The second half of June 2026 brought WooCommerce 10.9, with transactional email logging in core, later draft order creation at checkout and new product and order abilities, followed a day later by 10.9.1. Android 17 shipped, MySQL 8.4.10 and 9.7.1 arrived as a critical security patch update, and nginx 1.30.3 and 1.31.2 fixed gRPC proxy and HTTP/3 memory bugs. Here is what shipped and what it means for your store and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WooCommerce 10.9 | June 23, 2026 | Feature release | See standalone post |
| WooCommerce 10.9.1 | June 24, 2026 | Fix release | Update to 10.9.1 |
| Android 17 | June 16, 2026 | Major release | Test on Android 17 |
| MySQL 8.4.10 and 9.7.1 Critical Security Patch Update | June 16, 2026 | Security | Apply 8.4.10 or 9.7.1 |
| nginx 1.30.3 and 1.31.2 | June 17, 2026 | Security | Update nginx |
WooCommerce 10.9
WooCommerce 10.9 was released on June 23, 2026, with minimums at WordPress 6.9 and PHP 7.4. It logs every transactional email send attempt in core, stops the Store API from creating draft orders on fresh sessions, rebuilds the product and order abilities and deprecates the block based Product Editor beta.
For the full write up, read our standalone post: WooCommerce 10.9.
WooCommerce 10.9.1 fix
What shipped
WooCommerce 10.9.1 was released on June 24, 2026, restoring compatibility with older versions of the WooCommerce Stripe Payment Gateway.
What it means for you
Stores that run an older Stripe gateway should move straight to 10.9.1 or later rather than stopping at 10.9.0.
How we use it in WordPress builds
On stores with an older Stripe gateway we update to 10.9.1, flush OPcache and run a test payment on staging before production.
What it means for mobile apps
Store apps that take Stripe payments use the same gateway, so we run a test order through the app after the update.
What to do next
- Update to WooCommerce 10.9.1 or later, not 10.9.0.
- Run a test Stripe payment.
- Let our support and maintenance team handle it for you.
Android 17 Removes the Large Screen Orientation Opt Out and Enforces App Memory Limits
What shipped
Google released Android 17 on June 16, 2026. Changes that affect apps targeting API level 37:
- Google released Android 17 (API level 37) on June 16, 2026 for most supported Pixel devices.
- Apps targeting API 37 can no longer opt out of orientation and resizability on large screens.
- The system enforces app memory limits based on device RAM.
- Apps targeting API 37 have local network access blocked by default and need ACCESS_LOCAL_NETWORK.
- Certificate transparency is on by default, and native libraries loaded with System.load must be read only.
What it means for you
Apps that locked themselves to portrait will be resized on tablets and foldables once they target Android 17. Layouts that assume a phone screen need work before that target change.
How we use it in WordPress builds
Content from WordPress shown in the app should already be responsive. Fixed width embeds and tables are the usual problems on large screens.
What it means for mobile apps
AppPresser apps should be tested on a large screen emulator before targeting API 37. Apps that talk to local devices need the new permission.
What to do next
Test your app on Android 17 now, then plan the API 37 target change. Our custom mobile app team runs these checks.
MySQL 8.4.10 and 9.7.1 Ship as a Critical Security Patch Update
What shipped
Oracle released MySQL 8.4.10 and 9.7.1 on June 16, 2026, outside the normal quarterly schedule:
- MySQL 8.4.10 and 9.7.1 were released June 16, 2026.
- The 8.4.10 notes state that it is a Critical Security Patch Update tied to the Oracle Critical Security Patch Update Advisory for June 2026.
- audit_log_rotate_on_size now requires the AUDIT_ADMIN privilege.
What it means for you
This is a security only release. Oracle's advisory lists the details, and the release notes point to it.
How we use it in WordPress builds
We apply patch releases on the LTS line a site already runs, so the WordPress side sees no feature changes.
What it means for mobile apps
No app change. The fix is on the database server.
What to do next
Ask your host to apply 8.4.10 or 9.7.1 or later. Our WordPress security and hosting service schedules database patches.
nginx 1.30.3 and 1.31.2 Fix gRPC Proxy and HTTP/3 Memory Bugs
What shipped
nginx.org released 1.30.3 and 1.31.2 on June 17, 2026:
- nginx 1.30.3 and 1.31.2 were released June 17, 2026.
- CVE-2026-42055: buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module (medium).
- CVE-2026-48142: buffer overread in the charset module (low).
- 1.31.2 also fixes CVE-2026-42530, an HTTP/3 use after free rated major that affected only 1.31.0 and 1.31.1.
What it means for you
Servers on the mainline branch with HTTP/3 turned on had a major rated issue. Stable branch users still needed the gRPC and charset fixes.
How we use it in WordPress builds
Most WordPress stacks do not use gRPC, but the charset fix applies broadly. We update all servers.
What it means for mobile apps
HTTP/3 can speed up app requests on mobile networks. If you run it on mainline nginx, apply 1.31.2 right away.
What to do next
Update to 1.30.3 or 1.31.2 or later. Our WordPress security and hosting plans include this.
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule. Hosting and server changes are covered by our WordPress security and hosting service, and AI integrations by our AI implementation team.
We also track the server, app platform and payment releases behind your site and app, including Android, MySQL and nginx. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Frequently asked questions
Where do I find the new email logs?
Under WooCommerce, Status, Logs.
Are variation galleries switched on in 10.9?
No. They ship off by default behind a toggle in the Features settings.
Why did my site show a fatal error during the 10.9 update?
WooCommerce said the notice can appear while plugin files are being replaced and clears after the update finishes. If it persists, clearing the server cache or flushing OPcache helps.
Does Android 17 break existing apps right away?
Most of the new limits apply when an app targets API level 37. Memory limits and some security defaults affect all apps on Android 17, so test now even before changing the target.
Brief us on your mission
Want WooCommerce updates tested with your gateways and checkout extensions before they go live? Tell us about your store and a specialist will follow up.
