⚠️ Deprecated: this release is deprecated as its packages are missing files. Make sure to update to v2.22.6 instead. It has the same security release.
Highlights
Hardened Query Parameter Handling
This release hardens how Medusa turns dotted fields, filter, and order query parameters into its internal query objects. Unexpected path segments are now skipped or rejected consistently, and malformed query-parameter keys return a 400 error instead of a 500.
Projects hosted on Medusa Cloud are not impacted and require no action. We recommend that all self-hosted projects update to this version as soon as possible.
Patches for Older Versions
If you can't update to v2.22.5 yet, download the patch for your installed Medusa version:
Each ZIP contains the patch files and a SKILL.md with step-by-step instructions to apply and verify them using your package manager (npm, Yarn, pnpm, or bun). You can follow the instructions manually or point your AI coding agent at the SKILL.md:
Follow the instructions in 2.15.3-2.17.2/SKILL.mdFeatures
- feat(promotion): add target selection strategy for buy-get promotions by @kristianjakschnltg in #17563
Bugs
- fix(create-medusa-app): apply --version to scaffolded plugins by @medusa-os-bot in #17716
- fix(utils, query, framework): harden dotted field/filter path handling when building queries by @medusa-os-bot in #17712
- fix(medusa-oas-cli): keep each tag once when merging base file tags by @medusa-os-bot in #17714
- fix(core-flows): don't copy a location's fulfillment sets into each shipping option by @medusa-os-bot in #17710
- fix(promotion): let the automatic promotion prefilter use the promotion_id index by @medusa-os-bot in #17708
- fix(docs): fix broken links and content parity in agent markdown by @shahednasser in #17698
Documentation
- docs: document branch-aware root directory browser [automated] by @medusa-os-bot in #17725
- docs(cloud): link to subprocessors list in data protection guide by @shahednasser in #17703
- docs: update cloud documentation [automated] by @medusa-os-bot in #17705
- docs: regenerate DML references with docs links by @shahednasser in #17701
- docs(utils): link DML method TSDocs to data model docs by @shahednasser in #17700
- docs: fix medusajs installation in docs packages + update UI by @shahednasser in #17694
Chores
- chore(dashboard): add missing translations [automated] by @medusa-os-bot in #17711
- chore: clean up unused and duplicate GitHub Actions by @shahednasser in #17706
- chore: remove unused node-notifier dependency by @shahednasser in #17704
- chore(deps): replace deprecated lodash.isequal with dequal by @shahednasser in #17702
- chore(medusa-oas-cli): remove deprecated @readme/json-schema-ref-parser by @shahednasser in #17699
- chore(payment): align stripe and typescript alias specifiers by @shahednasser in #17697
- chore(integration-tests): update dotenv to v18 and remove unused get-port by @shahednasser in #17696
- chore(deps): update cva and @uiw/react-json-view prereleases by @shahednasser in #17695
- chore(deps): update dotenv-expand to v13 by @shahednasser in #17693
- chore(deps): update @changesets/cli to v3 by @shahednasser in #17685
- chore: migrate ESLint to flat config, update eslint to 10 and eslint-plugin-react-refresh to 0.5 by @shahednasser in #17687
- chore(docs): Generated References (automated) by @medusa-os-bot in #17692
- chore(docs): Updated API Reference (automated) by @medusa-os-bot in #17690
- chore(docs): Update version in documentation (automated) by @medusa-os-bot in #17689
New Contributors
- @kristianjakschnltg made their first contribution in #17563
Full Changelog: v2.22.4...v2.22.5