Adobe Commerce 2.4.1 release notes

Last update: November 25, 2024

CREATED FOR:

  • Experienced
  • Admin
  • Developer

Adobe Commerce 2.4.1 introduces enhancements to performance and security plus significant additions to the B2B feature set. Security enhancements include support for the SameSite attribute for cookies and the addition of CAPTCHA protection for payment-related and order-related API endpoints and the Place Order storefront page. B2B improvements focus on the order approval process, B2B shipping methods, expanded logging of Admin actions, and enhanced security on storefront.

This release includes all improvements to core quality that were included in 2.4.0, over 150 new fixes to core code, and over 15 security enhancements. It includes the resolution of almost 300 GitHub issues by our community members. These community contributions range from minor clean-up of core code to significant enhancements in GraphQL.

All known issues identified in 2.4.0 have been fixed in this release.

NOTE
Adobe Commerce releases can contain backward-incompatible changes (BICs). To review backward-incompatible changes, see BIC reference. Major backward-incompatible issues are described in BIC highlights. Not all releases introduce major BICs.

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. Adobe Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Apply a patch to continue offering DHL as shipping carrier Knowledge Base article for information about downloading and installing the patch.

Security patch available

Merchants can now install time-sensitive security fixes without applying the hundreds of functional fixes and enhancements that a full quarterly release (for example, 2.4.0-p1) provides. Patch 2.4.0.1 (Composer package 2.4.0-p1) is a security patch that provides fixes for vulnerabilities that have been identified in our previous quarterly release, 2.4.0. All hot fixes that were applied to the 2.4.0 release are included in this security patch. (A hot fix provides a fix to a released version that addresses a specific problem or bug.)

For general information about security patches, see Introducing the New Security Patch Release. For instructions on downloading and applying security patches (including patch 2.3.5-p2), see Quick start on-premises installation. Security patches include security bug fixes only, not the additional security enhancements that are included in the full patch.

Other release information

Although code for these features is bundled with quarterly releases , several of these projects (for example, B2B, Page Builder, and Progressive Web Applications (PWA) Studio) are also released independently. Bug fixes for these projects are documented in the separate, project-specific release information that is available in the documentation for each project.

Highlights

Look for the following highlights in this release.

Substantial security enhancements

This release includes over 15 security fixes and platform security improvements. All security fixes have been backported to 2.4.0-p1 and 2.3.6.

Over 15 security enhancements that help close remote code execution (RCE) and cross-site scripting (XSS) vulnerabilities

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts: IP allowlisting, two-factor authentication, use of a VPN, the use of a unique location rather than /admin, and good password hygiene. See Security Updates Available for Magento for a discussion of these fixed issues.

Additional security enhancements

Security improvements for this release include:

  • CAPTCHA protection has been added to the following product areas:

    • Place Order storefront page and REST and GraphQL endpoints
    • Payment-related REST and GraphQL endpoints.

    CAPTCHA protection for these additional pages is disabled by default. It can be enabled on the Admin in the same way that other pages covered by CAPTCHA are. This protection has been added as an anti-brute force mechanism to protect stores against carding attacks. See CAPTCHA.

  • Support for the SameSite attribute for cookies. To support the Google Chrome enforcement of the new cookie classification system, the application classes that handle cookies have been updated to support the SameSite cookie attribute. This attribute is set to Lax by default but can be explicitly overridden.

  • Enhanced Security Scan Tool. Adobe has partnered with Sanguine Security, a leader in preventing digital skimming, to integrate their database of over 8700 threat signatures into the Security Scan Tool. This partnership will enable merchants to get real-time insights into the security status of their site through proactive detection of malware and reduction of false positives. Merchants can register for the tool by visiting https://account.magento.com/scanner. For more information, see the Secure Your Storefront With the Enhanced Security Scan Tool blog post.

NOTE
Starting with the 2.3.2 release, we will assign and publish indexed Common Vulnerabilities and Exposures (CVE) numbers with each security bug reported to us by external parties. This allows users to more easily identify unaddressed vulnerabilities in their deployment. You can learn more about CVE identifiers at CVE.

Infrastructure improvements

This release contains enhancements to core quality, which improve the quality of the Framework and these functional areas: Customer Account, Catalog, CMS, OMS, Import/Export, Promotions and Targeting, Cart and Checkout, B2B, and Staging and Preview.

  • Site-Wide Analysis Tool integration with Admin. The tool provides system insights and instrumentation for Adobe on cloud infrastructure installations with 24/7 real-time performance monitoring, reports, and self-service recommendations. Merchants can use the new Admin role resource to securely access their Customer Detail pages through the Admin. See the FAQ for an overview.

Performance improvements

  • Reduction in the size of network transfers between Redis and Magento. Plugin list configuration is now generated during the execution of the bin/magento di:compile command. This configuration information is written to generated metadata folders based on scope. Previously, this information was stored in cache. Resulting performance improvements include a decrease in network cache size and execution time for many scenarios.

  • Enhanced message queue consumer performance. Three new configuration settings support a decrease in consumer queue CPU consumption. These optional parameters provide increased control over consumers and save server resources. See Configure message queues for a description of the maxIdleTime, sleep, and onlySpawnWhenMessageAvailable parameters.

  • Improved execution time for bin/magento commands.

Adobe Stock Integration

This release includes Adobe Stock Integration v2.1.0.

