Multi-Factor Authentication Support and Promotion Code Visibility
This release introduces primitives and API routes for Multi-Factor Authentication (MFA) to enhance security, along with improved visibility when promotion codes are skipped due to budget or usage limits. The MFA implementation provides a foundation for integrating various authentication methods while promotion visibility helps merchants understand and troubleshoot code application behavior.
Highlights
Multi-Factor Authentication Support
This release adds the primitives to support Multi-Factor Authentication (MFA) for enhanced security. This includes new authentication provider primitives, API routes for MFA management, and retrieval functionality. The implementation provides a foundation for integrating various MFA methods.
Promotion Code Visibility Improvements
When promotion codes are skipped due to budget or usage limits, the system now surfaces this information to provide better visibility into why certain promotions weren't applied. This helps merchants understand promotion application behavior and troubleshoot issues.
Features
- feat(js-sdk): add MFA auth helpers by @christiananese in #15441
- feat(ui): add CodeInput component by @christiananese in #15424
Bugs
- fix(design-system): broaden React peer dependencies to support v18 an… by @Suh0161 in #15271
- fix(core-flows): harden create payment sessions when customer has no account holders by @Suh0161 in #15264
- fix(dashboard): include inventory query in detail key by @Derekko-web in #15417
- fix(dashboard): complete and correct Thai (th) translations by @Ligament in #15409
- fix(test-utils, link-modules): encode URL credentials and fix schema-qualified RENAME TO by @Ultron03 in #15344
- fix(medusa): fix filtering by categories and tags in /store/products with the index module by @shahednasser in #15405
- fix(create-medusa-app): fix incorrect command replacement when using yarn and npm by @shahednasser in #15436
- fix(utils): implement tokenized free text search by @Suh0161 in #15275
- fix(core-flows): fix incorrect stock location picked for item with backorder in a sales channel with multiple locations by @shahednasser in #15159
Documentation
- docs: configure posthog capturing by @shahednasser in #15449
- docs: fix information about preview environments by @shahednasser in #15445
- docs: fix documentation issues in triage inbox by @shahednasser in #15427
- docs: revert Cloudflare migration by @shahednasser in #15438
- docs: add logging by @shahednasser in #15435
- docs: prepare to deploy to medusa cloud by @shahednasser in #15429
- docs: track logged in users by @shahednasser in #15425
- docs: added cloud docs for backups by @shahednasser in #15408
- docs: migrate to cloudflare by @shahednasser in #15388
- docs: fix mcp instructions for cursor by @shahednasser in #15401
- docs: add TSDocs for "add MFA provider primitives by @shahednasser in #15387
Chores
- chore(docs): cloud doc changes (automated) by @shahednasser in #15451
- chore: fix docs automation job by @shahednasser in #15452
- chore: fix required secrets in review and triage actions by @shahednasser in #15421
- chore: fix actions required anthropic api key by @shahednasser in #15410
- chore: switch actions to use anthropic api key by @shahednasser in #15404
- chore(docs): Updated UI Reference (automated) by @app/github-actions in #15391
- chore(docs): Generated References (automated) by @app/github-actions in #15393
- chore(docs): Update version in documentation (automated) by @app/github-actions in #15390
- chore: fixes to pr reviewer and issue triager by @shahednasser in #15394
Full Changelog: v2.15.2...v2.15.3
Source: original entry ↗
More from Medusa
Follow Medusa to get its new changes in your feed and email digest.
Performance Improvement for Search Route
The /store/search route now restricts field retrieval to only those defined on the index being searched, preventing data hydration outside the index for better performance. This release includes multiple bug fixes for search indexing, caching, promotions, payments, and dashboard internationalization.
v2.21.1: Search Module
Introduces a new Search Module that lets you manage and search through indexes for any data model, with built-in PostgreSQL and Medusa Cloud providers. Also includes improvements to the loyalty plugin's store credit features, new admin translations for Finnish and Swedish, and numerous bug fixes across authentication, payments, inventory, and shipping.
Strict allowed fields in Store API and Exported Admin Components
Store API routes now enforce a strict allowed-fields list, returning only explicitly declared fields and relations to prevent unintended data exposure. Disallowed fields are silently stripped; use the allowFields middleware to re-expose specific fields if needed.