Highlights
End-to-End Role-Based Access Control
Role-Based Access Control (RBAC) is now fully implemented across Medusa. Merchants can define custom roles with granular permissions and assign them to admin users, controlling what each user can view and do in the admin dashboard. The implementation spans the dashboard UI, API routes, core flows, the JS SDK, and a new dedicated RBAC module. Requires Enterprise License.
Off-Session Payments in Adyen
The Adyen payment provider now supports off-session payments, enabling recurring and subscription payment flows where charges are initiated without the customer being present at checkout. This unlocks use cases such as subscription billing and deferred payments for merchants using Adyen.
Features
- feat(dashboard,medusa,core-flows,framework,js-sdk,types,utils,link-modules,rbac): end to end RBAC implementation by @NicolasGorga in #15620
- feat: Add support for off-session payments in Adyen by @sradevski in #17587
Bugs
- fix(cli): exit instead of spinning forever when stdout is a broken pipe by @medusa-os-bot in #17640
- fix(medusa): apply the request locale in store product options routes by @medusa-os-bot in #17638
- fix(docs): fix stale property types in allOf response schemas of the OAS by @shahednasser in #17633
- fix: Clean up sandbox references, read a dedicated oauth secret by @sradevski in #17619
- fix(framework): register the restricted fields middlewares again when reloading API routes with HMR by @shahednasser in #17617
- fix(medusa): forward with_deleted to the query in GET /admin/shipping-options by @NicolasGorga in #17616
- fix(utils,dashboard,loyalty-plugin): add the Aruban Florin (AWG) currency by @medusa-os-bot in #17613
- fix(core-flows,utils): skip customer account email validation when the auth identity has no email, and add a validate hook to createCustomerAccountWorkflow by @shahednasser in #17608
- fix(event-bus-redis): don't silently lose kept events in clearGroupedEvents by @medusa-os-bot in #17600
Documentation
- docs: document filtering and sorting by linked data models in Query by @shahednasser in #17645
- docs: add security note to invoice generator store route by @shahednasser in #17646
- docs: address Kapa coverage gaps for 2026-10-01 [automated] by @medusa-os-bot in #17644
- docs: fix Stripe provider option names to camelCase by @medusa-os-bot in #17629
- docs: update API reference for v2.22.2 by @shahednasser in #17597
- docs: fix custom cell renderers file path in view configurations guide by @medusa-os-bot in #17541
- docs: doc changes for next release [automated] by @medusa-os-bot in #17496
Chores
- chore(ui,ui-preset): support Tailwind CSS 4 by @shahednasser in #17631
- chore(auth-oidc): update openid-client to v6 by @shahednasser in #17595
- chore(deps): update mikro-orm to 6.6.17 by @shahednasser in #17621
- chore: update jest to v30.5.2 by @shahednasser in #17618
- chore(admin-vite-plugin,dashboard,telemetry,draft-order): update babel to v8 by @shahednasser in #17611
- chore(cli,orchestration,utils,workflows-sdk,test-utils,file-s3,workflow-engine-inmemory,workflow-engine-redis): update ulid to v3.0.2 by @shahednasser in #17609
- chore(payment-stripe,payment): update stripe to v23.1.0 by @shahednasser in #17605
- chore(utils): update graphql to v17 and graphql-tools/codegen majors by @shahednasser in #17592
- chore(auth,auth-google): update jwks-rsa to v4 by @shahednasser in #17593
- chore(admin-vite-plugin): update magic-string to v1 by @shahednasser in #17594
- chore(eslint-plugin,workflow-engine-inmemory): update cron-parser to v5 by @shahednasser in #17590
- chore(framework,medusa): update chokidar to v6 by @shahednasser in #17584
- chore(deps,caching,types,utils,framework): update awilix to 13.0.5 by @shahednasser in #17574
- chore(docs): upgrade typedoc to 0.28 by @shahednasser in #17643
- chore(docs): bump glob and minimatch in docs tooling to fix security alerts by @shahednasser in #17627
- chore: fix status field across OAS versions by @shahednasser in #17607
- chore: give the PR review action the PR's code, search, and Opus by @shahednasser in #17589
- chore(deps): bump glob from 13.0.6 to 14.0.2 in /www/utils/packages/docs-generator by @dependabot in #17620
- chore(deps): bump the security-updates group across 1 directory with 2 updates by @dependabot in #17604
- chore(deps): bump glob from 13.0.6 to 14.0.2 in /integration-tests by @dependabot in #17603
- chore(docs): Generated + Updated UI Reference (automated) by @medusa-os-bot in #17583
- chore(docs): Generated References (automated) by @medusa-os-bot in #17582
- chore(docs): Update version in documentation (automated) by @medusa-os-bot in #17581
Full Changelog: v2.22.2...v2.22.3