Field Filter Stripping Fix, Search Stability, Schema Index Validation
Fixed a security issue where field filter restrictions (allowed query config and http.restrictedFields) were only applied when RBAC was enabled; now they are always enforced. Also fixed search correlated flag and schema index JSON validation.
Highlights
Field Filter Always Strips Disallowed Fields
Previously, the allowed query config on a route and http.restrictedFields config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.
Bug Fixes
- framework: Always strip fields that a field filter doesn't allow (#16704) — @shahednasser
- Remove correlated flag on search until it is supported (#16703) — @sradevski
- Disallow using JSON for schema index specification (#16692) — @sradevski
Contributors
Thank you to all contributors who made this release possible:
Source: original entry ↗
More from Medusa
Follow Medusa to get its new changes in your feed and email digest.
Performance Improvement for Search Route
The /store/search route now restricts field retrieval to only those defined on the index being searched, preventing data hydration outside the index for better performance. This release includes multiple bug fixes for search indexing, caching, promotions, payments, and dashboard internationalization.
v2.21.1: Search Module
Introduces a new Search Module that lets you manage and search through indexes for any data model, with built-in PostgreSQL and Medusa Cloud providers. Also includes improvements to the loyalty plugin's store credit features, new admin translations for Finnish and Swedish, and numerous bug fixes across authentication, payments, inventory, and shipping.
Strict allowed fields in Store API and Exported Admin Components
Store API routes now enforce a strict allowed-fields list, returning only explicitly declared fields and relations to prevent unintended data exposure. Disallowed fields are silently stripped; use the allowFields middleware to re-expose specific fields if needed.