https://leapgraph.com/graphql-api-security

This article mentions several add-on packages that Reaction may want to use. This issue is simply to investigate whether these vulnerabilities are present and try adding the packages to solve them.

Getting an error here when using the remove_promotion_line_items method. Seems like it should be using variant rather than item
https://github.com/spree/spree/blob/8ca9ec736a471b66f66d718b157be69946f8c5fc/core/app/models/spree/promotion_handler/coupon.rb#L78

Improve the tier prices feature - add info like "Buy 2 in x.xx$ and save x%"

Type: minor

Describe the bug
After adding a new account address, the screen goes blank you appear to be logged out, but when you refresh the page, the address is there and you are still logged in.

To Reproduce
Steps to reproduce the behavior:

1. Go to storefront
2. Log in
3. Click user name in upper right > Profile
4. Add a new address.
5. When you submit the form, see the

Hi,

I was trying to get the associated model from the cart item with $cartItem->model. However, it returns null.

I have seen that in CartItem class there is a call to the associatedModel function within __get method:

    /**
     * Get an attribute from the cart item or get the associated model.
     *
     * @param string $attribute
     *
     * @return mixed
     */
    pub