ÃÛ¶¹ÊÓƵ

ÃÛ¶¹ÊÓƵ Commerce 2.4.2 release notes

ÃÛ¶¹ÊÓƵ Commerce 2.4.2 introduces enhancements to performance and security plus significant platform improvements. Security enhancements include expansion of support for the SameSite attribute for all cookies. B2B improvements focus on support for online payments for purchase orders. Elasticsearch 7.9.x and Redis 6.x are now supported.

This release includes over 280 new fixes to core code and 35 security enhancements. It includes the resolution of almost 290 GitHub issues by our community members. These community contributions range from minor clean-up of core code to significant enhancements in GraphQL.

All known issues identified in 2.4.1 have been fixed in this release.

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. ÃÛ¶¹ÊÓƵ Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Knowledge Base article for information about downloading and installing the patch.

Security patch available

Merchants can now install time-sensitive security fixes without applying the hundreds of functional fixes and enhancements that a full quarterly release provides (for example, 2.4.1-p1). Patch 2.4.0.12 (Composer package 2.4.1-p1) is a security patch that provides fixes for vulnerabilities that have been identified in our previous quarterly release, 2.4.1. All hot fixes that were applied to the 2.4.1 release are included in this security patch. (A hot fix provides a fix to a released version that addresses a specific problem or bug.)

For general information about security patches, see . For instructions on downloading and applying security patches (including patch 2.4.1-p1), see Quick start on-premises installation. Security patches include security bug fixes only, not the additional security enhancements that are included in the full patch.

Other release information

Although code for these features is bundled with quarterly releases , several of these projects (for example, B2B, Page Builder, and Progressive Web Applications (PWA) Studio) are also released independently. Bug fixes for these projects are documented in the separate, project-specific release information that is available in the documentation for each project.

Highlights

Look for the following highlights in this release.

Substantial security enhancements

This release includes over 35 security fixes and platform security improvements. All security fixes have been backported to 2.4.1-p1 and 2.3.6-p1.

Over 35 security enhancements that help close remote code execution (RCE) and cross-site scripting (XSS) vulnerabilities

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts: IP allowlisting, , use of a VPN, the use of a unique location rather than /admin, and good password hygiene. See for a discussion of these fixed issues.

Additional security enhancements

Security improvements for this release include:

Infrastructure improvements

This release contains enhancements to core quality, which improve the quality of the Framework and these functional areas: Customer Account, Catalog, CMS, OMS, Import/Export, Promotions and Targeting, Cart and Checkout, B2B, and Staging and Preview.

Platform enhancements

The ability to configure an installation to use a split database has been deprecated in this release. Merchants who currently use split database should start planning to revert to or migrate to a single database or use an alternative approach. See the DevBlog post for an overview of this issue. See Revert from a split database to a single database for migration instructions.

Performance enhancements

This release includes code enhancements that boost API performance and Admin response time for deployments with large catalogs. Multiple scalability enhancements enable 2.4.2 to natively support complex catalogs up to 20x larger than in previous releases.

GraphQL

This release adds GraphQL coverage for the following features:

See the for details on these enhancements.

B2B

2.4.2 introduces B2B v1.3.1. This release includes support for online payments for purchase orders as well as multiple bug fixes.

Purchase orders can now be completed using online payment methods. B2B buyers are prompted to select their preferred payment method for each purchase order during the initial checkout. After the purchase order has been approved, buyers are prompted to enter payment details to convert the purchase order to a final order.

To support a complete workflow for accepting online payments, this feature also:

This release also includes multiple bug fixes. See B2B Release Notes.

PWA Studio

This release of PWA Studio includes:

For information about enhancements and bug fixes, see . See for a list of PWA Studio versions and their compatible versions.

