Additional security enhancements
Security improvements for this release improve compliance with the latest security best practices, including:
-
Gaps in Admin action logs have been addressed with more specific auditing of actions within grid views, mass actions, and exports.
-
reCAPTCHA validation no longer fails during checkout when unexpected errors occur during payment processing. GitHub-35093
-
New system configuration for requiring email confirmation when an admin user changes their email. To reduce site vulnerability, a new system configuration setting (disabled by default) was added to require email confirmation when an admin user changes their email: Stores > Settings:Configuration > Customers > Customer Configuration > Account Information Options > Require email confirmation if an email has been changed. When this option is enabled, the application will request email confirmation every time the admin user changes their email address. The following module is affected by this change:
Magento_Customer
.
Platform enhancements
Magento Open Source 2.4.6 introduces support for PHP 8.2. PHP 8.1 remains fully supported.
PHP 7.4 support has been removed from this release. You cannot run Magento Open Source 2.4.6 on PHP 7.4.
Magento Open Source now supports:
-
Composer 2.2.x. Composer 1.x has been removed.
-
Redis 7.0.x. Although compatibility with Redis 6.2 remains, we recommend deploying this release with Redis 7.0.x because Redis 6.2 is expected to reach end of life in 2024.
-
OpenSearch is now supported as the default search engine for Magento Open Source on-premises and cloud deployments. It is supported as an independent search engine for Magento Open Source. This release supports OpenSearch v2.x and has been tested with OpenSearch 2.5. Although compatibility with OpenSearch 1.x remains, we recommend using this release with OpenSearch 2.x. You can install and run Magento Open Source and Magento Open Source 2.4.6 with OpenSearch 2.x on both Cloud and on-premises Search engine prerequisites.
-
Elasticsearch 8.x. See Upgrade Elasticsearch.
-
MariaDB 10.6 (LTS version). This release is still compatible with MariaDB 10.4, but we recommend upgrading to MariaDB 10.6.
Other upgrades and replacements
-
The DHL schema has been migrated from v6.2 to v10.0.
-
Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.
-
PHP 7.4 compatibility has been removed from the Commerce and Magento Open Source code bases.
-
Symfony dependencies have been upgraded to the new LTS version. Dependencies include:
friendsofphp/php-cs-fixer
symfony/console
symfony/event-dispatcher
symfony/finder
symfony/process
web-token/jwt-framework
-
jquery-migrate
has been removed from the Commerce and Magento Open Source code bases. GitHub-21406 -
Upgraded
jQuery/fileUpload
library to v10.32. -
Zend framework (ZF1) components that have reached end of life have been removed from the codebase. See Backward-incompatible changes highlights.
-
Laminas dependencies have been updated to support PHP 8.2.
-
The
laminas/laminas-dependency-plugin
Composer plugin has been removed. GitHub-36515 -
Replaced
Zend_Filter
withlaminas/laminas-filter
. -
Upgraded
web-token/jwt-framework
to v3.0.5. (latest version) -
Upgraded
allure-framework/allure-phpunit
to v2.x. -
Upgraded the
Chart-js
library to v3.9.1
Accessibility updates
The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:
- The visual text label for the Sign in button now matches its accessible name. (Best practice recommends that a UI element’s accessible name starts with the visible label text.)
- Descriptive accessible names have been added to buttons throughout the storefront.
- Verbal descriptive labels have been added to the Has Video checkboxes in search filters.
- Keyboard-only users can now access all page functionality on the storefront. Previously, shoppers could not access sub-navigation links using only keystrokes.
Adobe Commerce integration with Adobe IMS
The following Adobe IMS modules have been decoupled from the Adobe Commerce and Magento Open Source core code and are now packaged as a separate metapackage:
adobe-ims
adobe-ims-api
admin-adobe-ims
The new adobe-ims-metapackage
v2.2.0 is bundled with Adobe Commerce 2.4.6 and Magento Open Source 2.4.6. No functionality has changed in this release.
Braintree
- The Pay Later button and banners (messages) for Italy and Spain have been enabled for Braintree.
- PayLater messaging with PayPal Vault has been enabled.
- Added Fraud Protection and ACH web hooks. The Fraud Protection web hook is triggered when a risk decision has been made in Braintree. The ACH web hook is triggered when the status of an ACH payment is updated to
settled
orsettlement decline
.
- Added LPM (Local Payment Methods) web hook.
GraphQL
GraphQL performance enhancements include:
Improved response time when querying categories with category permissions enabled. Response times have improved when querying products in categories for which category permissions are enabled and that contain many customer groups or shared catalogs. Code changes that support this performance improvement include:
- GraphQL resolver operation has been optimized.
