CoCart – Headless REST API for WooCommerce

Changelog

CoCart is open source and community-driven. Every release is tested, maintained, and published here on WordPress.org. Need more power? CoCart Plus unlocks advanced features and priority support.

v4.9.0 – July 12th, 2026

What’s New?

[!IMPORTANT]
PHP version 8.2 is the minimum requirement to install and use CoCart. PHP 7.4, 8.0, and 8.1 are all past end-of-life/security support so to help manage development resources to maintain CoCart, it will no longer be tested on these versions. Running CoCart on PHP 8.2 not only ensures you are secure but it also improves the performance of the CoCart API. Thank you for your understanding.

• REST API: Added ETag support for all cart endpoints (GET/POST/PUT/DELETE) enabling conditional requests with If-None-Match header for immediate use.
• REST API: Added ETag support for product endpoints (products, categories, tags, attributes, reviews).
• REST API: Added CoCart-Cache response header indicating cache status: HIT, MISS, or SKIP.
• REST API: Added _skip_cache query parameter to bypass caching for individual requests.
• REST API: Added stale-while-revalidate directive to cacheable routes (products) for improved performance.
• REST API: Added check for X-HTTP-Method-Override header if it exists during authentication.

• WordPress Dashboard: New integrations page to provide more control over which supported plugin is running when making a CoCart request.

• Plugin: New settings page providing quick easy control of CoCart without touching code for the following:

• • CORS and allowed origin.
• • Authorization header server variable.
• • Session expiration for guest and logged-in users.
• • “Load Cart from Session” feature.
• • “Name Your Price” feature.

Settings show a locked state when controlled by an external filter with a link providing information as to what and where.

Bug Fixes

• REST API: Requests made via the WordPress REST API batch endpoint were not recognized and caused a fatal error when adding items.
• REST API: Shipping address fields were blank after submitting billing-only details — billing fields now mirror to shipping when ship_to_different_address is not set, matching WooCommerce checkout behaviour. Shipping packages now also return correctly after a complete address is saved.
• REST API: Slugs, permalinks and attribute names with non-ASCII characters (e.g., Chinese, Arabic) are now returned decoded instead of encoded across all product and cart endpoints.
• REST API: Authentication not determining user in time when rest_url_prefix filter is used causing several cloned guest sessions with cart items.
• REST API: Fixed fatal error when adding an invalid product to cart via v2 controller due to missing WP_Error check after product validation.
• REST API: Corrected Last-Modified header in GMT per HTTP spec with more robust date parsing.
• Plugin: Fixed cocart_deprecated_filter() returning null when the debug log was active, causing callers to receive no value from the deprecation wrapper.

PHP 8.2+ Fixes

• REST API: Fixed warnings for undefined array keys cart_item_data and cart_item_key in v1 add item controller.
• Session: Fixed warning for undefined array key total in session handler cart hash generation.
• Plugin: Fixed warnings for undefined array key count when database queries return no results in cart counting functions.
• Plugin: Fixed warning for undefined variable $per_page in admin plugin search.
• Plugin: Fixed deprecated ${var} string interpolation syntax in plugin update screen.

Change

• Session: Removed the max expiration exceed limit of 30 days to allow adjusting the lifetimes via the cocart_cart_expiring and cocart_cart_expiration filters as needed.

Dev note: You will still be warned “Keeping sessions for longer than X days can cause performance issues and larger session tables.”

Improvements

• REST API: Slight performance increase by preventing admin content from loading in the background for every REST request made.
• REST API: cocart_upload_file() and cocart_upload_image_from_url() now use a try/finally block to guarantee the upload_dir filter is always removed, even when an exception is thrown during upload.
• REST API: cocart_upload_image_from_url() now uses wp_parse_url() to extract the filename from the image URL, correctly stripping query strings instead of splitting on ?.
• Session: Adjusted get_session() using wp_cache_set() instead of wp_cache_add(), which caused stale persistent object cache entries to never be overwritten.
• Session: Adjusted get_session() and update_cart() using an uninitialized expiration value on frontend requests, preventing sessions from being cached after a database read.
• Session: Adjusted save_data() writing to object cache with a potentially negative TTL when session expiration was stale or unset.
• Session: Adjusted update_cart() not syncing the object cache after a database write, causing subsequent reads to return stale cached data.
• Session: Added get_cache_expiration() helper to reliably resolve cache expiration across both REST API and frontend contexts.

Breaking Changes

• REST API: The cocart_does_product_allow_price_change filter now defaults to false. Price overrides via the price parameter on cocart/v2/cart/add-item are disabled by default. To restore the previous behaviour, add add_filter( 'cocart_does_product_allow_price_change', '__return_true' ); — or return true conditionally for specific products only.

