Self-Managed Commerce 8.6.x Release Notes

Learn about changes to Self-Managed Commerce for this release. Fixes since the release are summarized in the changelog.

Changelog

The changelog contains the list of fixes and improvements made to Self-Managed Commerce 8.6 since its release date. To learn how to consume the updates, see Consuming Support Fixes.

Commit	Description	Badges	Release Date
ae6093ff	Fixed issue with service level options in the Commerce Manager promotion actions not updating correctly after the selected stores are changed.		21‑Aug‑2025
91085e30	Removed all ESAPI dependencies, which were not effectively protecting the Cortex API endpoints and were including vulnerable transitive dependencies.		21‑Aug‑2025
8b6cafe8	Replaced all uses of deprecated org.osgi.core and org.osgi.annotation dependencies with osgi.core and osgi.annotation.		12‑Aug‑2025
166460e5	Fixed issue on promotion editor where store and catalog assignments were not persisted if changed after an initial save.		11‑Aug‑2025
6264ddc6	Fixed duplicate guid in facet test data that was causing intermittent test failures.		31‑Jul‑2025
16aa1f55	Upgraded ActiveMQ from 5.18.5 to 5.18.7 to address CVE-2025-27533.	Security	31‑Jul‑2025
3b041842	Fixed connection leak in DBConnector classes.		28‑Jul‑2025
e8648705	Upgraded Jackson from 2.16.1 to 2.19.1 and switched to jackson-bom to define dependency versions.	Security	23‑Jul‑2025
5ad1bc9e	Fixed the Build Tools script build_source_tree.sh to properly handle the --deploy command-line argument.	Build Tools	22‑Jul‑2025
1f67e6cf	Added a new COMMERCE/STORE/FILTEREDNAVIGATION/priceFacetingEnabled setting that controls whether price faceting support is enabled. If disabled, product search indexing may be significantly faster.	Performance Data model changes	22‑Jul‑2025
f13ddde7	Upgraded Tomcat from 9.0.106 to 9.0.107.	Security	18‑Jul‑2025
954c43fd	Fixed all @Named annotations that are paired with @Autowired to the correct @Qualifier annotation.		18‑Jul‑2025
e8f093ee	Fixed potential race condition for limited use coupons when incrementing the coupon usage count during checkout, causing some uses to be missed.		17‑Jul‑2025
93138090	Fixed multiple incorrect XML bean configurations.		17‑Jul‑2025
1b4202c2	Updated both the Build Tools build container image and the Build Tools application container base images to Amazon Linux 2023.7.20250623.1.	Build Tools	15‑Jul‑2025
81a6297d	Fixed error that was occurring on the Commerce Manager exchange wizard after modifying items to be exchanged.		11‑Jul‑2025
55e7656f	Fixed issue where resending a Gift Certificate for a specific order line item was resending all order gift certificates to the specified recipient.		10‑Jul‑2025
b1af4e5c	Added support for IS NULL and IS NOT NULL to EP Search Query Language.		10‑Jul‑2025
96d76d33	Upgraded commons-beanutils from 1.9.4 to 1.11.0.	Security	9‑Jul‑2025
6226ed30	Added a new warning to the logs when a service using SwitchableProxyBinder is using the fallback implementation, which usually indicates that application-level caching is not working.		9‑Jul‑2025
381ed781	Upgraded Tomcat from 9.0.105 to 9.0.106.	Security	8‑Jul‑2025
683c10ca	Upgraded spring-security from 5.8.14 to 5.8.15.	Security	8‑Jul‑2025
06f76ed4	Fixed issue with the simulated selling context dialog in Commerce Manager in which labels were not appearing.		8‑Jul‑2025
97cd0113	Fixed infinite recursion bug in CacheableFacetService#findAllFacetsForStore.		8‑Jul‑2025
c05dd186	Modified bundle availability logic so that bundles appear as available as long as sufficient constituents are available to satisfy the bundle selection rules.		7‑Jul‑2025
0dc0da93	Fixed parsing of queries in LuceneRawQueryComposerImpl that was causing problems for the search server when processing some index notifications.		27‑Jun‑2025
e4229c02	Build Tools: Set timeouts for Maven commands, so that Maven builds triggered by these tools will fail fast if Maven artifact download connections hang.	Build Tools	25‑Jun‑2025
9c50ae15	Fixed an issue where domain events are not always triggered as expected if the domain class has been extended.		24‑Jun‑2025
637a79b4	Certified MySQL RDS 8.4.		24‑Jun‑2025
f3f43041	Fixed the Operational Insights revenue calculations to exclude failed but include cancelled orders.		24‑Jun‑2025
b08a2bad	Fixed issue in which the CM_USER_CREATED event is sent before the Commerce Manager user is persisted.		21‑Jun‑2025
b89551b3	Build Tools: Updated the ActiveMQ container's entrypoint.sh script to enable new ActiveMQ container configuration options. Users can set new environment variables EP_ACTIVEMQ_X_JVM_ARGS and MAXIMUM_CONNECTIONS.	Build Tools	20‑Jun‑2025
217d9b5c	Added a new ext-container-layout module with updated build tools, to simplify building Self-Managed Commerce container images.		20‑Jun‑2025
ea48517e	Fixed issue that causes search indexing to fail if multiple attribute values exist for the same attribute with the same locale.		19‑Jun‑2025
943a1104	Minor cleanup of code around Extension Point Framework event-based extensions.		18‑Jun‑2025
79f8124b	Replace the unmaintained tag library taglibs-standard-impl with the newer jakarta.servlet.jsp.jstl.	Security	16‑Jun‑2025
1bacbb36	Upgraded Tomcat from 9.0.102 to 9.0.105.	Security	12‑Jun‑2025
20bc33c7	Fixed SQL Injection issues identified by Static Application Security Testing tooling in ep-persistence-openjpa.	Security	5‑Jun‑2025
f0b6086b	Upgraded jetty-server from 9.4.56.v20240826 to 9.4.57.v20241219.	Security	5‑Jun‑2025
418d58fe	Fixed suppression for false positive FindBugs issues.	Security	5‑Jun‑2025
6883bca6	Fixed multiple issues with limited usage promotions: Promotion wizard not saving the flag, error occurring when checking out, and a potential race condition during checkout.	Data model changes Requires downtime	5‑Jun‑2025
ff11c3ea	Added calls to super.configure() within configure methods of route builders extending CRSCEnabledRouteBuilder.		2‑Jun‑2025
a9e8f450	Build stability improvements.		30‑May‑2025
8eaaffa7	Fixed issue that was sending messages to VirtualTopic.ep.catalog containing an error message when Catalog Syndication was triggered.		29‑May‑2025
3313cbbe	Fixed issue with Extension Point Framework entities missing all non-localized attribute values when a localized attribute contains a non-localized fallback value.		27‑May‑2025
bcd7a680	Made ordering of payment method elements consistent in Cortex.		26‑May‑2025
f8a7ee2a	Multiple conflicting jars: com.github.java-json-tools:json-schema-core:1.2.14, com.github.java-json-tools:json-schema-validator:2.2.14		21‑May‑2025
4b4ffe35	Added optional JUnit 5 support to the platform.		20‑May‑2025
9a410dc8	Multiple conflicting jars: com.sun.activation:jakarta.activation:1.2.2, com.sun.activation:javax.activation:1.2.0, jakarta.activation:jakarta.activation-api:1.2.2, javax.activation:activation:1.1		20‑May‑2025
db02b7f6	Multiple conflicting jars: aopalliance:aopalliance:1.0, org.glassfish.hk2.external:aopalliance-repackaged:3.1.1, org.springframework:spring-aop:5.3.39		19‑May‑2025
1c7f4991	Multiple conflicting jars: com.antkorwin:xsync:1.3, org.hibernate.validator:hibernate-validator:6.2.0.Final		19‑May‑2025
4081d2eb	Multiple conflicting jars: javax.el:javax.el-api:3.0.0, org.glassfish:jakarta.el:3.0.4		18‑May‑2025
62f673c2	Multiple conflicting jars: io.swagger.core.v3:swagger-annotations-jakarta:2.2.22, io.swagger.core.v3:swagger-annotations:2.1.13		17‑May‑2025
4cc9ecce	Multiple conflicting jars: jakarta.xml.bind:jakarta.xml.bind-api:2.3.3, javax.xml.bind:jaxb-api:2.3.1		16‑May‑2025
749883b6	Multiple conflicting jars: jakarta.validation:jakarta.validation-api:2.0.2, javax.validation:validation-api:2.0.1.Final		16‑May‑2025
b696b384	Fix for banned dependency errors introduced by "Multiple conflicting jars: org.slf4j:jcl-over-slf4j:1.7.32, org.springframework:spring-jcl:5.3.39, commons-logging:commons-logging:1.1.1"		15‑May‑2025
6b7cb213	Added debug logging for SwitchableProxyBinder.		15‑May‑2025
1ca4e9bf	Multiple conflicting jars: org.slf4j:jcl-over-slf4j:1.7.32, org.springframework:spring-jcl:5.3.39, commons-logging:commons-logging:1.1.1		15‑May‑2025
ceb1bb00	Multiple conflicting jars: javax.servlet:javax.servlet-api:3.1.0, org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6		15‑May‑2025
dbc2b7c7	Multiple conflicting jars: com.sun.mail:imap:1.5.6, com.sun.mail:jakarta.mail:1.6.7, com.sun.mail:javax.mail:1.5.6		15‑May‑2025
8288ad77	Refactored b2b-buyer-functionality.feature to use client.authRegisteredUserByName instead of JWT authentication.		12‑May‑2025
d80268af	Upgraded certified MySQL 8.0 Aurora version from 8.0.mysql_aurora.3.04.2 to 8.0.mysql_aurora.3.08.2.	Security	11‑May‑2025
c5a78213	Fixed problem with XPFShoppingCartPricing#getTaxes returning the cart total instead of the cart taxes.		11‑May‑2025
92f5a151	Upgraded certified Oracle version from 19.0.0.0.ru-2024-01.rur-2024-01.r1 to 19.0.0.0.ru-2025-01.rur-2025-01.r2.	Security	6‑May‑2025
808f753b	Upgraded certified MySQL RDS version from 8.0.35 to 8.0.41.	Security	6‑May‑2025
e8f3108f	Fixed vulnerability in DownloadServiceHandler.	Security	5‑May‑2025
ec1053b1	Build stability improvements.		3‑May‑2025
2cc22cde	Fixed intermittently failing ExternalPluginTest integration tests.		2‑May‑2025
cf8c9bc8	Upgraded certified MySQL 5.7 Aurora version from 5.7.mysql_aurora.2.11.4 to 5.7.mysql_aurora.2.12.5.	Security	2‑May‑2025
1874964c	Fixed intermittently failing "Search product for Merchandising Associations can be filtered by brand" Cucumber test.		1‑May‑2025
87358096	Added new build plugin that detects when multiple JARs provide the same classes, and outputs this as a warning.		24‑Apr‑2025
ae3cb22a	Fixed issue with CouponUsageDaoImpl#findEligibleUsagesByEmailAddressInStore passing wrong value to the named query when email address is empty.		22‑Apr‑2025
cd6174e3	Fixed a performance issue in LocalizedAttributeKeyUtils#getLocaleFromLocalizedKeyName.	Performance	17‑Apr‑2025
cdd67b7c	Fixed issue with structured error messages from some shopping item validators not showing a link to the affected shopping item.		11‑Apr‑2025
fc692311	Upgraded Tomcat version from 9.0.98 to 9.0.102 to address CVE-2025-24813.	Security	10‑Apr‑2025
b7e4c7f9	Allow Cucumber tests in coupon-apply-validation.feature to pass in Trusted Header Mode.		9‑Apr‑2025
bea240f5	Hardcoded "mobee" and "vestri" values removed from scope autocomplete in Cortex Studio.		4‑Apr‑2025
e93ab4b5	Fixed problem with "All Stores" filter being ignored on the customer search tab.		4‑Apr‑2025
2a07d89e	Fixed performance issue when adding actions to catalog promotions in Commerce Manager when database contains a large number of price lists.	Performance	4‑Apr‑2025
63b61bb5	Fixed the Operational Insights revenue calculations to exclude failed and cancelled orders.		3‑Apr‑2025
a20620b9	Improved "View Disabled Data Policy for Customer" Selenium test to not fail on retry.		3‑Apr‑2025
4204486e	Improved performance in Commerce Manager when removing an attribute from a product type.	Performance	28‑Mar‑2025
819a3fc1	Minor code refactoring for TimeIntervalCacheImpl#get to simplify the implementation.		27‑Mar‑2025
40aba2c5	Fixed search indexing issue in which delete requests are ignored if there are no corresponding add/update requests.		25‑Mar‑2025
02a83ae2	Fixed issue with structured error messages from some shopping item validators not showing a link to the affected shopping item.		20‑Mar‑2025
4a3a1a25	Created filter to ensure that the Cortex OSGi console is only accessible on the port specified by ep.management.port.		14‑Mar‑2025
b04ff165	Upgraded netty-handler from 4.1.113.Final to 4.1.118.Final.	Security	14‑Mar‑2025
2ce56027	Removed jakarta-xmlbind Jackson module introduced by Solr 9.8.0 to avoid Jackson module autodiscovery issues.		12‑Mar‑2025
1aa1c732	Performance optimization for the Extension Point Framework to avoid classpath scanning when extensions are retrieved from the framework.	Performance	12‑Mar‑2025
915e2f41	Allow Cortex to authenticate with JWT tokens when enableTrustedSubjectHeaderMode is enabled.		12‑Mar‑2025
4106b40a	Fixed potential table scan when retrieving the order list in Commerce Manager.	Performance	10‑Mar‑2025
79623e18	Fixed intermittently failing Selenium test "Verify price facets are updated when a promotion is changed".		7‑Mar‑2025
ebcdb873	Initial release of new build tools for configuring a build environment, building and testing the code project, building the set of application container images, and running the application containers locally.	Build Tools	7‑Mar‑2025
75212081	Fixed issue where attributes with keys that match the regex for having a language tag are incorrectly treated as localized attributes when passed to Extension Point Framework entities.		4‑Mar‑2025
248ff5bc	Modified Tax Calculator extension point so that extensions don't need to calculate before tax price for inclusive taxes.		4‑Mar‑2025
331a0967	Fixed behaviour of the first time buyer flag if the shopper's first order fails.		3‑Mar‑2025
63bf457c	Fixed issue with order hold getting stuck in RESOLVE_PENDING if order lock is present.		3‑Mar‑2025
647ca468	Fixed issue with Operational Insights interpreting serviceResponseWaitTime in minutes instead of milliseconds.		28‑Feb‑2025
223f7ac2	Fixed Tax Calculator extension IndexOutOfBoundsException exception for empty tax records collection.		26‑Feb‑2025
daaf9bc4	Fixed issue with Core Request Scoped Caching where some database lookups were not being cached.	Performance	25‑Feb‑2025
f73122aa	Eliminated unnecessary shopper and shopping cart lookups during cart order retrieval.	Performance	25‑Feb‑2025
c6c758c9	Removed unitils-core dependency to address CVE-2016-3093.	Security	24‑Feb‑2025
a5ce4d69	Disabled intermittently failing "Verify price facets are updated when a promotion is changed" test.		22‑Feb‑2025
151432e2	Fixed "bad value for type int" error that appeared in the logs when running Operational Insights with a PostgreSQL database.		21‑Feb‑2025
38d4f0d2	Ensure that affected products are re-indexed when catalog promotions are added, modified, or become active or inactive to ensure that the indexed price is correct.		21‑Feb‑2025
