Medusa — CMS, Commerce product updates and releases, tracked on megachangelog.
The /store/search route now restricts field retrieval to only those defined on the index being searched, preventing data hydration outside the index for better performance. This release includes multiple bug fixes for search indexing, caching, promotions, payments, and dashboard internationalization.
Introduces a new Search Module that lets you manage and search through indexes for any data model, with built-in PostgreSQL and Medusa Cloud providers. Also includes improvements to the loyalty plugin's store credit features, new admin translations for Finnish and Swedish, and numerous bug fixes across authentication, payments, inventory, and shipping.
Store API routes now enforce a strict allowed-fields list, returning only explicitly declared fields and relations to prevent unintended data exposure. Disallowed fields are silently stripped; use the allowFields middleware to re-expose specific fields if needed.
Fixed a security issue where field filter restrictions (allowed query config and http.restrictedFields) were only applied when RBAC was enabled; now they are always enforced. Also fixed search correlated flag and schema index JSON validation.
Medusa v2.20.0 introduces critical security fixes for payment provider validation and MFA enforcement, enforces query relation limits on Store API to improve performance, and adds support for fractional inventory quantities with units of measure. Draft orders now support calculated shipping options via third-party rate providers.
Major release introducing Vite v7 and React Router v7 updates with breaking changes, new inventory item export capability, support for custom delivery addresses in fulfillment creation, and notification preferences for order edits. Several API methods have been removed and cart/order totals behavior has changed.
Medusa 2.18.0 introduces breaking changes to database query loading strategy and internal service delete methods for composite key support, adds improved data table configuration in the Admin dashboard, enables order transfers to guest customers, emits inventory events for external syncing, supports AWS RDS short-lived credentials, and resolves security vulnerabilities through dependency updates.
Medusa v2.17.2 introduces a fully customizable admin dashboard layout with drag-and-drop composer, support for asynchronous payment methods across the payment module and integrations, and quantity-based tiered pricing for price lists. Multiple bug fixes improve payment webhook handling, search functionality, and tax calculations.
Fixed a critical regression in v2.17.0 where the Redis Event Bus worker would hang indefinitely on startup due to improper awaiting of bullWorker_.run(). This issue only affected worker mode, not server mode.
Released version 2.17.1 of the in-memory workflow engine package for Medusa. Check package updates for bug fixes and improvements.
Release of the Medusa workflow engine Redis module version 2.17.1.
Release of @medusajs/user package version 2.17.1. This update includes fixes and improvements to the user management module.
Updated translation package to version 2.17.1.
A minor release of the Medusa UI preset package addressing maintenance and updates to the UI component library.
Release of @medusajs/ui package version 4.1.18 with updates and improvements to the UI component library.
Release of test utilities package version 2.17.1 for Medusa.
Telemetry package version update to 2.17.1, containing general fixes and improvements for the Medusa telemetry module.
Medusa v2.15.5 introduces multi-factor authentication with a complete admin dashboard UI for managing authentication methods and emitting MFA lifecycle events. The release also adds RBAC admin dashboard utilities and fixes several bugs including refund handling, inventory calculations, and permission checks.
This release introduces primitives and API routes for Multi-Factor Authentication (MFA) to enhance security, along with improved visibility when promotion codes are skipped due to budget or usage limits. The MFA implementation provides a foundation for integrating various authentication methods while promotion visibility helps merchants understand and troubleshoot code application behavior.
Fixed a critical regression where running medusa db:migrate and db:generate could generate migrations that drop all database tables. This affected versions after v2.13.6. Users should update immediately and clean up incorrect snapshot files in their custom modules as detailed in the release notes.
Medusa 2.15.0 includes breaking changes to align Product and ProductVariant attribute types to float, introduces a new Medusa Cloud proxy command for local development, adds promotion context hooks for custom promotion rules, and adds SKU search support to the admin API. Note: Several PRs were missing from published packages; upgrading to 2.15.1 is recommended.
This patch release includes several PRs that were accidentally omitted from the 2.15.0 release due to a process issue. Users who installed 2.15.0 should upgrade to get the intended changes from that version.
Release of the in-memory workflow engine package for Medusa. This version includes updates and improvements to the workflow orchestration system.
Release of the Redis workflow engine package version 2.15.0 for Medusa.
Release of the Medusa user module version 2.15.0.
Release of the Medusa utilities package version 2.15.0 with updates to internal utilities and helpers used across the Medusa framework.
Released version 2.15.0 of the workflows SDK for Medusa, introducing updates and improvements to the workflow orchestration capabilities.
24 more changes from Medusa. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.