Highlights End-to-End Role-Based Access Control Role-Based Access Control (RBAC) is now fully implemented across Medusa. Merchants can define custom roles with granular permissions and assign them to admin users, controlling what each user can view and do in the admin dashboard. The implementation spans the dashboard UI, API routes, core flows, the JS SDK, and a new dedicated RBAC module. Requires…
Highlights Adyen Payment Provider Medusa now includes an official Adyen payment provider module in beta, enabling merchants to accept card payments through Adyen's payment platform. The provider integrates with Adyen's APIs to handle payment sessions, captures, and refunds within Medusa's payment workflows. #17577 Search Improvements and Fixes Several enhancements and fixes have been applied to Me…
Highlights Update Payment Session Client Data Payment sessions can now be updated with new client data after creation. This enables payment flows where client-side metadata -- such as a browser fingerprint or 3D Secure result -- needs to be attached to an existing session without tearing it down and recreating it. #17432 Bugs fix(core-flows): remove optional chaining from processPaymentWorkflow co…
Highlights Node.js v22.22.0 or Later Required 🚧 Breaking change This change only affects projects running Node.js 20. Projects already on Node.js 22 are unaffected. Node.js 20 has reached end-of-life and is no longer supported. Medusa now requires Node.js v22.22.0 or later. Update your runtime environment before upgrading to this release. node --version # must print v22.22.0 or higher #17089 #1710…
Disallow Expanding Fields Outside of Index in Search Route The /store/search route now only allows retrieving fields that are defined on the index being searched. It no longer allows fetching data outside the index by hydrating through query.graph. This is for better search performance and ensures you clearly define what can be retrieved on your indexed data model. Bugs fix: Disallow expanding bey…
Highlights Search Module The Search Module allows you to manage and search through indexes defined in your Medusa application. You can search products or any data model defined just by defining an index for it. The Search Module supports providers that integrate a search engine to perform the search operations. Out of the box, Medusa provides a PostgreSQL Search Module Provider and Medusa Search f…
Highlights Field Filter Always Strips Disallowed Fields Previously, the allowed query config on a route and http.restrictedFields config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix. Bug Fixes framework: Always strip fields that a field filter do…
Highlights This release brings security improvements to the Store API, specifically related to what relations and fields can be retrieved through the routes. We recommend all Medusa stores update to this version. Below you'll find the details of the change and an upgrade guide to apply it to older versions of Medusa, if you are unable to upgrade to the latest. We usually don't offer patches to old…
Highlights Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.20.0 Payment providers are now validated against the cart's region Security fix: creating a payment session no longer trusts the payment provider ID passed in the request. The createPaymentSessionsWorkflow and the cart payment validation step now verify that the chosen provider is actual…
Highlights Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.19.0 Update Vite and React Router to v7 🚧 Breaking change This release updates the Medusa Admin dashboard to use Vite v7.3.6 and React Router v7.18.2. This is a breaking change and requires you to make the following changes: Update your vite direct dependency to v7.3.6 Update your react-…
Highlights before / after on widgets injection zones 🚧 Breaking change Since the components in a LayoutComposer controlled page are now arranged through the Editor view (including widgets), the .after | .before widget injection zones don't have an effect on where the Widget is placed within its injection zone - you should configure this, just like with any other layout component, through the Edito…
Highlights This release comes with new features, bug fixes, and dependency updates for better security. Medusa MCP users can update their project using the following prompt: Update my Medusa project to v2.18.0 Balanced Query Load Strategy by Default 🚧 Breaking change The default database load strategy has changed from SELECT_IN to BALANCED, matching MikroORM v7's intended default. MikroORM picks b…
Highlights Regression with workers in Redis Event Bus This release fixes a critical bug introduced in 2.17.0. What Not await bullWorker_.run() in event-bus-redis onApplicationStart Why bullWorker_.run() is designed to return only when the worker is closed (taskforcesh/bullmq#2128). This bug had flown under the radar until we started awaiting all modules onApplicationStart here. The effect is that…
@medusajs/tax@2.17.1
@medusajs/translation@2.17.1
@medusajs/user@2.17.1
@medusajs/workflow-engine-inmemory@2.17.1
@medusajs/workflow-engine-redis@2.17.1
@medusajs/telemetry@2.17.1
@medusajs/test-utils@2.17.1
@medusajs/ui@4.1.18
@medusajs/ui-preset@2.17.1