Magento Open Source 2.4.6 highlights

Look for the following highlights in this release.

Security enhancements

This release includes eight security fix and platform security improvements.

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts:

See Adobe Security Bulletin for the latest discussion of these fixed issues.

Additional security enhancements

Security improvements for this release improve compliance with the latest security best practices, including:

  • Gaps in Admin action logs have been addressed with more specific auditing of actions within grid views, mass actions, and exports.

  • reCAPTCHA validation no longer fails during checkout when unexpected errors occur during payment processing. GitHub-35093

  • New system configuration for requiring email confirmation when an admin user changes their email. To reduce site vulnerability, a new system configuration setting (disabled by default) was added to require email confirmation when an admin user changes their email: Stores > Settings:Configuration > Customers > Customer Configuration > Account Information Options > Require email confirmation if an email has been changed. When this option is enabled, the application will request email confirmation every time the admin user changes their email address. The following module is affected by this change: Magento_Customer.

Platform enhancements

Magento Open Source 2.4.6 introduces support for PHP 8.2. PHP 8.1 remains fully supported.

PHP 7.4 support has been removed from this release. You cannot run Magento Open Source 2.4.6 on PHP 7.4.

Magento Open Source now supports:

  • Composer 2.2.x. Composer 1.x has been removed.

  • Redis 7.0.x. Although compatibility with Redis 6.2 remains, we recommend deploying this release with Redis 7.0.x because Redis 6.2 is expected to reach end of life in 2024.

  • OpenSearch is now supported as the default search engine for Magento Open Source on-premises and cloud deployments. It is supported as an independent search engine for Magento Open Source. This release supports OpenSearch v2.x and has been tested with OpenSearch 2.5. Although compatibility with OpenSearch 1.x remains, we recommend using this release with OpenSearch 2.x. You can install and run Magento Open Source and Magento Open Source 2.4.6 with OpenSearch 2.x on both Cloud and on-premises Search engine prerequisites.

  • Elasticsearch 8.x. See Upgrade Elasticsearch.

  • MariaDB 10.6 (LTS version). This release is still compatible with MariaDB 10.4, but we recommend upgrading to MariaDB 10.6.

Other upgrades and replacements

  • The DHL schema has been migrated from v6.2 to v10.0.

  • Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.

  • PHP 7.4 compatibility has been removed from the Commerce and Magento Open Source code bases.

  • Symfony dependencies have been upgraded to the new LTS version. Dependencies include:

    • friendsofphp/php-cs-fixer
    • symfony/console
    • symfony/event-dispatcher
    • symfony/finder
    • symfony/process
    • web-token/jwt-framework
  • jquery-migrate has been removed from the Commerce and Magento Open Source code bases. GitHub-21406

  • Upgraded jQuery/fileUpload library to v10.32.

  • Zend framework (ZF1) components that have reached end of life have been removed from the codebase. See Backward-incompatible changes highlights.

  • Laminas dependencies have been updated to support PHP 8.2.

  • The laminas/laminas-dependency-plugin Composer plugin has been removed. GitHub-36515

  • Replaced Zend_Filter with laminas/laminas-filter.

  • Upgraded web-token/jwt-framework to v3.0.5. (latest version)

  • Upgraded allure-framework/allure-phpunit to v2.x.

  • Upgraded the Chart-js library to v3.9.1

Accessibility updates

The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:

  • The visual text label for the Sign in button now matches its accessible name. (Best practice recommends that a UI element’s accessible name starts with the visible label text.)
  • Descriptive accessible names have been added to buttons throughout the storefront.
  • Verbal descriptive labels have been added to the Has Video checkboxes in search filters.
  • Keyboard-only users can now access all page functionality on the storefront. Previously, shoppers could not access sub-navigation links using only keystrokes.

Adobe Commerce integration with Adobe IMS

The following Adobe IMS modules have been decoupled from the Adobe Commerce and Magento Open Source core code and are now packaged as a separate metapackage:

  • adobe-ims
  • adobe-ims-api
  • admin-adobe-ims

The new adobe-ims-metapackage v2.2.0 is bundled with Adobe Commerce 2.4.6 and Magento Open Source 2.4.6. No functionality has changed in this release.

Braintree

  • The Pay Later button and banners (messages) for Italy and Spain have been enabled for Braintree.
  • PayLater messaging with PayPal Vault has been enabled.
  • Added Fraud Protection and ACH web hooks. The Fraud Protection web hook is triggered when a risk decision has been made in Braintree. The ACH web hook is triggered when the status of an ACH payment is updated to settled or settlement decline.
  • Added LPM (Local Payment Methods) web hook.

GraphQL

GraphQL performance enhancements include:

Improved response time when querying categories with category permissions enabled. Response times have improved when querying products in categories for which category permissions are enabled and that contain many customer groups or shared catalogs. Code changes that support this performance improvement include:

  • GraphQL resolver operation has been optimized.
  • The data provider no longer re-sets runtime-cached data for every new product being processed, which has improved performance.
  • Product permission processing has been optimized in the GraphQL resolver. Product permissions are now applied to product collections instead now on a per-product basis.
  • Optimized permissions read in shared catalogs in the addProductsToCart mutation.
  • Product permissions have been optimized with product inline fragments.

Optimized performance of category tree rendering. The categoryList query has been optimized to support customers with a large number of categories. Merchants using this query to search more than 1500 categories with up to five levels of nested subcategories will notice a performance improvement. The loading of category children by refactoring code has been improved by removing unnecessary method calls, improving caching of the category tree, and loading category data recursively. Code changes that support this performance improvement include:

  • Custom attributes metadata fetching for category models has been improved.
  • Category ID fetching has been improved, and getChildren calls have been reduced.
  • Category children loading has been improved.

Reduced bulk cart operations query response times. The add product mutations have been optimized to improve query performance when adding up to 500 simple and configurable products. Bundle products are not affected. The optimized mutations include addProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addSimpleProductsToCart, addVirtualProductsToCart,addWishlistItemsToCart, and updateCartItems.

customer query now supports order sorting. The orders output object of the customer query now contains a sort field. You can now sort orders by order number or creation date and in ascending or descending order.

New mutations:

deleteCustomer