9e2e1dae	Fixed incorrect environment subfolder names in ext-data.		18‑Feb‑2025
e1a37e5d	Removed unnecessary TCUSTOMER index on CREATED_DATE.	Data model changes	14‑Feb‑2025
db0e540a	Added java.base/java.lang.ref add-open JVM parameter to prevent possible failures when Operational Insights evaluates cache sizes.		13‑Feb‑2025
cb7275d0	Upgraded xstream from version 1.4.20 to 1.4.21 to address CVE-2024-47072.	Security	13‑Feb‑2025
7112314b	Enabled HTTP/2 for Solr replication in ops-spec.json.		13‑Feb‑2025
d5b06a8d	Removed unnecessary product/category cleanup after Cucumber tests and fixed issue that allowed bundles to be created in Commerce Manager without a valid sku code.		12‑Feb‑2025
3a402df7	Solr upgraded from 9.4.1 to 9.8.0.	Security	11‑Feb‑2025
59e9733f	Fixed race condition that can occur when multiple users execute keyword or navigation searches with different sort keys.		11‑Feb‑2025
7b4f7dc6	Fixed race condition that can occur when multiple users execute keyword or navigation searches with different sort keys.		7‑Feb‑2025
27d1914b	Fixed intermittent Selenium issue related to case-sensitive ErrorDialog class.		4‑Feb‑2025
173a52af	Build stability improvements.		30‑Jan‑2025
1f131ba0	Fixed an issue that was causing unnecessary TORDER and TORDERAUDIT update queries to be created.		28‑Jan‑2025
cbe22cba	Upgraded Tomcat version from 9.0.97 to 9.0.98 to address CVE-2024-56337 and CVE-2024-50379.	Security	27‑Jan‑2025
f4f9500a	Fixed issues with the 2024-12-create-missing-indexes changeset caused by needing to modify this changeset in Self-Managed Commerce 8.4 and earlier.	Data model changes	21‑Jan‑2025
e923786d	Updated getDisplayNames method to lazy loaded in all Extension Point Framework entities to address a potential performance issue when stores have a large number of locales enabled.	Performance	20‑Jan‑2025
0e6db98b	Improved performance of Operational Insights revenue query.	Performance Data model changes	17‑Jan‑2025
fc64bd3f	Fixed incorrect banning of camel-test dependencies.		17‑Jan‑2025
b339d89d	Fixed default OpenID Connect identity provider URL in settings files.		15‑Jan‑2025
b8aab1ab	Upgraded Camel from 3.14.10 to 3.21.5 to address CVE-2024-22371.	Security	15‑Jan‑2025
b9b84463	Removed jetty-runner dependency to address CVE-2024-52046.	Security	15‑Jan‑2025
58f10695	Added missing indexes to PostgreSQL and Oracle that were created implicitly in MySQL.	Performance Data model changes	14‑Jan‑2025
a91d446b	Updated certified PostgreSQL version from 14.10 to 16.6.	Security	14‑Jan‑2025
bcd56e2c	Updated Commerce Manager cookies to always set the HttpOnly flag for improved security.	Security	8‑Jan‑2025
3e07010c	Changed the orders list on the customer record in Commerce Manager to sort by created date instead of order number to avoid alphanumeric sorting issues.		7‑Jan‑2025
aa8d8e69	Fixed definition of 1FreeForAtleast5AlienSku test promotion.		7‑Jan‑2025
e017e07a	Changed coupon validation failure code ERROR_COUPON_USAGE_MISSING to ERROR_EMAIL_NOT_ASSIGNED to improve clarity.		7‑Jan‑2025
0bf048d7	Added XPFShipmentTypeEnum value SERVICE and deprecated SERVICE_ORDINAL.		7‑Jan‑2025
6786ef68	Upgraded zookeeper from 3.9.2 to 3.9.3 to address CVE-2024-51504 and CVE-2024-47535.	Security	6‑Jan‑2025
b4557e57	Enabled state comparison version strategy on order holds to ensure that two users don't resolve the same hold simultaneously.		6‑Jan‑2025
e3777617	Fixed NullPointerException in ShippingOptionInfoSelectorRepositoryImplTest.		6‑Jan‑2025
f53d4a11	Added system property to ensure that Log4j always uses the BasicContextSelector to avoid OSGi issues in Cortex.		20‑Dec‑2024
defd5aee	Changed featuredoffers link on navigations resource from a conditional to a static link to remove unnecessary product query.	Performance	17‑Dec‑2024
5af306dc	Added subquery support to JpqlQueryBuilder.		16‑Dec‑2024
9c86b8e9	Upgraded Spring from 5.3.34 to 5.3.39.	Security	13‑Dec‑2024
80058cf0	Fixed Core Request-Scoped Caching to ensure that retrievals with different load tuners or fetch groups are cached separately.		10‑Dec‑2024
6f79100e	Changed the way that SkuOptionValue is associated with ProductSkuOptionValue, using a lazy load approach instead of the Eager Field Post Load Strategy, to prevent possible "context has been closed" exceptions.		9‑Dec‑2024
6638afd2	Upgraded Tomcat version from 9.0.85 to 9.0.97.	Security	9‑Dec‑2024
481595ed	Removed duplicate and incorrect shopping cart event setting definition bean for determining the shopping cart messaging channel.		6‑Dec‑2024
42e74e19	Fixed issue where dependent items could not be removed from dynamic bundles in the shopping cart.		5‑Dec‑2024
55e33d5e	Fixed stack trace logging on Camel routes for event-based extension points.		5‑Dec‑2024
4c0dd186	Upgraded Quartz from version 2.3.2 to 2.4.0 to address CVE-2023-39017.	Security	4‑Dec‑2024
00602ab1	Fixed issue with ProductDaoImpl#findUidBySkuCode that can cause OpenJPA to read all product skus from the database in rare circumstances.	Performance	3‑Dec‑2024
10641655	Fixed intermittent failure in Selenium tests due to problems verifying that a user interface element contains the expected value.		29‑Nov‑2024
019a11be	Fixed intermittent failure in Selenium tests due to problems obtaining focus on a user interface element.		29‑Nov‑2024
e45a5180	Upgraded Jetty from version 10.0.20 to 10.0.24 to address CVE-2024-8184.	Security	28‑Nov‑2024
2fdad9f3	Upgraded Jetty for Wiremock from version 9.4.53 to 9.4.56 to address CVE-2024-22201.	Security	27‑Nov‑2024
eabf8137	Upgraded Spring Security from version 5.8.7 to 5.8.14 to address CVE-2024-22257.	Security	27‑Nov‑2024
1b149b2d	Upgraded commons-io from version 2.8.0 to 2.14.0 to address CVE-2024-47554.	Security	26‑Nov‑2024
b3941f9f	Fixed parent references in Commerce Manager modules to improve Maven reactor hygiene.		26‑Nov‑2024
5f63dd86	Fixed Import/Export to ensure that the necessary product search indexes are rebuilt when base amounts are updated.		25‑Nov‑2024
acdaec33	Updated Wiremock Jetty dependencies from 9.4.49.v20220914 to 9.4.53.v20231009.	Security	25‑Nov‑2024
020a55d6	Fixed intermittent failure in Selenium tests due to problems typing into text boxes.		25‑Nov‑2024
816bba7c	Fixed duplicate dependency definition in the ep-camel-bundle module.		24‑Nov‑2024
c6fe30e2	Removed unnecessary Jetty dependency in webapp-smoketests.		24‑Nov‑2024
fdc77a27	Added a new getAttributeValueByKey method to all Extension Point Framework entities with attributes for use with non-localized attribute values.		22‑Nov‑2024
b808e7af	Fixed problem with private use coupon not working for user after added to existing promotion.		21‑Nov‑2024
5eba77d2	Added jvmRuntimeArguments field to ActiveMQ in ops-spec.json.		20‑Nov‑2024
a92f92cd	Improved order hold resolution error handling to ensure that order holds don't get stuck in a pending state.		19‑Nov‑2024
1386d151	Fixed issue with event-based extension points not supporting multiple extensions on the same extension point.		19‑Nov‑2024
e0df5199	Created ep-camel-bundle bundle so we can avoid embedding Camel dependencies in multiple bundles.		19‑Nov‑2024
dab29cb5	Changed root link expectations in Cucumber tests to prevent failures if new resources are added.		13‑Nov‑2024
c16135df	Modified extensions.json requirements so that just the identifier and enabled flag can be specified; all other fields are now optional.		13‑Nov‑2024
a095e219	Renamed notsoldseperately to notsoldseparately in snapitup products.xml.		12‑Nov‑2024
aec0b99c	Updated product, product sku, and category default cache timeouts from 1 second to 1 hour.	Performance	12‑Nov‑2024
6a8d8c7e	Fixed Cortex structured message response when purchase form is submitted with validation errors.		12‑Nov‑2024
d3c5882e	Fixed cart subtotal applied promotions to ensure it only returns the applied 'best of' promotion.		8‑Nov‑2024
57e8551c	Added additional details to the structured error message response when a coupon is determined to be invalid.		8‑Nov‑2024
9948528e	Added new X-Ep-Follow-Location-Status header to indicate the status of the second resource when followLocation is used.		6‑Nov‑2024
8dfae32e	Fixed error handling for shipping option determination so that the actual underlying error is reported rather than a NullPointerException.		31‑Oct‑2024
9443b77a	Fixed a NullPointerException that can occur when publishing multi-sku products through the Data Sync Webapp.		30‑Oct‑2024
49d4271f	Refactored ProductAssociationQueryBuilder to use JPQLQueryBuilder and optimized generated query for determining product associations.	Performance	29‑Oct‑2024
084eca93	Fixed search index rebuild when a product is added or updated using Import/Export.		29‑Oct‑2024
fb3332c2	Upgraded esapi from 2.5.3.1 to 2.5.4.0.	Security	21‑Oct‑2024
15e9f9a9	Upgraded Wiremock from version 2.27.2 to 2.35.1.	Security	16‑Oct‑2024
28348a64	Added pagination support for wish list line items in Cortex.	Performance	9‑Oct‑2024
5d0a0102	Fixed Spring circular dependency that was causing NullPointerExceptions during Integration Server startup.		8‑Oct‑2024
640f0cfb	Fixed preconditions in core-changelog-2020-08-cleanup-expired-failed-orders-job.xml to avoid potential upgrade error.	Data model changes	3‑Oct‑2024
5007f8db	Upgraded certified ActiveMQ version from 5.16.7 to 5.18.5.	Security	26‑Sep‑2024
fb734c0a	Added missing Liquibase checksums to changesets that were updated during the Liquibase upgrade.	Data model changes	26‑Sep‑2024
ddf3594f	Fixed race condition in TimeIntervalCacheImpl that can result in a NoSuchElementException when retrieving values from the cache.		26‑Sep‑2024
f68964b7	Fixed issue with Cortex attempting to write logs to a folder based on the build machine home folder instead of the runtime machine home folder.		20‑Sep‑2024
fcfd8dbc	Removed support for user-name and user-company fields in JWT metadata payload, which was leading to unique constraint errors in PunchOut.		19‑Sep‑2024
e5001f89	Fixed issue with Data Sync Webapp where changesets containing base amounts were causing multiple product index notifications to be created and were also holding the base amount objects in memory until the service was restarted.		19‑Sep‑2024
aa055099	Fixed error that can occur when editing boolean attributes in Commerce Manager.		14‑Sep‑2024
7f98fdd8	Updated jetty from 9.4.44.v20210927 to 9.4.53.v20231009.	Security	12‑Sep‑2024
527cfd95	Refactored the Catalog Syndication builders to use AbstractBatchJob instead of Spring Batch, to address lock wait timeout issues during the build process.		11‑Sep‑2024
ca57f95d	Fixed issues with the shopper conditions user interface in Commerce Manager where conditions were sometimes duplicated or could not be removed.		11‑Sep‑2024
bbf48b2b	Ignore lazy loaded Extension Point Framework entity fields when serializing Extension Point Framework entity classes to JSON.		10‑Sep‑2024
66bc2c6b	Colored logging now disabled by default, only enabled for local development deployments.		2‑Sep‑2024
78937a65	Fix for NullPointerException that can occur if looking up a non-existent compound GUID with CategoryLookup#findByCompoundCategoryAndCatalogCodes.		30‑Aug‑2024
8535dac8	Fixed NullPointerException in coupon auto-apply role transition if registered user email is null.		30‑Aug‑2024
25ac3f4b	Fix for NullPointerException that can occur if RuleService#findByRuleGuid is called with a non-existent guid.		28‑Aug‑2024
ff6e6aa4	Fixed Commerce Manager error that occurs when searching for products using Advanced Search Query Builder.		27‑Aug‑2024
d2410e22	Updated the Log4j configuration for all services to ensure that log file sizes are limited by using a fixed window rolling policy.		26‑Aug‑2024
ee34a55f	Fixed sorting for "Enabled" and "Expiration Date" columns on cart and catalog promotion search results in Commerce Manager.		26‑Aug‑2024
2e5191e6	Fixed issue where the parentCategoryCodes field is not populated in the SOLR index for linked categories.		26‑Aug‑2024
f909f297	Removed unused CustomerTagStrategy interface.		21‑Aug‑2024
4d58c6ea	Fixed a race condition in service health checks that could report false health check failures if multiple requests are submitted concurrently.		15‑Aug‑2024
204cdb59	Fixed Catalog Syndication cucumber test stability issue.		15‑Aug‑2024
7b55d07d	Upgraded Tomcat from version 9.0.85 to 9.0.90.	Security	14‑Aug‑2024
0a784232	Fixed issue where the shopping cart memento object was not correctly passed to bundle items during instantiation.		7‑Aug‑2024
b0694c2f	Fixed issue with logging of some Catalog Syndication failures.		6‑Aug‑2024
57232e83	Fixed Cortex keyword search functionality so it correctly reads the COMMERCE/SEARCH/* system configuration settings.		2‑Aug‑2024
9ee21644	Fixed LibJarUtil parser to properly exclude #runtime refs when scanning the payment plugin classpath.		2‑Aug‑2024
087a922b	Removed checksum validation from core-changelog-2024-07-expired-data-point-values-job changeset due to required changes in earlier versions.	Data model changes	2‑Aug‑2024
4607c74b	Improved warning Setting retrieval strategy {} threw an exception to ensure that full stack trace is logged.		29‑Jul‑2024
582e2656	Fixed SolrFacetAdapter to consistently expect searchCriteria.getSearchHint("priceSourceIds") to contain a list of strings.		29‑Jul‑2024
7725bc2e	Fixed all query strings defined on beans for Catalog Syndication JpaPagingItemReader instances to ensure they have an ORDER BY clause.		24‑Jul‑2024
52ffe73f	Fixed issue where importing entities doesn't properly invalidate the application cache in some circumstances.		23‑Jul‑2024
f9f2ba86	Fixed out of memory error that can occur on the Batch Server if database contains a large number of TCUSTOMERCONSENT records.		23‑Jul‑2024
9e382e7b	Improvements to the Extension Point Framework to support JSON serialization of Extension Point Framework entity objects.		19‑Jul‑2024
3a9e1a72	Fixed the Commerce Manager status plugin to allow mvn test to work.		19‑Jul‑2024
8dd44edb	Upgraded Apache bval from version 0.4 to 2.0.6.	Security	17‑Jul‑2024
8d308c90	Fixed potential NullPointerException that can occur if opening an address with a null subCountry in Commerce Manager.		5‑Jul‑2024

