PaaS only

Magento Open Source 2.4.5 release notes

Last update: May 5, 2025

CREATED FOR:

  • Experienced
  • Admin
  • Developer

Magento Open Source introduces improvements to platform quality, payment methods, GraphQL caching performance, and accessibility. It includes updates to integrated Google modules.

This release includes over 290 quality fixes and enhancements.

NOTE
Adobe Commerce releases can contain backward-incompatible changes (BICs). To review backward-incompatible changes, see BIC reference. Major backward-incompatible issues are described in BIC highlights. Not all releases introduce major BICs.

Other release information

Although code for these features is bundled with quarterly releases of the Magento Open Source core code, several of these projects are also released independently. Bug fixes for these projects are documented in the separate, project-specific release information that is available in the documentation for each project.

Magento Open Source 2.4.5 highlights

Look for the following highlights in this release.

Security enhancements

This release includes 20 security fix and platform security improvements. This security fix has been backported to Magento Open Source 2.4.4-p1 and Magento Open Source 2.3.7-p4.

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts:

See Adobe Security Bulletin for the latest discussion of these fixed issues.

Additional security enhancements

Security improvements for this release improve compliance with the latest security best practices, including:

  • reCAPTCHA support has been added to the Wish List Sharing, Create New Customer Account, and Gift Card forms.

  • ACL resources have been added to Inventory.

  • Inventory template security has been enhanced.

  • The MaliciousCode filter has been upgraded to use the HtmlPurifier library.

Platform enhancements

Magento Open Source 2.4.5 now supports

  • Composer 2.2

  • TinyMCE (5.10.2). Earlier versions of TinyMCE (v5.9.2 or earlier) allowed arbitrary JavaScript execution when a specially crafted URL or an image with a specially crafted URL was updated.

  • jQueryUI (1.13.1)

  • PHPStan (^1.5.7 with constraint) GitHub-35315

The DHL Integration schema has been updated from v6.0 to v6.2. This upgrade will not result in a change in product behavior.

Outdated JavaScript libraries have been updated to their latest versions, and outdated dependencies have been removed. These changes are backward compatible.

Composer dependency updates

The following Composer dependencies have been updated to the latest versions with constraint:

  • colinmollenhour/credis (1.13.0)
  • guzzlehttp/guzzle (^7.4.2)
  • laminas/laminas-captcha (updated with a constraint ^2.12)
  • laminas/laminas-db (^2.15.0)
  • laminas/laminas-di (^3.7.0)
  • laminas/laminas-escaper (~2.10.0)
  • laminas/laminas-eventmanager (^3.5.0)
  • laminas/laminas-feed (^2.17.0)
  • laminas/laminas-mail (^2.16.0)
  • laminas/laminas-mvc (^3.3.3)
  • laminas/laminas-server (^2.11.1)
  • laminas/laminas-servicemanager (^3.11.0)
  • laminas/laminas-validator (^2.17.0)
  • league/fly (2.4.3)
  • monolog/monolog (^2.5)
  • phpmd/phpmd (^2.12.0)
  • phpstan/phpstan (^1.5.7)
  • phpunit/phpunit (~9.5.20)
  • php-cs-fixer (^3.4.0)
  • webonyx/graphql-php (14.11.6)

The laminas/laminas-session, laminas/laminas-text, and laminas/laminas-view dependencies have been removed.

Other upgrades and replacements

  • The DHL Integration schema has been updated from v6.0 to v6.2.

  • The default Gateway URL for USPS shipping has been updated to use https instead of http.

  • The Froogaloop library has been replaced with the Vimeo Player.js library (2.16.4).

  • The grunt-eslint (NPM) library has been upgraded to the latest version.

  • The jQuery Storage libraries have been replaced with julien-maurel/js-storage.

  • The php-cs-fixer and phpcs static code analysis tools are now compatible with PHP 8.x.

  • glob.js dependency (upgraded with constraint to ~7.2.0)

  • serve-static.js dependency (upgraded with constraint ~1.14.2)

  • underscore.js dependency (NPM) (1.14.2)

  • moment-timezone-with-data.js (0.5.34)

  • The library jquery/jquery-cookie has been replaced with js-cookie/js-cookie.

  • The jarallax.js and jaralax-video.js libraries have been updated to use the latest version of the Vimeo REST API.