Page Builder

This release includes enhancements to Page Builder content migration and Page Builder CSS customization:

Interactive In-Product Guidance

Interactive In-Product Guidance provides merchants with usage tips and information from within the Admin on new feature announcements, walk-through guides, on-boarding information, and tool tips. Administrators must opt-in from the Admin to receive in-product guidance if this feature is not enabled. See Usage Data Collection and Admin Usage.

ÃÛ¶¹ÊÓƵ Stock Integration

This release includes ÃÛ¶¹ÊÓƵ Stock Integration v2.1.1.

Media Gallery

New Role Resources for Media Gallery. This release provides merchants the ability to limit administrator access to only the Media gallery and to control who can perform these actions:

Web-optimized images in content. Merchants can now use web-optimized image rendition in content instead of high resolution images. The original image remains unmodified in the Media Gallery, and the image rendition is dynamically generated when the image is inserted in the content.

AWS S3 support enhancements

Amazon Simple Storage Service (AWS S3) support has been enhanced to include support for:

Support for AWS S3 has been added to all modules including B2B, PageBuilder, and ÃÛ¶¹ÊÓƵ Stock Integration.

Functional Testing Framework (MFTF)

MFTF 3.2.1 is now available. This release introduces error tolerance in both tests and test suite generation. Additional enhancements and bug fixes are described in the .

Order Management System (OMS)

The MCOM Connector is fully compatible with 2.4.2. Bug fixes and enhancements to the connector are described in . This release includes improvements to the OMS command-line interface, which now provides verbose information that partners and support teams can use to troubleshoot retry, queue_prune, order_sync, message process, and catalog export processes.

Vendor Developed Extensions

See the following articles for updates on features and changes for this release:

Fixed issues

We have fixed hundreds of issues in the 2.4.2 core code.

Installation, upgrade, deployment

AdminGWS

ÃÛ¶¹ÊÓƵ Stock Integration

Analytics

Braintree

Bundle products

Cart and checkout

Cart price rule

Catalog

Catalog Rule

Cleanup

Typo and grammar cleanup

Code cleanup

Configurable products

cron

Custom customer attributes

Customer

dotdigital

Downloadable

Dynamic block (formerly banner)

EAV

Email

Frameworks

General fixes

Gift cards

Google Tag Manager

GraphQL

Grouped products

Images

Import/export

Index

Infrastructure

Klarna

Logging

Media Gallery

MFTF

New tests

New action groups

Newsletter

Payment methods

PayPal

Performance

Persistent

Pricing

Reports

Return Merchandise Authorizations (RMA)

Reviews

Rewards

Sales

Sales Rule

Search search-heading

Shipping

Sitemap

Staging

Store

Target rules

Tax

Test

Theme

Translation and locales

UI

Vault

Vertex

Web API framework

Wishlist

Known issues

Issue: The [magento_root]/index.php file has been removed, and The application now runs from /pub by default for Apache configurations. Stores that are served from subfolders will not work as expected and may display 404 errors. Workaround: Use symlinks to emulate the installation into subfolders. The following example uses two stores (https://shop01.com/shop/ and https://shop02.com/shop/) to illustrate how to use a symlink to emulate an installation in subfolders.

   <?php
   require realpath(__DIR__) . '/../../../app/bootstrap.php';

   switch ($_SERVER['HTTP_HOST']) {
       case 'shop01.com':
       case 'www.shop01.com':
           $params = $_SERVER;
           $params[\Magento\Store\Model\StoreManager::PARAM_RUN_CODE] = 'shop01';
           $params[\Magento\Store\Model\StoreManager::PARAM_RUN_TYPE] = 'website';
           $bootstrap = \Magento\Framework\App\Bootstrap::create(BP, $params);
           $app = $bootstrap->createApplication(\Magento\Framework\App\Http::class);
           $bootstrap->run($app);
           break;

       default:
           $bootstrap = \Magento\Framework\App\Bootstrap::create(BP, $_SERVER);
           /** @var \Magento\Framework\App\Http $app */
           $app = $bootstrap->createApplication(\Magento\Framework\App\Http::class);
           $bootstrap->run($app);
       break;
   }

   <VirtualHost *:80>
       DocumentRoot "magento_root/pub/shop1"
       ServerName shop01.com
   </VirtualHost>

Issue: Merchants must activate the Fastly Force TLS functionality from the Admin to enable the global HTTP to HTTPS redirect for all store pages. See the Knowledge Base article.

