Adobe Commerce 2.4.5 highlights

Look for the following highlights in this release.

Security enhancements

This release includes 20 security fixes and platform security improvements. This security fix has been backported to Adobe Commerce 2.4.3-p3 and Adobe Commerce 2.3.7-p4.

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts:

See Adobe Security Bulletin for the latest discussion of these fixed issues.

Additional security enhancements

Security improvements for this release improve compliance with the latest security best practices, including:

  • reCAPTCHA support has been added to the Wish List Sharing, Create New Customer Account, and Gift Card forms.

  • ACL resources have been added to Inventory.

  • Inventory template security has been enhanced.

  • The MaliciousCode filter has been upgraded to use the HtmlPurifier library.

Platform enhancements

  • Adobe Commerce on-premises deployments: Adobe Commerce 2.4.5 has been tested and confirmed to be compatible with Elasticsearch 7.17 (~7.17.0 with constraint). Merchants hosting Adobe Commerce on-premises can use either Elasticsearch or OpenSearch 1.2.

  • Adobe Commerce cloud-hosted deployments: ElasticSearch 7.11 or later is not supported on Adobe Commerce 2.4.5 cloud-hosted deployments. OpenSearch is the default search engine for Adobe Commerce 2.4.5 cloud deployments.

Adobe Commerce 2.4.5 now supports

  • Composer 2.2

  • TinyMCE (5.10.2). Earlier versions of TinyMCE (v5.9.2 or earlier) allowed arbitrary JavaScript execution when a specially crafted URL or an image with a specially crafted URL was updated.

  • jQueryUI (1.13.1)

  • PHPStan (^1.5.7 with constraint) GitHub-35315

The DHL Integration schema has been updated from v6.0 to v6.2. This upgrade will not result in a change in product behavior.

Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.

Composer dependency updates

The following Composer dependencies have been updated to the latest versions with constraint:

  • colinmollenhour/credis (1.13.0)?
  • guzzlehttp/guzzle (^7.4.2)
  • laminas/laminas-captcha (updated with a constraint ^2.12)
  • laminas/laminas-db (^2.15.0)
  • laminas/laminas-di (^3.7.0)
  • laminas/laminas-escaper (~2.10.0)
  • laminas/laminas-eventmanager (^3.5.0)
  • laminas/laminas-feed (^2.17.0)
  • laminas/laminas-mail (^2.16.0)
  • laminas/laminas-mvc (^3.3.3)
  • laminas/laminas-server (^2.11.1)
  • laminas/laminas-servicemanager (^3.11.0)
  • laminas/laminas-validator (^2.17.0)
  • league/fly (2.4.3)
  • monolog/monolog (^2.5)
  • phpmd/phpmd (^2.12.0)
  • phpstan/phpstan (^1.5.7)
  • phpunit/phpunit (~9.5.20)
  • php-cs-fixer (^3.4.0)
  • webonyx/graphql-php (14.11.6)

The laminas/laminas-session, laminas/laminas-text, and laminas/laminas-view dependencies have been removed.

Other upgrades and replacements

  • The DHL Integration schema has been updated from v6.0 to v6.2.

  • The default Gateway URL for USPS shipping has been updated to use https instead of http.

  • The Froogaloop library has been replaced with the Vimeo Player.js library (2.16.4).

  • The grunt-eslint (NPM) library has been upgraded to the latest version.

  • The jQuery Storage libraries have been replaced with julien-maurel/js-storage.

  • The php-cs-fixer and phpcs static code analysis tools are now compatible with PHP 8.x.

  • glob.js dependency (upgraded with constraint to ~7.2.0)

  • serve-static.js dependency (upgraded with constraint ~1.14.2)

  • underscore.js dependency (NPM) (1.14.2)

  • moment-timezone-with-data.js (0.5.34)

  • The library jquery/jquery-cookie has been replaced with js-cookie/js-cookie.

  • The jarallax.js and jaralax-video.js libraries have been updated to use the latest version of the Vimeo REST API.