Accessibility updates

The focus of this release has been on creating a storefront experience on Venia (PWA) that is more perceivable, operable, understandable, and robust. These enhancements include:

  • Search results summary information is now announced to screen reader users
  • Screen readers are now informed when a new page view loads
  • Contrast and keyboard accessibility have been improved

Google Analytics

Google has updated the tracking and integration mechanisms of AdWords and Analytics in web applications through integration with GTag. This integration of Google functionality into website pages extends opportunities to track and manage content through Google Services. Adobe Commerce has a set of built-in modules including Google AdWords, Analytics, Optimizer, and TagManager that leverage the former API for integration with Google services. In this release, we have re-implemented this integration using the GTag approach.​ See Migrate from analytics.js to gtag.js (Universal Analytics).

GraphQL

GraphQL performance enhancements include:

  • Developers and administrators experience faster rebuilding of the unified storefront GraphQL schema on deployment or when changing attributes in production. Shoppers also experience significantly faster page load speeds when the GraphQL schema must be rebuilt for any reason.

  • Added capability to consume the expiration date/time of the authorization token through the use of JSON Web Tokens (JWT) in the GraphQL API.

  • The bin/magento config:set graphql/session/disable 1 command allows merchants to completely disable the creation of session cookies for all GraphQL operations. By default, the application Open Source creates these cookies and relies on them for authorization, which affects performance. Going forward, we recommend using tokens as the only form of authorization for GraphQL requests. We do not recommend using session cookies alone or in conjunction with authorization tokens. See GraphQL Authorization.

  • Session cookies are now launched in GraphQL operations using class proxies only when needed.

  • Session usage has been removed from http header processors in GraphQL such as store, customer, or currency.

See the GraphQL Developer Guide for details on these enhancements.

Inventory

Inventory template security has been enhanced.

Page Builder

Page Builder v.1.7.2 is compatible with Magento Open Source 2.4.5.

Page Builder column layout includes these enhancements:

  • Columns are now exposed, permitting users to control column settings on the storefront.

  • Column resizing now supports wrapping triggered by user actions.

Payments

Apple Pay is now available to all merchants running deployments with Payment Services enabled. This payment method does not require shoppers to enter their credit or debit card details. Apple Pay is available on the product details page, mini cart, shopping cart, and checkout workflow. Merchants can toggle on this feature.

PayPal

  • Merchants in Spain and Italy can now offer PayPal Pay Later to shoppers.

  • Previews of the PayPal, Credit and Pay Later buttons are now available in the Admin for the checkout, minicart, cart, and product pages. Previews reveal how these buttons will look when they are enabled and rendered on the storefront.

Braintree

  • Braintree has discontinued the KOUNT fraud protection integration. It has been removed from the Magento Open Source codebase.

  • The Always request 3DS option has been added to the Admin.

PWA Studio

PWA Studio v.12.5.x is compatible with Magento Open Source 2.4.5.

New features for this release include:

  • Shopper behavior data is collected on PWA Studio storefront for web analytics services. Merchants can now subscribe and extend these events as needed.

  • Merchants can now select a service to deploy from the Admin (Google Tag Manager).

For information about enhancements and bug fixes, see PWA Studio releases. See Version compatibility for a list of PWA Studio versions and their compatible Magento Open Source core versions.

Fixed issues

We have fixed hundreds of issues in the Magento Open Source 2.4.5 core code.

Installation, upgrade, deployment

  • You can now rename a data patch and add the old class name as an alias in the patch_list database table. Magento Open Source now checks whether data patch aliases already existed in the database before applying the patch. Previously, the applicationOpen Source threw an error under these conditions.
  • Magento Open Source no longer throws an exception when you try to change the Admin URL to a custom URL from the Admin. Previously, after changing the Admin URL, you could not log in. GitHub-35416
  • Merchants can now successfully upgrade from an Magento Open Source 2.4.2 deployment with Klarna to Magento Open Source 2.4.3. GitHub-33760
  • The path to Magento Open Source Analytics is no longer hardcoded. Previously, this hardcoded path resulted in conflicts when multiple Magento Open Source instances were installed on one server. GitHub-29373

Accessibility

  • The Shopping bag button now provides a programmatic or textual indication of its state. Screen reader users are informed that clicking this button will expand other content, or that the associated content is expanded or collapsed. Previously, this button did not provide a programmatic or textual indication of its state.
  • Payment Information credit card option text elements or images of text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, they did not meet the expected contrast ratio.
  • Address book > Communication > Account information custom focus indicators now provide a contrast ratio of at least 3:1 against the background color.
  • Filter and Sort button text now meet the WCAG 2.0 required minimum color contrast ratio of 4.5:1 for standard text of 18pt (24px) or 14pt (19px) if bolded. Previously, navigation buttons for carousels did not meet these minimum contrast requirements.
  • Screen readers announce the word “Venia” only once when navigating to Venia headers and footers. Previously, the same word was announced twice consecutively.
  • Buttons that trigger dropdowns now provide information to screen readers that indicate their expanded or collapsed state and accessible names.
  • Screen reader users are informed when a new page view is rendered. Previously, when a page title changed, the title change was not announced.