Badge legend

• Security: Indicates that the patch includes security fixes.
• Performance: Indicates that the patch improves system performance.
• Data model changes: Indicates that the patch includes Liquibase scripts that make changes to the data model.
• Requires downtime: Indicates that the Self-Managed Commerce services should be shut down while the Data Population Tool is executed.
• Build Tools: Indicates that the patch includes changes to Build Tools.

Changelog Announcements

Added build-time checks for multiple JARs providing the same classes

When a Java runtime classpath contains multiple JARs that provide the same fully qualified class name, the classloader will randomly choose one of the class implementations. This can lead to confusing intermittent issues such as MethodNotFound at runtime.

To prevent this, we have added a new plugin to the build process called duplicate-finder-maven-plugin, which detects this situation and logs a warning at build time if it finds multiple JARs providing the same class.

Along with this change, several conflicting dependencies have been resolved:

• Multiple conflicting jars: jakarta.xml.bind:jakarta.xml.bind-api:2.3.3, javax.xml.bind:jaxb-api:2.3.1
  • javax.xml.bind:jaxb-api was removed.
  • jakarta.xml.bind:jakarta.xml.bind-api is now the primary JAR providing JAXB functionality.
• Multiple conflicting jars: javax.servlet:javax.servlet-api:3.1.0, org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6
  • org.eclipse.jetty.toolchain:jetty-servlet-api was removed.
  • javax.servlet:javax.servlet-api is now the primary JAR providing servlet functionality.
• Multiple conflicting jars: org.slf4j:jcl-over-slf4j:1.7.32, org.springframework:spring-jcl:5.3.39, commons-logging:commons-logging:1.1.1
  • commons-logging:commons-logging was removed and banned.
  • org.slf4j:jcl-over-slf4j is now the primary JAR providing commons logging functionality.
• Multiple conflicting jars: aopalliance:aopalliance:1.0, org.glassfish.hk2.external:aopalliance-repackaged:3.1.1, org.springframework:spring-aop:5.3.39
  • aopalliance:aopalliance was removed and banned.
  • org.glassfish.hk2.external:aopalliance-repackaged is now the primary JAR providing AOP functionality.
• Multiple conflicting jars: jakarta.validation:jakarta.validation-api:2.0.2, javax.validation:validation-api:2.0.1.Final
  • Core is only using javax.validation:validation-api (jakarta.validation-api was removed).
  • Search Server is using both:
    • jakarta.validation-api version 3.0.2 which provides the jakarta.validation packages for SOLR.
    • javax.validation-api version 2.0.1 which provides the javax.validation packages.
• Multiple conflicting jars: javax.el:javax.el-api:3.0.0, org.glassfish:jakarta.el:3.0.4
  • jakarta.el:jakarta.el-api and javax.el:javax.el-api were removed and banned.
  • org.glassfish:jakarta.el is now the only JAR providing expression language functionality.
• Multiple conflicting jars: io.swagger.core.v3:swagger-annotations-jakarta:2.2.22, io.swagger.core.v3:swagger-annotations:2.1.13
  • io.swagger.core.v3:swagger-annotations was removed and banned.
  • io.swagger.core.v3:swagger-annotations-jakarta is now the only JAR providing Swagger annotations functionality.
• Multiple conflicting jars: com.sun.mail:imap:1.5.6, com.sun.mail:jakarta.mail:1.6.7, com.sun.mail:javax.mail:1.5.6
  • com.sun.mail:javax.mail, com.sun.mail:imap, javax.mail:mailapi, and javax.mail:mail and were removed and banned.
  • com.sun.mail:jakarta.mail is now the only JAR providing mail functionality.
• Multiple conflicting jars: com.sun.activation:jakarta.activation:1.2.2, com.sun.activation:javax.activation:1.2.0, jakarta.activation:jakarta.activation-api:1.2.2, javax.activation:activation:1.1
  • com.sun.activation:javax.activation, javax.activation:activation, javax.activation:javax.activation-api, and jakarta.activation:jakarta.activation-api were removed and banned.
  • com.sun.activation:jakarta.activation is now the only JAR providing activation functionality.

If you encounter a banned dependency error after consuming these patches, follow these steps to address the error:

1. In your terminal, navigate to the module where the banned dependency was found. (i.e. cd extensions/integration/ext-integration-webapp)
2. Run mvn dependency:tree to view the dependency tree and determine where the banned dependency is coming from.
3. If the banned dependency is a direct dependency, you should remove it from the POM file.
4. If the banned dependency is a transitive dependency, add an exclusion to the dependency that is including the banned dependency.
5. Run mvn dependency:tree again to verify that the banned dependency is no longer in the dependency tree.

Solr upgraded from 9.4.1 to 9.8.0

This upgrade resolves several CVEs:

• CVE-2024-45216 (CVSS3 score 9.8) raised on 2024-10-16.
• CVE-2024-45217 (CVSS3 score 5.3) raised on 2024-10-16.
• CVE-2025-24814 (CVSS3 score 9.1) raised on 2025-01-27.
• CVE-2024-52012 (CVSS3 score 7.6) raised on 2025-01-27.

However, this upgrade also causes Solr to use HTTP/2 by default for index replication between the leader (primary) and replica (follower) nodes. As a result, Solr replication will fail unless at least one of the following actions is taken:

• Enable HTTP/2 support in the Tomcat server used by the Solr leader. Upgrading to Elastic Path Docker version 4.5.6, 4.4.7, or 4.3.7 will do this automatically.
• Set the following JVM parameter on the Solr follower Tomcat instance: -Dsolr.http1=true.

8.6.0

Released: June 2024

Release highlights

OpenID Connect integration for business users

Commerce Manager now has the ability to authenticate business users using a third-party Identity Provider. If enabled, business users will have the option to sign in as a local user with their existing username and password (if present), or login using the enterprise Identity Provider. Use of a third-party Identity Provider can improve security and allow single-sign-on across multiple web applications.

For more information, see Commerce Manager Enterprise User Authentication.