Performance and scalability enhancements

Price indexer optimization

Primary index performance has been improved by reducing the number of primary indexes from 3 to 1 for the catalog_product_index_price_tmp table. This enhancement reduced the number of records created in the price index by reducing eSKU multiplication that resulted from shared catalogs. Indexing time has been significantly reduced.

Accessibility updates

The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:

  • Search results summary information is now announced to screen reader users
  • Screen readers are now informed when a new page view loads
  • Contrast and keyboard accessibility have been improved

Adobe Sign

Merchants can now allow customers to electronically sign customized agreements, such as warranty documents, purchase agreements, and terms and conditions, during Adobe Commerce checkout.

Adobe Commerce integration with Adobe IMS

Adobe Commerce merchants who have an Adobe ID and want a streamlined login to Adobe Commerce and Adobe Business products can integrate Commerce authentication with the Adobe IMS authentication workflow. After this integration is enabled for your Commerce store, each Admin user must use their Adobe credentials — not their Commerce credentials — to log in. See Adobe Identity Management Service (IMS) Integration Overview.

Branding and style changes

The Admin has been updated to align with Adobe’s brand strategy. Changes affect headers, footers, data grid color updates, and navigation elements.

B2B

We have optimized the normalized database data that is needed to implement the Shared Catalogs feature. This reduction in eSKU multiplication results in a performance boost as fewer database rows must be stored. Previously, Adobe Commerce duplicated every SKU in the catalog for each Shared Catalog. Adobe Commerce now creates unique eSKUs for those directly assigned to a Shared Catalog.

Enabling the new Enabled Shared Catalog direct product price assigning configuration option also improves product price indexer performance.

This release includes multiple bug fixes. See B2B Release Notes.

Google Analytics

Google has updated the tracking and integration mechanisms of AdWords and Analytics in web applications through integration with GTag. This integration of Google functionality into website pages extends opportunities to track and manage content through Google Services. Adobe Commerce has a set of built-in modules including Google AdWords, Analytics, Optimizer, and TagManager that leverage the former API for integration with Google services. In this release, we have re-implemented this integration using the GTag approach.​ See Migrate from analytics.js to gtag.js (Universal Analytics).

GraphQL

GraphQL performance enhancements include:

  • Developers and administrators experience faster rebuilding of the unified storefront GraphQL schema on deployment or when changing attributes in production. Shoppers also experience significantly faster page load speeds when the GraphQL schema must be rebuilt for any reason.

  • Added capability to consume the expiration date/time of the authorization token through the use of JSON Web Tokens (JWT) in the GraphQL API.

  • The bin/magento config:set graphql/session/disable 1 command allows merchants to completely disable the creation of session cookies for all GraphQL operations. By default, Adobe Commerce creates these cookies and relies on them for authorization, which affects performance. Going forward, we recommend using tokens as the only form of authorization for GraphQL requests. We do not recommend using session cookies alone or in conjunction with authorization tokens. See GraphQL Authorization.

  • Session cookies are now launched in GraphQL operations using class proxies only when needed.

  • Session usage has been removed from http header processors in GraphQL such as store, customer, or currency.

See the GraphQL Developer Guide for details on these enhancements.

Inventory

Inventory template security has been enhanced.

This release introduces support for B2B customer groups and custom pricing. Live Search now respects product assignments to customer groups and the pricing that is set for a specific customer group/shared catalog.

Page Builder

Page Builder v.1.7.2 is compatible with Adobe Commerce 2.4.5.

Page Builder column layout includes these enhancements:

  • Columns are now exposed, permitting users to control column settings on the storefront.

  • Column resizing now supports wrapping triggered by user actions.

Payments

Apple Pay is now available to all merchants running deployments with Payment Services enabled. This payment method does not require shoppers to enter their credit or debit card details. Apple Pay is available on the product details page, mini cart, shopping cart, and checkout workflow. Merchants can toggle on this feature.

PayPal

  • Merchants in Spain and Italy can now offer PayPal Pay Later to shoppers.

  • Previews of the PayPal, Credit and Pay Later buttons are now available in the Admin for the checkout, mini cart, cart, and product pages. Previews reveal how these buttons will look when they are enabled and rendered on the storefront.

