Disallow Expanding Fields Outside of Index in Search Route The /store/search route now only allows retrieving fields that are defined on the index being searched. It no longer allows fetching data outside the index by hydrating through query.graph. This is for better search performance and ensures you clearly define what can be retrieved on your indexed data model. Bugs fix: Disallow expanding bey…
Highlights Search Module The Search Module allows you to manage and search through indexes defined in your Medusa application. You can search products or any data model defined just by defining an index for it. The Search Module supports providers that integrate a search engine to perform the search operations. Out of the box, Medusa provides a PostgreSQL Search Module Provider and Medusa Search f…
Highlights Field Filter Always Strips Disallowed Fields Previously, the allowed query config on a route and http.restrictedFields config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix. Bug Fixes framework: Always strip fields that a field filter do…
Highlights This release brings security improvements to the Store API, specifically related to what relations and fields can be retrieved through the routes. We recommend all Medusa stores update to this version. Below you'll find the details of the change and an upgrade guide to apply it to older versions of Medusa, if you are unable to upgrade to the latest. We usually don't offer patches to old…
Highlights Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.20.0 Payment providers are now validated against the cart's region Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actual…
Highlights Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.19.0 Update Vite and React Router to v7 🚧 Breaking change This release updates the Medusa Admin dashboard to use Vite v7.3.6 and React Router v7.18.2. This is a breaking change and requires you to make the following changes: Update your vite direct dependency to v7.3.6 Update your react-…
Highlights before / after on widgets injection zones 🚧 Breaking change Since the components in a LayoutComposer controlled page are now arranged through the Editor view (including widgets), the .after | .before widget injection zones don't have an effect on where the Widget is placed within its injection zone - you should configure this, just like with any other layout component, through the Edito…
Highlights This release comes with new features, bug fixes, and dependency updates for better security. Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.18.0 Balanced Query Load Strategy by Default 🚧 Breaking change The default database load strategy has changed from SELECT_IN to BALANCED, matching MikroORM v7's intended default. MikroORM picks b…
Highlights Regression with workers in Redis Event Bus This release fixes a critical bug introduced in 2.17.0. What Not await bullWorker_.run() in event-bus-redis onApplicationStart Why bullWorker_.run() is designed to return only when the worker is closed (taskforcesh/bullmq#2128). This bug had flown under the radar until we started awaiting all modules onApplicationStart here. The effect is that…
@medusajs/tax@2.17.1
@medusajs/translation@2.17.1
@medusajs/user@2.17.1
@medusajs/workflow-engine-inmemory@2.17.1
@medusajs/workflow-engine-redis@2.17.1
@medusajs/telemetry@2.17.1
@medusajs/test-utils@2.17.1
@medusajs/ui@4.1.18
@medusajs/ui-preset@2.17.1