Adobe Stock

  • Users can now successfully sign out of Adobe Stock.

Bundle products

  • You can now use the PUT /V1/products endpoint to update product price attributes for a specific website. Previously, if some product attributes were overridden for a specific store view, you could not update a price attribute for that product in that same store view.
  • Magento Open Source now correctly calculates the cart total for a bundle product when the Product Subselect rule is applied.

Cache

  • Full page cache is no longer shown as disabled in the Admin when the Magento Open Source cache is flushed and use_stale_cache is enabled.
  • New Relic deployment markers now work as expected when cache is flushed. GitHub-32649

Cart and checkout

  • The address search pop-up on the billing step of the checkout workflow no longer causes DOM errors.
  • The addProductsToCart mutation now works correctly with multiple products. Previously, this query returned the first product with an accurate subtotal, but returned a subtotal of 0 for other products.
  • Permission exceptions are now handled for restricted products that are added by SKU. Shoppers are now given an appropriate message on the storefront, and the quantity field in the error table is disabled. Previously, the applicationOpen Source threw an exception like this: There has been an error processing your request.
  • The SQL query that updates affected quotes after disabling a cart price rule has been optimized to avoid locking the entire quote table.
  • Shoppers with global account sharing are no longer required to log in again to a secondary website in a multi-site deployment when guest checkout is disabled. Customer data is now loaded when the shopper navigates to the subdomain. The shopper is no longer asked to log in again, and the previous cart contents are displayed.
  • Address dropdown values in the checkout workflow no longer change for the remaining items in a quote when a single quantity address item is removed in a multi-address checkout. Previously, when a product was removed from a quote during multi-address checkout, the address dropdown value changed to default for all products.
  • The cart query no longer return null responses when a product is out of stock. A new errors element containing the error message was introduced to the response. Previously, when you ran a query with an out-of-stock product, the application Open Source displayed a null value under the items section in the response. See cart query.
  • Shipping methods are now available as expected when a guest shopper creates an account after adding a product to their cart before proceeding to checkout. Previously, when a guest added a product the cart before creating an account, no shipping methods were available during checkout. After adding other products to the cart, shipping methods became available.
  • Shoppers can now add products to their carts when no options in the Allow Countries field have been selected.
  • Cart contents and login status are now reloaded as expected after a session times out when Enable Persistence is set to Yes. GitHub-35182
  • Mini cart subtotals are now updated correctly when a shopper navigates from the shipping page to the cart page in the checkout workflow for an order with multiple shipping addresses. Previously, the subtotal was doubled.
  • The mini cart now displays previously added products after a session timeout when Enable Persistence is enabled . GitHub-35183
  • Merchants can now create a credit memo in which Refund Shipping (Incl. Tax) is set to -0.01 and can now set this amount to 0. Previously, the credit memo could not be created under these conditions.

Cart price rule

  • The Parent Only attribute scope is now used properly in the Cart Rule condition.

