Hyvä Checkout 1.3.10: Why Small Fixes to Checkout UX Matter More Than You Think

Hyvä Checkout 1.3.10 was released on 23 April 2026 as a maintenance release focused mainly on bug fixes.

Hyvä’s official 1.3.10 changelog lists six changes covering guest-checkout CSP behaviour, address-modal interactions, street-address handling, checkout reinitialisation and saved-address list state.

These are focused reliability and usability fixes rather than new headline features.

For merchants running the 1.3.x line at the time, version 1.3.10 was therefore relevant as part of normal checkout maintenance and regression testing.

Later security update: Hyvä subsequently released 1.3.12 on 13 July 2026 with a High-severity payment-method availability bypass fix. Hyvä also provided security backports for earlier 1.3.x releases. Merchants still running 1.3.10 today should confirm that the relevant security patch is installed or move to 1.3.12 or later. The current 1.3.x stable release is 1.3.14, released on 15 September 2026. See Hyvä’s security changelog and current Checkout changelog.

What changed in Hyvä Checkout 1.3.10?

Hyvä lists six changes in the 1.3.10 release:

• a temporary fix for Alpine CSP errors when guest checkout is disabled

• preventing the address modal from closing when the pre-loader is clicked

• allowing the address modal to submit using the Enter or “Go” key

• fixing a TypeError when saving an empty single-line street address

• reinitialising checkout after cart or address changes outside the checkout

• preserving the “Show all / Show less” state in the saved-address list

These changes mostly address specific edge cases in checkout interaction and state handling.

Guest checkout no longer triggers the same Alpine CSP errors

Hyvä added a temporary fix for Alpine CSP errors that could occur when guest checkout was disabled.

The fix adds dedicated login templates for the affected checkout flow.

Hyvä describes this as a temporary solution until its in-checkout login and registration workflows are introduced.

For merchants, the practical point is that stores requiring customers to log in before checkout should retest the login path after upgrading, particularly where Content Security Policy controls are enabled.

This is a compatibility and flow-stability fix rather than a new customer-login feature.

The address modal stays open when the pre-loader is clicked

Version 1.3.10 fixes an issue where clicking the pre-loader could close the address modal.

For customers adding or editing an address, this could interrupt the interaction before the address work was complete.

The fix keeps the modal open while the relevant loading state is active.

Merchants should include this flow in regression testing where customers regularly add or update shipping and billing addresses during checkout.

Address forms can be submitted with Enter or the mobile “Go” key

Hyvä also updated the address modal so the form can be submitted using the keyboard Enter key or the equivalent “Go” action on mobile keyboards.

This is a focused interaction improvement.

For customers who use keyboards or mobile input controls rather than clicking the visible submit button, the behaviour is more consistent with common form expectations.

It is also worth testing this alongside any custom address-form JavaScript or validation logic.

Empty single-line street addresses no longer trigger the same TypeError

Hyvä fixed a TypeError that could occur when saving an empty single-line street address.

This is particularly relevant to stores using a single street-line configuration and address-book functionality.

The issue is an edge case rather than a general address failure, but merchants using custom address settings should include empty and incomplete address states in checkout regression testing.

Checkout reinitialises after external cart or address changes

Version 1.3.10 also improves how Hyvä Checkout responds when relevant data changes outside the current checkout state.

Hyvä documents reinitialisation when:

• a customer adds an address through My Account

• cart contents change outside the checkout

The checkout now refreshes its state so those external changes can be reflected correctly.

For merchants, this is relevant to customer journeys that move between account, cart and checkout, or where several browser tabs are used during a session.

It also matters for implementations with integrations or custom functionality that can modify cart or address data outside the checkout page.

Saved-address list state is preserved

Hyvä fixed the behaviour of the Show all / Show less control used in the saved-address list.

The selected state is now preserved rather than being reset unexpectedly during checkout interactions.

This is a small usability fix, but it is relevant for logged-in customers with several saved addresses.

Merchants with account-heavy or B2B customer journeys may find this especially useful to include in regression testing.

