Magento Open Source 2.4.0 release notes

Implementation of 2FA for Admin accounts, magento.com user accounts, and Cloud SSH access

• Securing your Admin account. Two-factor authentication (2FA) is now required for the Admin. Admin users must first configure their 2FA before logging into the Admin through either the UI or a web API. 2FA is enabled by default. We strongly recommend against disabling the 2FA module. This extra step of authentication makes it harder for malicious users to log in to the Admin without authorization. See Two-factor Authentication (2FA).

• Securing your account. Two-factor Authentication (2FA) provides an added, optional layer of security to better protect your magento.com account from unauthorized users who might want to use your account in ways you do not want. See Securing Your Account.

Securing Cloud SSH access. Adobe on cloud infrastructure provides multi-factor authentication (MFA) enforcement to manage authentication requirements for SSH access to Cloud environments. Multi-factor authentication for 2FA is not enabled by default on a project. Adobe highly recommends enabling this feature. Contact Support for assistance. See Enable multi-factor authentication for SSH access.

Template filter strict mode is now enabled by default. Components (including CMS pages and blocks) that use the template filter in legacy mode can be vulnerable to remote code execution (RCE). Enabling strict mode by default ensures that RCE attacks cannot be deliberately enabled.

Data rendering for UI data providers is now disabled by default. This removes an opportunity for malicious users to execute arbitrary JavaScript.

New \Magento\Framework\Escaper class. This class is provided for .phtml templates and the PHP classes that are responsible for generating HTML. This class contains HTML sanitization methods relevant to multiple contexts. The $escaper local variable is available inside .phtml templates and should be used instead of the deprecated $block->escape{method}. Use $escaper rather than $block as the use of $block->escape{method} has been deprecated.

Support for new security.txt file. This file is an industry-standard file on the server that helps security researchers report potential security issues to site administrators.

Enhancements to Content Security Policy (CSP) support. SecureHtmlRenderer has been added to the Framework and is available in .phtml templates to whitelist inline style and script tags. Inline scripts and styles are not permitted with default CSP configuration, which can be overridden by XML files.

PHP 7.4 support introduced and PHP 7.1 and 7.2 deprecated. 2.4.0 introduces support for PHP 7.4.

Support for PHPUnit 9.x and deprecation of PHPUnit 6.5. PHP 7.4 requires the use of the latest PHPUnit testing framework, which is PHPUnit 9.x. Commerce Marketplace extension vendors must confirm that all new extension versions are compatible with PHP 7.4 and that all unit and integration tests have been configured to be run with PHPUnit 9.

Elasticsearch 7.6.x support. Elasticsearch 7.6.x is now the default catalog search engine for Adobe Commerce and Adobe Commerce. You cannot install or upgrade to version 2.4.0 without also installing Elasticsearch 7.6.x. Elasticsearch version 2.x code has been removed. Elasticsearch versions 5.x and 6.x have been deprecated and are no longer supported. See Search engine prerequisites.

MySQL 8.0 support. Version 2.4.x supports MySQL 8.x. (2.4.0 was tested with MySQL 8.0.20.) Merchants are encouraged to migrate their deployments to MySQL 8.x to take advantage of its improved performance, security, and reliability. Although MySQL 5.7 is still supported for Magento 2.4.x, MySQL 5.6 is no longer supported. You cannot host 2.4.x with a MySQL 5.6 database. See MySQL.

Removal of the MySQL catalog search engine. The MySQL search engine has been removed from 2.4.0 and replaced as the default search engine with Elasticsearch. Elasticsearch provides superior search capabilities as well as catalog performance optimizations. All merchants must have Elasticsearch to install and deploy 2.4.0. See Verify Elasticsearch is installed.

MariaDB 10.4 support. Support for MySQL 8.0 provides the opportunity for merchants to deploy MariaDB 10.4 with Magento Open Source. Although merchants can still use MariaDB 10.2 with 2.4.0, we recommend upgrading to MariaDB 10.4 for improved performance and reliability. MariaDB 10.0 and 10.1 are no longer supported (as a result of removing support for MySQL 5.6 in this release).