- The data provider no longer re-sets runtime-cached data for every new product being processed, which has improved performance.
- Product permission processing has been optimized in the GraphQL resolver. Product permissions are now applied to product collections instead now on a per-product basis.
- Optimized permissions read in shared catalogs in the
addProductsToCart
mutation. - Product permissions have been optimized with product inline fragments.
Optimized performance of category tree rendering. The categoryList
query has been optimized to support customers with a large number of categories. Merchants using this query to search more than 1500 categories with up to five levels of nested subcategories will notice a performance improvement. The loading of category children by refactoring code has been improved by removing unnecessary method calls, improving caching of the category tree, and loading category data recursively. Code changes that support this performance improvement include:
- Custom attributes metadata fetching for category models has been improved.
- Category ID fetching has been improved, and
getChildren
calls have been reduced. - Category children loading has been improved.
Reduced bulk cart operations query response times. The add product mutations have been optimized to improve query performance when adding up to 500 simple and configurable products. Bundle products are not affected. The optimized mutations include addProductsToCart
, addConfigurableProductsToCart
, addDownloadableProductsToCart
, addSimpleProductsToCart
, addVirtualProductsToCart
,addWishlistItemsToCart
, and updateCartItems
.
customer query now supports order sorting. The orders
output object of the customer
query now contains a sort field. You can now sort orders by order number or creation date and in ascending or descending order.
New mutations:
deleteCustomer
Page Builder
Page Builder v.1.7.3 is compatible with Magento Open Source 2.4.6.
PWA Studio
PWA Studio v.13.0.x is compatible with Magento Open Source 2.4.6. It includes multiple enhancements to improve accessibility. For information about bug fixes, see PWA Studio releases. See Version compatibility for a list of PWA Studio versions and their compatible Adobe Commerce core versions.
Known issue
Issue: New Relic is not currently compatible with PHP 8.2. Deployments running New Relic can run Adobe Commerce 2.4.6 on PHP 8.1 but not PHP 8.2. Workaround: Run Adobe Commerce 2.4.6 on PHP 8.1 until a new version of New Relic is released that supports PHP 8.2. This release is expected Summer 2023.
Fixed issues
We have fixed hundreds of issues in the Magento Open Source 2.4.6 core code.
Installation, upgrade, deployment
- Static content deployment no longer times out or fails during standard or compact deployments with multiple locales and websites.
- Compact strategy no longer causes an invalid reference to an external domain when running static content deployment (
bin/magento set:static-content:deploy -f --strategy compact
).
- Executing
bin/magento setup:di:compile -vvv
(or with the-v
or-vv
options) now returns an informative message on failure. GitHub-35391
- Magento Open Source no longer throws the following exception when you run the
bin/magento setup:upgrade
command in a deployment already running the data migration tool:PHP Fatal error: Declaration of Migration\Logger\Logger::addRecord(int $level, string $message, array $context = []): bool must be compatible with Monolog\Logger::addRecord(int $level, string $message, array $context = [], ?Monolog\DateTimeImmutable $datetime = null): bool in /var/www/html/vendor/magento/data-migration-tool/src/Migration/Logger/Logger.php on line 34
. GitHub-35604
- The
bin/magento setup:db:status
command no longer fails in environments running MySQL 8.0.29. Previously, command output stated erroneously that the declarative schema was outdated. GitHub-35671
- The
composer install
command no longer overwrites.gitignore
files. GitHub-32888
- Running
bin/magento sampledata:remove
to remove sample data after upgrade on Alpine Linux no longer fails with this error:Undefined constant "MagentoHackathon\Composer\Magento\Deploystrategy\GLOB_BRACE
. GitHub-36062
bin/magento setup:upgrade
now executes successfully after first executingcomposer install --no-dev
. GitHub-36351
- Exceptions and exception stack trace entries are now included in
var/log/exception.log
. GitHub-36054
Magento Open Source now throws a parameter validation error when you use the command line to set a Redis connection without a password.
Accessibility
- The Proceed to Checkout, Review Order, and Place Order buttons in the checkout workflow now work as expected with keyboard input.
- Visual indication of focus on buttons when using TAB or SHIFT + TAB to navigate through page controls now works as expected.
Screen readers
- The screen reader for the order history page now reads the correct image description.
Screen readers now announce:
- Total item count found in search results as expected
- Logged-in user’s name when a user successfully signs in using keyboard controls
- Product search result page header now reads the correct value for the
<title>
element - Whether input fields are required
- Correct current state of accordion elements (collapsed and expanded)
- When page content has been refreshed after the user has clicked the Create an account button
Bundle products
- Updating bundle product via API for a specific store view now does not override other store views data for the same bundle product. Previously, bundle product option titles were overridden with the first option title for other store views.
