PaaS only

Magento Open Source 2.4.2 release notes

Last update: November 25, 2024

CREATED FOR:

  • Experienced
  • Admin
  • Developer

Magento Open Source 2.4.2 introduces enhancements to performance and security plus significant platform improvements. Security enhancements include expansion of support for the SameSite attribute for all cookies. Elasticsearch 7.9.x and Redis 6.x are now supported.

This release includes over 280 new fixes to core code and 35 security enhancements. It includes the resolution of almost 290 GitHub issues by our community members. These community contributions range from minor clean-up of core code to significant enhancements in GraphQL.

All known issues identified in 2.4.1 have been fixed in this release.

NOTE
Adobe Commerce releases can contain backward-incompatible changes (BICs). To review backward-incompatible changes, see BIC reference. Major backward-incompatible issues are described in BIC highlights. Not all releases introduce major BICs.

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. Adobe Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Apply a patch to continue offering DHL as shipping carrier Knowledge Base article for information about downloading and installing the patch.

Security patch available

Merchants can now install time-sensitive security fixes without applying the hundreds of functional fixes and enhancements that a full quarterly release provides (for example, 2.4.1-p1). Patch 2.4.0.12 (Composer package 2.4.1-p1) is a security patch that provides fixes for vulnerabilities that have been identified in our previous quarterly release, 2.4.1. All hot fixes that were applied to the 2.4.1 release are included in this security patch. (A hot fix provides a fix to a released version that addresses a specific problem or bug.)

For general information about security patches, see Introducing the New Security Patch Release. For instructions on downloading and applying security patches (including patch 2.4.1-p1), see Quick start on-premises installation. Security patches include security bug fixes only, not the additional security enhancements that are included in the full patch.

Other release information

Although code for these features is bundled with quarterly releases , several of these projects (for example, Progressive Web Applications (PWA) Studio) are also released independently. Bug fixes for these projects are documented in the separate, project-specific release information that is available in the documentation for each project.

Highlights

Look for the following highlights in this release.

Substantial security enhancements

This release includes over 35 security fixes and platform security improvements. All security fixes have been backported to 2.4.1-p1 and 2.3.6-p1.

Over 35 security enhancements that help close remote code execution (RCE) and cross-site scripting (XSS) vulnerabilities

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts: IP allowlisting, two-factor authentication, use of a VPN, the use of a unique location rather than /admin, and good password hygiene. See Adobe Security Bulletin for a discussion of these fixed issues.

Additional security enhancements

Security improvements for this release include:

  • All core cookies now support the SameSite attribute.

  • The application now displays messages that identify potentially malicious content in product and category description fields when the user tries to save values in these fields.

  • File system operations across components have been standardized and hardened to prevent malicious uploads.

  • Core Content Security Policy (CSP) violations have been fixed.

NOTE
Starting with the 2.3.2 release, we will assign and publish indexed Common Vulnerabilities and Exposures (CVE) numbers with each security bug reported to us by external parties. This allows users to more easily identify unaddressed vulnerabilities in their deployment. You can learn more about CVE identifiers at CVE.

Infrastructure improvements

This release contains enhancements to core quality, which improve the quality of the Framework and these functional areas: Customer Account, Catalog, CMS, OMS, Import/Export, Promotions and Targeting, and Cart and Checkout.

Platform enhancements

  • Elasticsearch 7.9.x is now supported. Although we recommend running Elasticsearch 7.9.x, version 2.4.x remains compatible with Elasticsearch 7.4.x.

  • 2.4.2 has been tested with Varnish 6.4. Version 2.4.x remains compatible with Varnish 6.x.

  • Redis 6.x is now supported. Version 2.4.x remains compatible with Redis 5.x.

  • 2.4.2 is now compatible with Composer 2.x. We recommend that merchants migrate to Composer 2.x. Although you can install this release using Composer 1.x, Composer 1.x will soon reach end-of-life. For an overview of Composer 2.x features, see Composer 2.0 is now available!

The ability to configure an installation to use a split database has been deprecated in this release. Merchants who currently use split database should start planning to revert to or migrate to a single database or use an alternative approach. See the Deprecation of split database functionality in Magento Open Source DevBlog post for an overview of this issue. See Revert from a split database to a single database for migration instructions.

Performance enhancements

This release includes code enhancements that boost API performance and Admin response time for deployments with large catalogs. Multiple scalability enhancements enable 2.4.2 to natively support complex catalogs up to 20x larger than in previous releases.

Adobe Stock Integration

This release includes Adobe Stock Integration v2.1.1.

GraphQL

This release adds GraphQL coverage for the following features:

  • Added support for comparison lists. Shoppers can create and delete comparison lists, and add and remove items to the comparison lists. In addition, shoppers that create a compare list as a guest can log in as a customer and retain their comparison lists.

  • Added the generateCustomerTokenAsAdmin mutation and updated the Customer object to support remote purchasing assistance.

  • Added localization support across stores to support tasks such as changing languages, carts, and currencies.

