Adobe Commerce 2.4.6 highlights

Look for the following highlights in this release.

Security enhancements

This release includes eight security fixes and platform security improvements.

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts:

See Adobe Security Bulletin for the latest discussion of these fixed issues.

Additional security enhancements

Security improvements for this release improve compliance with the latest security best practices, including:

  • Gaps in Admin action logs have been addressed with more specific auditing of actions within grid views, mass actions, and exports.

  • reCAPTCHA validation no longer fails during checkout when unexpected errors occur during payment processing. GitHub-35093

  • New system configuration for requiring email confirmation when an admin user changes their email. To reduce site vulnerability, a new system configuration setting (disabled by default) was added to require email confirmation when an admin user changes their email: Stores > Settings:Configuration > Customers > Customer Configuration > Account Information Options > Require email confirmation if an email has been changed. When this option is enabled, the application will request email confirmation every time the admin user changes their email address. The following module is affected by this change: Magento_Customer.

Platform enhancements

Adobe Commerce 2.4.6 introduces support for PHP 8.2. PHP 8.1 remains fully supported.

PHP 7.4 support has been removed from this release. You cannot run Adobe Commerce 2.4.6 on PHP 7.4.

Adobe Commerce 2.4.6 now supports:

  • Composer 2.2.x. Composer 1.x has been removed.

  • Redis 7.0.x. Although compatibility with Redis 6.2 remains, we recommend deploying this release with Redis 7.0.x because Redis 6.2 is expected to reach end of life in 2024.

  • OpenSearch is now supported as the default search engine for Adobe Commerce on-premises and cloud deployments. It is supported as an independent search engine for Magento Open Source. This release supports OpenSearch v2.x and has been tested with OpenSearch 2.5. Although compatibility with OpenSearch 1.x remains, we recommend using this release with OpenSearch 2.x. You can install and run Adobe Commerce and Magento Open Source 2.4.6 with OpenSearch 2.x on both Cloud and on-premises Search engine prerequisites.

  • Elasticsearch 8.x. See Upgrade Elasticsearch.

  • MariaDB 10.6 (LTS version). This release is still compatible with MariaDB 10.4, but we recommend upgrading to MariaDB 10.6.

Other upgrades and replacements

  • The DHL schema has been migrated from v6.2 to v10.0.

  • Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.

  • PHP 7.4 compatibility has been removed from the Commerce codebase.

  • Symfony dependencies have been upgraded to the new LTS version. Dependencies include:

    • friendsofphp/php-cs-fixer
    • symfony/console
    • symfony/event-dispatcher
    • symfony/finder
    • symfony/process
    • web-token/jwt-framework
  • jquery-migrate has been removed from the Commerce codebase. GitHub-21406

  • Upgraded jQuery/fileUpload library to v10.32.

  • Zend framework (ZF1) components that have reached end of life have been removed from the codebase. See Backward-incompatible changes highlights.

  • Laminas dependencies have been updated to support PHP 8.2.

  • The laminas/laminas-dependency-plugin Composer plugin has been removed. GitHub-36515

  • Replaced Zend_Filter with laminas/laminas-filter.

  • Upgraded web-token/jwt-framework to v3.0.5. (latest version)

  • Upgraded allure-framework/allure-phpunit to v2.x.

  • Upgraded the Chart-js library to v3.9.1

Performance and scalability enhancements

  • Improved performance for operations affecting many customer segments. Merchants can improve the performance of operations involving more than 100 customer segments by enabling a new configuration setting. The Real-time Check if Customer is Matched by Segment setting can be disabled as needed to reduce processing time by reducing validation of each customer segment against customers. See Customer segments validation.

  • New system configuration setting for limiting number of products displayed in product grid. Merchants can use the new Limit Number of Products in Grid configuration setting to improve product grid performance. This limit is configured to 20000 by default and affects only product collections that are used by UI components. Limiting the number of products displayed can boost performance of operations for grids populated with more than 200,000 products. See Limit number of products in grid

  • Improved import performance (up to 100,000 records per minute). Merchants can use the new POST /rest/<store_view_code>/V1/import/csv REST API endpoint to import data into Adobe Commerce. This endpoint provides the same capabilities as the Admin import feature and supports using a CSV file to create, update, and remove products, product pricing, and customer entities. See Import data.

