Adobe Commerce 2.4.5 highlights
Look for the following highlights in this release.
Security enhancements
This release includes 20 security fixes and platform security improvements. This security fix has been backported to Adobe Commerce 2.4.3-p3 and Adobe Commerce 2.3.7-p4.
No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts:
- IP allowlisting
- Two-factor authentication
- Use of a VPN
- Use of a unique location rather than
/admin
- Good password hygiene
See Adobe Security Bulletin for the latest discussion of these fixed issues.
Additional security enhancements
Security improvements for this release improve compliance with the latest security best practices, including:
-
reCAPTCHA support has been added to the Wish List Sharing, Create New Customer Account, and Gift Card forms.
-
ACL resources have been added to Inventory.
-
Inventory template security has been enhanced.
-
The
MaliciousCode
filter has been upgraded to use theHtmlPurifier
library.
Platform enhancements
-
Adobe Commerce on-premises deployments: Adobe Commerce 2.4.5 has been tested and confirmed to be compatible with Elasticsearch 7.17 (~7.17.0 with constraint). Merchants hosting Adobe Commerce on-premises can use either Elasticsearch or OpenSearch 1.2.
-
Adobe Commerce cloud-hosted deployments: ElasticSearch 7.11 or later is not supported on Adobe Commerce 2.4.5 cloud-hosted deployments. OpenSearch is the default search engine for Adobe Commerce 2.4.5 cloud deployments.
Adobe Commerce 2.4.5 now supports
-
Composer 2.2
-
TinyMCE (5.10.2). Earlier versions of TinyMCE (v5.9.2 or earlier) allowed arbitrary JavaScript execution when a specially crafted URL or an image with a specially crafted URL was updated.
-
jQueryUI (1.13.1)
-
PHPStan
(^1.5.7 with constraint) GitHub-35315
The DHL Integration schema has been updated from v6.0 to v6.2. This upgrade will not result in a change in product behavior.
Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.
Composer dependency updates
The following Composer dependencies have been updated to the latest versions with constraint:
colinmollenhour/credis
(1.13.0)?guzzlehttp/guzzle
(^7.4.2)laminas/laminas-captcha
(updated with a constraint ^2.12)laminas/laminas-db
(^2.15.0)laminas/laminas-di
(^3.7.0)laminas/laminas-escaper
(~2.10.0)laminas/laminas-eventmanager
(^3.5.0)laminas/laminas-feed
(^2.17.0)laminas/laminas-mail
(^2.16.0)laminas/laminas-mvc
(^3.3.3)laminas/laminas-server
(^2.11.1)laminas/laminas-servicemanager
(^3.11.0)laminas/laminas-validator
(^2.17.0)league/fly
(2.4.3)monolog/monolog
(^2.5)phpmd/phpmd
(^2.12.0)phpstan/phpstan
(^1.5.7)phpunit/phpunit
(~9.5.20)php-cs-fixer
(^3.4.0)webonyx/graphql-php
(14.11.6)
The laminas/laminas-session
, laminas/laminas-text
, and laminas/laminas-view
dependencies have been removed.
Other upgrades and replacements
-
The DHL Integration schema has been updated from v6.0 to v6.2.
-
The default Gateway URL for USPS shipping has been updated to use
https
instead ofhttp
. -
The
Froogaloop
library has been replaced with the VimeoPlayer.js
library (2.16.4). -
The
grunt-eslint
(NPM) library has been upgraded to the latest version. -
The
jQuery Storage
libraries have been replaced withjulien-maurel/js-storage
. -
The
php-cs-fixer
andphpcs
static code analysis tools are now compatible with PHP 8.x. -
glob.js
dependency (upgraded with constraint to ~7.2.0) -
serve-static.js
dependency (upgraded with constraint ~1.14.2) -
underscore.js
dependency (NPM) (1.14.2) -
moment-timezone-with-data.js
(0.5.34) -
The library
jquery/jquery-cookie
has been replaced withjs-cookie/js-cookie
. -
The
jarallax.js
andjaralax-video.js
libraries have been updated to use the latest version of the Vimeo REST API.
