@medusajs/medusa 2.22.5 on Node.js NPM

Highlights

Hardened Query Parameter Handling

This release hardens how Medusa turns dotted fields, filter, and order query parameters into its internal query objects. Unexpected path segments are now skipped or rejected consistently, and malformed query-parameter keys return a 400 error instead of a 500.

Projects hosted on Medusa Cloud are not impacted and require no action. We recommend that all self-hosted projects update to this version as soon as possible.

Patches for Older Versions

If you can't update to v2.22.5 yet, download the patch for your installed Medusa version:

Each ZIP contains the patch files and a SKILL.md with step-by-step instructions to apply and verify them using your package manager (npm, Yarn, pnpm, or bun). You can follow the instructions manually or point your AI coding agent at the SKILL.md:

Follow the instructions in 2.15.3-2.17.2/SKILL.md

Features

feat(promotion): add target selection strategy for buy-get promotions by @kristianjakschnltg in #17563

Bugs

fix(create-medusa-app): apply --version to scaffolded plugins by @medusa-os-bot in #17716
fix(utils, query, framework): harden dotted field/filter path handling when building queries by @medusa-os-bot in #17712
fix(medusa-oas-cli): keep each tag once when merging base file tags by @medusa-os-bot in #17714
fix(core-flows): don't copy a location's fulfillment sets into each shipping option by @medusa-os-bot in #17710
fix(promotion): let the automatic promotion prefilter use the promotion_id index by @medusa-os-bot in #17708
fix(docs): fix broken links and content parity in agent markdown by @shahednasser in #17698

Documentation

docs: document branch-aware root directory browser [automated] by @medusa-os-bot in #17725
docs(cloud): link to subprocessors list in data protection guide by @shahednasser in #17703
docs: update cloud documentation [automated] by @medusa-os-bot in #17705
docs: regenerate DML references with docs links by @shahednasser in #17701
docs(utils): link DML method TSDocs to data model docs by @shahednasser in #17700
docs: fix medusajs installation in docs packages + update UI by @shahednasser in #17694

Chores

chore(dashboard): add missing translations [automated] by @medusa-os-bot in #17711
chore: clean up unused and duplicate GitHub Actions by @shahednasser in #17706
chore: remove unused node-notifier dependency by @shahednasser in #17704
chore(deps): replace deprecated lodash.isequal with dequal by @shahednasser in #17702
chore(medusa-oas-cli): remove deprecated @readme/json-schema-ref-parser by @shahednasser in #17699
chore(payment): align stripe and typescript alias specifiers by @shahednasser in #17697
chore(integration-tests): update dotenv to v18 and remove unused get-port by @shahednasser in #17696
chore(deps): update cva and @uiw/react-json-view prereleases by @shahednasser in #17695
chore(deps): update dotenv-expand to v13 by @shahednasser in #17693
chore(deps): update @changesets/cli to v3 by @shahednasser in #17685
chore: migrate ESLint to flat config, update eslint to 10 and eslint-plugin-react-refresh to 0.5 by @shahednasser in #17687
chore(docs): Generated References (automated) by @medusa-os-bot in #17692
chore(docs): Updated API Reference (automated) by @medusa-os-bot in #17690
chore(docs): Update version in documentation (automated) by @medusa-os-bot in #17689

New Contributors

@kristianjakschnltg made their first contribution in #17563

Full Changelog: v2.22.4...v2.22.5

@medusajs/medusa 2.22.5 v2.22.5: Security Hardening for Unsafe Parameters on Node.js NPM