Braintree

  • Braintree has discontinued the KOUNT fraud protection integration. It has been removed from the Adobe Commerce codebase.

  • The Always request 3DS option has been added to the Admin.

PWA Studio

PWA Studio v.12.5.x is compatible with Adobe Commerce 2.4.5.

New features for this release include:

  • Shopper behavior data is collected on PWA Studio storefront for web analytics services. Merchants can now subscribe and extend these events as needed.

  • Merchants can now select a service to deploy from the Admin (Google Tag Manager).

For information about enhancements and bug fixes, see PWA Studio releases. See Version compatibility for a list of PWA Studio versions and their compatible Adobe Commerce core versions.

Upgrade Compatibility Tool

Enhancements include:

  • Method signature validation now identifies incompatible changes within a method or a constructor signature.

  • Database schema validation now identifies schema changes and incompatibilities.

  • DI configuration validation now verifies references to removed or deprecated non-API core classes in di.xml and preferences for core classes and interfaces.

  • UCT now identifies code deprecations and provides specific recommendations for resolving each issue.

Fixed issues

We have fixed hundreds of issues in the Adobe Commerce 2.4.5 core code.

Installation, upgrade, deployment

  • You can now rename a data patch and add the old class name as an alias in the patch_list database table. Adobe Commerce now checks whether data patch aliases already existed in the database before applying the patch. Previously, Adobe Commerce threw an error under these conditions.
  • Adobe Commerce no longer throws an exception when you try to change the Admin URL to a custom URL from the Admin. Previously, after changing the Admin URL, you could not log in. GitHub-35416
  • Merchants can now successfully upgrade from an Adobe Commerce 2.4.2 deployment with Klarna to Adobe Commerce 2.4.3. GitHub-33760
  • The path to Adobe Commerce Analytics is no longer hardcoded. Previously, this hardcoded path resulted in conflicts when multiple Adobe Commerce instances were installed on one server. GitHub-29373

Accessibility

  • The Shopping bag button now provides a programmatic or textual indication of its state. Screen reader users are informed that clicking this button will expand other content, or that the associated content is expanded or collapsed. Previously, this button did not provide a programmatic or textual indication of its state.
  • Payment Information credit card option text elements or images of text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, they did not meet the expected contrast ratio.
  • Address book > Communication > Account information custom focus indicators now provide a contrast ratio of at least 3:1 against the background color.
  • Filter and Sort button text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, navigation buttons for carousels did not meet these minimum contrast requirements.
  • Screen readers announce the word “Venia” only once when navigating to Venia headers and footers. Previously, the same word was announced twice consecutively.
  • Buttons that trigger dropdowns now provide information to screen readers that indicate their expanded or collapsed state and accessible names.
  • Screen reader users are informed when a new page view is rendered. Previously, when a page title changed, the title change was not announced.

Adobe Stock

  • Users can now successfully sign out of Adobe Stock.

Bundle products

  • You can now use the PUT /V1/products endpoint to update product price attributes for a specific website. Previously, if some product attributes were overridden for a specific store view, you could not update a price attribute for that product in that same store view.
  • Adobe Commerce now correctly calculates the cart total for a bundle product when the Product Subselect rule is applied.

Cache

  • Full page cache is no longer shown as disabled in the Admin when the Adobe Commerce cache is flushed and use_stale_cache is enabled.
  • New Relic deployment markers now work as expected when cache is flushed. GitHub-32649