Performance and scalability enhancements
Price indexer optimization
Primary index performance has been improved by reducing the number of primary indexes from 3 to 1 for the catalog_product_index_price_tmp
table. This enhancement reduced the number of records created in the price index by reducing eSKU multiplication that resulted from shared catalogs. Indexing time has been significantly reduced.
Accessibility updates
The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:
- Search results summary information is now announced to screen reader users
- Screen readers are now informed when a new page view loads
- Contrast and keyboard accessibility have been improved
Adobe Sign
Merchants can now allow customers to electronically sign customized agreements, such as warranty documents, purchase agreements, and terms and conditions, during Adobe Commerce checkout.
Adobe Commerce integration with Adobe IMS
Adobe Commerce merchants who have an Adobe ID and want a streamlined login to Adobe Commerce and Adobe Business products can integrate Commerce authentication with the Adobe IMS authentication workflow. After this integration is enabled for your Commerce store, each Admin user must use their Adobe credentials — not their Commerce credentials — to log in. See Adobe Identity Management Service (IMS) Integration Overview.
Branding and style changes
The Admin has been updated to align with Adobe’s brand strategy. Changes affect headers, footers, data grid color updates, and navigation elements.
B2B
We have optimized the normalized database data that is needed to implement the Shared Catalogs feature. This reduction in eSKU multiplication results in a performance boost as fewer database rows must be stored. Previously, Adobe Commerce duplicated every SKU in the catalog for each Shared Catalog. Adobe Commerce now creates unique eSKUs for those directly assigned to a Shared Catalog.
Enabling the new Enabled Shared Catalog direct product price assigning configuration option also improves product price indexer performance.
This release includes multiple bug fixes. See B2B Release Notes.
Google Analytics
Google has updated the tracking and integration mechanisms of AdWords and Analytics in web applications through integration with GTag. This integration of Google functionality into website pages extends opportunities to track and manage content through Google Services. Adobe Commerce has a set of built-in modules including Google AdWords, Analytics, Optimizer, and TagManager that leverage the former API for integration with Google services. In this release, we have re-implemented this integration using the GTag approach. See Migrate from analytics.js to gtag.js (Universal Analytics).
GraphQL
GraphQL performance enhancements include:
-
Developers and administrators experience faster rebuilding of the unified storefront GraphQL schema on deployment or when changing attributes in production. Shoppers also experience significantly faster page load speeds when the GraphQL schema must be rebuilt for any reason.
-
Added capability to consume the expiration date/time of the authorization token through the use of JSON Web Tokens (JWT) in the GraphQL API.
-
The
bin/magento config:set graphql/session/disable 1
command allows merchants to completely disable the creation of session cookies for all GraphQL operations. By default, Adobe Commerce creates these cookies and relies on them for authorization, which affects performance. Going forward, we recommend using tokens as the only form of authorization for GraphQL requests. We do not recommend using session cookies alone or in conjunction with authorization tokens. See GraphQL Authorization. -
Session cookies are now launched in GraphQL operations using class proxies only when needed.
-
Session usage has been removed from
http
header processors in GraphQL such as store, customer, or currency.
See the GraphQL Developer Guide for details on these enhancements.
Inventory
Inventory template security has been enhanced.
Live Search
This release introduces support for B2B customer groups and custom pricing. Live Search now respects product assignments to customer groups and the pricing that is set for a specific customer group/shared catalog.
Page Builder
Page Builder v.1.7.2 is compatible with Adobe Commerce 2.4.5.
Page Builder column layout includes these enhancements:
-
Columns are now exposed, permitting users to control column settings on the storefront.
-
Column resizing now supports wrapping triggered by user actions.
Payments
Apple Pay is now available to all merchants running deployments with Payment Services enabled. This payment method does not require shoppers to enter their credit or debit card details. Apple Pay is available on the product details page, mini cart, shopping cart, and checkout workflow. Merchants can toggle on this feature.
PayPal
-
Merchants in Spain and Italy can now offer PayPal Pay Later to shoppers.
-
Previews of the PayPal, Credit and Pay Later buttons are now available in the Admin for the checkout, mini cart, cart, and product pages. Previews reveal how these buttons will look when they are enabled and rendered on the storefront.