Split payments

This feature allows shoppers to pay for their shopping cart purchase by splitting the total across multiple payment instruments. Payment can be split across any supported payment methods, including different credit cards, gift cards, direct debits, or any other payment method provided by a payment plugin.

To support this, the Cortex API now allows multiple payment instruments to be selected on the cart order. Exactly one of the payment instruments must have a limit of 0, which means "unlimited". All other payment instruments must have a limit set. When checkout occurs, the payment system will charge the limit amount on each payment instruments with limits, and charge the remainder of the order total on the unlimited payment instrument. In case of failure during the reserve phase of any payment instrument, any payment instruments that have already been reserved will have their reservations cancelled automatically.

For more information, see Checkout Payment Instruments.

Shopping Cart Line Item promotions

Shopping cart promotions can now be configured to either evaluate conditions and actions at the cart level (matching the behaviour in all previous versions of Self-Managed Commerce), or at the cart item level.

If Define cart level rules is selected, then the promotion conditions will be evaluated on the entire cart, and the actions will apply to the entire cart if the conditions are satisfied.

If Define line item level rules is selected, then the promotion conditions will be evaluated on each individual cart line item, and the actions will apply to the line item if the conditions are satisfied.

This new feature allows your merchandiser to define discounts that are activated by very specific conditions related to a particular shopping cart line item.

For more information, see Creating a Shopping Cart Promotion.

Ability to filter promotions based on selling context fields

Merchandisers can now search for catalog and shopping cart promotions that would apply to a simulated shopper with particular attributes. For example, if a simulated shopper is configured with age 18, then any promotion with shopper conditions that require that the shopper be that age will be returned.

Merchandisers can also search for promotions that apply to all shoppers (i.e. no shopper conditions) or that apply on a specific date and time (i.e. a date that falls between the promotion start date and end date).

For more information, see Searching for a Catalog Promotion and Searching for a Shopping Cart Promotion.

Promotion carrots for catalog items

On a product display page, your merchandisers may want to entice shoppers with the promotions that are potentially available if they add the product to cart. For example, if the shopper is looking at a iPhone 14 product page, we want to show them that a buy-one-get-one offer or a free item is available once they add the product to cart. There might also be other conditions that need to be satisfied, such as a certain quantity, or another item in cart, etc.

Promotion carrots addresses these use cases by exposing a new link on the item resource called promotioncarrots. This new resource shows a list of elements that represent shopping cart promotions that are related to the item (product SKU). For example, if all of the promotion shopper conditions apply, and the promotion has a condition that the item's product SKU must be present in the cart, it will be included in the results.

The front-end can either use the carrot description specified by the business on each promotion, or can use the detailed condition and action details from the response to generate a description that is meaningful to the shopper.

For more information, see Read Promotion Carrots for an Item.

Shopping Cart Events extension point

A new extension point has been added that notifies extensions when shopping cart events occur. This allows Extension Point Framework extensions to make decisions based on shopping cart events or inform back-end systems about shopping cart changes.

For more information, see Shopping Cart Events extension point.

Shopping Cart Line Item Events extension point

A new extension point has been added that notifies extensions when shopping cart line item events occur. This allows Extension Point Framework extensions to make decisions based on shopping cart line-item events or inform back-end systems when items are added or removed from cart.

For more information, see Shopping Cart Item Events extension point.

Customer Events extension point

A new extension point has been added that notifies extensions when customer events occur. This allows Extension Point Framework extensions to make decisions based on customer events or inform back-end systems when customers register, authenticate, or make profile changes.

For more information, see Customer Events extension point.

Order Release Events extension point

A new extension point has been added that notifies extensions when a purchase is confirmed and ready to be sent to the fulfillment system. This allows Extension Point Framework extensions to inform back-end systems when a purchase is ready to be fulfilled.

For more information, see Order Release Events extension point.

Message-based cache invalidation for products

When products are updated, either through Commerce Manager, Import/Export, or Data Sync Webapp, these changes are now reflected immediately in Cortex API responses. Since products are cached in Cortex, these changes would previously take up to an hour to be reflected in API responses.

Now when products are updated, a domain event is processed by Integration Server, which triggers a topic broadcast to all services in the environment. Then this broadcast is received, the services evict the product from their local Ehcache.

Message-based cache invalidation for other entities such as base amounts (prices) and promotions will be added in future Self-Managed Commerce versions.

For more information, see Application Caching using Ehcache.

Support for street line 3 on addresses

Support for a third street line has been added to all addresses. This includes the following changes:

• All Commerce Manager address forms now show an "Address Line 3" field.
• All address objects in Import/Export now support a street3 field.
• All Cortex address forms now have street-address, street-address-2, and street-address-3 fields. The extended-address field is deprecated. If a client posts a form with this field, it will map to the street-address-2 field for backwards compatibility. The response will include street-address, street-address-2, street-address-3, and extended-address fields, but street-address-2 and extended-address will contain the same values.
• The customer address CSV import now supports a street3 field.
• Data policies now support the STREET_3 field.
• All standard email templates with addresses will now display street address line 3.

New in this release

In addition to the Release Highlights, this release contains the following updates:

Customer Data Tag Set Populator extension point

A new extension point has been added that allows an extension to access customer and account records and use those details to add fields to the tag set. Those fields can then be used in promotion and price list assignment conditions.

For more information, see Customer Data Populator extension point.

Added "Never available" option to product availability rules

Added a new option to product availability rules called "Never available". This will ensure that the product will always appear as out-of-stock.

The complete list of product availability rules is as follows:

• Available only if in stock
• Available on pre order
• Available on back order
• Always available
• Never available

note

These availability rules will only apply to skus that are configured as "Shippable". "Digital Asset" skus are treated as "Always available" regardless of the product available rule setting.

Added ability for buyers to determine their role in each account they're associated to

For buyers who are associated to accounts, they can see all the accounts they are associated to by reading defaultprofile --> accounts --> element. Within each account, buyers can also see all associates by accessing associates -> element. Within this associate resource, the user's role, email, first name, and last name is visible.

However, this made it difficult for the logged-in buyer to determine their own role in each account. To address this, the associates resource now returns an activeuser link, which returns the associate details for the currently logged-in buyer.

Added pagination support for shopping cart line items and purchase line items in Cortex

Added a new link to the carts.cart and purchases.purchase resources named lineitemspaginated. This returns the same elements as the existing lineitems link, but the results are paginated. The page size is defined by the COMMERCE/STORE/listPagination setting value. An example response from the lineitemspaginated resource is shown below:

{
    "self": {
        "type": "carts.paginated-line-items",
        "uri": "/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitemspaginated/1",
        "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitemspaginated/1"
    },
    "messages": [],
    "links": [
        {
            "rel": "element",
            "type": "carts.line-item",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitems/hfrdaolghazdmljrmq2tcljumntdmllbgvrdallege2gioldmu4deojqgu="
        },
        {
            "rel": "element",
            "type": "carts.line-item",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitems/gqydezrymnrteljtgrrdcljumm2dellbheygcljvmi3ggzjyhe2wknlfmy="
        },
        {
            "rel": "element",
            "type": "carts.line-item",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitems/ga3dizjqg43tcljugizwmljugbsdcllbmezdqllemiztazrtgeztenzxgi="
        },
        {
            "rel": "element",
            "type": "carts.line-item",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitems/g4ytqzbsmfsdsllbmrqwiljuhaydcljzguzwcllcgyztiojsgfqwiylbmm="
        },
        {
            "rel": "element",
            "type": "carts.line-item",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitems/giztsojwgzrwkllbgmztmljug42teljyg4zwkljsmiztanjwmjrtiy3emi="
        },
        {
            "rel": "next",
            "type": "carts.paginated-line-items",
            "href": "http://epc-sandbox.elasticpath.net:8080/cortex/carts/mobee/he3tmobuha3teljwmi2tiljuhfrdgllcgfqwelldmy2tozrqmeytmnzrha=/lineitemspaginated/2"
        }
    ],
    "pagination": {
        "current": 1,
        "page-size": 5,
        "pages": 2,
        "results": 7,
        "results-on-page": 5
    }
}

Soft delete shopping carts

When user deletes a custom shopping cart through Cortex, the cart is no longer deleted immediately. Instead, the status is set to INACTIVE, the same behaviour that occurs when checking out a shopping cart.

The InactiveCartsCleanupJob will then delete all inactive shopping carts asynchronously. However, a new setting has also been added to this job named COMMERCE/SYSTEM/INACTIVECARTSCLEANUPJOB/minAge, which controls the minimum number of minutes after last modification for an inactive shopping cart to be cleaned up. This delay was added to ensure that the Shopping Cart Events extension point has the opportunity to retrieve details about a deleted cart before the record is deleted from the database.

Gift Certificate payment plugin

For many years, Self-Managed Commerce has supported the ability for shoppers to purchase a product that generates a gift certificate balance that is tracked in the application. However, the only way to allow that gift certificate balance to be used by shoppers required consuming the Pay with Gift Certificates Accelerator.

Now, Self-Managed Commerce 8.6 provides a built-in payment plugin for making purchases using the gift certificate balance. In combination with Split Payments, this allows shoppers to pay for purchases with a combination of gift certificate balance and another payment method.

This functionality completely replaces and deprecates the Pay with Gift Certificates Accelerator.

For more information, see Payment Plugins.

The Operational Insights API now reports JVM timezone configuration

In the Operational Insights API response, the configuration --> ep-services --> [SERVICE_GUID] --> jvm node now contains a field called jvm-timezone, which reports the timezone offset as determined by the JVM. This allows the Operational Insights front-end to report a severe error if the database timezone and the applications server timezone do not match, which can lead to timezone conversion issues.

Added ability to copy a coupon code to the clipboard from Commerce Manager

When viewing a coupon code in the coupon code editor in Commerce Manager, the field is now in a read-only text box so users can highlight the code and copy it to their clipboard.

Performance Insights HTML report now includes a link to a CSV file showing JPQL query count differences

When viewing the HTML report for a Cucumber test run that compares against the release baseline, there's a new column named "Query Diffs" that contains a link. This link resolves to a CSV file that shows a list of all JPQL queries that either increased or decreased in count. The first column of the report is the JPQL query, and the second column is how much the count increased (positive value) or decreased (negative value).

For more information, see Performance Insights Reports.

Support for interleaving of version-specific platform Liquibase changesets and custom Liquibase changesets

Until now, to make schema changes in the database through Liquibase changesets, Self-Managed Commerce only supported a single injection point for custom Liquibase changesets: The extensions/database/ext-data/src/main/resources/schema/schema-customizations-changelog.xml Liquibase changelog file.

The Liquibase changesets in this file are always executed after all other schema modification changesets by Data Population. This can create a problem if a patch or version upgrade provided by Elastic Path modifies a table or index that a custom changeset is accessing or modifying.

As an example, assume that your company is using Self-Managed Commerce 8.5, and you create a custom Liquibase changeset to add a column to the TSHOPPINGITEMRECURRINGPRICE table. This changeset is part of the extensions/database/ext-data/src/main/resources/schema/schema-customizations-changelog.xml Liquibase changelog file, so it's evaluated last. Later, when upgrading to Self-Managed Commerce 8.6, that table is removed by a platform Liquibase changeset. When updating an existing database, everything appears to work as expected because Liquibase detects that the changeset to add the column to TSHOPPINGITEMRECURRINGPRICE was already executed and skips it. However, if a database is reset, the platform changeset to drop the table is executed first, and then the custom changeset to add the column is executed, but fails because the table no longer exists.

To address these issues, the extensions/database/ext-data/src/main/resources/schema folder now contains Liquibase changelog files for each version. Self-Managed Commerce 8.6 supports the following changelog files:

• schema-customizations-changelog-820.xml: Executed after all release changesets for Self-Managed Commerce 8.2 and earlier, but before any 8.2 patch changesets or 8.3 release changesets.
• schema-customizations-changelog-830.xml: Executed after all release changesets for Self-Managed Commerce 8.3, but before any 8.3 patch changesets or 8.4 release changesets.
• schema-customizations-changelog-840.xml: Executed after all release changesets for Self-Managed Commerce 8.4, but before any 8.4 patch changesets or 8.5 release changesets.
• schema-customizations-changelog-850.xml: Executed after all release changesets for Self-Managed Commerce 8.5, but before any 8.5 patch changesets or 8.6 release changesets.
• schema-customizations-changelog-860.xml: Executed after all release changesets for Self-Managed Commerce 8.6, but before any 8.6 patch changesets or 8.7 release changesets.
• schema-customizations-changelog.xml: Executed after all release changesets. This file continues to be supported for backward compatibility but is no longer recommended for use.