Developers

• Logger: Log entries now include a source line identifying the calling class, method, file, and line number for easier debugging.
• Introduced new filter cocart_etag_cart_routes to customize which cart routes support ETag.
• Introduced new filter cocart_etag_product_routes to customize which product routes support ETag.
• Introduced new filter cocart_etag_routes to add ETag support for third-party plugin routes.
• Introduced new filter cocart_cache_max_age to customize cache duration (default: 1 hour).
• Introduced new filter cocart_stale_while_revalidate to customize stale-while-revalidate duration (default: 24 hours).

Deprecation’s

• Filter cocart_secure_registered_users deprecated for security — unauthenticated access to registered user carts is now always blocked.

Compatibility

• Tested with WordPress 7.0
• Tested with WooCommerce v10.9

v4.8.4 – 21st April, 2026

Bug Fixes

• Plugin: Fixed fatal error from sprint_f() typo in database update scheduler (sprintf).
• REST API: Apply Access-Control-Allow-Credentials header correctly.
• Load Cart: Only trigger warning if hook cocart_load_cart_override was used.
• Load Cart: Fixed uncaught type error merging an empty cart value. Reported by @allkhor 👍
• WordPress Dashboard: Fixed HTML issue in the WooCommerce admin bar title.

Compatibility

• Tested with WooCommerce v10.7

v4.8.3 – 26th January, 2026

Bug Fixes

• REST API: Updating a customer address after one is placed would not update.
• REST API: Return error responses correctly so all headers return.

Changes

• Plugin: Updated broken external links throughout the plugin.

v4.8.2 – 20th January, 2026

Improvements

• Plugin: WordPress plugin checker helped resolve a few PHP code standards.

Compatibility

• Tested with WordPress 6.9
• Tested with WooCommerce v10.4

v4.8.1 – 24th November, 2025

Bug Fixes

• REST API: Updating a customer address after one is placed would not update.
• REST API: No customer data, no applied coupons or removed items in session caused undefined errors.
• REST API: Customer data was not converting correctly to return in the Session API.
• REST API: The product object was not passed correctly in the Session API for items.
• REST API: Damaged or empty cart sessions was failing in the Session API.

Improvements

• Plugin: WordPress plugin checker helped resolve a few database issues to keep up with security practices.

Compatibility

• Tested with WooCommerce v10.3
• Added support for the next CoCart Plus update.

v4.8.0 – 22nd September, 2025

What’s New?

• Authentication: Enhanced login endpoint with improved permissions control via the new hooks mentioned below.

Improvements

• Authentication: Removed priority order so our JWT Auth integration can run earlier in the process.
• Authentication: Refactored get_ip_address for better trusted proxy support and better IP address detection with additional headers.
• REST-API: Session handler now loads during the login endpoint operations.
• Security: Item keys are now restricted to 32 characters maximum for better validation.
• User Management: Refactored is_user_customer function to support additional user roles beyond just customers.

Developers

• Logging: Added informational logs for IP address detection and proxy handling.
• Introduced a new filter cocart_login_permission_callback allows additional authentication checks after basic authorization for the login endpoint.
• Introduced a new filter cocart_login_secure_auth_methods determines which authentication methods should skip additional auth checks.
• Introduced a new filter cocart_login_query_parameters allows plugins to add additional parameters to the login endpoint.
• Introduced a new filter cocart_trusted_proxies allows adding trusted proxy IPs/CIDR for secure IP detection.
• Introduced a new filter cocart_ip_headers allows customization of headers used for IP address detection.
• Introduced a new hook cocart_login_permission_granted that triggers when login permission is granted for the login endpoint.

Compatibility

• Tested with WooCommerce v10.2

v4.7.0 – 8th August, 2025

What’s New?

• Authentication: Added support for authenticating via JSON request body with clear indication for the login endpoint (API v2 ONLY).

Improvements

• Authentication: Internal refactor to return WP_Error consistently from permission checks.
• REST API: Login (API v2 ONLY) Explicit added query params for username and password.

v4.6.4 – 6th August, 2025

Bug Fixes

• REST API: Fixes both the product review and rating count.
• Feature: Fixed “Load Cart from Session” from destroying sessions once loaded due to session improvements made in WC v10.