Cart and checkout

  • The address search pop-up on the billing step of the checkout workflow no longer causes DOM errors.
  • The addProductsToCart mutation now works correctly with multiple products. Previously, this query returned the first product with an accurate subtotal, but returned a subtotal of 0 for other products.
  • Permission exceptions are now handled for restricted products that are added by SKU. Shoppers are now given an appropriate message on the storefront, and the quantity field in the error table is disabled. Previously, Adobe Commerce threw an exception like this: There has been an error processing your request.
  • The SQL query that updates affected quotes after disabling a cart price rule has been optimized to avoid locking the entire quote table.
  • Shoppers with global account sharing are no longer required to log in again to a secondary website in a multisite deployment when guest checkout is disabled. Customer data is now loaded when the shopper navigates to the subdomain. The shopper is no longer asked to log in again, and the previous cart contents are displayed.
  • Address dropdown values in the checkout workflow no longer change for the remaining items in a quote when a single quantity address item is removed in a multi-address checkout. Previously, when a product was removed from a quote during multi-address checkout, the address dropdown value changed to default for all products.
  • The cart query no longer return null responses when a product is out of stock. A new errors element containing the error message was introduced to the response. Previously, when you ran a query with an out-of-stock product, Adobe Commerce displayed a null value under the items section in the response. See cart query.
  • Shipping methods are now available as expected when a guest shopper creates an account after adding a product to their cart before proceeding to checkout. Previously, when a guest added a product the cart before creating an account, no shipping methods were available during checkout. After adding other products to the cart, shipping methods became available.
  • Shoppers can now add products to their carts when no options in the Allow Countries field have been selected.
  • Cart contents and login status are now reloaded as expected after a session times out when Enable Persistence is set to Yes. GitHub-35182
  • Mini cart subtotals are now updated correctly when a shopper navigates from the shipping page to the cart page in the checkout workflow for an order with multiple shipping addresses. Previously, the subtotal was doubled.
  • The mini cart now displays previously added products after a session timeout when Enable Persistence is enabled . GitHub-35183
  • Merchants can now create a credit memo in which Refund Shipping (Incl. Tax) is set to -0.01 and can now set this amount to 0. Previously, the credit memo could not be created under these conditions.

Cart price rule

  • The Parent Only attribute scope is now used properly in the Cart Rule condition.

Catalog

  • Product URL keys now remain unchanged when updating product name via PUT /V1/products/ for a store view. Previously, a new URL key was generated based on the new product name and assigned to the product, which overrode the URL key in that store view.
  • Rule-based upsell products are no longer shown twice on the product page.
  • Adding a product to a category from the Page Builder product widget set to carousel mode no longer triggers a page reload.
  • Products set to Not Visible Individually no longer appear in catalog Advanced Search results.
  • Dynamic bundle attributes are now updated correctly on the Mass Attribute Update page. Previously, the Dynamic SKU attribute remained set to Yes even though they were disabled on the Mass Update page.
  • Catalog rules are now correctly applied using incremental indexers rather than a full re-index.
  • You can now successfully switch between list and grid views of multi-page product lists. Previously, when you navigated to the last page of a multi-page product list view before switching to the grid view, Adobe Commerce displayed this error: Unfortunately there are no products in this category on our website currently.
  • Admin Action Log reports now display updated product IDs and updated status information as expected.
  • Triggers are now restored as expected to the catalogrule_product_price table after a full re-index. Previously, triggers were removed from the catalogrule_product_price table after a catalogrule_rule or catalogrule_product full re-index.
  • Category rules that are used to assign products to categories no longer randomly change.
  • Adobe Commerce no longer throws an error when a category rule assigns a product to a category that is subsequently sorted in a multi-site deployment.
  • Categories can no longer be updated globally by an administrator with scope-restricted access. Previously, when multiple websites used the same category but different products, and an administrator with permission restricted to one store changed products in the category, the product selection also changed for other stores.
  • The product details page now displays the correct price when a non-default currency for a specified locale is used. Previously, numbers were not localized as expected on the storefront.
  • Products can now be enabled using a scheduled update.
  • The same error message is now displayed by the API and on the storefront when trying to retrieve the tier prices of a product with duplicate records. Previously, PUT /V1/products/tier-prices returned an incorrect error message.
  • Adobe Commerce now provides validation error messages when you try to add a product URL key with a trailing hyphen. Informative tooltip text is also available.
  • The new ConfigurableWishlistItem.configured_variant field has replaced the ConfigurableWishlistItem.child_sku field. The latter field triggered an internal error when a customer wishlist contained an un-configured configurable product.
  • URL rewrites are now generated only for the selected stores during the mass attribute update to change product visibility. Previously, the mass attribute update created a URL rewrite for the wrong store.
  • When the Synchronize widget products with backend storage setting is enabled, Adobe Commerce adds recently view product data into the catalog_product_frontend_action database table. It includes the customer or visitor ID when adding records. The recently_viewed_product section in the response is now empty if customer ID and visitor ID are null. As a result, when the customer/section/load Ajax request is sent, Adobe Commerce can correctly filter recently viewed products based on customer or visitor ID. Previously, the response included all the data available in the catalog_product_frontend_action database table because there was no check for an empty customer or visitor ID.
  • Category rules with a Quantity attribute for configurable products now work correctly when staging is implemented. Previously, when products had different values for row_id and entity_id in the catalog_product_entity table due to staging updates, the Visual Merchandiser Match product by rule functionality did not correctly filter the products.
  • Administrators can now change configurable product options in a shopper’s cart from the Admin slide panel. Previously, the slide panel did not work correctly.
  • Page cache is now cleared as expected for the configurable product parent when changes to a child product are saved. Previously, because the cache was not cleared, changes were not selected on the storefront configuration product page. GitHub-34508
  • Product lists are now rendered correctly in the Admin. Previously, the product list did not render, and Adobe Commerce displayed this error: Item (Magento\Catalog\Model\Product\Interceptor) with the same ID "<ID>" already exists. GitHub-33145
  • Product prices are now the same on the product detail page and in storefront search in multi-store deployments after Catalogue Price Scope changes from website to global. Previously, the Catalog Search Results page displayed the global price, and the product details page displayed the website price. GitHub-34074
  • Layered navigation now displays products with the highest prices as expected when Price Navigation Step Calculation is set to Manual.
  • You can now change the per-page product limit displayed within a category when Remember Category Pagination is enabled. Previously, the cookie form_key and UI form_key differed, and Adobe Commerce displayed this error: Invalid Form Key. Please refresh the page.
  • The EAV indexer now processes product IDs as type int to prevent possible performance issues.
  • A new product cache is now successfully generated after you add a new image with a name that contains ‘.’ to a product, then save the product and clean the image cache. GitHub-32699
  • Adobe Commerce now displays an error message as expected when you try to create an attribute from the product page without completing the Admin field. GitHub-33099