Braintree
-
Braintree has discontinued the KOUNT fraud protection integration. It has been removed from the Adobe Commerce codebase.
-
The Always request 3DS option has been added to the Admin.
PWA Studio
PWA Studio v.12.5.x is compatible with Adobe Commerce 2.4.5.
New features for this release include:
-
Shopper behavior data is collected on PWA Studio storefront for web analytics services. Merchants can now subscribe and extend these events as needed.
-
Merchants can now select a service to deploy from the Admin (Google Tag Manager).
For information about enhancements and bug fixes, see PWA Studio releases. See Version compatibility for a list of PWA Studio versions and their compatible Adobe Commerce core versions.
Upgrade Compatibility Tool
Enhancements include:
-
Method signature validation now identifies incompatible changes within a method or a constructor signature.
-
Database schema validation now identifies schema changes and incompatibilities.
-
DI configuration validation now verifies references to removed or deprecated non-API core classes in
di.xml
and preferences for core classes and interfaces. -
UCT now identifies code deprecations and provides specific recommendations for resolving each issue.
Fixed issues
We have fixed hundreds of issues in the Adobe Commerce 2.4.5 core code.
Installation, upgrade, deployment
- You can now rename a data patch and add the old class name as an alias in the
patch_list
database table. Adobe Commerce now checks whether data patch aliases already existed in the database before applying the patch. Previously, Adobe Commerce threw an error under these conditions.
- Adobe Commerce no longer throws an exception when you try to change the Admin URL to a custom URL from the Admin. Previously, after changing the Admin URL, you could not log in. GitHub-35416
- Merchants can now successfully upgrade from an Adobe Commerce 2.4.2 deployment with Klarna to Adobe Commerce 2.4.3. GitHub-33760
- The path to Adobe Commerce Analytics is no longer hardcoded. Previously, this hardcoded path resulted in conflicts when multiple Adobe Commerce instances were installed on one server. GitHub-29373
Accessibility
- The Shopping bag button now provides a programmatic or textual indication of its state. Screen reader users are informed that clicking this button will expand other content, or that the associated content is expanded or collapsed. Previously, this button did not provide a programmatic or textual indication of its state.
- Payment Information credit card option text elements or images of text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, they did not meet the expected contrast ratio.
- Address book > Communication > Account information custom focus indicators now provide a contrast ratio of at least 3:1 against the background color.
- Filter and Sort button text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, navigation buttons for carousels did not meet these minimum contrast requirements.
- Screen readers announce the word “Venia” only once when navigating to Venia headers and footers. Previously, the same word was announced twice consecutively.
- Buttons that trigger dropdowns now provide information to screen readers that indicate their expanded or collapsed state and accessible names.
- Screen reader users are informed when a new page view is rendered. Previously, when a page title changed, the title change was not announced.
Adobe Stock
- Users can now successfully sign out of Adobe Stock.
Bundle products
- You can now use the
PUT /V1/products
endpoint to update product price attributes for a specific website. Previously, if some product attributes were overridden for a specific store view, you could not update a price attribute for that product in that same store view.
- Adobe Commerce now correctly calculates the cart total for a bundle product when the Product Subselect rule is applied.
Cache
- Full page cache is no longer shown as disabled in the Admin when the Adobe Commerce cache is flushed and
use_stale_cache
is enabled.
- New Relic deployment markers now work as expected when cache is flushed. GitHub-32649
Cart and checkout
- The address search pop-up on the billing step of the checkout workflow no longer causes DOM errors.
- The
addProductsToCart
mutation now works correctly with multiple products. Previously, this query returned the first product with an accurate subtotal, but returned a subtotal of 0 for other products.
- Permission exceptions are now handled for restricted products that are added by SKU. Shoppers are now given an appropriate message on the storefront, and the quantity field in the error table is disabled. Previously, Adobe Commerce threw an exception like this:
There has been an error processing your request
.
- The SQL query that updates affected quotes after disabling a cart price rule has been optimized to avoid locking the entire quote table.