Why these maintenance fixes matter

Hyvä Checkout 1.3.10 does not introduce a new checkout architecture or major customer-facing capability.

Its value is in addressing several specific interaction and state-management issues that can affect particular checkout journeys.

Checkout behaviour spans:

• customer authentication

• saved addresses

• shipping and billing forms

• cart state

• keyboard and mobile interaction

• account-to-checkout transitions

Small defects in those areas can create friction for some customers even when the main checkout path works correctly.

That does not mean every 1.3.10 fix affected every Hyvä merchant.

The relevance depends on the store’s configuration, customer journeys and customisations.

What merchants should test after upgrading

On Tap recommends regression testing the areas directly touched by the release.

Guest checkout disabled

If the store requires customers to log in before checkout:

• open checkout with guest checkout disabled

• test the login flow

• check the browser console for Alpine or CSP-related errors

• confirm that returning customers can proceed into checkout normally

Address modal interactions

Test:

• opening the add/edit address modal

• clicking during loading or pre-loader states

• confirming the modal does not close unexpectedly

• submitting using the visible button

• submitting with Enter on desktop

• submitting with the “Go” action on mobile keyboards

Single-line street addresses

For stores using a single-line street configuration:

• test empty street values

• test partially completed addresses

• test saving to the address book

• confirm no TypeError occurs

External cart and address changes

Test journeys where:

• a customer adds an address in My Account and then returns to checkout

• cart contents change outside checkout

• multiple browser tabs are used

• custom integrations modify quote or address data externally

Confirm that checkout reinitialises and reflects the updated state correctly.

Saved-address list

For customers with multiple saved addresses:

• expand the address list

• collapse it again

• move through other checkout interactions

• confirm the Show all / Show less state remains consistent

Should merchants upgrade specifically to 1.3.10?

At the time this article was published, 1.3.10 was a current maintenance release in the 1.3.x line.

The release itself was not an emergency security update.

For merchants on an earlier 1.3.x version in May 2026, it was reasonable to include 1.3.10 in the next planned maintenance deployment, subject to normal staging and regression testing.

However, that historical recommendation should not be used as current upgrade guidance.

Since publication, Hyvä has released later 1.3.x versions, including the security-related 1.3.12 release.

Merchants still on 1.3.10 today should not remain on that exact version simply because it was stable in May.

They should either:

• install the applicable security backport for their existing 1.3.x version, where supported by Hyvä; or

• upgrade to 1.3.12 or later, following current Hyvä guidance

The current 1.3.x stable release is 1.3.14.

Later security context: payment-method availability bypass

On 13 July 2026, Hyvä released Checkout 1.3.12 with a fix for a High-severity payment-method availability bypass.

Hyvä’s security changelog explains that client-side availability checks could be bypassed, allowing an unavailable or restricted payment method to be persisted on the quote.

Hyvä backported the fix to earlier versions rather than limiting remediation to 1.3.12.

For merchants reading this article today, this later security development is more important than upgrading specifically to 1.3.10.

If a store remains on an older 1.3.x release, confirm that the relevant security backport is installed.

The bigger picture

Hyvä Checkout 1.3.10 is a focused maintenance release.

Its six changes improve specific areas of checkout behaviour:

• login/CSP handling when guest checkout is disabled

• address-modal stability

• keyboard and mobile form submission

• single-line street-address handling

• state refresh after external cart or address changes

• saved-address list behaviour

The release is useful historically because it shows the kind of edge-case maintenance that keeps checkout flows predictable across different customer journeys.

For current merchants, however, the appropriate action is to use Hyvä’s latest release and security guidance rather than selecting 1.3.10 as a target version.

About On Tap

On Tap is a growth-focused eCommerce consultancy and Hyvä partner, specialising in Magento and Adobe Commerce implementations for mid-market and enterprise merchants.

From Hyvä Checkout upgrades and regression testing to payment integrations, checkout customisation and ongoing technical maintenance, On Tap helps merchants keep checkout changes controlled and evidence-led.

If you need help reviewing your Hyvä Checkout version, applying the relevant security updates or planning an upgrade, get in touch with the On Tap team.