  • Improved high-throughput order processing performance through load balancing. Adobe Commerce 2.4.6 on cloud infrastructure customers who have a high volume of simultaneous orders (1000 orders per minute) can now improve order processing performance by balancing the load on their database across different nodes. Merchants can re-balance this load by enabling secondary connections for the MySQL database and Redis instances. See High-throughput order processing

Adobe Commerce Extension metapackage

This release introduces the Adobe Commerce Extension metapackage v1.1.0, which automatically bundles select Adobe Commerce extensions with this core release. The versions of these extensions that are included in this metapackage are installed when composer update is run, simplifying the process of upgrading these extensions when upgrading to the latest core release. These extensions will still maintain independent release schedules.

The Adobe Commerce Extension metapackage for Adobe Commerce 2.4.6 includes these two extensions:

Future versions of this extension metapackage will contain additional extensions.

Adobe I/O Events for Adobe Commerce

Adobe I/O Events for Adobe Commerce captures Commerce events and transfers data from Adobe Commerce to other Adobe systems. Developers can build cloud-native apps in Adobe Developer App Builder that subscribe to Commerce events such as inventory updates, order status changes, and price updates. Developers can use this capability to exchange data for the orchestration of the entire buyer journey across their mission-critical systems.

Accessibility updates

The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:

  • The visual text label for the Sign in button now matches its accessible name. (Best practice recommends that a UI element’s accessible name starts with the visible label text.)
  • Descriptive accessible names have been added to buttons throughout the storefront.
  • Verbal descriptive labels have been added to the Has Video checkboxes in search filters.
  • Keyboard-only users can now access all page functionality on the storefront. Previously, shoppers could not access sub-navigation links using only keystrokes.

Adobe Commerce integration with Adobe IMS

The following Adobe IMS modules have been decoupled from the Adobe Commerce 2.4.6 core code and are now packaged as a separate metapackage:

  • adobe-ims
  • adobe-ims-api
  • admin-adobe-ims

The new adobe-ims-metapackage v2.2.0 is bundled with Adobe Commerce 2.4.6. No functionality has changed in this release.

B2B

The Purchase Orders for Companies feature is now fully exposed by the GraphQL API. This release introduces two GraphQL schemas:

  • Purchase Order GraphQL schema covers B2B company user Purchase Order Management functionality such as creating, editing, and deleting purchase orders. See Purchase orders (B2B).
  • Purchase Order Rule GraphQL schema provides the ability to create, edit, and delete approval rules as well as to manually validate purchase orders. See Purchase order approval rules (B2B).

This release includes multiple bug fixes. See B2B Release Notes.

Braintree

  • The Pay Later button and banners (messages) for Italy and Spain have been enabled for Braintree.
  • PayLater messaging with PayPal Vault has been enabled.
  • Added Fraud Protection and ACH web hooks. The Fraud Protection web hook is triggered when a risk decision has been made in Braintree. The ACH web hook is triggered when the status of an ACH payment is updated to settled or settlement decline.
  • Added LPM (Local Payment Methods) web hook.

GraphQL

GraphQL performance enhancements include:

Improved response time when querying categories with category permissions enabled. Response times have improved when querying products in categories for which category permissions are enabled and that contain many customer groups or shared catalogs. Code changes that support this performance improvement include:

  • GraphQL resolver operation has been optimized.
  • The data provider no longer re-sets runtime-cached data for every new product being processed, which has improved performance.
  • Product permission processing has been optimized in the GraphQL resolver. Product permissions are now applied to product collections instead now on a per-product basis.
  • Optimized permissions read in shared catalogs in the addProductsToCart mutation.
  • Product permissions have been optimized with product inline fragments.

Optimized performance of category tree rendering. The categoryList query has been optimized to support customers with a large number of categories. Merchants using this query to search more than 1500 categories with up to five levels of nested subcategories will notice a performance improvement. The loading of category children by refactoring code has been improved by removing unnecessary method calls, improving caching of the category tree, and loading category data recursively. Code changes that support this performance improvement include:

  • Custom attributes metadata fetching for category models has been improved.
  • Category ID fetching has been improved, and getChildren calls have been reduced.
  • Category children loading has been improved.

Reduced bulk cart operations query response times. The add product mutations have been optimized to improve query performance when adding up to 500 simple and configurable products. Bundle products are not affected. The optimized mutations include addProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addSimpleProductsToCart, addVirtualProductsToCart,addWishlistItemsToCart, and updateCartItems.

customer query now supports order sorting. The orders output object of the customer query now contains a sort field. You can now sort orders by order number or creation date and in ascending or descending order.

New mutations:

deleteCustomer

Page Builder

Page Builder v.1.7.3 is compatible with Adobe Commerce 2.4.6.