If the Liquibase changeset to add the column to TSHOPPINGITEMRECURRINGPRICE is moved to schema-customizations-changelog-850.xml instead of schema-customizations-changelog.xml, it will always be executed before the platform changeset for Self-Managed Commerce 8.6 that dropped this table, and no failure occurs.

Messages in ActiveMQ are now discarded automatically if not retrieved after a week

If messages are delivered to ActiveMQ queues that do not have consumers, then messages will accumulate until the storage limit of KahaDB is reached, or the machine runs out of disk space.

To address this, all messages sent to ActiveMQ now have a time-to-live defined. This value is set to one week (604800000 ms) by default, but can be overridden by setting the -Dep.jms.ttl JVM parameter. Additionally, the ActiveMQ configuration has been modified to ensure that expired messages are discarded rather than being moved to a dead letter queue.

note

Messages in a dead letter queue due to repeat failed processing attempts will not be discarded.

Fixed issues

Commerce Manager

Changed boolean attribute value dialogs to use consistent terminology

All boolean attribute values displayed in Commerce Manager now use true/false terminology instead of yes/no and true/false inconsistently.

Cleaned up warnings in Commerce Manager startup log

Fixed an issue that was causing warnings to appear in the Commerce Manager logs during startup. The warnings looked like the following:

cm              | !ENTRY org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE Warnings while parsing the images from the 'org.eclipse.ui.commandImages' extension point.
cm              | !SUBENTRY 1 org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE com.elasticpath.cmclient.core.commands.ChangePassword: plug-in='com.elasticpath.cmclient.core'
cm              | !SUBENTRY 1 org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE com.elasticpath.cmclient.core.commands.ChangePagination: plug-in='com.elasticpath.cmclient.core'
cm              | !SUBENTRY 1 org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE com.elasticpath.cmclient.core.commands.AboutApplication: plug-in='com.elasticpath.cmclient.core'
cm              | !SUBENTRY 1 org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE com.elasticpath.cmclient.core.commands.ChangeTimezone: plug-in='com.elasticpath.cmclient.core'
cm              | !SUBENTRY 1 org.eclipse.rap.ui 2 0 2024-03-19 14:28:26.394
cm              | !MESSAGE com.elasticpath.cmclient.core.commands.Docs: plug-in='com.elasticpath.cmclient.core'

Cortex

Orders are now placed on hold if a payment plugin sets requestHold field

Since version 8.0, the PaymentCapabilityResponse object that is returned by payment plugins has had a requestHold field. However, the platform has been ignoring this value. Now, if a payment plugin sets this field as part of the reserve method implementation, Self-Managed Commerce will place a hold on the order.

Example payment plugin implementation:

@Override
    public PaymentCapabilityResponse reserve(final ReserveCapabilityRequest reserveCapabilityRequest) throws PaymentCapabilityRequestFailedException {
        // Create pre-authorization through payment gateway APIs

        PaymentCapabilityResponse paymentCapabilityResponse = new PaymentCapabilityResponse();
        paymentCapabilityResponse.setData(paymentCapabilityResponseData);
        paymentCapabilityResponse.setProcessedDateTime(LocalDateTime.ofInstant(Instant.ofEpochSecond(paymentIntent.getCreated()), ZoneOffset.UTC));
        paymentCapabilityResponse.setRequestHold(true);

        return paymentCapabilityResponse;
    }

Re-exposed Apache Camel JMX MBeans

After upgrading Apache Camel from 2.25 to 3.14, the Apache Camel JMX MBeans were no longer exposed. Now these MBeans are available for all services except Cortex.

Updating a cart line item no longer deletes and recreates the cart line item database record

Previously, updating the quantity of a cart line item or the modifiers on a cart line item would actually result in delete and insert database operations. This was very inefficient, and resulted in a lot of unnecessarily complex code to deal with child line items. This has been simplified so now a simple update database operation is performed.

Refactored how shopping cart line items are loaded from the database

Shopping cart line items are complex entities because they can have multiple levels of children. To avoid making queries for all of the children of every line item at each level of the tree, a method called ShoppingCartServiceImpl#restoreDependents would retrieve all cart line items in a single query and allocate them to the correct root line items. However, this confused OpenJPA and resulted in problems when trying to update the shopping cart line items later.

To resolve this, we changed the ShoppingCartImpl domain class so that it loads all shopping cart line items (regardless of position in the tree) into a single collection. We then removed the list of child items from each shopping item and instead created methods that retrieve the child items on demand by retrieving them from the list based on their parent line item GUID.

This change greatly simplified the JPA object graph and allowed us to remove some complex logic that was causing problems.

Payment failures during checkout should not include stack trace in structured error response

Fixed an issue where a complete stack trace was being included in a field of the structured error message called InternalMessage when an error occurred during payment processing. This field has been replaced with a field called cause that includes a simple text message that explains the reason for the failure. Example:

{
  "messages": [
    {
      "type": "error",
      "id": "payment.failed",
      "debug-message": "Error occurred when processing payment.",
      "data": {
        "cause": "Not enough balance on this gift certificate."
      }
    }
  ]
}

Fixed issue with Cortex refusing to load promotion rules if they didn't exist on first attempt to load them

Due to a caching bug, if Cortex attempted to load compiled rules from the TRULESTORAGE table before Search Server finished building them, the Cortex server would never attempt to load them again. This resulted in promotions not being calculated until the server was restarted. Now, the cache is aware of the compiled rules are not present and will periodically check the database to see if the rules are available.

Made several improvements to api-platform exception handling

Fixed several issues related to how exceptions are handled in Cortex resources:

• When an unexpected exception is reported in the Cortex response body for a resource, the reference number in the response now matches the logged reference number. Example:

  Server failure processing resource operation. See log for details. Ref#214ce0f1-8268-11ee-bea8-a2b04d2007df
  

• When an unexpected exception is reported in the Cortex response body for an advisor, the response now includes a reference number that matches the logged reference number. Example:

  "messages": [
    {
      "type": "error",
      "id": "advisor.internal.error",
      "debug-message": "Server failure processing advise operation. Ref#a17954ce-8272-11ee-8b25-a2b04d2007df",
      "blocks": {}
    }
  ]
  

• The full stack trace was not being logged in some circumstances.

Added the Vary header to Cortex responses to prevent client-side caching issues

Front-ends using Javascript to access Cortex were finding that the browser was only using the request URI as the key for browser caching. This caused several issues, for example:

• If a user logs out and a new user logs in, the new user might see the old user’s responses.
• If the selected account is changed, the user might see responses from a different account, or from when no account was selected.
• If the language is changed, the user might see responses from the old language.

The reason for this is that Cortex returns header Cache-Control: private with many responses. This means that the browser is permitted to cache the response for the current machine. However, since Cortex was not also sending the Vary header, only the request URI was used in the cache key.

The HTTP Vary header allows a service to tell upstream caches (such as browser caches) that the response body is influenced by the value of certain request headers. By default, Cortex now sends this header with all responses:

Vary: authorization, accept, accept-language, x-ep-account-shared-id, x-ep-user-traits, x-ep-user-id, x-ep-user-roles, x-ep-user-scopes, x-ep-data-policy-segments

The values returned by this header can be overridden by setting the cortex.response.header.vary JVM parameter.

Cortex Studio

Added option to control whether or not browser caching should be used

By default, all HTTP requests from Studio to Cortex include a cache busting query parameter like this: ?_=1694273409740. This ensures that the browser will always make a request to Cortex rather than using the browser cache to return the response. In some cases, it may be necessary to disable the cache busting parameter, such as when testing client-side caching of Cortex responses. Therefore, a new checkbox has been added to the "Setup" section of studio named "Bypass Browser Caching". When enabled (which is the default), the cache busting query parameter will be added to ensure that the client-side cache is not used. When disabled, the cache busting query parameter will not be used, and duplicate requests may come from the client-side cache.

Integration Server

Orders with a physical shipment are no longer released until the shipment is released

Previously, when an order was first created, the InitiateFulfilmentCheckoutAction checkout action executed by the Integration Server (as part of the PostCaptureCheckoutService) would call OrderService#releaseOrder right away. This "release order" method does a few things including changing the order status to IN_PROGRESS and sending the ORDER_RELEASED event. The ORDER_RELEASED event tells listeners that it is safe to release the order to fulfillment (i.e. ship the product to the customer). In Self-Managed Commerce 8.6, this event tells Integration Server to trigger all extensions assigned to the Order Release Events extension point.

The issue with this behavior was that the physical shipment could still be in the INVENTORY_ASSIGNED state, meaning that business users are still permitted to modify the shipment before it goes to fulfillment. There is a "pick delay" configuration on the warehouse that defines how long physical shipments should stay in this state before they are released. Alternatively, business users can manually release physical shipments through Commerce Manager.

The new behaviour ensures that orders with a physical shipment are only released by the InitiateFulfilmentCheckoutAction checkout action once the physical shipment is released. This ensures that the order is only released to fulfillment after the shipment can no longer be modified by business users.

The Catalog Syndication history table has been dropped

Previously, when Catalog Syndication projections were built by Batch Server, if a previous snapshot of an entity existed, it was copied from the TCATALOGPROJECTIONS table to the TCATALOGHISTORY table. However, no APIs were provided for accessing the data in this table, and the table often grew to an extremely large size with no real benefit.

Therefore the TCATALOGHISTORY table has now been removed, and the Catalog Syndication projection builder no longer populates these records. The cleanupCatalogSyndicationHistoryJob Batch job has also been removed.

The Integration Server readiness health check no longer validates that Search Server indexes are fully built

Previously, the Integration Server readiness health check would fail until the related Search Server completed. This was causing several issues:

• The deprecated health check endpoints were delegating to the readiness checks (not the liveness checks) so they were taking much longer to pass, resulting in services being restarted while the search indexes were being built.
• The smoke tests were expecting Integration Server readiness checks to fail, because they weren't waiting long enough for the search indexes to complete building.
• An Integration Server often connects to several load-balanced Search Servers, which can each be at different states of index completion, which can result in strange results from the Integration Server health checks.

As a result of these issues, we removed this step from the Integration Server readiness health check.

Fixed issue with Operational Insights sometimes returning partial responses

Previously, when an Operational Insights API request was received, Integration Server would wait for a fixed period of time for all responses to arrive from running services. This meant that sometimes it would delay unnecessarily, and sometimes it would not wait long enough for all responses to arrive.

Now, Operational Insights first sends out a "ping" request to all services to determine what is running in the environment. Then it requests the configuration and runtime details and waits until replies are received from all running services before returning the consolidated response. This ensures that all services are given enough time to generate a reply which can be included in the response.

Search Server

Invalid compiled Drools rules are now automatically deleted

A startup check was added to the Search Server to determine if the rules compiled into the TRULESTORAGE table are invalid. This usually occurs if the Drools version was upgraded which results in errors occurring when the compiled rules are retrieved. Once the rules are deleted, Search Server will rebuild the contents of the TRULESTORAGE table automatically.

Fixed issue with Search Server freezing during shut down if index build was in progress

If a user attempted to terminate Search Server while an index build was in progress, the service would lockup and would need to be forcibly killed. This has now been resolved.

Batch Server

Changed the behaviour of the batch size configuration parameter for data cleanup jobs

Each data cleanup job in the Batch Server is configured with a batchSize parameter (i.e. COMMERCE/SYSTEM/ANONYMOUSCUSTOMERCLEANUP/batchSize). Previously, this value simply indicated how many records would be processed in a single transaction, and the cleanup job would always keep executing batches until all available records were processed. Now, the cleanup job will only process up to the number of records specified by batchSize (in a single transaction) and then stop. Any remaining records will be processed in the next scheduled execution of the job.

Improved Catalog Syndication cleanup process to run in batches to avoid lock wait timeouts

When the Catalog Syndication projection build is run with the cleanUpDatabase option set, the cleanup operation now runs in a batch operation so that large deletes do not timeout.

Import/Export

Improved Import/Export exception stack trace

In some circumstances, if a problem was detected in the data being imported, Import/Export would throw an exception that was logged as follows:

com.elasticpath.importexport.common.exception.runtime.PopulationRollbackException: null

This exception didn't provide any details about the nature of the issue that was found. This has been improved, so the exception now shows the details of the problem.

