Adobe Commerce & Magento Open Source 2.4.8 Release Notes – What’s New?

• Cache Key Behavior Changes
•  Coupon Code Generation Limits (capped at 2,50,000 by default)
• Admin URL Optimization
• Full-Page Cache Configuration
• Rate Limiting for REST and GraphQL APIs
• It introduces fixes to security vulnerabilities as listed in the security bulletin APSB23-35. These include some of the most critical vulnerabilities including cross-site scripting and XML Injection.
• Risk associated with {BASE-URL}/page_cache/block/esi HTTP endpoint has been fixed
• The SRI mechanism introduced in 2.4.7 has been refactored to improve reliability and performance

• It introduces fixes to security vulnerabilities as listed in the security bulletin APSB25-26.
• Change Updates the Duo Security (2FA) implementation with the latest SDK (Web SDK v4).
• Added new CLI commands for changing keys and re-encrypting certain system configurations, payment, and custom field data. Admin UI is no longer available.
• OTP Window field now provides an accurate explanation of the setting and the default value has been changed from 1 to 29.
• SRI hashes are now stored directly in the pub/static directory and organized by area (adminhtml, base, frontend). No need to redeploy static content after cache flushes.

  GraphQL:

• Added a “theme” field to the “recaptchaV3Config” query. It allows you to specify the name of the theme to use to render the reCaptcha ensuring accurate price and currency information.
• Improved security by ensuring that requests with expired customer tokens

• optimized parser requests and cacheable queries
• Multiple clicks in the Sales > Orders page’s mass action drop-down menu no longer generate multiple POST requests. GitHub-37997
• Improved performance of page loading speed when many options are added to bundled products. GitHub-29409
• The process of assigning products to categories from the Products in Category tab has been optimized.
• The performance of the addProductToCart mutation when executing with many custom product attributes has improved.
• Performance issues when loading product attributes that are used by cart rules have been resolved. Only product attributes for active cart rules are now loaded.
• The parser method in GraphQL is only called once, which was called three times earlier, which results in better performance.
• This release introduces enhanced caching capabilities with improved page load speed and support for custom attributes.
• JSON format is now supported for the REST Import API.
• Enhanced indexer management. The new indexer:set-status command supports the dynamic management of indexer status. Admin users can use this command to change the indexer status to suspended, invalid, or valid. This feature is particularly useful for managing system performance during extensive bulk operations, such as product imports or updates, by allowing control over when the system’s cron jobs automatically trigger indexers.
• GraphQL now supports order cancellation.

• Indexer: The default indexer mode is “Update by Schedule” for all indexers which improves system performance and reduces potential issues.
• Product Price: Bulk Updates of tier prices without causing performance issues or unresponsiveness via [/V1/products/tier-prices] REST API.

• Inventory: The system now operates without the previously hidden dependency from the Catalog introduced by InventoryIndexer, ensuring that the product creation, display mode switch, stock status change, and other related functionalities work as expected.

• Logged-in customers can now store their Google Pay payments for future use
• 3DS verification support for Google Pay non-tokenized cards
• Logged-in customers who have previously stored their PayPal account can now store new credit/debit cards and PayPal accounts in the Customer account area.
• Customers can use PayPal Pay Later, PayPal Credit, and Pay Now via default card
• Express pay options at the checkout, including PayPal, PayPal Pay Later, Apple Pay, and Google Pay

• Removed “Sofort” and “Giropay” payment methods