- Bundled products can now be filtered successfully from Admin Catalog > Products when using a Dutch locale. Previously, Magento Open Source displayed this error when you tried to filter on
Type: Bundle Product
:Something went wrong with processing the default view and we have restored the filter to its original state
. GitHub-35704
- The products grid no longer throws an exception when bundle products have a special price that exceeds 1000. Previously, when you either searched for the product by SKU or navigated to Catalog > Products, Magento Open Source threw this error:
Non Numeric value encountered
. GitHub-36284)
- Columns in credit memo and invoice PDFs for orders that contain a mix of bundle and simple products are now rendered correctly. Previously, columns were distorted or misaligned.
- In GraphQL queries that contain a
BundleProduct
fragment, theitems.options.product
object contains data as expected. Previously, the object could be null in some circumstances.
- Decimal quantities for bundle options are now rendered correctly when Quantity uses decimals is enabled. Previously, only the integer part of the quantity was rendered, not the fractional component. For example, a quantity of 1.5 was rendered as 1.0. GitHub-35964
- GraphQL product queries now return only bundle product options within the scope of the store being queried.
- Products that are not assigned to categories but that are product options for bundle or grouped products are now returned in responses when the Allow Category Browsing configuration setting is enabled for the customer sending the query.
Cache
- Full-page cache is no longer flushed after order fulfillment unless the ordered product is out of stock. Previously, the cache was purged for the category whenever a shipment was created.
- Data is now cached successfully when the L2 cache is configured and remote data is partially evicted. Previously, after flushing only the data cache without hashes of those data, the new cache was not saved while the data hashes existed.
- Corrected defects in
CatalogUrlResolverIdentity
andCmsUrlResolverIdentity
that prevented caching. This affected route query caching on multiple requests.
Cart and checkout
- Shoppers can now add an additional item to their cart when their cart contains the minimum quantity of the simple product.
- REST API calls to retrieve cart data now return the same
grand_total
andbase_grand_total
values when the store currency and base currency are the same. GitHub-34649
- The exported value of Maximum Qty Allowed in Shopping Cart now matches the default value set in the Admin configuration setting.
- Magento Open Source now correctly calculates the grand total for refunds of orders with a discount for shipping.
- Google reCAPTCHA now works as expected for storefront orders. Previously, Magento Open Source displayed these errors when Google ReCAPTCHA was not first selected before a shopper first attempted to place an order:
ReCaptcha validation failed, please try again
andNo such cart with id = ID
.
- CAPTCHA image refresh now honors the Admin configuration setting and is not triggered when the setting is disabled. Previously, the refresh was triggered whenever the payment method changed regardless of whether the setting was enabled or disabled. GitHub-34855
- Magento Open Source now displays a confirmation popup as expected before redirecting a shopper to the next page when the shopper changes product quantity on the cart page without updating the cart and then tries to navigate to the next page.
- Shoppers can now decrease a product’s quantity from their cart after it was decreased in the Admin. Previously, Magento Open Source threw the following error when a shopper tried to decrease product quantity:
The requested qty is not available
. GitHub-35780
- Magento Open Source no longer throws an error in the JavaScript console when product quantity exceeds the configured maximum during multi-shipping checkout. Instead, Magento Open Source now displays an informative error message. GitHub-36184
- Item quantity on the shopping cart page is no longer represented as a negative number when a shopper uses the down arrow key on their keyboard to change product quantity. GitHub-36299
- Shoppers can no longer add to the cart a product from a category that is now disallowed after changing the customer group to which the shopper belongs. Magento Open Source now checks customer group permission access for specific categories when the permission configuration settings have been changed.
- Customer shopping carts are no longer emptied before Admin order creation, and cart contents are now restored if the order is canceled or abandoned. Items are now removed from the cart only after order creation. Previously, whenever an admin user tried to create an order on the Admin Manage Shopping Cart page, the cart was emptied.
- The mini cart now displays correct product images after you run
bin/magento catalog:image:resize
. Previously, all images were replaced by the default product placeholder image. GitHub-35535
- Checkout can now complete successfully when the shipping address contains an extension attribute. Previously, Magento Open Source threw this error:
Object of class Magento\Quote\Api\Data\AddressExtension could not be converted to string
. GitHub-34202
- The
addBundleProductsToCart
mutation no longer adds products to a quote if a required product option has no value. GitHub-25676
- Magento Open Source now returns an informative message when an
addProductsToCart
mutation fails when adding a product to the cart with insufficient permissions.
- Magento Open Source no longer throws an error on the cart page when Quick Order is used to add a product in a quantity that exceeds available inventory.