PWA Studio

PWA Studio v.13.0.x is compatible with Adobe Commerce 2.4.6. It includes multiple enhancements to improve accessibility. For information about bug fixes, see PWA Studio releases. See Version compatibility for a list of PWA Studio versions and their compatible Adobe Commerce core versions.

Known issue

Issue: New Relic is not currently compatible with PHP 8.2. Deployments running New Relic can run Adobe Commerce 2.4.6 on PHP 8.1 but not PHP 8.2. Workaround: Run Adobe Commerce 2.4.6 on PHP 8.1 until a new version of New Relic is released that supports PHP 8.2. This release is expected Summer 2023.

Fixed issues

We have fixed hundreds of issues in the Adobe Commerce 2.4.6 core code. A subset of the fixed issues included in Adobe Commerce 2.4.6 is described below.

Installation, upgrade, deployment

  • Static content deployment no longer times out or fails during standard or compact deployments with multiple locales and websites.
  • Compact strategy no longer causes an invalid reference to an external domain when running static content deployment (bin/magento set:static-content:deploy -f --strategy compact).
  • Executing bin/magento setup:di:compile -vvv (or with the -v or -vv options) now returns an informative message on failure. GitHub-35391
  • Adobe Commerce no longer throws the following exception when you run the bin/magento setup:upgrade command in a deployment already running the data migration tool: PHP Fatal error: Declaration of Migration\Logger\Logger::addRecord(int $level, string $message, array $context = []): bool must be compatible with Monolog\Logger::addRecord(int $level, string $message, array $context = [], ?Monolog\DateTimeImmutable $datetime = null): bool in /var/www/html/vendor/magento/data-migration-tool/src/Migration/Logger/Logger.php on line 34. GitHub-35604
  • The bin/magento setup:db:status command no longer fails in environments running MySQL 8.0.29. Previously, command output stated erroneously that the declarative schema was outdated. GitHub-35671
  • The composer install command no longer overwrites .gitignore files. GitHub-32888
  • Running bin/magento sampledata:remove to remove sample data after upgrade on Alpine Linux no longer fails with this error: Undefined constant "MagentoHackathon\Composer\Magento\Deploystrategy\GLOB_BRACE. GitHub-36062
  • bin/magento setup:upgrade now executes successfully after first executing composer install --no-dev. GitHub-36351
  • Exceptions and exception stack trace entries are now included in var/log/exception.log. GitHub-36054
  • Adobe Commerce now throws a parameter validation error when you use the command line to set a Redis connection without a password.

Accessibility

  • The Proceed to Checkout, Review Order, and Place Order buttons in the checkout workflow now work as expected with keyboard input.
  • Visual indication of focus on buttons when using TAB or SHIFT + TAB to navigate through page controls now works as expected.

Screen readers

  • The screen reader for the order history page now reads the correct image description.

Screen readers now announce:

  • Total item count found in search results as expected
  • Logged-in user’s name when a user successfully signs in using keyboard controls
  • Product search result page header now reads the correct value for the <title> element
  • Whether input fields are required
  • Correct current state of accordion elements (collapsed and expanded)
  • When page content has been refreshed after the user has clicked the Create an account button

Bundle products

  • Updating bundle product via API for a specific store view now does not override other store views data for the same bundle product. Previously, bundle product option titles were overridden with the first option title for other store views.
  • Bundled products can now be filtered successfully from Admin Catalog > Products when using a Dutch locale. Previously, Adobe Commerce displayed this error when you tried to filter on Type: Bundle Product: Something went wrong with processing the default view and we have restored the filter to its original state. GitHub-35704
  • The products grid no longer throws an exception when bundle products have a special price that exceeds 1000. Previously, when you either searched for the product by SKU or navigated to Catalog > Products, Adobe Commerce threw this error: Non Numeric value encountered. GitHub-36284)
  • Columns in credit memo and invoice PDFs for orders that contain a mix of bundle and simple products are now rendered correctly. Previously, columns were distorted or misaligned.
  • In GraphQL queries that contain a BundleProduct fragment, the items.options.product object contains data as expected. Previously, the object could be null in some circumstances.
  • Decimal quantities for bundle options are now rendered correctly when Quantity uses decimals is enabled. Previously, only the integer part of the quantity was rendered, not the fractional component. For example, a quantity of 1.5 was rendered as 1.0. GitHub-35964
  • GraphQL product queries now return only bundle product options within the scope of the store being queried.
  • Products that are not assigned to categories but that are product options for bundle or grouped products are now returned in responses when the Allow Category Browsing configuration setting is enabled for the customer sending the query.