- Shoppers with global account sharing are no longer required to log in again to a secondary website in a multisite deployment when guest checkout is disabled. Customer data is now loaded when the shopper navigates to the subdomain. The shopper is no longer asked to log in again, and the previous cart contents are displayed.
- Address dropdown values in the checkout workflow no longer change for the remaining items in a quote when a single quantity address item is removed in a multi-address checkout. Previously, when a product was removed from a quote during multi-address checkout, the address dropdown value changed to default for all products.
- The
cart
query no longer return null responses when a product is out of stock. A newerrors
element containing the error message was introduced to the response. Previously, when you ran a query with an out-of-stock product, Adobe Commerce displayed anull
value under theitems
section in the response. See cart query.
- Shipping methods are now available as expected when a guest shopper creates an account after adding a product to their cart before proceeding to checkout. Previously, when a guest added a product the cart before creating an account, no shipping methods were available during checkout. After adding other products to the cart, shipping methods became available.
- Shoppers can now add products to their carts when no options in the Allow Countries field have been selected.
- Cart contents and login status are now reloaded as expected after a session times out when Enable Persistence is set to Yes. GitHub-35182
- Mini cart subtotals are now updated correctly when a shopper navigates from the shipping page to the cart page in the checkout workflow for an order with multiple shipping addresses. Previously, the subtotal was doubled.
- The mini cart now displays previously added products after a session timeout when Enable Persistence is enabled . GitHub-35183
- Merchants can now create a credit memo in which Refund Shipping (Incl. Tax) is set to -0.01 and can now set this amount to 0. Previously, the credit memo could not be created under these conditions.
Cart price rule
- The
Parent Only
attribute scope is now used properly in the Cart Rule condition.
Catalog
- Product URL keys now remain unchanged when updating product name via
PUT /V1/products/
for a store view. Previously, a new URL key was generated based on the new product name and assigned to the product, which overrode the URL key in that store view.
- Rule-based upsell products are no longer shown twice on the product page.
- Adding a product to a category from the Page Builder product widget set to carousel mode no longer triggers a page reload.
- Products set to Not Visible Individually no longer appear in catalog Advanced Search results.
- Dynamic bundle attributes are now updated correctly on the Mass Attribute Update page. Previously, the Dynamic SKU attribute remained set to Yes even though they were disabled on the Mass Update page.
- Catalog rules are now correctly applied using incremental indexers rather than a full re-index.
- You can now successfully switch between list and grid views of multi-page product lists. Previously, when you navigated to the last page of a multi-page product list view before switching to the grid view, Adobe Commerce displayed this error:
Unfortunately there are no products in this category on our website currently
.
- Admin Action Log reports now display updated product IDs and updated status information as expected.
- Triggers are now restored as expected to the
catalogrule_product_price
table after a full re-index. Previously, triggers were removed from thecatalogrule_product_price
table after acatalogrule_rule
orcatalogrule_product
full re-index.
- Category rules that are used to assign products to categories no longer randomly change.
- Adobe Commerce no longer throws an error when a category rule assigns a product to a category that is subsequently sorted in a multi-site deployment.
- Categories can no longer be updated globally by an administrator with scope-restricted access. Previously, when multiple websites used the same category but different products, and an administrator with permission restricted to one store changed products in the category, the product selection also changed for other stores.
- The product details page now displays the correct price when a non-default currency for a specified locale is used. Previously, numbers were not localized as expected on the storefront.
- Products can now be enabled using a scheduled update.
- The same error message is now displayed by the API and on the storefront when trying to retrieve the tier prices of a product with duplicate records. Previously,
PUT /V1/products/tier-prices
returned an incorrect error message.
- Adobe Commerce now provides validation error messages when you try to add a product URL key with a trailing hyphen. Informative tooltip text is also available.
- The new
ConfigurableWishlistItem.configured_variant
field has replaced theConfigurableWishlistItem.child_sku
field. The latter field triggered an internal error when a customer wishlist contained an un-configured configurable product.
- URL rewrites are now generated only for the selected stores during the mass attribute update to change product visibility. Previously, the mass attribute update created a URL rewrite for the wrong store.
