I have lost count of how many times I have explained to a client why their store slows down the moment they pass 50,000 orders. It is rarely the server. It is the way WooCommerce handles data serialization. The WooCommerce 10.7 update finally deals with one of the bottlenecks we have been fighting for years: the N+1 query pattern on the REST API. If you have been putting off the switch to High-Performance Order Storage (HPOS), this is the release that makes it worth doing.
HPOS and the 51% query reduction
Performance is the headline of the WooCommerce 10.7 update, and the /wc/v4/orders endpoint is where it shows. Fetching orders used to be a database nightmare thanks to N+1 patterns during serialization, with a single request firing 271 queries. New cache priming logic brings that down to 132, a 51% reduction. The Store API product endpoint now skips the database entirely when the Last-Modified timestamp is already cached.
High-traffic stores also get a new filter for skipping redundant order count refreshes. That one earns its keep if you already track those counts in an external cache like Redis or Memcached.
// Skip redundant order count refreshes in high-traffic scenarios
add_filter( 'woocommerce_pre_refresh_order_count_cache', '__return_true' );The Fulfillments API is maturing
The Fulfillments API is still in beta, and it is turning into a proper architectural piece. Moving it from Automattic\WooCommerce\Internal to Automattic\WooCommerce\Admin signals that a stable public API is close. There are typed PHP methods for tracking data now, which is a relief for anyone building custom ERP integrations.
Fulfillment tracking data now goes through clean typed methods instead of raw meta keys:
<?php
function bbioon_update_fulfillment_tracking( $fulfillment_id, $tracking_number ) {
// Note: Fulfillments is currently a Beta feature
$fulfillment = wc_get_fulfillment( $fulfillment_id );
if ( $fulfillment ) {
$fulfillment->set_tracking_number( $tracking_number );
$fulfillment->set_shipping_provider( 'ups' );
$fulfillment->save();
}
}For more on squeezing these endpoints, see my guide on optimizing WooCommerce REST API performance.
Security, and the database catch
This release runs a database update (wc_update_1070_disable_hpos_sync_on_read), so do not ship it on a Friday afternoon without a staging backup. On the security side there is some overdue hardening. XSS protection through wp_kses_post() is now enforced on the v4 order notes endpoint, and the product ordering AJAX handlers validate CSRF tokens.
One small fix worth calling out: payment gateway password fields use trim() now instead of sanitize_text_field(). I have watched that break plenty of integrations where a user had a % in their password and the “sanitization” quietly ate it.
If the WooCommerce 10.7 update is eating your dev hours, hand it over. I have been wrestling with WordPress since the 4.x days.
What to do about it
This is more than another incremental release. It reworks how order data flows through the API. On a large store the gains on the orders endpoint alone justify the upgrade work. Test the Fulfillments API changes if you have custom shipping logic, because the namespace move can break legacy code. The official WooCommerce 10.7 developer notes have the full technical breakdown.