Fixed issue with unexpected locales being included when exporting locale-specific attribute values

When exporting attribute values with locale-specific values, unexpected locales were being included in the results. This was due to Import/Export generating values for all locales supported by the JVM. Now, only locale-specific values present in the databse will be exported.

Exporting data using Maven no longer requires ep.debug.port to be specified

When exporting Import/Export data using Maven, the Maven command would fail unless the ep.debug.port property was specified. Now it defaults to 8000 so it can be run without specifying this property.

Added additional validation to order import functionality

Added additional validation to Import/Export for orders to ensure that child records aren't accidentally transferred from one order to another by importing a child record with a GUID that already exists in the database. Affected child record types include order skus, shipments, payments, and order payment instruments.

Database

Multiple improvements to PostgreSQL support

In PostgreSQL, a server can contain multiple databases, and each database can have multiple schemas. Previously, we allowed the database to be selected by setting the epdb.databasename JVM parameter, but Self-Managed Commerce would always use the public schema. Now, the schema can also be selected by setting the epdb.schemaname JVM parameter.

Additionally, when running reset-db on PostgreSQL, the initialization script would drop and recreate the user, which would also drop all objects owned by that user, including schemas. In Self-Managed Commerce 8.6, the user is only created if it doesn't already exist, and users are never dropped.

Finally, the uuid-ossp extension is now installed in the pg_catalog schema, allowing it to be used by multiple schemas. This allows the creation of multiple Self-Managed Commerce schemas on a single PostgreSQL database.

Moved wish list items out of TCARTITEM table into new TWISHLISTITEM table

Previously, both shopping cart line items and wish list items were stored in the TCARTITEM table. To support this, TCARTITEM contained nullable SHOPPINGCART_UID and WISHLIST_UID fields. Due to this architecture, there was a chance for table scans to occur when filtering on these fields due to low cardinality of the indexed field.

To address this, a new TWISHLISTITEM table has been created and all wish list items have been moved into this table. Additionally, the SHOPPINGCART_UID field has been changed to non-nullable, and the WISHLIST_UID field has been removed from TCARTITEM.

Additional Commerce Engine fixes

• When extensions implementing ProductSkuValidator were being called, the XPFProductSkuValidationContext#getParentProductSku method was always returning null during cart update operations, even if the cart line item had a parent line item.
• The custom RandomGuidImpl class for generating UUIDs has been removed and all uses of this class have been refactored to use the Java-provided UUID#randomUUID method instead. The custom class was using the MD5 hash, which was being flagged as having a "weak pseudo-random" vulnerability.
• Fixed some small inconsistencies between services regarding where the ep.properties and ep.override.properties files were expected to be found. Those inconsistencies have been resolved and all services now look for these files in the locations documented in Spring Configuration.
• Updated all Camel routes to extend CRSCEnabledRouteBuilder so they properly evict the Core Request-Scoped Cache and avoid dirty reads.
• Fixed an issue where a caching logic bug caused the TimeService#getTimeZone method to intermittently return null.
• When publishing change sets, email notifications indicating success or failure were not being delivered to the change set owner. This has now been resolved.
• Removed confusing optional contexts parameter from SettingsReader#getSettingValues which didn't work as expected and was unused.
• Fixed issue where CouponUsageLimitValidator didn't properly handle some coupon-related issues.
• Fixed an issue where the post capture checkout process was unintentionally retried multiple times if there was an exception thrown.
• Fixed a potential race condition around initialization of the CategoryLookup and CategoryService load tuners which could cause errors about unloaded fields.
• Fixed issue where the Cortex health checks may read the internal health check URL using the wrong Tomcat connector, which can cause the health checks to show Cortex as healthy before startup completes.
• Added an exclusion on Spring Framework dependencies within ext-commerce-engine-wrapper to ensure that Spring dependencies aren't accidentally embedded in the bundle. This implements the suggested recommended in this Expert Blog post.
• The ep-rest-repositories-epcommerce module was previously defined as a bundle, but was not deployed as a bundle. This module embedded within the ext-cortex-repositories bundle. The maven-bundle-plugin plugin has been removed, and the pom.xml file now defines this module as a jar.
• Due to an issue in the permission.properties configuration in the cart --> lineitems --> element --> dependentoptions resource, an "Authorization failed" error was appearing in the Cortex logs. This has now been resolved.
• Removed the logic that allowed cached tax calculation for a shopping cart to be reused when checking out, which was unnecessarily complex and was causing a possible issue where tax calculation failures could occur.
• Fixed an issue where the store was not always set properly on the XPFProductSku object when a shopping item context was created.
• Removed code that could change a customer's associated store code when they log into a linked store.
• Fixed issue for scenario when multiple customer records have the same username for different stores, the wrong customer record could be selected during authentication.
• Fixed a NullPointerException that can occur if custom code attempts to save a sku option value using SkuOptionService#add(SkuOptionValue).
• Changed the "Less shipment discount" label on the Commerce Manager shipment summary to always appear as black.
• Added java.base/java.lang.invoke to add-opens to resolve a potential Helix Validator plugin failure.
• Added additional add-opens JVM parameters to prevent possible failures when Operational Insights evaluates cache sizes.
• Fixed exception handling when an unexpected attribute value type was read from an attribute value table.
• Improved exception handing around customer creation logic to ensure that root cause is properly logged.
• Fixed anonymous customer cleanup job failure that occurs if a customer has wish list items.
• Fixed issue with the ActiveMQ console showing an error when accessed on a local developer machine.
• Fixed issue where a selling context condition that uses "not matching" or "not containing" incorrectly evaluated to false if the key was not present in the tagset.
• If order hold resolution fails due to a locked order, process will now retry automatically.
• Fixed race condition that can occur if a user posts multiple requests to the registration form concurrently. This change ensures that only a single authentication record is created in this circumstance.
• Fixed Cortex permission error that can occur if x-ep-account-shared-id header is set when reading accounts associated to the current user.
• Fixed Cortex server error that occurs when reading applied promotions on a shopping cart where one or more line items has no price.
• Fixed a failure in the wishlistmembership resource if a wish list contains the same product sku more than once.
• Fixed a NullPointerException that can occur if looking up a non-existent category GUID with CategoryLookup#findByGuid.
• Modified the handling of email localized property values so that properties that are explicitly set to empty string result in an empty string being used as the value.
• Fixed usages of COMMERCE/SYSTEM/FILTEREDNAVIGATION/separatorInToken so the setting works as expected.
• Fixed issue with Query Analyzer associating SQL queries to the wrong JPQL query in some circumstances.
• Fixed issue where physical product inventory was not properly released if an order failed.
• Fixed issue with offer price range not including bundle price adjustments.
• Fixed an issue where the last modified date on a setting value was not being updated when the setting value was changed.
• Fixed issue with customer CSV imports treating shared ID as case sensitive in PostgreSQL.
• Removed unused /authentication/user endpoint in Cortex.
• Fixed equals/hashcode implementation in IndexNotificationImpl.
• When a Cortex item and offer keyword searches return zero results, a fallback fuzzy search is supposed to be attempted. The second search was doing the exact same search as the initial search instead of doing a fuzzy search.
• Fixed an issue with Import/Export where the service could run out of memory when importing large files with a lot of errors. Now, only the first 20 errors are held in memory and displayed in the results.
• Fixed issue in which the Data Sync Webapp would try to send emails even if they were disabled by setting COMMERCE/SYSTEM/emailEnabled to false.
• Addressed several split package warnings in Cortex.
• Updated the Data Population reset-db functionality in MySQL to use the data.population.databasename property instead of the data.population.schemaname.
• Replaced the custom ep-tycho-versions-plugin with the standard tycho-maven-plugin in the set-ep-versions.sh script.
• Changed all references to the P2 repositories at http://download.eclipse.org with https://download.eclipse.org.
• Moved all dependency version definitions to bill-of-materials/pom.xml.
• Moved all plugin version definitions to the top-level pom.xml.
• Fixed issue where an untracked file (ruleUpdate.properties) was left in the Git source folder after running a build with tests enabled.
• Changed ep-test-application dependencies to test scope to ensure that test artifacts don't end up in the compiled WAR files.
• Updated Checkstyle plugin configuration to remove use of deprecated sourceDirectory parameter that appeared as a warning in the build output.
• Fixed PostgreSQL initialization scripts so that they work properly when a low-privilege database user is specified in the data.population.username data population parameter.
• Removed the Commerce Manager reactors from mvnmin.xml, which are no longer required after the Tycho 4 upgrade.

Additional Commerce Manager fixes

• Fixed Commerce Manager build failure that appears as "bundle org.eclipse.equinox.p2.repository is not started" error.
• Fixed issue where scroll bar doesn't appear as expected after adding new promotion conditions or actions.
• Fixed Commerce Manager to allow orders in the CREATED state to be canceled.
• Added ability to use quotes to request an exact match on each individual word when searching for products and skus in Commerce Manager.
• Fixed search error that can occur if a Commerce Manager search field contains OR or AND.
• Fixed issue with currency codes being duplicated in the currency drop-down on shopping cart promotions.
• Fixed an error that could appear when doing search operations in Commerce Manager if the COMMERCE/SEARCH/boosts system configuration setting was specified.
• Fixed issue with fields not properly being disabled on the coupon assignment page of the shopping cart promotion wizard.
• Fixed issue with the "Assign All Stores" option being disabled in some cases when copying a shopping cart promotion.
• Improved messaging around where a generic "A system error has occurred" error that appeared if a user attempts to delete a product sku that is in use on an order.
• Fixed issue where price list drop-down in Commerce Manager product editor was empty unless user had access to all catalogs.
• Fixed issue with sorting accounts by business number where duplicate records were appearing.
• Fixed issue where buyer admins see customers from other stores when associating buyers to an account by email address.
• Fixed issue with selected disabled radio buttons and checkboxes being invisible on the shopping cart promotion wizard.
• Fixed issue with Commerce Manager initialization that can occur if several initial requests are received concurrently.

Additional Performance fixes

• Refactored InventoryFlowServiceImpl so that product skus are passed as parameters and unnecessary database lookups can be avoided.

• Refactored ProductInventoryShoppingServiceImpl to prevent inventory lookup for all skus in a multi-sku product when checking inventory for a single sku.

• Added logic to avoid creating unnecessary shopper and shopping cart records when the x-ep-account-shared-id header is set in Cortex.

• Refactored AbstractShoppingItemImpl to eliminate unnecessary queries to update cart item last modified date (i.e. UPDATE TCARTITEM SET LAST_MODIFIED_DATE = ? WHERE UIDPK = ?) when persisting the shopping cart.

• Removed the TSHOPPINGITEMRECURRINGPRICE table and changed the relationship from ShoppingItemImpl to ShoppingItemRecurringPriceImpl from persisted to transient. Since pricing is recalculated each time the shopping cart is loaded, there's no reason to persist recurring prices in the database. This allows us to eliminate the following unnecessary queries:

  SELECT t0.UIDPK, t0.GUID, t0.FREQ_AMOUNT, t0.FREQ_UNIT, t0.PAYMENT_SCHEDULE_NAME, t0.DURATION_AMOUNT, t0.DURATION_UNIT, t0.LIST_UNIT_PRICE, t0.PROMO_UNIT_PRICE, t0.SALE_UNIT_PRICE FROM TSHOPPINGITEMRECURRINGPRICE t0 WHERE t0.CARTITEM_UID = ?
  

• Removed the JPA relationship from ProductImpl to ProductTypeImpl. Product type is now loaded only on-demand if the Product#getProductType method is called. We also improved caching of product types in CachingProductTypeDaoImpl. The main benefit of this change is that the product cache uses 30-60% less memory.

• Improved performance of the wishlistmembership link by eliminating duplicate shopper and customer queries.

• Added a 60 second cache around inventory lookups done by Cortex during add-to-cart operations and availability requests.

  • This means that for high demand physical products, these products might appear available or be permitted to be added to cart for up to a minute after they run out of stock.
  • However, the final inventory lookup at checkout is not cached, so shoppers will be blocked from checking out products that have run out of inventory.

• Refactored the core-changelog-2021-01-data-fields-as-json-clob.xml Liquibase changeset to make it run 20-30X faster on PostgreSQL databases.