- When the
Synchronize widget products with backend storage
setting is enabled, Adobe Commerce adds recently view product data into thecatalog_product_frontend_action
database table. It includes the customer or visitor ID when adding records. Therecently_viewed_product
section in the response is now empty if customer ID and visitor ID are null. As a result, when thecustomer/section/load
Ajax request is sent, Adobe Commerce can correctly filter recently viewed products based on customer or visitor ID. Previously, the response included all the data available in thecatalog_product_frontend_action
database table because there was no check for an empty customer or visitor ID.
- Category rules with a
Quantity
attribute for configurable products now work correctly when staging is implemented. Previously, when products had different values forrow_id
andentity_id
in thecatalog_product_entity
table due to staging updates, the Visual Merchandiser Match product by rule functionality did not correctly filter the products.
- Administrators can now change configurable product options in a shopper’s cart from the Admin slide panel. Previously, the slide panel did not work correctly.
- Page cache is now cleared as expected for the configurable product parent when changes to a child product are saved. Previously, because the cache was not cleared, changes were not selected on the storefront configuration product page. GitHub-34508
- Product lists are now rendered correctly in the Admin. Previously, the product list did not render, and Adobe Commerce displayed this error:
Item (Magento\Catalog\Model\Product\Interceptor) with the same ID "<ID>" already exists
. GitHub-33145
- Product prices are now the same on the product detail page and in storefront search in multi-store deployments after Catalogue Price Scope changes from website to global. Previously, the Catalog Search Results page displayed the global price, and the product details page displayed the website price. GitHub-34074
- Layered navigation now displays products with the highest prices as expected when Price Navigation Step Calculation is set to Manual.
- You can now change the per-page product limit displayed within a category when Remember Category Pagination is enabled. Previously, the cookie
form_key
and UIform_key
differed, and Adobe Commerce displayed this error:Invalid Form Key. Please refresh the page
.
- The EAV indexer now processes product IDs as type
int
to prevent possible performance issues.
- A new product cache is now successfully generated after you add a new image with a name that contains ‘.’ to a product, then save the product and clean the image cache. GitHub-32699
-
Adobe Commerce now displays an error message as expected when you try to create an attribute from the product page without completing the Admin field. GitHub-33099
-
Product ratings are now correct on all catalog product lists when the home page contains multiple catalog lists. GitHub-33867
CMS content
- Merchants can no longer edit an active scheduled update from the entity edit page.
- An administrator with restricted permissions can now view a CMS page in the CMS hierarchy after a scheduled update.
Configurable products
- Adobe Commerce now displays the correct product price for a configurable product with a selected option after changing its quantity on product details page. Previously, the price was reset to the initial value after the quantity changed.
- The
products
query now retrieves prices for configurable products that accurately reflect the Display Out Of Stock configuration setting. Previously, the query did not return accurate prices.
- Configurable options are now linked to configurable products that are created in the Admin using
POST /V1/configurable-products/configurable1/child
.
- Multi-select attributes are now saved correctly during product edit. Previously, Adobe Commerce saved the default option for non-selected attributes as well as selected attributes when saving a product.
- Adobe Commerce now displays configurable attributes as expected during the creation of global
select
attributes via a patch script. Previously, eligible global attributes were hidden.
- The
addConfigurableProductsToCart
mutation can now be used to add configurable products with custom options. Previously, Adobe Commerce threw this error:Magento 2.3.4 graphql Notice: Undefined index: option_value in /var/www/html/mg234/vendor/magento/module-configurable-product-graph-ql/Model/Resolver/ConfigurableCartItemOptions.php on line 62
. GitHub-28860
-
Adobe Commerce now correctly displays a configurable product’s stock status, available configurations, and displayed price when the availability of one of the configurable product’s child product is changed by a scheduled update. Previously, when a configurable product had two children and the availability of one child product was disabled with a scheduled update, the parent product’s stock status was incorrectly displayed as Out of Stock when the update was active, After the update completed, the displayed price and the availability of its configurations was miscalculated.