  • Added support for unions in GraphQL. GitHub-29425

  • The GraphQL schema has been enhanced to optimize product data retrieval for configurable products with many variants.

  • Integer type object IDs have been deprecated in favor of uid attributes of type ID.

  • Added the staging attribute to the ProductInterface and CategoryInterface to determine if a product is staged and to view its associated campaign information.

See the GraphQL Developer Guide for details on these enhancements.

PWA Studio

This release of PWA Studio includes:

  • Internationalization and localization. Venia now provides support for multiple languages and currencies.

  • Improved extensibility framework to support code changes through extensions.

  • Initial components for My Account related features such as Wishlist, Saved Payments, Address Book, and Order History.

  • Various performance optimizations and bug fixes.

For information about enhancements and bug fixes, see PWA Studio releases. See compatibility for a list of PWA Studio versions and their compatible versions.

New Role Resources for Media Gallery. This release provides merchants the ability to limit administrator access to only the Media gallery and to control who can perform these actions:

  • Insert media assets into content

  • Upload assets

  • Edit assets details

  • Delete assets from the Media Gallery

  • Manage folder structure.

Web-optimized images in content. Merchants can now use web-optimized image rendition in content instead of high resolution images. The original image remains unmodified in the Media Gallery, and the image rendition is dynamically generated when the image is inserted in the content.

Functional Testing Framework (MFTF)

MFTF 3.2.1 is now available. This release introduces error tolerance in both tests and test suite generation. Additional enhancements and bug fixes are described in the Functional Testing Framework Changelog.

Vendor Developed Extensions

See the following articles for updates on features and changes for this release:

AWS S3 support enhancements

Amazon Simple Storage Service (AWS S3) support has been enhanced to include support for:

Fixed issues

We have fixed hundreds of issues in the 2.4.2 core code.

Installation, upgrade, deployment

  • Merchants can now successfully upgrade an Open Source deployment that runs MySQL 8.x to a Commerce deployment. Previously, the application threw an exception when AUTO_INCREMENT values reverted to initial values for all tables where row_id was added during upgrade.
  • The application now displays an error message that identifies the path that was used to create the patch if an error occurs when running bin/magento/setup:db:generate-patch. GitHub-27523
  • block_html, full_page, and layout caches are now disabled as expected after bin/magento/setup:upgrade execution. GitHub-28186
  • The minimum required PHP version in bootstrap.php has been updated. GitHub-30004
  • You can now execute bin/magento/setup:upgrade after installing sample data. Previously, when you tried to execute bin/magento/setup:upgrade, the application displayed this error: unable to apply data patch magento\catalogrulesampledata\setup\patch\data\installcatalogrulesampledata for module magento_catalogrulesampledata. The application also displayed this error in the system log: main.ERROR: Sample Data error: Unable to unserialize value. Error: Syntax error. GitHub-30685
  • You can now set a YouTube API key from the command line as expected. Previously, the applicationreturned this error when you tried to execute bin/magento config:sensitive:set catalog/product_video/youtube_api_key: There are no sensitive configurations to fill.
  • The application now honors the maxMessages values that are defined in queue_consumer.xml. Previously, the applicationused only the deployment configuration values. GitHub-29522
  • URL generation for a new store now works as expected when the store is created using bin/magento setup:config:import. Previously, URL rewrites were not generated in production environments. GitHub-30025
  • The application no longer throws an error when you try to change backend-frontname using the ssh container after installing Magento Open Source. GitHub-26762
  • The application no longer displays this question when you run bin/magento setup:install to connect to existing database: Overwrite the existing configuration for db-ssl-verify?[Y/n]. GitHub-29612

Adobe Stock Integration

  • Added support for reading exif_image.png or exif-image.jpeg metadata. GitHub-1449
  • The content displayed when you click the Default View bookmark for the Media Gallery is no longer filtered. Previously, the default view contained a filter that was applied from url-filter applier. GitHub-1813, GitHub-1789, GitHub-1780
  • Logic has been removed from the WYSIWYG OnInsert controller (Magento\Cms\Controller\Adminhtml\Wysiwyg\Images\OnInsert::execute()) and added to the Model\Wysiwyg\Images\PrepareImage::execute() model. GitHub-1504
  • Area emulation has been removed from the media-content:sync command (\Magento\MediaContentSynchronization\Console\Command\Synchronize::execute). GitHub-1784

Analytics

  • Advanced Reporting now works as expected for multiple environments in the same domain. Previously, CSV files that were generated by Advanced Reporting failed because double quotes were escaped with backslashes rather than with another double quote as required by CSV standard RFC4180.
  • The analytics_collect_data job now runs successfully when using either the default or non-default port to connect to MySQL in env.php. Previously, analytics_collect_data threw an error when you used the non-default port.
  • CSV files that are generated by analytics_collect_data are now properly escaped. Previously, these files were not generated with the correct escaping, which prevented the generation of Inventory reports.