Issue: You cannot use the addConfigurableProductToCart GraphQL mutation to add a configurable product to a cart in a non-default store view in a multi-store deployment that runs Inventory. (Luma storefronts are not affected.) the application displays this error: Could not add item to cart. Please check required options and try again. Workaround: Use the addProductsToCart mutation instead.

Issue: The application does not submit payment information as expected when a shopper first enters a correct code into the CAPTCHA field on the Payment page but displays this error: There has been an error processing your request. This occurs only when the shopper tries to place the order either without entering the CAPTCHA code or by entering it incorrectly. Workaround: Refresh the page.

Issue: The application creates an order in Braintree as expected when a shopper clicks Pay with Venmo, but does not create the order in the Admin. Workaround: None. See the Knowledge Base article.

B2B known issues

Issue: B2B buyers can use online payment methods to bypass the usual purchase order flow. This scenario can occur if the buyer can reduce their entire checkout total to a 0 — for example, by a promo code or gift card — and subsequently remove the code or gift card. Even under those conditions, the application still places the order for the correct amount based on the prices of the items in their assigned catalog. Workaround: Disable gift cards and coupon codes when online payment methods are enabled for purchase order approval.

Issue: Buyers are redirected to the shopping cart when trying to place an order from a purchase order using PayPal Express Checkout when In-Context Mode is disabled.

Issue: The application sometimes displays a 404 error when a buyer creates a purchase order and then navigates to the checkout page. This error occurs when a buyer has previously created a different purchase order with an online payment method before navigating to the checkout page without completing the previous purchase. The buyer can still place the purchase order. Workaround: None.

Issue: Discounts for a specific payment method persist during checkout for a purchase order even when the buyer changes their payment method during final checkout. As a result, customers may receive a discount that they are not entitled to. This occurs because a cart rule for the original payment method is still applied despite the change in payment method. Workaround: None. See the Knowledge Base article.

Issue: The deleteRequisitionListOutput query returns details about the deleted requisition list instead of the remaining requisition lists.

Community contributions

We are grateful to the wider Magento Open Source community and would like to acknowledge their contributions to this release.

The Community Engineering team maintains a list of top contributing individuals and partners by month, quarter, and year. From that Contributors page, you can follow links to their merged PRs on GitHub.

Partner contributions

The following table highlights contributions made by Partners. This table lists the Partner who contributed the pull request, the external pull request, and the GitHub issue number associated with it (if available).

Partner

Pull Requests

Related GitHub Issues

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

, , , , , , , , , , , ,

, , , , , , , , , , , , , ,

, , , , , , , ,

, , , , ,

, , , , ,

, , , , , ,

, ,

,

, ,

, , ,

,

,

, ,

, ,

,

,

, ,

,

, ,

,

,

,

Individual contributor contributions

The following table identifies contributions from our community members. This table lists the external pull requests, the GitHub issue number associated with it (if available), and the community member who contributed the pull request.

System requirements

Our technology stack is built on PHP and MySQL. For more information, see System Requirements.

Installation and upgrade instructions

You can install ÃÛ¶¹ÊÓƵ Commerce 2.4.2 using Composer.

Migration tool kits

The Data Migration Tool helps transfer existing Magento 1.x store data to Magento 2.x. This command-line interface includes verification, progress tracking, logging, and testing functions. For installation instructions, see Install the Data Migration Tool. Consider exploring or contributing to the .

The helps transfer existing Magento 1.x store extensions and customizations to Magento 2.x. The command-line interface includes scripts for converting Magento 1.x modules and layouts.