Migration of dependencies on Zend Framework to the Laminas project to reflect the transitioning of Zend Framework to the Linux Foundation’s Laminas Project. Zend Framework has been deprecated. See the Migration of Zend Framework to the Laminas Project DevBlog post.

Decomposition of Controllers allows extension developers to implement ActionInterface directly without “layer supertype” classes. See the Decomposition of Controllers DevBlog post. Enhancement started by Vinai Kopp in pull request 16268 and finalized by Lukasz Bajsarowicz in pull request 26778. GitHub-9582

Removal of the core integration of the Signifyd fraud protection code. This core feature is no longer supported. Merchants should migrate to the Signifyd Fraud & Chargeback Protection extension that is available on the Commerce Marketplace.

The core Braintree module has been removed from the code base. The Braintree Payments module now provides the same feature set. See Braintree Payments.

The Internet Explorer 11.x browser is no longer supported.

Removal of core integration of third-party payment methods. With this release, the Authorize.Net payment method integration has been removed from core code. Merchants should migrate to the official extension that is available on the Commerce Marketplace. See the Deprecation of payment integrations devblog post.

Support for partial-word search for Elasticsearch (new default search engine). Elasticsearch now supports the use of partial words in search terms for product names and SKUs when using quick search. This capability was supported by the MySQL search engine, which has been deprecated and replaced by Elasticsearch in this release.

PayPal JavaScript SDK upgrade. We’ve migrated the PayPal Express Checkout integration to the latest PayPal JavaScript SDK, an SDK that automatically collects and passes needed risk parameters to PayPal. The behavior of the PayPal Express Checkout payment method remains unchanged. However, upgrading this SDK to the latest version let merchants access the latest features and security enhancements.

Deprecation and removal of the Web Set Up Wizard. You must use the command line to install or upgrade 2.4.0. See Install Magento.

Composer update plugin. Composer plugin streamlines the upgrade process by resolving changes that must be made to the root project composer.json file before updating to a new version. This plug-in protects against overwriting customizations. See Upgrade using the composer root plugin.

Seller-assisted shopping. This feature allows merchants to view the storefront on behalf of their customers. Customers opt to allow storefront access to their accounts. This community-developed feature includes an original extension developed by MAGEFAN. See Seller Assisted Shopping. Features include:

• ACL to control which administrators can log in to customer accounts can be configured on a per-website basis
• Compatibility with multiple websites and customer account scopes
• Orders placed on behalf of customers are logged in the storefront and Admin
• All sessions are destroyed following administrator logout, and administrators cannot access customer passwords.

Improvements to customer data section invalidation logic. This release introduces a new way of invalidating all customer sections data that avoids a known issue with local storage when custom sections.xml invalidations are active. (Previously, private content (local storage) was not correctly populated when you had a custom etc/frontend/sections.xml with action invalidations.) See Private content.

Multiple optimizations to Redis performance. The enhancements minimize the number of queries to Redis that are performed on each request. These optimizations include:

• Decrease in the size of network data transfers between Redis and Magento

• Reduction in Redis’ consumption of CPU cycles by improving the adapter’s ability to automatically determine what needs to be loaded

• Reduction in race conditions on Redis write operations

See Use Redis for the page and default cache and Configure caching.

Improved caching of results of SQL queries to inventory tables. These enhancements include:

• Caching of SQL queries to the inventory_stock_sales_channel table (1 query instead of 16)

• Caching of result of queries to the inventory_stock table (1 query instead of 16)

Improvement of up to 25-30% to Quick Order add-to-cart performance.

Merchants can now use lazy loading to load images.

The application now displays the following behaviors when your connection to Redis is interrupted. Previously, the application did not reload the current page and displayed this error: An error has happened during application run. See exception log for details.

