Magento 2.4.9 Release Notes

Yes, if you’re on 2.4.8

Smooth upgrade. Mostly point-release changes layered on top of three infra swaps (PHP, search, cache). Plan a 1-2 week sprint for QA. Most extensions work as-is. Get the staging build green, run Lighthouse on your top 10 URLs, smoke-test checkout, then ship.

Plan ahead, if you’re on 2.4.6 or 2.4.7

You’re skipping multiple PHP versions and big infra jumps in one go: Redis → Valkey, OpenSearch 2 → 3, Symfony 6 → 7.4. 4-8 week project minimum. Don’t rush. Audit every custom module for PHP 8.5 compat first; then plan a hosting migration window; then run the Magento upgrade.

Hyvä stores, mostly fine

Hyvä Themes + Hyvä Checkout work with 2.4.9. Tailwind + Alpine are untouched by the Symfony bump. One thing to retest: your Hyvä Checkout adapter for Braintree, because Adobe added 12+ payment changes including Google Pay vaulting, Apple Pay on Chrome and Firefox, and BLIK. Budget 1 extra week for Hyvä QA.

Adobe Commerce B2B, schedule a long window

Schedule a longer testing window. Companies module, quotes, requisition lists, shared catalogues, negotiable quotes, test every single flow. New GraphQL mutations make headless B2B much easier, but they need full integration testing. 4-8 weeks for enterprise B2B. Don’t skip MFTF regression.

clearCart mutation

Bulk-remove every item from a cart in one call. Was Adobe Commerce-only; now in Open Source. Huge for headless storefronts that need to rebuild cart state on logout, payment error, or session expiry without looping over removeItemFromCart one item at a time.

clearWishlist mutation

Bulk-empty a customer’s wishlist in one call. Same code path as clearCart. Useful for “clear all” UI on a wishlist page, and for B2B flows that move wishlist items into a quote.

exchangeExternalCustomerToken

Bridge authentication from an external identity provider (Auth0, Okta, AWS Cognito) to a Magento customer token in one call. Removes the JWT roundtrip workaround most agencies have to write today. What it means: if a customer logs in to your headless storefront with Okta, you can now hand the Okta token to Magento and get a Magento session back. One request instead of three.

Cart-merge config + B2B extras

New admin toggle for guest→customer cart merging, historical orders now include out-of-stock product details, a new OrderTotal.grand_total_excl_tax field, and queries for the applied customer groups, customer segments, and cart-rule IDs on an order (handy for B2B headless apps that need to show why a customer got a price).

SRI hash storage per area/theme/locale

Subresource Integrity hashes (cryptographic fingerprints of every JS/CSS file Magento serves) are now stored in separate files per admin/storefront × theme × locale. Faster page loads (fewer hashes parsed per request), less memory, easier rollback when a single locale’s asset changes. What it means: SRI is what stops a hacked CDN from injecting malicious JS into your store, this change makes that protection faster.

2FA flexibility for admin

Admin users now only need one enabled 2FA provider instead of every available provider. Smaller agencies finally get a workable 2FA flow without forcing every admin to enable Google Authenticator + Duo + U2F simultaneously. What it means: you can now pick the 2FA method that fits your team and stop fighting Magento about it.

CAPTCHA / reCAPTCHA on more APIs

Both REST and GraphQL account-creation endpoints now enforce CAPTCHA. Closes a fraud-bot vector that was scraping customer accounts via the API while the storefront form was protected. What it means: bot signups via API are now blocked the same way bot signups via the website are blocked.

reCAPTCHA on more GraphQL mutations

updateCustomer, updateCustomerV2, and contactUs mutations now validate reCAPTCHA. Spam-form mitigation for contact forms and a small but useful improvement against account-takeover scripts that try to update customer email or password.

Media Gallery on-demand tree

The admin Media Gallery no longer loads the full folder tree at boot. Folders expand on click. Stores with 10k+ media assets save many seconds on every admin page that opens the gallery (product edit, CMS page edit, category edit, email template edit).

SRI per-area files

Only the SRI hash file relevant to the current area/theme/locale is loaded per page. Less JavaScript parsing on every storefront request, small win per page, large win across a session.

Analytics cron jobs optimised

Fewer queries, less DB lock contention on the cron group that fires hourly. Stores running Adobe Commerce Intelligence (formerly MBI) see noticeably less “background DB pressure” on busy hours.

File export uses temp files

Partial downloads no longer leave a half-written export visible in the admin. What it means: if a CSV export crashes halfway, customer-service staff don’t accidentally download the broken file and email a partial customer list. Cleaner CI/CD audit logs too.

Uppy

jQuery Validate

jQuery UI

Less.js

Moment Timezone

Underscore.js

Chart.js

Allure PHPUnit

Symfony 7.4 type declarations

Custom modules that extend Symfony core classes (rare but real for big agencies) need updated: string /: void /: array return-type hints. Check var/log/exception.log after staging deploy for must be compatible with errors. What it means: Symfony 7.4 enforces stricter type rules, if your custom code told Symfony “trust me” before, you now have to spell out the types.

Redis → Valkey migration

Old config keys (cache-backend-redis-server) still work because Valkey speaks the Redis wire protocol, but the underlying binary, monitoring tools, and managed cloud offerings change. AWS still ships ElastiCache Redis; GCP MemoryStore has Valkey in preview; Azure Cache for Redis is unaffected. What it means: plan your hosting carefully. Your app code probably doesn’t change at all, but your infra ticket might.

OpenSearch 2 → 3 reindex

OpenSearch 3 changed the index mappings for analyzers; you must reindex catalogsearch_fulltext after the upgrade. What it means: budget the indexer-run time during your deploy window. A 50k-SKU store reindexes in 5-15 minutes; a 1M-SKU store can take an hour. Run it during low-traffic hours.