Catalog

  • Product URL keys now remain unchanged when updating product name via PUT /V1/products/ for a store view. Previously, a new URL key was generated based on the new product name and assigned to the product, which overrode the URL key in that store view.
  • Adding a product to a category from the Page Builder product widget set to carousel mode no longer triggers a page reload.
  • Products set to Not Visible Individually no longer appear in catalog Advanced Search results.
  • Dynamic bundle attributes are now updated correctly on the Mass Attribute Update page. Previously, the Dynamic SKU attribute remained set to Yes even though they were disabled on the Mass Update page.
  • Catalog rules are now correctly applied using incremental indexers rather than a full re-index.
  • You can now successfully switch between list and grid views of multi-page product lists. Previously, when you navigated to the last page of a multi-page product list view before switching to the grid view, the application Open Source displayed this error: Unfortunately there are no products in this category on our website currently.
  • Admin Action Log reports now display updated product IDs and updated status information as expected.
  • Triggers are now restored as expected to the catalogrule_product_price table after a full re-index. Previously, triggers were removed from the catalogrule_product_price table after a catalogrule_rule or catalogrule_product full re-index.
  • Category rules that are used to assign products to categories no longer randomly change.
  • Categories can no longer be updated globally by an administrator with scope-restricted access. Previously, when multiple websites used the same category but different products, and an administrator with permission restricted to one store changed products in the category, the product selection also changed for other stores.
  • The product details page now displays the correct price when a non-default currency for a specified locale is used. Previously, numbers were not localized as expected on the storefront.
  • The same error message is now displayed by the API and on the storefront when trying to retrieve the tier prices of a product with duplicate records. Previously, PUT /V1/products/tier-prices returned an incorrect error message.
  • Magento Open Source now provides validation error messages when you try to add a product URL key with a trailing hyphen. Informative tooltip text is also available.
  • The new ConfigurableWishlistItem.configured_variant field has replaced the ConfigurableWishlistItem.child_sku field. The latter field triggered an internal error when a customer wish list contained an un-configured configurable product.
  • URL rewrites are now generated only for the selected stores during the mass attribute update to change product visibility. Previously, the mass attribute update created a URL rewrite for the wrong store.
  • When the Synchronize widget products with backend storage setting is enabled, the application Open Source adds recently view product data into the catalog_product_frontend_action database table. It includes the customer or visitor ID when adding records. The recently_viewed_product section in the response is now empty if customer ID and visitor ID are null. As a result, when the customer/section/load Ajax request is sent, the application Open Source can correctly filter recently viewed products based on customer or visitor ID. Previously, the response included all the data available in the catalog_product_frontend_action database table because there was no check for an empty customer or visitor ID.
  • Administrators can now change configurable product options in a shopper’s cart from the Admin slide panel. Previously, the slide panel did not work correctly.
  • Page cache is now cleared as expected for the configurable product parent when changes to a child product are saved. Previously, because the cache was not cleared, changes were not selected on the storefront configuration product page. GitHub-34508
  • Product lists are now rendered correctly in the Admin. Previously, the product list did not render, and Magento Open Source displayed this error: Item (Magento\Catalog\Model\Product\Interceptor) with the same ID "<ID>" already exists. GitHub-33145
  • Product prices are now the same on the product detail page and in storefront search in multi-store deployments after Catalogue Price Scope changes from website to global. Previously, the Catalog Search Results page displayed the global price, and the product details page displayed the website price. GitHub-34074
  • Layered navigation now displays products with the highest prices as expected when Price Navigation Step Calculation is set to Manual.
  • You can now change the per-page product limit displayed within a category when Remember Category Pagination is enabled. Previously, the cookie form_key and UI form_key differed, and Magento Open Source displayed this error: Invalid Form Key. Please refresh the page.
  • The EAV indexer now processes product IDs as type int to prevent possible performance issues.
  • A new product cache is now successfully generated after you add a new image with a name that contains ‘.’ to a product, then save the product and clean the image cache. GitHub-32699

  • Magento Open Source now displays an error message as expected when you try to create an attribute from the product page without completing the Admin field. GitHub-33099

  • Product ratings are now correct on all catalog product lists when the home page contains multiple catalog lists. GitHub-33867

Configurable products

  • Magento Open Source now displays the correct product price for a configurable product with a selected option after changing its quantity on product details page. Previously, the price was reset to the initial value after the quantity changed.
  • The products query now retrieves prices for configurable products that accurately reflect the Display Out Of Stock configuration setting. Previously, the query did not return accurate prices.
  • Configurable options are now linked to configurable products that are created in the Admin using POST /V1/configurable-products/configurable1/child.
  • Multi-select attributes are now saved correctly during product edit. Previously, the applicationOpen Source saved the default option for non-selected attributes as well as selected attributes when saving a product.
  • Magento Open Source now displays configurable attributes as expected during the creation of global select attributes via a patch script. Previously, eligible global attributes were hidden.

  • The addConfigurableProductsToCart mutation can now be used to add configurable products with custom options. Previously, the applicationOpen Source threw this error: Magento 2.3.4 graphql Notice: Undefined index: option_value in /var/www/html/mg234/vendor/magento/module-configurable-product-graph-ql/Model/Resolver/ConfigurableCartItemOptions.php on line 62. GitHub-28860

  • You can now re-order configurable products with optional custom options. Previously, re-order attempts failed, and meant displayed this error: Some of the selected options are not currently available. GitHub-35409

  • The addConfigurableProductsToCart mutation now works as expected with multiple products. Previously, incorrect product information was returned, or an invalid error message was returned. GitHub-30948