  • Product ratings are now correct on all catalog product lists when the home page contains multiple catalog lists. GitHub-33867

CMS content

  • Merchants can no longer edit an active scheduled update from the entity edit page.
  • An administrator with restricted permissions can now view a CMS page in the CMS hierarchy after a scheduled update.

Configurable products

  • Adobe Commerce now displays the correct product price for a configurable product with a selected option after changing its quantity on product details page. Previously, the price was reset to the initial value after the quantity changed.
  • The products query now retrieves prices for configurable products that accurately reflect the Display Out Of Stock configuration setting. Previously, the query did not return accurate prices.
  • Configurable options are now linked to configurable products that are created in the Admin using POST /V1/configurable-products/configurable1/child.
  • Multi-select attributes are now saved correctly during product edit. Previously, Adobe Commerce saved the default option for non-selected attributes as well as selected attributes when saving a product.
  • Adobe Commerce now displays configurable attributes as expected during the creation of global select attributes via a patch script. Previously, eligible global attributes were hidden.
  • The addConfigurableProductsToCart mutation can now be used to add configurable products with custom options. Previously, Adobe Commerce threw this error: Magento 2.3.4 graphql Notice: Undefined index: option_value in /var/www/html/mg234/vendor/magento/module-configurable-product-graph-ql/Model/Resolver/ConfigurableCartItemOptions.php on line 62. GitHub-28860
  • Adobe Commerce now correctly displays a configurable product’s stock status, available configurations, and displayed price when the availability of one of the configurable product’s child product is changed by a scheduled update. Previously, when a configurable product had two children and the availability of one child product was disabled with a scheduled update, the parent product’s stock status was incorrectly displayed as Out of Stock when the update was active, After the update completed, the displayed price and the availability of its configurations was miscalculated.