The New Media Gallery is now enabled by default in the Admin. Merchants can now perform these actions on images in the Media Gallery:

  • Delete images in bulk

  • Optimize media storage by identifying duplicate images and images that are not used on the storefront

  • Filter images by the storefront area they are used in, including product and category content and CMS blocks

  • Work with image metadata

    • View metadata from the images uploaded into Media Gallery
    • Edit image metadata (title, description, and keywords)
    • Search for images by their metadata

Page Builder

Page Builder now supports full screen mode, which supports easier editing of content and provides a consistent experience editing content across the Admin. See Workspace.

GraphQL

This release adds GraphQL coverage for the following features:

  • Product reviews. Customers and guests can write product reviews. Customers can retrieve their product review histories. See Create a product review and productReviewRatingsMetadata query for information on retrieving information about the reviews infrastructure.

  • Gift options. All customers and guests can add a gift message to their order. On Adobe Commerce installations, they can also add gift wrapping, gift receipts, and printed cards to the order. See setGiftOptionsOnCart mutation and updateCartItems mutation

  • Reward points. Customers can apply or remove reward points to their carts. They can also view their reward point history. See applyRewardPointsToCart and removeRewardPointsFromCart for a discussion of managing reward points within a cart.

  • Order history. All customers can view details about their order histories, including invoices, shipping, and refunds.

  • Add to cart. The addProductsToCart mutation allows you to add any type of product to the active cart. We recommend using this mutation instead of single-purpose mutations such as addSimpleProductsToCart. Fix submitted by Yaroslav Rogoza in pull request 27914. GitHub-28524

  • Stored payment methods. Logged-in customers can now store payment details (including Braintree credit card and Braintree with PayPal) in My Account.

  • Support for wish lists in Magento Open Source. You can add items to, update items in, and remove items from a wish list.

  • Improved management of customer accounts. We have added the createCustomerV2 and updateCustomerV2 mutations to manage customer accounts. These new mutations require different input objects than the createCustomer and updateCustomer mutations. To change a customer’s email address, use the new updateCustomerEmail mutation.

  • Support for Payflow Pro Vault. Added GraphQL Vault support for the Payflow Pro Vault payment method. Fix submitted by Oleh Usik in pull request 28821. GitHub-28520

  • Updated the GraphQL storeConfig query to include new customer configuration settings. Fix submitted by Oleh Usik in pull request 27876. GitHub-28521

  • Added the requestPasswordResetEmail mutation, which triggers the password reset email for the provided email address. Fix submitted by Oleh Usik in pull request 27876. GitHub-28521

  • Klarna GraphQL. Added or updated topics on Klarna GraphQL in Klarna’s payment method and createKlarnaPaymentsSession

See the GraphQL Developer Guide for details on these enhancements.

PWA Studio

PWA Studio v8.0.0 introduces new features and enhancements:

  • Updates to the Venia style guide that apply to design tokens, typography, colors, core components, and page layouts

  • Improvements to the Venia mini-cart experience

  • Initial support for multiple locales and localized content on the Venia storefront

  • Numerous improvements to the MyAccount experience of the Venia storefront

See compatibility for a list of PWA Studio versions and their compatible versions. For information about enhancements and bug fixes, see PWA Studio releases.

B2B

Version 2.4.1 introduces B2B v1.3.0. This release includes improvements to order approvals, shipping methods, shopping cart, and logging of Admin actions.

Improvements to Order Approvals

B2B order approvals have been enhanced to improve usability and to allow for bulk actions on purchase orders.
Improvements to order approval and rejection include the following:

  • New View Rule page for users without edit privileges. B2B buyers can now view rules that apply to their company on the new View Rule page when they do not have permission to edit them.

  • Count alert icon on the Requires My Approval tab. The Requires My Approval tab in the My Purchase Orders view now displays a counter that indicates the number of pending approval actions.

  • Bulk order approvals and rejections. B2B managers and Company Administrators can now perform bulk rejection and approval of purchase orders. These changes allow approvers to approve or reject multiple purchase orders in a single action.

  • Merchants can now search the Applies to and Requires approval from fields of the My Purchase Orders view and can select multiple user roles during rule creation.

  • Examples of how to configure Order Approval rules are provided on the Rule Configuration page.

See Approval rules

B2B shipping methods enhancements

B2B merchants can now control shipping methods that are offered to each Company. Merchants can configure the following from the Admin:

  • A specific set of shipping methods for B2B Company accounts
  • The use of All or B2B-specific shipping methods for each Company account
  • A specific list of B2B shipping methods for each Company account

Shopping cart improvements

  • Merchants can now allow users to clear the contents of their shopping cart in a single action and can configure this ability independently on each website.

  • B2B buyers can now add individual items or the entire contents of their shopping cart directly to a requisition list.

New Admin features

  • B2B merchants can create orders from the Admin on behalf of customers using Payment on Account as the payment method.
  • Merchants can now directly view all quotes associated with a user from the customer’s detail page.
  • Merchants can now filter the Customers Now Online grid by Company.
  • Admins can now filter customers in the Admin by Sales Rep.

See B2B Features.

Enhanced security on storefront

To reduce creation of fraudulent or spam accounts, merchants can now enable Google reCAPTCHA on the New Company Request form on the storefront. See reCAPTCHA.

Expanded logging of Admin actions

Admin actions taken in the Company modules are now logged in the Admin Actions Log. Actions are logged from all relevant company modules: Company, NegotiableQuote, CompanyCredit, SharedCatalog.

This release also includes multiple bug fixes. See B2B Release Notes.