Improvements

• Plugin: Ensure that dependent plugins can be installed/activated if the plugin is installed in a different folder name.
• Feature: “Load Cart from Session” improved session data checking.
• Session handler: Reduced duplicate session calls and optimized update_session_timestamp() database query.
• Session handler: Restored persistent_cart_update compatibility for WooCommerce v10; only active for versions lower than v10.1.
• Session handler: Overrode session_exists() and delete_session() to use CoCart’s session table.
• Load Cart: Switched from $_REQUEST to $_GET and removed the priority for load_cart_action.
• Load Cart: Re-enabled initialize_cart_session() and stopped destroying cookies when loading carts.

Deprecated

• Action hook cocart_load_cart_override is no longer used.

v4.6.3 – 27th July, 2025

Bug Fix

• REST API: Fixes identifying namespace and routes in the WordPress REST API Index if not set should they already be filtered out.

v4.6.2 – 25th July, 2025

Bug Fix

• REST API: Removing an item stays removed. Solves issue #534

WooCommerce v10 caused a cache issue due to a change in the many times session data is handled.

Improvements

• Plugin: Session handler optimized – New sessions created first, then auth users if no cart requested.
• Plugin: Session handler – Removed the need to set cart hash at the start.
• Plugin: Session handler – Added a warning log for when the session data must have really screwed up.
• Plugin: Session handler – Added max expiration exceed limit to 30 days to avoid performance issues and the session table growing too large.
• REST API: Check REST request is CoCart before maybe loading cart or filtering served requests.
• REST API: Fixed deprecated functions still called in Products API.
• REST API: Authentication and CORS optimized to parse data less allowing for a faster response.
• REST API: Moved global headers to be filtered in rest_pre_serve_request instead of CoCart_Response which is not used for Products API.
• Plugin: Moved the cart cache to load once WooCommerce has loaded instead of only during the REST API.

Developer note: Cart cache allows for items with custom pricing to be calculated on the native site and not just via the REST API to keep consistent with calculations.

Requirements

• WooCommerce v9 minimum is now required for CoCart but for best performance recommend using v10+

Compatibility

• Tested with WooCommerce v10.0.4

v4.6.1 – 21st July, 2025

Bug Fixes

• REST API: Fixed undefined array key errors with cart session when cart is empty. Solves Issue #533
• REST API: Fixed removing an item using the update endpoint when it thinks quantity value is not numeric.

Compatibility

• Tested with WooCommerce v10.0.3

v4.6.0 – 26th June, 2025

This release is a compatibility release for the next WooCommerce release.

What’s new?

• WordPress dot ORG: Added a Playground blueprint.

Changes

• Plugin: Branding for CoCart has been updated.
• Plugin: Styling for CoCart pages have been improved and more consistent on all pages by reducing conflicts with WordPress and WooCommerce styling.

Improvements

• REST API: Basic authentication is detected much better.
• REST API: Authentication failures now has debug logs.
• WordPress Dashboard: Semantic markup overhaul for better screen reader interpretation.
• WordPress Dashboard: Setup wizard and Support pages have been updated.

Compatibility

• Tested with WooCommerce v10.0

v4.5.0 – 31st May, 2025

This release will most likely be the last update released on the WordPress plugin directory with anything NEW added.

What’s New?

• REST API: Products can now be filtered to return only products by brand names.

Bug Fix

• REST API: Added missing option for allowing to order products by random. Solves issue #516

Plugin Details

• Plugin: Updated links for documentation.
• WordPress Dashboard: Updated link for upgrade page.
• WordPress Dashboard: Plugin action links are added after now, not before.

Compatibility

• Tested with WooCommerce v9.9

v4.4.0 – 16th May, 2025

This release focuses on supporting such tools like ManageWP, MainWP, Blogvault etc.

Changes

• WordPress Dashboard: Database updates now run automatically if needed. Resolves issue #511
• WordPress Dashboard: Sessions now transfer automatically for new installs.
• Session: Cart session expiration’s are now matching the default expiration WooCommerce set for better compatibility and abandoned cart support.
• Session: Cart session expiration for logged in users renew daily and expire in a week. This is to keep carts persistent for logged in users.

Note: The session expiration’s can still be filtered back to the previous values but that would mean it would match the expiration for logged in users.

Third Party Support

• Plugin: LiteSpeed Cache will now exclude CoCart from being cached. Commit

Developers

• Filter cocart_cart_expiring added parameter is_user_logged_in() to allow the expiration for logged in users to be filtered.
• Filter cocart_cart_expiration added parameter is_user_logged_in() to allow the expiration for logged in users to be filtered.