  • You can now re-order configurable products with optional custom options. Previously, re-order attempts failed, and meant displayed this error: Some of the selected options are not currently available. GitHub-35409

  • The addConfigurableProductsToCart mutation now works as expected with multiple products. Previously, incorrect product information was returned, or an invalid error message was returned. GitHub-30948

Customer

  • Adobe Commerce now displays predefined EAV system attributes correctly according to the website setting on the storefront. Previously, website-level customer attributes that were enabled for one website and disabled for another were displayed as enabled for both websites.

Customer segment

  • Customer segment-specific Related Product rules now work as expected. The issue has been fixed by calling a method to add a visitor-segment relation for a specific website. Previously, the segments for this rule fetched only on the basis of registered customers and websites.

Downloadable

  • You can now remove sample links and files from a downloadable product. GitHub-31887

Email

  • System-issued emails are now successfully sent to recipients with “.-” in their email address.
  • Customers now get email reminders about their abandoned carts on the correct schedule. The new TIMESTAMPDIFF(DAY, ,) SQL function has replaced the TO_DAYS() function and calculates the difference in the timestamps on the basis of date and time. Previously, email reminders were not sent per schedule because of the incorrect calculation of two date-time values of cart abandonment (any timezone) and server time (UTC).
  • Adobe Commerce now displays an error message on the Shipping page when a shopper enters an invalid email format after the shopper clicks Place Order. Previously, the error message was displayed on the Payment page. [GitHub-33590](https://github.com/magento/magento2/issues/33590

Frameworks

  • The bin/magento setup:config:set command no longer overrides already set cache ID prefixes in app/etc/env.php.
  • The bin/magento setup:static-content:deploy -s compact command now includes styles from child themes as expected. Previously, theme CSS files were not present on the storefront after deployment.
  • A new sniff has been added to check if closing slashes are used in void elements.
  • Adobe Commerce no longer throws an SQL error after assigning a new source to a product and changing its quantity. GitHub-35262
  • Attribute sort order now works as specified in the di.xml file after update.
  • The updateCartCurrency function now sets string instead of an object inside the cart object. Previously, Adobe Commerce did not load a quote using getQuote because the updateCartCurrency function set an object instead of a string inside the cart object. GitHub-34199
  • Deprecation notices no longer occur in unit tests due to\DateTimeFormatter::formatObject(). This method now works as expected with numeric values for $format.
  • Adobe Commerce no longer displays a preg_replace() error on the Admin. The third argument ($subject) is now of type array|string instead of bool.
  • The isFreeShipping method now returns an integer rather than a Boolean.GitHub-35164
  • Adobe Commerce no longer throws the following error when you create a plugin for any method of class vendor/magento/module-backend/Model/Menu.php: Error: Call to undefined method ReflectionUnionType::getName(). GitHub-35292
  • Adobe Commerce now returns a 404 error instead of a 500 error when you navigate to /checkout/sidebar/updateItemQty/?item_qty=error on the storefront. Previously, this error was thrown: Warning: A non-numeric value encountered in /vendor/magento/module-checkout/Controller/Sidebar/UpdateItemQty.php on line 69. GitHub-34380
  • Adobe Commerce no longer triggers a trim(): Passing null to parameter #1 ($string) of type string is deprecated error when the AMPQ connection is configured without SSL configuration.
  • Corrected the longblog database definition to long blob. GitHub-35108
  • Knockout text containing single quotes is now translatable. GitHub-34319
  • A TypeError in magento2/app/code/Magento/Security/Model/AdminSessionsManager.php has been corrected from int to string. GitHub-34415
  • .htpasswd has been added to banned locations in the nginx configuration file. GitHub-35150
  • Load time of category product list pages have been improved by adding Magento_Ui/js/core/app as a deps to app/code/Magento/Ui/view/frontend/requirejs-config.js. GitHub-34847
  • The ProductRepository.php:get method now returns cache keys once. Previously, they were returned twice. GitHub-34958
  • Added an error message to a new exception that was created in the exception handler for cron jobs. GitHub-34941
  • The ReadMe files for the GraphQl-GroupedProductGraphQl modules have been updated. GitHub-34951
  • The storefront print order/invoice/credit memo pages no longer display the default Luma logo instead of the logo that has been specified for display on the website. GitHub-34942