-
You can now re-order configurable products with optional custom options. Previously, re-order attempts failed, and meant displayed this error:
Some of the selected options are not currently available
. GitHub-35409
- The
addConfigurableProductsToCart
mutation now works as expected with multiple products. Previously, incorrect product information was returned, or an invalid error message was returned. GitHub-30948
Customer
- Adobe Commerce now displays predefined EAV system attributes correctly according to the website setting on the storefront. Previously, website-level customer attributes that were enabled for one website and disabled for another were displayed as enabled for both websites.
Customer segment
- Customer segment-specific Related Product rules now work as expected. The issue has been fixed by calling a method to add a visitor-segment relation for a specific website. Previously, the segments for this rule fetched only on the basis of registered customers and websites.
Downloadable
- You can now remove sample links and files from a downloadable product. GitHub-31887
- System-issued emails are now successfully sent to recipients with “.-” in their email address.
- Customers now get email reminders about their abandoned carts on the correct schedule. The new
TIMESTAMPDIFF(DAY, ,)
SQL function has replaced theTO_DAYS()
function and calculates the difference in the timestamps on the basis of date and time. Previously, email reminders were not sent per schedule because of the incorrect calculation of two date-time values of cart abandonment (any timezone) and server time (UTC).
- Adobe Commerce now displays an error message on the Shipping page when a shopper enters an invalid email format after the shopper clicks Place Order. Previously, the error message was displayed on the Payment page. [GitHub-33590](https://github.com/magento/magento2/issues/33590
Frameworks
- The
bin/magento setup:config:set
command no longer overrides already set cache ID prefixes inapp/etc/env.php
.
- The
bin/magento setup:static-content:deploy -s compact
command now includes styles from child themes as expected. Previously, theme CSS files were not present on the storefront after deployment.
- A new sniff has been added to check if closing slashes are used in
void
elements.
- Adobe Commerce no longer throws an SQL error after assigning a new source to a product and changing its quantity. GitHub-35262
- Attribute sort order now works as specified in the
di.xml
file after update.
- The
updateCartCurrency
function now sets string instead of an object inside the cart object. Previously, Adobe Commerce did not load a quote usinggetQuote
because theupdateCartCurrency
function set an object instead of a string inside the cart object. GitHub-34199
- Deprecation notices no longer occur in unit tests due to
\DateTimeFormatter::formatObject()
. This method now works as expected with numeric values for$format
.
- Adobe Commerce no longer displays a
preg_replace()
error on the Admin. The third argument ($subject
) is now of typearray|string
instead ofbool
.
- The
isFreeShipping
method now returns an integer rather than a Boolean.GitHub-35164
- Adobe Commerce no longer throws the following error when you create a plugin for any method of class
vendor/magento/module-backend/Model/Menu.php
:Error: Call to undefined method ReflectionUnionType::getName()
. GitHub-35292
- Adobe Commerce now returns a 404 error instead of a 500 error when you navigate to
/checkout/sidebar/updateItemQty/?item_qty=error
on the storefront. Previously, this error was thrown:Warning: A non-numeric value encountered in /vendor/magento/module-checkout/Controller/Sidebar/UpdateItemQty.php on line 69
. GitHub-34380
- Adobe Commerce no longer triggers a
trim(): Passing null to parameter #1 ($string) of type string is deprecated
error when the AMPQ connection is configured without SSL configuration.
- Corrected the
longblog
database definition tolong blob
. GitHub-35108
- Knockout text containing single quotes is now translatable. GitHub-34319
- A
TypeError
inmagento2/app/code/Magento/Security/Model/AdminSessionsManager.php
has been corrected fromint
tostring
. GitHub-34415
.htpasswd
has been added to banned locations in thenginx
configuration file. GitHub-35150
- Load time of category product list pages have been improved by adding
Magento_Ui/js/core/app
as adeps
toapp/code/Magento/Ui/view/frontend/requirejs-config.js
. GitHub-34847
- The
ProductRepository.php:get
method now returns cache keys once. Previously, they were returned twice. GitHub-34958
- Added an error message to a new exception that was created in the exception handler for cron jobs. GitHub-34941
- The ReadMe files for the
GraphQl-GroupedProductGraphQl
modules have been updated. GitHub-34951
- The storefront print order/invoice/credit memo pages no longer display the default Luma logo instead of the logo that has been specified for display on the website. GitHub-34942