Cart price rule
- Cart price rule free shipping options that are set during rule creation are now applied to orders as expected. Previously, free shipping options applied during rule created were ignored during checkout, and free shipping was not permitted when the rule was applied. GitHub-35013
- The
discount_percent
column of thesales_order_item
table for a product is now populated as expected with the discount percentage when the item discount quantity is not set or it is greater than or equal to order item quantity. Previously, this column was not populated when a cart price rule was applied to this product.
Catalog
- The product list widget no longer displays incorrect or cached prices for a logged-in shopper. The price displayed in the home page widget now matches the shopper’s address and is updated when the shopper updates the address. Previously, the browser cache did not update product prices on the home page based on customer group tax rules.
- The Compare Products list feature now works correctly in a multi-website deployment and is dependent on website.
- Magento Open Source no longer displays data from the previous page when you reload a product detail page. Previously, when the product detail page was reloaded, data from the first tab was merged with the newly loaded data for a split second.
- Categories with subcategories can now be expanded in the main menu on mobile devices as expected. Previously, shoppers could not open or expand categories with subcategories in mobile deployments. GitHub-35329
- Category listings are now updated as expected when a product is assigned to a new website or store. Previously, the product price indexer was not marked as invalid and subsequently re-triggered on a
cron
run as expected. As a result, the product’s price entry was missing from the price index table and was not displayed on the new store or website.
- The storefront inventory count is now accurate when the Display Out of Stock Products configuration setting is enabled. GitHub-35899
- The category page is no longer empty when the Allow All Products Per Page setting is enabled. GitHub-35900
- The Display Out of Stock Products configuration option now works as expected when enabled. Previously, all products were displayed as out-of-stock on the storefront when this option was enabled on the Admin. GitHub-35898
- Product sorting by Boolean attributes now works as expected. GitHub-36390
- Catalog price rule discounts are no longer applied to fixed price custom product options but are applied to only the product’s original price.
- Catalog price rules now take into account the selected scope and are applied to products only for the websites for which the attribute has an option value that matches the rule. Previously, the rule did not take into account the selected scope in multi-site deployments. GitHub-36049
- The swatch options color and size attributes are now pre-selected in the product detail page when a shopper modifies the configurable product from the My Cart page. (jQuery 3.x version now supports the
swatchRenderer
widget name, which is now camel case.) Previously, the swatch option is not pre-selected.
- Customers are now notified for product price drops when the customer is subscribed to the price drop alert. Previously, price drop notifications were not always sent due to application level caching.
- Catalog rules that are based on SKUs with the is not one of condition now work as expected.
- Magento Open Source no longer erroneously assumes that one category is the parent category of another based on category path. Previously, when two categories were adjacent and one category ID starts with another category’s category ID, Adobe Commerce assumed that the categories had the same parent category. GitHub-32464
Configurable products
- Magento Open Source no longer throws an error when an admin user adds products manually to a configurable product that already has many simple products assigned to it. Previously, Magento Open Source displayed this error:
Something went wrong with processing the default view and we have restored the filter to its original state
.
- Shoppers can no longer add configurable products with a salable quantity of 0 to their shopping cart in deployments with back orders disabled. Magento Open Source now indicates that the product is out of stock. GitHub-35319
- Creating a new product by importing a configurable product with many options from a different store view now results in an exact copy of the first product as expected. Previously, the sort order of the new product’s configurable options was incorrect, and titles were not translated to the new store view’s locale in deployments with multiple store views and locales. GitHub-35200
- Configurable products with all out-of-stock child products are now displayed as out of stock on the storefront.
- Configurable product SKUs and product names are now displayed accurately. Previously, name and SKUs were displayed as undefined after you moved an attribute group above the Product Details group on Stores > Attribute set. GitHub-36309
Coupons
- Validation logic has been added to the Manage Coupon Codes workflow to enforce the coupon code settings when generating coupons. Previously, coupon code generation ignored the Code Length setting when the Coupon Qty value was greater than 2500.
- Reward points are now added to a customer’s account as expected when a rewards coupon is applied during checkout with the PayPal Express payment method.
- You can now apply a coupon code during Admin order creation when the cart price rule has weight as a condition. Previously, coupon codes were not set if other fields were not selected for the product. GitHub-36271
- You can now filter coupon reports by multiple cart price rules. GitHub-36272
- Custom options are now applied and saved when an admin user presses Enter while configuring a product with custom options. Previously, you were able to select options and add the product to an order, but the options were not saved, and the admin user was prompted to re-select product options. GitHub-35284
- Coupon codes can now be successfully exported to Excel XML. Previously, the generated file did not contain all selected coupon codes but only as many items as were selected in the items per page selector.GitHub-36073