• Changed sortattributes link to static instead of conditional to remove unnecessary extra product search when using the offersearch resource.

• Fixed product lookup cache population bug that can lead to unnecessary database queries.

• Added a database index on the name and state_code fields of the TCHANGESET table to address performance issue in the Automated Imports Accelerator.

Additional Test fixes

• Fixed intermittent failure in the Promotion Search With Quotes.Search for promotion in store by single name no quotes Cucumber test.
• Fixed intermittent failure in the AccessTokenDtoTransformerTest.testTransformToOAuth2AccessToken unit test.
• Fixed intermittent failure in several Cucumber tests that appears as Unable to find event type [ORDER_RELEASED].
• Fixed intermittent failure in several Selenium tests that appeared as Error forwarding the new session Empty pool of VM for setup.
• Improved reliability of SarchIndexDefinition#verifyIndexStatus method that verifies the Search Index status in Cucumber tests.
• Deleted the commerce-engine/core/ep-core-cucumber-itests module, which only contained a single test of dubious value.
• Improved H2DataSourceInitializerImpl to prevent H2 database snapshots from being corrupted when multiple tests are run concurrently.
• Modified the webapp-smoketests module to validate services using liveness healthcheck instead of readiness healthcheck, and removed an unnecessary dependency on htmlunit.
• Fixed issue where parent-widget-id and widget-type attributes on a table row were not properly set after a table is updated. This could lead to Selenium test issues.
• Several Cucumber tests and the Webapp Smoke tests module start Self-Managed Commerce services using the Cargo Plugin. These tests instructed the services to listen for JMX requests on pre-defined ports. These ports were sometimes used by other Operating System services which led to "port in use" exceptions. The JMX parameters have now been removed so that the services will no longer listen on these ports.
• Modified Performance Insights so that Core Request-Scoped Caching is disabled when these tests are executed to ensure that it doesn't hide performance issues.

Supported technology updates

Self-Managed Commerce 8.6.0 is compatible with the following Elastic Path releases:

Elastic Path Component	Compatibility
Extension Point Framework	Extension Point Framework compatibility matrix
CloudOps for Kubernetes	CloudOps for Kubernetes compatibility matrix
Self-Managed Commerce Docker	Self-Managed Commerce Docker compatibility matrix

For more information, see Supported Technologies.

Dependency changes

Many dependencies were updated as part of Self-Managed Commerce 8.6.0. The highlights are shown below:

• Upgraded ActiveMQ from 5.16.5 to 5.17.6 to address CVE-2023-46604 and CVE-2023-46604.
• Upgraded Apache Shiro from 1.9.1 to 1.13.0 to address CVE-2023-34478 and CVE-2023-46749.
• Upgraded Apache SOLR from 8.11.1 to 9.4.1 to address several CVEs.
• Upgraded certified Tomcat version from 9.0.50 to 9.0.85 to address several CVEs.
• Upgraded Drools from 7.6 to 7.74.1 to address CVE-2022-1415.
• Upgraded h2 from 2.1.214 to 2.2.224 to address CVE-2022-45868.
• Upgraded Liquibase from 4.8.0 to 4.27.0 to support new functionality.
• Upgraded Logback from 1.2.10 to 1.2.13 to address CVE-2023-6481.
• Upgraded Maven Failsafe Plugins and Maven Surefire Plugins from 2.22.2 to 3.1.2 to support new functionality.
• Upgraded pf4j from 3.6.0 to 3.10.0 to address CVE-2023-40828.
• Upgraded Spring Framework from 5.3.26 to 5.3.34 to address CVE-2023-20863, CVE-2024-2225, CVE-2024-22243, CVE-2024-22262.

The complete list of all library dependency updates can be seen in the table below:

