Performance Improvement for Search Route
The /store/search route now restricts field retrieval to only those defined on the index being searched, preventing data hydration outside the index for better performance. This release includes multiple bug fixes for search indexing, caching, promotions, payments, and dashboard internationalization.
Disallow Expanding Fields Outside of Index in Search Route
The /store/search route now only allows retrieving fields that are defined on the index being searched. It no longer allows fetching data outside the index by hydrating through query.graph. This is for better search performance and ensures you clearly define what can be retrieved on your indexed data model.
Bugs
- fix: Disallow expanding beyond index fields on search endpoint by @sradevski in #17044
- fix: Wait for search cache to settle before setting or invalidating by @sradevski in #16966
- fix(search): stop search index versions from piling up by @sradevski in #16930
- fix: Correctly count when using distinct by @sradevski in #16928
- fix(promotion): correlate the automatic promotion prefilter with the candidate promotions by @DylanCuure in #16954
- fix(medusa): allow omitting deprecated options in admin product updates by @Dextheking1 in #16959
- fix(workflow-engine-redis): nest RedisWorkflowsOptions under redis in the module options type by @Asgabani in #16730
- fix(payment): avoid double-prefixing an already pp_-prefixed provider by @RoxasZohbi in #16899
- fix(draft-order): fix admin crash when selecting a customer without an email by @kelvin511 in #16952
- fix(utils): strip g/y flags in buildRegexpIfValid for CORS origins by @wakqasahmed in #16568
- fix(dashboard): internationalize order payment labels by @luxapan in #16846
- fix(dashboard): i18n fill the 5 missing keys in fi hr pl sv tr by @theluckystrike in #16933
- fix(dashboard): add readable validation messages to create region form by @NikhilDhillon in #16720
- fix(dashboard): point refund and return reason row links at their edit routes by @Minhal128 in #16742
- fix(dashboard): correct shipping profile row link path by @Asgabani in #16728
- fix(dashboard): i18n placeholders in de and pl that don't match en.json by @Na5co in #16907
- fix: rename misspelled orignalSet parameter to originalSet by @Dextheking1 in #16908
- chore: fix handling of invalid translation json by @shahednasser in #17002
Documentation
- docs: add docs on canceling workflow execution by @shahednasser in #16901
- docs: add behavior of allow unauthenticated by @shahednasser in #16965
- docs: clarify has_account behavior + how to convert a guest customer into a registered customer by @shahednasser in #17001
- docs: add markdown parsing for pricing page by @shahednasser in #17005
- docs: update cloud navigation info and pricing page by @shahednasser in #16924
- docs: update cloud usage with search changes by @shahednasser in #17015
- docs: document usage credits and searchable branch picker in Cloud [automated] by @shahednasser in #17017
- docs: remove published status filter by @shahednasser in #16915
- docs: generate sidebar + update actions to use opus 5.5 by @shahednasser in #16931
- docs: address Kapa coverage gaps for 2026-08-01 [automated] by @shahednasser in #17011
- docs: document Kapa top questions for 2026-08-01 [automated] by @shahednasser in #17012
- docs: document domain provisioning failures, database access controls, and log time-range limits [automated] by @shahednasser in #16919
- docs: fix JSDoc typos in core types and js-sdk by @Dextheking1 in #16920
- docs: fix typos in Alert example and CommandBar JSDoc by @Dextheking1 in #16906
- docs: mention plural-config.json in admin translation guide by @SanteriMoilanen in #16888
- docs: fix typo multple -> multiple by @vaibhav8a in #16654
- docs: doc changes for next release [automated] by @shahednasser in #16798
Chores
- chore: combine release actions + fix snapshot releases by @shahednasser in #17041
- chore: re-add snapshot comment by @shahednasser in #17042
- chore: add action to automate translations by @shahednasser in #16962
- chore: add automation for Kapa insights to docs by @shahednasser in #17008
- chore: update claude code action version by @shahednasser in #17009
- chore: update CLAUDE.md by @shahednasser in #17043
- chore: increase stalebot API limit by @leobenzol in #16927
- chore(dashboard): add missing translations [automated] by @shahednasser in #17004
- chore(dashboard): add missing translations [automated] by @shahednasser in #17000
Other Changes
- chore(dashboard): i18n complete the vi dashboard locale by @theluckystrike in #16936
- chore(dashboard): i18n complete the uk dashboard locale by @theluckystrike in #16939
- chore(dashboard): i18n complete the el dashboard locale by @theluckystrike in #16948
- i18n complete the mk dashboard locale by @theluckystrike in #16940
- add missing hungarian translations in admin dashboard by @theluckystrike in #17007
New Contributors
- @DylanCuure made their first contribution in #16954
- @RoxasZohbi made their first contribution in #16899
- @kelvin511 made their first contribution in #16952
- @wakqasahmed made their first contribution in #16568
- @luxapan made their first contribution in #16846
- @NikhilDhillon made their first contribution in #16720
- @Minhal128 made their first contribution in #16742
- @Na5co made their first contribution in #16907
- @leobenzol made their first contribution in #16927
- @SanteriMoilanen made their first contribution in #16888
- @vaibhav8a made their first contribution in #16654
- @Asgabani made their first contribution in #16728
- @Dextheking1 made their first contribution in #16906
- @theluckystrike made their first contribution in #16933
Full Changelog: v2.21.1...v2.21.2
Source: original entry ↗
More from Medusa
Follow Medusa to get its new changes in your feed and email digest.
v2.21.1: Search Module
Introduces a new Search Module that lets you manage and search through indexes for any data model, with built-in PostgreSQL and Medusa Cloud providers. Also includes improvements to the loyalty plugin's store credit features, new admin translations for Finnish and Swedish, and numerous bug fixes across authentication, payments, inventory, and shipping.
Strict allowed fields in Store API and Exported Admin Components
Store API routes now enforce a strict allowed-fields list, returning only explicitly declared fields and relations to prevent unintended data exposure. Disallowed fields are silently stripped; use the allowFields middleware to re-expose specific fields if needed.
Field Filter Stripping Fix, Search Stability, Schema Index Validation
Fixed a security issue where field filter restrictions (allowed query config and http.restrictedFields) were only applied when RBAC was enabled; now they are always enforced. Also fixed search correlated flag and schema index JSON validation.