{"title":"Website v20.0.41 - 24 March 2026","slug":"website-v20-0-41","url":"https://support.storeconnect.com/articles/website-v20-0-41","url_markdown":"https://support.storeconnect.com/articles/website-v20-0-41.md","subtitle":null,"summary":"This patch resolves bugs affecting checkout error messaging, product category menu ordering, and price filtering on collection pages, with security dependency updates and a data sync performance improvement.","type":"Release_Notes","video_url":"","keywords":"release notes, update","last_modified":"2026-08-21T07:12:35+0000","body_markdown":"This patch resolves bugs affecting checkout error messaging, product category menu ordering, and price filtering on product collection pages. It also includes critical security dependency updates and a performance improvement to data sync processing.\n\n## Enhancements\n\n**Faster data sync processing.** Internal data synchronization queries have been optimized to reduce the time taken to process large volumes of record changes. Bulk insert and update operations now run approximately 35% faster, improving how quickly Salesforce data updates are reflected in your storefront during high-volume sync activity.\n\n**Security dependency updates.** This release includes updates to several dependencies to address high-severity security vulnerabilities:\n\n- **rack** — updated to address a multipart parser denial-of-service vulnerability and a regular expression denial-of-service issue.\n- **nokogiri** — updated to address a SAML signature bypass vulnerability (CVE-2025-30206) and multiple vulnerabilities in bundled libxml2 and libxslt libraries.\n- **rollup** — updated to address a critical path traversal vulnerability (CVE-2026-27606, CVSS 9.8) that could allow arbitrary file writes.\n- **vite** — updated to address a development server file disclosure vulnerability.\n- **Rails** — bumped to 7.2.3 as required for compatibility with the updated rack version.\n\nThese updates are applied automatically with this release and require no action from store administrators.\n\n## Fixed bugs\n\n**Checkout: clearer messaging when payment status is uncertain.** When a network timeout or server error occurred during checkout, customers previously saw a generic error message that gave no indication of whether their payment had gone through. This could lead to customers submitting duplicate payments. Customers in this situation are now shown a specific message advising them to check their confirmation email or Orders page before retrying, and the Pay button remains disabled to prevent accidental repeat submissions. For definite payment failures — where the outcome is known — the Pay button is re-enabled so customers can try again.\n\n**Product category menus were displaying child categories in the wrong order.** Child product categories were not always appearing in the configured order in navigation menus when using Menu Ordering. This was caused by how the database query was constructed — the sort order was applied to a subquery where it had no guaranteed effect on the outer result. The query has been rewritten to apply ordering correctly, so categories now appear in the position you have set.\n\n**Price range filter not working on product collection pages.** Adjusting the price slider on product collection and search pages had no effect — products outside the selected price range continued to be displayed. The slider also failed to restore its last position on page reload. The root cause was a malformed input name in the price range template and an incorrect parameter name being submitted to the server. Both issues have been fixed, and price filtering now works as expected."}