Highlights

Update Payment Session Client Data

Payment sessions can now be updated with new client data after creation. This enables payment flows where client-side metadata -- such as a browser fingerprint or 3D Secure result -- needs to be attached to an existing session without tearing it down and recreating it.

#17432

Bugs

• fix(core-flows): remove optional chaining from processPaymentWorkflow constructor by @shahednasser in #17479
• fix(order): fix count query for paginated cross-module filters by @medusa-os-bot in #17471
• fix(core-flows): import only declared dependencies at runtime by @medusa-os-bot in #17470
• fix(dashboard): stop product media edit on failed upload and show the error by @medusa-os-bot in #17445
• fix(promotion): rank buy-get eligible items by unit price by @medusa-os-bot in #17444
• fix(medusa): respond with 404 on /admin/index routes when index is off by @medusa-os-bot in #17442
• fix(utils): skip running migrations for modules without a migrations folder by @medusa-os-bot in #17441
• fix(utils): copy null-prototype objects in parseStringifyIfNecessary by @medusa-os-bot in #17440
• fix(pricing): don't drop price list updates that carry explicit ids by @medusa-os-bot in #17439
• fix(dashboard): let Enter activate buttons inside modal and drawer forms by @medusa-os-bot in #17438
• fix(search-postgres): apply min_score to facet counts for keyword search by @medusa-os-bot in #17437
• fix(index): don't skip the index data sync when types generation fails by @medusa-agents in #17419
• fix(types): allow filtering price rules by attribute, value and operator by @medusa-agents in #17428
• fix: validate cart customer ownership checks by @medusa-agents in #17402
• fix(core-flows): validate customer account email matches the authenticated identity by @medusa-agents in #17415
• fix(promotion): enforce and track spend_by_attribute campaign budgets by @medusa-os-bot in #17446
• fix(promotion): respect is_tax_inclusive on buy-get promotions by @medusa-os-bot in #17447
• fix(medusa): reject deleting a variant through a product it doesn't belong to by @medusa-os-bot in #17449
• fix(core-flows): persist refund_amount when creating and completing a return by @medusa-os-bot in #17448
• fix(core-flows): set is_custom_amount when updating a draft order shipping method price by @medusa-os-bot in #17450
• fix(utils): ignore non-string ids when applying translations by @medusa-os-bot in #17451
• fix(payment): round to currency precision regardless of server locale by @medusa-os-bot in #17452
• fix(build-scripts): make the docs edited-dates step work on Windows by @medusa-os-bot in #17455
• fix(ui): respect the dismissable prop in toast.loading by @medusa-os-bot in #17456
• fix(caching): don't throw on numeric entity ids when computing cache tags by @medusa-os-bot in #17457
• fix(dashboard): define missing build-time constants for yarn dev by @medusa-os-bot in #17458
• fix(utils,dashboard,loyalty-plugin): add the Haitian Gourde (HTG) currency by @medusa-os-bot in #17459
• fix(locking,locking-redis): close the Redis client on shutdown by @medusa-os-bot in #17460
• fix(test-utils): read database credentials when connecting, not at import by @medusa-os-bot in #17461
• fix(core-flows): cascade delete custom records linked to deleted variants by @medusa-os-bot in #17462
• fix(utils,core-flows): import region price columns from product export by @medusa-os-bot in #17464
• fix(dashboard): apply the product list filters to product exports by @medusa-os-bot in #17469
• fix(order,dashboard): stop returns exceeding the returnable quantity by @vethan in #17431

Documentation

• docs: document setting cache ttl to 0 by @shahednasser in #17433
• docs: document retryIntervalAwaiting and maxAwaitingRetries for async steps by @medusa-agents in #17406
• docs: document running a workflow with an existing transaction ID by @medusa-agents in #17404
• docs: add redeploy warning after Cloud database restore or import by @medusa-agents in #17396
• docs: upgrade documentation apps to Next.js 16 by @shahednasser in #17395
• docs(cloud): document sender domain limits per plan in emails guide by @medusa-agents in #17388
• docs: doc changes for next release [automated] by @shahednasser in #17065
• docs(book): fix typos and grammar in Learn docs by @prairiewriter in #17214
• docs(resources): fix typos, grammar, and broken anchor links by @prairiewriter in #17248
• docs(user-guide): fix typos by @prairiewriter in #17246
• docs(cloud): fix typos by @prairiewriter in #17247
• docs(book): fix errors in the /start agent setup prompt by @prairiewriter in #17250
• docs(book): improve clarity in Get Started pages by @prairiewriter in #17252
• docs: fix remaining typos and grammar by @prairiewriter in #17251

Chores

• chore: add weekly dependency update workflow by @shahednasser in #17480
• chore(deps): bump the security-updates group across 1 directory with 2 updates by @dependabot in #17454
• chore: changes to issue triaging and PR reviews by @shahednasser in #17435
• chore: add OSS Scanner build Dockerfile by @olivermrbl in #17410
• chore(docs): Generated References (automated) by @medusa-os-bot in #17390
• chore(docs): Update version in documentation (automated) by @medusa-os-bot in #17391
• chore(docs): Updated UI Reference (automated) by @medusa-os-bot in #17392
• chore(docs): Generated DML JSON files (automated) by @medusa-os-bot in #17393
• chore(deps): bump dompurify to 3.4.17 to fix GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, GHSA-c6gr-qvv4-5v3f by @medusa-os-bot in #17467
• chore: show denied tool calls in dependency update runs by @shahednasser in #17484
• chore: plan pinned dependency updates like majors and group @types packages by @shahednasser in #17482

Other Changes

• feat(translation): seed fa-IR default locale by @soroush2025 in #17198

New Contributors

• @prairiewriter made their first contribution in #17214
• @vethan made their first contribution in #17431
• @soroush2025 made their first contribution in #17198

Full Changelog: v2.22.0...v2.22.1