that demonstrate how this feature works, or how it can be used in practice.
This helps with documentation and ensures maintainers can quickly understand and verify the change.
```ts
// Example usage
```
---
## Checklist
Please ensure the following before requesting a review:
- [x] I have added a **changeset** for this PR
- Every non-breaking change should be marked as a **patch**
- To add a changeset, run `yarn changeset` and follow the prompts
- [ ] The changes are covered by relevant **tests**
- [x] I have verified the code works as intended locally
- [x] I have linked the related issue(s) if applicable
---
## Additional Context
Add any additional context, related issues, or references that might help the reviewer understand this PR.
closes SUP-2620
---
> [!NOTE]
> Prevents InfiniteList from entering an infinite fetch loop by storing pagination functions in refs and removing them from the effect dependency array.
>
> - **Dashboard**:
> - **`packages/admin/dashboard/src/components/common/infinite-list/infinite-list.tsx`**:
> - Store pagination callbacks in refs: `fetchNextPageRef`, `fetchPreviousPageRef`, synced via `useEffect`.
> - Update `IntersectionObserver` callbacks to call `ref.current()` instead of the functions directly.
> - Remove `fetchNextPage`/`fetchPreviousPage` from the `useEffect` dependency array to stabilize observer setup.
> - **Changeset**:
> - Patch release for `@medusajs/dashboard` describing the fix.
>
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e21d9998ac01ae048fa7e72713a2027d3fc8cfb6. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
* Limit the number of ids passed to the different queries to render the tooltip details to 10, for products, product types and shipping options
* Add changeset
* Extract common additional field computation into variable
* Remove harcoded email in create user payload, use user_metadata instead to resolve the field
* Execute prep command on book and resources projects
* Improve user_metadata comment as per Shahed's suggestion
**What**
Return provider specific user_metadata in jwt token returned by auth/[actor_type]/[auth_provider] routes.
**Why**
When implementing thrid party auth flows, to create the Medusa entity representing the actor type, you will need information obtained from the callback after the user consents. For google for example, you need the email, which so far is stored in the provider user_metadata property but is never returned in the http response.
This causes one to circumvent around this issue by creating an additional http route which gets the auth_identity from the auth_context object, to access the providers array and then look for the specific element matching the current auth_provider route.
**How**
Pass the auth_provider obtained from the route path param and pass it down to `generateJwtTokenForAuthIdentity` and inside it, find the provider matching the auth provider passed from route handler inside the auth identity `provider_identities` property. If found, assign its `user_metadata` value to the property of the same name in the payload of the token to be generated.
Now the user has the user_metadata property included in the obtained token and can use it's information to create the corresponding Medusa entity for the actor type in context. In the case of google and customer actor type, they would use `user_metadata.email` to call the create customer api endpoint.
**Testing**
Haven't found anywhere in the codebase where the http layer of /auth functionality is tested, but tested locally with debugger and test storefront to guarantee the user_metadata is returned as expected, all working correctly.
Fixes#13584
CLOSES CORE-437
---
> [!NOTE]
> Propagates auth provider to JWT generation and embeds provider-specific user_metadata in tokens returned by auth routes.
>
> - **Auth JWT Payload**:
> - `generateJwtTokenForAuthIdentity` now accepts optional `authProvider` and injects matching provider `user_metadata` into JWT payload.
> - **Auth Routes** (`auth/[actor_type]/[auth_provider]/*`):
> - Pass `authProvider` from route params to JWT generator in `authenticate`, `register`, and `callback` handlers.
> - **Release**:
> - Changeset adds patch for `@medusajs/medusa`.
>
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4833faf84533ce7438bc37c15bd572f991988e69. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
Fixes#13625
---
> [!NOTE]
> Ensure `reserved_quantity` is adjusted when deleting reservation items via `deleteReservationItems`, with new integration tests covering deletion and inventory updates.
>
> - **Inventory Module Service (`packages/modules/inventory/src/services/inventory-module.ts`)**:
> - Add `deleteReservationItems` API (and transactional `_` variant) that hard-deletes reservations, then updates related inventory levels via `adjustInventoryLevelsForReservationsDeletion`.
> - Wire through event emission/manager decorators consistent with existing patterns.
> - **Integration Tests (`packages/modules/inventory/integration-tests/__tests__/inventory-module-service.spec.ts`)**:
> - Add tests for `deleteReservationItems` to verify deletion by id and `reserved_quantity` adjustments on inventory levels.
> - Minor import update to include `ReservationItemDTO`.
> - **Changeset**:
> - Patch release note for `@medusajs/inventory` documenting the fix.
>
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit ac6641a9ec9543115504407f708f81bd427c3444. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
- fix: make Metadata Variant and Product Variant static columns use the new function, so they don't fail later with the create / update product zod schema
- chore: add tests for processAsJson fucntion
Co-authored-by: Oli Juhl <59018053+olivermrbl@users.noreply.github.com>
Nicolas GorgaandGitHub