Internal

• Improved the logger. Commit
• Added logs for database update procedure. Commit

Deprecations

• Filter cocart_log_entry_name no longer used.
• Filter cocart_log_entry_version no longer used.
• Filter cocart_log_entry_source no longer used.
• Filter cocart_setup_wizard_store_save_next_step_override no longer used.

v4.3.30 – 27th April, 2025

Bug Fix

• WordPress Dashboard: Fix plugin update warning for core plugin. Solves issue #506

Improvement

• REST API: Variation attribute data is now sanitized. Labels are converted to names (e.g. Size to pa_size), and values are cleaned.

Compatibility

• Tested with WordPress v6.8

v4.3.29 – 10th April, 2025

Bug Fix

• REST API: Package details would not return but showed fine in shipping meta.

Improvements

• REST API: Optimized fetching the cart in all Cart API endpoints.
• REST API: Shipping now fully respects the shipping settings.

Dev note: Meaning if you have requested that the customer provides the shipping address first before shipping is calculated, then no shipping methods will return until it’s provided.

Compatibility

• Tested with WooCommerce v9.8

v4.3.28 – 6th April, 2025

Bug Fix

• REST API: Fixed unidentified item key when adding grouped products.

v4.3.27 – 3rd April, 2025

Bug Fix

• REST API: Undone a change to fix any WooCommerce cookies from setting with the Cart API. Related to fixing persistent cart back in November last year.

v4.3.26 – 1st April, 2025

Bug Fix

• REST API: Fixed critical error when adding an item and asking to return the item details. Solves issue #509

Improvements

• REST API: Corrected and added missing schema information for Cart API v1.
• WordPress Dashboard: Tweaked plugin screen modal for listing untested plugins.

Requirement change

• WordPress 6.3 is the new minimum version required.

v4.3.25 – 17th March, 2025

Bug Fixes

• Plugin: Failed to activate fully when network activated due to how admin notices where set. – Bug Report
• WordPress Dashboard: Plugin suggestions was not letting you press the “Install Now” button.

v4.3.24 – 10th March, 2025

Bug Fix

• Fixed a few typo’s in the session handler.

Improvements

• WordPress Dashboard: Improved detection of a suggested plugin hosted on WordPress dot ORG and from a third party.
• WP-CLI: Update command now asks for confirmation before proceeding.

v4.3.23 – 3rd March, 2025

Bug Fixes

• Authentication: Changed access for setting an authentication error from protected to public. Allowing other authenticators to not fail when an error does occur.
• WP-CLI: When updating the plugin, we don’t need to include the install class again.

Improvements

• Database: Simply modified the structure for columns that were BIGINT UNSIGNED to bigint(20) unsigned.
• Session handler: Guest carts will now have a prefix t_ before the cart key provided. This matches with WooCommerce session handler where it maybe used by 3rd party plugins or web host configurations to identify if the session is for a guest user.

Dev note: This affects only new guest sessions.

Compatibility

• Tested with WooCommerce v9.7

v4.3.22 – 26th February, 2025

Corrections

• REST API: Schema corrections for cart endpoint.
• REST API: Schema corrections for items endpoint to match cart schema.

For Developers

• Moved filter cocart_get_customer_{field} after value instead of using it only when there is no value returned for a customers field. Replace {field} with the section prefix followed by the field name. e.g. billing_country

Developer note: This allows you to then alter values such as the billing country. See example.

add_filter( 'cocart_get_customer_billing_country', function( $value ) {
    if ( WC()->countries->country_exists( $value ) ) {
        return WC()->countries->get_countries()[ $value ];
    }

    return $value;
}, 10, 1);

• Introduced new filter cocart_get_after_customer_{field-type}_fields that allows you to change the customer fields after they returned. Replace {field-type} with either billing or shipping for the fields to alter.

v4.3.21 – 20th February, 2025

Improvement

• REST API: Added no-store as part of the Cache-Control header for guest users.

v4.3.20 – 8th February, 2025

Bug Fix

• REST API: Fixed product reviews not returning.

v4.3.19 – 6th February, 2025

Bug Fix

• REST API: Fixed setting a customers shipping address line 1 and 2.

v4.3.18 – 22nd January, 2025

General

• Updated link to Next Changelog for coming future major release. (v5.0)
• Improved SASS to CSS conversion.

Compatibility

• Tested with WooCommerce v9.6

v4.3.17 – 14th January, 2025

Bug Fix

• REST API: Stock status was incorrectly queried for Products API and now checks available stock statuses before filtering.

Improvements

• REST API: Version of CoCart only returns in the returned headers when debug is enabled now.
• REST API: WP_DEBUG is made sure it is defined before returning extras for developers in the store response.

Compatibility

• Tested with WooCommerce v9.5

View the full changelog here.