• Admin and storefront sessions expire
• Admin and storefront users must log in again
• Session data is saved to var/session/
• No error or exceptions are logged.

php bin/magento cron:run no longer processes items from the change log table multiple times. Previously, when you had more than 100000 new versions in the change log table, actions could be called several times for the same entity id.

php bin/magento setup:cron:run command has now been removed. References to this in crontabs should be removed when upgrading.

The update/cron.php file has been removed in 2.4.0, if this file exists on your installation, it can be safely removed. Also, remove references to this file in crontabs when upgrading.

Corrected a problem in GraphQL in which the application did not return all the required information while using fragments on products query. Fix submitted by Riccardo Tempesta in pull request 26218. GitHub-26217

The GraphQL mutation setShippingMethodsOnCart no longer retrieves the wrong data in the available_shipping_methods attribute. Fix submitted by Vadim Malesh in pull request 27004. GitHub-26742

The application no longer displays a blank page instead of displaying all the shipping carriers in the dropdown/multi-select box. Previously, an error in the toOptionArray function in vendor/magento/module-shipping/Model/Config/Source/Allmethods.php occurred. Fix submitted by Marc Rodriguez in pull request 25315. GitHub-13136

The application no longer applies a fixed amount discount multiple times when a customer creates an order that will be shipped to multiple addresses. Fix submitted by Mahesh Singh in pull request 26419. GitHub-25834

Each Action group in a test has been moved to a separate file to follow MFTF best practices, and inconsistent file names have been revised. Tests for the following modules have been affected:

• module-catalog-permissions
• module-shared-catalog
• module-catalog-event
• module-banner
• module-admin-gws
• module-advanced-checkout
• module-shipping
• module-ui
• module-shipping
• module-checkout-address-search
• module-sales
• module-catalog
• module-catalog-rule-staging
• module-visual-merchandiser
• module-customer

Fix submitted by Lukasz Bajsarowicz in pull requests 25800, 26323, 26321, 26320, 26319, 26322, 25828, 26329 (and pull requests 104, 105, 106, 107, 108, 109, 111, 119, 120, 121 in private repository partners-magento2ee). GitHub-22853

Issue: Payment methods are missing from the checkout workflow when a customer clicks Return to standard checkout during checkout with Amazon Pay. Workaround: Refresh the checkout page to display the missing methods.

Issue: The application displays two identical Amazon Pay methods in the Payment Method drop-down list that is available when creating a new cart price rule.

Issue: The application displays an error when an administrator tries to access the Braintree Settlement Report page (Admin > Reports ). Currently, the application displays this message: An error has happened during application run. See exception log for details. See Braintree Settlement Report fails to load Knowledge Base article. The BUNDLE-2683_SettlementReport.patch hotfix for this issue is now available from Releases.

Issue: Merchants can’t create partial invoices for orders in deployments where Venmo is enabled and the Enable Vault for Card Payments setting is disabled. Currently, the application displays this error: The "vault_capture" command doesn't exist. Verify the command and try again.

Issue: The application displays two identical PayPal methods in the Payment Method drop-down list that is available when creating a new cart price rule.

Issue: The application an error when opening Sales > Braintree Virtual Terminal. Although the form contains corrupted UI elements, it still accepts payments. Workaround: Save the correct Braintree credentials, which will fix the collapsed input fields. See Braintree Virtual Terminal page is corrupted Knowledge Base article. The BUNDLE-2670_VirtualTerminal.patch hotfix for this issue is now available from Releases.

Issue: The application displays an error message in the following countries when a customer selects a local payment method during checkout: Belgium, Netherlands, Italy, Spain, and Poland. Workaround: Ignore the error message and continue with payment.

If a community member has provided a fix for this release, we identify the fix in the Fixed Issue section of these notes with the phrase, “Fix provided by community member @member_name”.

The Community Engineering team Magento Contributors maintains a list of top contributing individuals and partners by month, quarter, and year. From that Contributors page, you can follow links to their merged PRs on GitHub.