Library	Change
activemq-broker-5.17.5.jar	Version changed from 5.16.5
activemq-client-5.17.6.jar	Version changed from 5.17.5
activemq-jms-pool-5.17.6.jar	Version changed from 5.17.5
activemq-kahadb-store-5.17.5.jar	Removed
activemq-mqtt-5.17.6.jar	Added
activemq-openwire-legacy-5.17.5.jar	Version changed from 5.16.5
activemq-pool-5.17.6.jar	Version changed from 5.17.5
activemq-spring-5.16.7.jar	Version changed from 5.16.5
activemq-web-console-5.17.6.war	Version changed from 5.17.5
ant-1.10.14.jar	Version changed from 1.7.1
ant-launcher-1.10.14.jar	Version changed from 1.7.1
antisamy-1.7.5.jar	Version changed from 1.6.7
antlr4-runtime-4.8.jar	Version changed from 4.5.1-1
antlr4-runtime-4.7.1.jar	Removed
apache-el-9.0.83.1.jar	Version changed from 8.5.70
apache-jsp-10.0.20.jar	Version changed from 9.4.44.v20210927
apache-jsp-9.0.83.1.jar	Version changed from 8.5.70
apache-jstl-10.0.20.jar	Version changed from 9.4.44.v20210927
api-asn1-api-2.1.5.jar	Added
api-asn1-ber-2.1.5.jar	Added
api-i18n-2.1.5.jar	Added
api-ldap-model-2.1.5.jar	Added
api-util-2.1.5.jar	Added
apiguardian-api-1.1.0.jar	Removed
asm-7.2.jar	Version changed from 8.0.1
asm-analysis-7.2.jar	Added
asm-commons-7.2.jar	Version changed from 8.0.1
asm-tree-7.2.jar	Added
audience-annotations-0.12.0.jar	Version changed from 0.5.0
avatica-core-1.18.0.jar	Removed
awaitility-3.1.6.jar	Version changed from 2.0.0
batik-constants-1.17.jar	Version changed from 1.14
batik-css-1.17.jar	Version changed from 1.14
batik-i18n-1.17.jar	Version changed from 1.14
batik-shared-resources-1.17.jar	Version changed from 1.14
batik-util-1.17.jar	Version changed from 1.14
caffeine-3.1.8.jar	Version changed from 2.9.2
calcite-core-1.27.0.jar	Removed
calcite-linq4j-1.27.0.jar	Removed
camel-activemq-3.14.10.jar	Version changed from 3.14.6
camel-api-3.14.10.jar	Version changed from 3.14.6
camel-attachments-3.14.10.jar	Version changed from 3.14.6
camel-base-3.14.10.jar	Version changed from 3.14.6
camel-base-engine-3.14.10.jar	Version changed from 3.14.6
camel-bean-3.14.10.jar	Version changed from 3.14.6
camel-browse-3.14.10.jar	Version changed from 3.14.6
camel-cloud-3.14.10.jar	Version changed from 3.14.6
camel-cluster-3.14.10.jar	Version changed from 3.14.6
camel-controlbus-3.14.10.jar	Version changed from 3.14.6
camel-core-3.14.10.jar	Version changed from 3.14.6
camel-core-engine-3.14.10.jar	Version changed from 3.14.6
camel-core-languages-3.14.10.jar	Version changed from 3.14.6
camel-core-model-3.14.10.jar	Version changed from 3.14.6
camel-core-processor-3.14.10.jar	Version changed from 3.14.6
camel-core-reifier-3.14.10.jar	Version changed from 3.14.6
camel-core-xml-3.14.10.jar	Version changed from 3.14.6
camel-dataformat-3.14.10.jar	Version changed from 3.14.6
camel-dataset-3.14.10.jar	Version changed from 3.14.6
camel-direct-3.14.10.jar	Version changed from 3.14.6
camel-directvm-3.14.10.jar	Version changed from 3.14.6
camel-file-3.14.10.jar	Version changed from 3.14.6
camel-groovy-3.14.10.jar	Version changed from 3.14.6
camel-health-3.14.10.jar	Version changed from 3.14.6
camel-http-base-3.14.10.jar	Version changed from 3.14.6
camel-http-common-3.14.10.jar	Version changed from 3.14.6
camel-jackson-3.14.10.jar	Version changed from 3.14.6
camel-jaxb-3.14.10.jar	Version changed from 3.14.6
camel-jms-3.14.10.jar	Version changed from 3.14.6
camel-jsonpath-3.14.10.jar	Version changed from 3.14.6
camel-language-3.14.10.jar	Version changed from 3.14.6
camel-log-3.14.10.jar	Version changed from 3.14.6
camel-mail-3.14.10.jar	Version changed from 3.14.6
camel-management-3.14.10.jar	Added
camel-management-api-3.14.10.jar	Version changed from 3.14.6
camel-mock-3.14.10.jar	Version changed from 3.14.6
camel-ref-3.14.10.jar	Version changed from 3.14.6
camel-rest-3.14.10.jar	Version changed from 3.14.6
camel-saga-3.14.10.jar	Version changed from 3.14.6
camel-scheduler-3.14.10.jar	Version changed from 3.14.6
camel-seda-3.14.10.jar	Version changed from 3.14.6
camel-servlet-3.14.10.jar	Version changed from 3.14.6
camel-spring-3.14.10.jar	Version changed from 3.14.6
camel-spring-xml-3.14.10.jar	Version changed from 3.14.6
camel-stub-3.14.10.jar	Version changed from 3.14.6
camel-support-3.14.10.jar	Version changed from 3.14.6
camel-swagger-java-3.14.10.jar	Version changed from 3.14.6
camel-test-3.14.10.jar	Version changed from 3.14.6
camel-test-spring-3.14.10.jar	Version changed from 3.14.6
camel-timer-3.14.10.jar	Version changed from 3.14.6
camel-tooling-model-3.14.10.jar	Version changed from 3.14.6
camel-util-3.14.10.jar	Version changed from 3.14.6
camel-util-json-3.14.10.jar	Version changed from 3.14.6
camel-validator-3.14.10.jar	Version changed from 3.14.6
camel-vm-3.14.10.jar	Version changed from 3.14.6
camel-xml-io-util-3.14.10.jar	Version changed from 3.14.6
camel-xml-jaxb-3.14.10.jar	Version changed from 3.14.6
camel-xml-jaxp-3.14.10.jar	Version changed from 3.14.6
camel-xpath-3.14.10.jar	Version changed from 3.14.6
camel-xslt-3.14.10.jar	Version changed from 3.14.6
cglib-nodep-2.1_3.jar	Removed
cglib-nodep-3.1.jar	Removed
checker-qual-3.12.0.jar	Removed
checker-qual-3.33.0.jar	Version changed from 3.10.0
classmate-1.5.1.jar	Version changed from 1.3.4
com.ibm.icu.base-58.2.0.v20170418-1837.eclipse-plugin	Removed
commons-compiler-3.0.9.jar	Removed
commons-fileupload-1.4.jar	Added
commons-pool2-2.4.2.jar	Removed
commons-pool2-2.11.1.jar	Removed
curator-client-2.13.0.jar	Removed
curator-framework-2.13.0.jar	Removed
curator-recipes-2.13.0.jar	Removed
dec-0.1.2.jar	Removed
disruptor-3.4.2.jar	Removed
drools-compiler-7.74.1.Final.jar	Version changed from 7.6.0.Final
drools-core-7.74.1.Final.jar	Version changed from 7.6.0.Final
drools-core-dynamic-7.74.1.Final.jar	Added
drools-core-reflective-7.74.1.Final.jar	Added
drools-ecj-7.74.1.Final.jar	Added
drools-mvel-7.74.1.Final.jar	Added
ecj-4.4.2.jar	Removed
ecj-3.33.0.jar	Version changed from 3.19.0
eigenbase-properties-1.1.5.jar	Removed
error_prone_annotations-2.18.0.jar	Version changed from 2.11.0
esapi-2.5.3.1.jar	Version changed from 2.3.0.0
esri-geometry-api-2.2.0.jar	Removed
guava-32.0.1-jre.jar	Version changed from 31.1-jre
h2-2.2.224.jar	Version changed from 2.1.214
hawtdispatch-1.22.jar	Version changed from 1.11
hawtdispatch-transport-1.22.jar	Version changed from 1.11
hibernate-validator-6.2.0.Final.jar	Version changed from 6.0.20.Final
hppc-0.9.1.jar	Version changed from 0.8.1
hsqldb-2.3.2.jar	Removed
htmlunit-2.70.0.jar	Removed
htmlunit-core-js-2.70.0.jar	Removed
htmlunit-cssparser-1.14.0.jar	Removed
htmlunit-xpath-2.70.0.jar	Removed
htrace-core4-4.1.0-incubating.jar	Removed
http2-client-10.0.20.jar	Version changed from 9.4.44.v20210927
http2-common-10.0.20.jar	Version changed from 9.4.44.v20210927
http2-hpack-10.0.20.jar	Version changed from 9.4.44.v20210927
http2-http-client-transport-10.0.20.jar	Version changed from 9.4.44.v20210927
http2-server-9.4.44.v20210927.jar	Removed
httpclient5-5.3.1.jar	Version changed from 5.1.3
httpcore5-5.2.4.jar	Version changed from 5.1.3
httpcore5-h2-5.2.4.jar	Version changed from 5.1.3
imap-1.5.6.jar	Version changed from 1.5.2
j2objc-annotations-2.8.jar	Version changed from 1.3
jackson-annotations-2.16.1.jar	Version changed from 2.13.4
jackson-core-2.16.1.jar	Version changed from 2.13.4
jackson-databind-2.16.1.jar	Version changed from 2.13.4
jackson-dataformat-cbor-2.16.1.jar	Added
jackson-dataformat-smile-2.16.1.jar	Version changed from 2.12.3
jackson-datatype-jsr310-2.16.1.jar	Version changed from 2.13.4
jackson-jaxrs-base-2.16.1.jar	Version changed from 2.13.4
jackson-jaxrs-json-provider-2.16.1.jar	Version changed from 2.13.4
jackson-module-jaxb-annotations-2.16.1.jar	Version changed from 2.13.4
jakarta.el-3.0.4.jar	Added
jakarta.servlet.jsp.jstl-api-1.2.7.jar	Added
jakarta.transaction-api-1.3.3.jar	Added
jakarta.validation-api-2.0.2.jar	Added
janino-3.0.9.jar	Removed
javax.el-3.0.0.jar	Removed
javax.inject-1.0.0.v20091030.eclipse-plugin	Removed
jaxb-api-2.3.1.jar	Added
jboss-logging-3.4.1.Final.jar	Version changed from 3.3.2.Final
jcip-annotations-1.0-1.jar	Added
jersey-container-jetty-http-2.39.1.jar	Added
jersey-entity-filtering-2.39.1.jar	Added
jersey-media-json-jackson-2.39.1.jar	Added
jersey-server-2.39.1.jar	Added
jetty-alpn-client-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-alpn-java-client-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-annotations-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-client-9.4.50.v20221201.jar	Removed
jetty-client-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-http-10.0.20.jar	Version changed from 9.4.50.v20221201
jetty-io-10.0.20.jar	Version changed from 9.4.50.v20221201
jetty-jaas-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-jndi-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-plus-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-runner-10.0.20.jar	Version changed from 9.4.44.v20210927
jetty-schemas-4.0.3.jar	Version changed from 3.1.2
jetty-security-10.0.20.jar	Added
jetty-server-10.0.20.jar	Added
jetty-servlet-10.0.20.jar	Added
jetty-servlet-api-4.0.6.jar	Added
jetty-slf4j-impl-10.0.20.jar	Added
jetty-util-9.4.51.v20230217.jar	Added
jetty-util-10.0.20.jar	Added
jetty-webapp-10.0.20.jar	Added
jetty-xml-10.0.20.jar	Added
jjwt-api-0.10.5.jar	Removed
jjwt-impl-0.10.5.jar	Removed
jjwt-jackson-0.10.5.jar	Removed
jose4j-0.6.5.jar	Removed
json-20231013.jar	Version changed from 20220924
json-path-2.9.0.jar	Version changed from 2.6.0
jsoup-1.15.3.jar	Version changed from 1.8.3
jstl-1.2.jar	Removed
jstl-1.1.2.jar	Removed
junit-4.13.1.jar	Version changed from 4.12
kerb-core-1.0.1.jar	Removed
kerb-util-1.0.1.jar	Removed
kerby-asn1-1.0.1.jar	Removed
kerby-pkix-1.0.1.jar	Removed
kie-api-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-internal-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-memory-compiler-7.74.1.Final.jar	Added
kie-soup-commons-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-soup-maven-support-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-soup-project-datamodel-api-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-soup-project-datamodel-commons-7.74.1.Final.jar	Version changed from 7.6.0.Final
kie-soup-xstream-7.74.1.Final.jar	Added
liquibase-core-4.27.0.jar	Version changed from 4.8.0
log4j-layout-template-json-2.16.0.jar	Removed
logback-classic-1.2.13.jar	Version changed from 1.2.10
logback-core-1.2.13.jar	Version changed from 1.2.10
lucene-analysis-common-9.8.0.jar	Added
lucene-analysis-kuromoji-9.8.0.jar	Added
lucene-analysis-nori-9.8.0.jar	Added
lucene-analysis-phonetic-9.8.0.jar	Added
lucene-analyzers-common-8.11.1.jar	Removed
lucene-analyzers-kuromoji-8.11.1.jar	Removed
lucene-analyzers-nori-8.11.1.jar	Removed
lucene-analyzers-phonetic-8.11.1.jar	Removed
lucene-backward-codecs-9.8.0.jar	Version changed from 8.11.1
lucene-classification-9.8.0.jar	Version changed from 8.11.1
lucene-codecs-9.8.0.jar	Version changed from 8.11.1
lucene-core-9.8.0.jar	Version changed from 8.11.1
lucene-expressions-9.8.0.jar	Version changed from 8.11.1
lucene-grouping-9.8.0.jar	Version changed from 8.11.1
lucene-highlighter-9.8.0.jar	Version changed from 8.11.1
lucene-join-9.8.0.jar	Version changed from 8.11.1
lucene-memory-9.8.0.jar	Version changed from 8.11.1
lucene-misc-9.8.0.jar	Version changed from 8.11.1
lucene-queries-9.8.0.jar	Version changed from 8.11.1
lucene-queryparser-9.8.0.jar	Version changed from 8.11.1
lucene-sandbox-9.8.0.jar	Version changed from 8.11.1
lucene-spatial-extras-9.8.0.jar	Version changed from 8.11.1
lucene-spatial3d-9.8.0.jar	Version changed from 8.11.1
lucene-suggest-9.8.0.jar	Version changed from 8.11.1
metrics-jetty9-4.1.5.jar	Removed
metrics-jmx-4.2.21.jar	Version changed from 4.1.5
metrics-jvm-4.2.21.jar	Version changed from 4.1.5
mina-core-2.2.3.jar	Added
mqtt-client-1.16.jar	Version changed from 1.3
mvel2-2.4.13.Final.jar	Version changed from 2.4.0.Final
mysql-connector-j-8.2.0.jar	Added
mysql-connector-java-8.0.30.jar	Removed
neko-htmlunit-3.11.1.jar	Version changed from 2.24
nekohtml-1.9.16.jar	Removed
netty-buffer-4.1.105.Final.jar	Version changed from 4.1.68.Final
netty-codec-4.1.105.Final.jar	Version changed from 4.1.68.Final
netty-common-4.1.105.Final.jar	Version changed from 4.1.68.Final
netty-handler-4.1.68.Final.jar	Removed
netty-handler-4.1.105.Final.jar	Version changed from 4.1.50.Final
netty-resolver-4.1.105.Final.jar	Version changed from 4.1.68.Final
netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar	Added
netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar	Added
netty-tcnative-boringssl-static-2.0.61.Final-osx-aarch_64.jar	Added
netty-tcnative-boringssl-static-2.0.61.Final-osx-x86_64.jar	Added
netty-tcnative-boringssl-static-2.0.61.Final-windows-x86_64.jar	Added
netty-tcnative-boringssl-static-2.0.61.Final.jar	Added
netty-tcnative-classes-2.0.61.Final.jar	Added
netty-transport-4.1.105.Final.jar	Version changed from 4.1.68.Final
netty-transport-classes-epoll-4.1.105.Final.jar	Added
netty-transport-native-epoll-4.1.50.Final.jar	Removed
netty-transport-native-epoll-4.1.68.Final.jar	Removed
netty-transport-native-epoll-4.1.105.Final-linux-x86_64.jar	Added
netty-transport-native-unix-common-4.1.105.Final.jar	Version changed from 4.1.68.Final
nimbus-jose-jwt-9.37.2.jar	Added
objenesis-2.6.jar	Version changed from 2.1
opencsv-5.9.jar	Added
openjpa-3.2.2-ep1.4.jar	Version changed from 3.2.2-ep1.3
org.apache.servicemix.bundles.antlr-3.5.2_1.jar	Added
pf4j-3.10.0.jar	Version changed from 3.6.0
poi-4.1.1.jar	Version changed from 4.0.1
postgresql-42.4.4.jar	Version changed from 42.3.3
protobuf-java-3.16.3.jar	Version changed from 3.11.0
re2j-1.2.jar	Removed
rrd4j-3.5.jar	Removed
salvation2-3.0.1.jar	Removed
semver4j-5.2.2.jar	Added
shiro-cache-1.13.0.jar	Version changed from 1.9.1
shiro-config-core-1.13.0.jar	Version changed from 1.9.1
shiro-config-ogdl-1.13.0.jar	Version changed from 1.9.1
shiro-core-1.13.0.jar	Version changed from 1.9.1
shiro-crypto-cipher-1.13.0.jar	Version changed from 1.9.1
shiro-crypto-core-1.13.0.jar	Version changed from 1.9.1
shiro-crypto-hash-1.13.0.jar	Version changed from 1.9.1
shiro-event-1.13.0.jar	Version changed from 1.9.1
shiro-lang-1.13.0.jar	Version changed from 1.9.1
simplemagic-1.17.jar	Added
slf4j-log4j12-1.7.25.jar	Removed
snakeyaml-2.2.jar	Added
snappy-java-1.1.10.5.jar	Version changed from 1.1.7.6
solr-api-9.4.1.jar	Added
solr-core-9.4.1.jar	Version changed from 8.11.1
solr-scripting-9.4.1.jar	Added
solr-solrj-9.4.1.jar	Version changed from 8.11.1
solr-solrj-streaming-9.4.1.jar	Added
solr-solrj-zookeeper-9.4.1.jar	Added
spatial4j-0.8.jar	Version changed from 0.7
spring-aop-5.3.34.jar	Version changed from 5.3.26
spring-beans-5.3.34.jar	Version changed from 5.3.26
spring-context-5.3.34.jar	Version changed from 5.3.26
spring-context-support-5.3.34.jar	Version changed from 5.3.26
spring-core-5.3.34.jar	Version changed from 5.3.26
spring-expression-5.3.34.jar	Version changed from 5.3.26
spring-jcl-5.3.34.jar	Version changed from 5.3.26
spring-jdbc-5.3.34.jar	Version changed from 5.3.26
spring-jms-5.3.34.jar	Version changed from 5.3.26
spring-messaging-5.3.34.jar	Version changed from 5.3.26
spring-orm-5.3.34.jar	Version changed from 5.3.26
spring-security-config-5.8.7.jar	Version changed from 5.8.5
spring-security-core-5.8.7.jar	Version changed from 5.8.5
spring-security-crypto-5.8.7.jar	Version changed from 5.8.5
spring-security-web-5.8.7.jar	Version changed from 5.8.5
spring-test-5.3.34.jar	Version changed from 5.3.26
spring-tx-5.3.34.jar	Version changed from 5.3.26
spring-web-5.3.34.jar	Version changed from 5.3.26
ST4-4.0.8.jar	Added
standard-1.1.2.jar	Removed
stax2-api-4.2.2.jar	Added
swagger-annotations-2.2.17.jar	Added
websocket-api-9.4.44.v20210927.jar	Removed
websocket-api-9.4.50.v20221201.jar	Removed
websocket-client-9.4.44.v20210927.jar	Removed
websocket-client-9.4.50.v20221201.jar	Removed
websocket-common-9.4.44.v20210927.jar	Removed
websocket-common-9.4.50.v20221201.jar	Removed
websocket-core-common-10.0.20.jar	Added
websocket-core-server-10.0.20.jar	Added
websocket-jetty-api-10.0.20.jar	Added
websocket-jetty-common-10.0.20.jar	Added
websocket-jetty-server-10.0.20.jar	Added
websocket-server-9.4.44.v20210927.jar	Removed
websocket-servlet-10.0.20.jar	Version changed from 9.4.44.v20210927
woodstox-core-6.5.1.jar	Version changed from 6.2.4
xbean-spring-4.22.jar	Version changed from 4.21
xercesImpl-2.12.0.jar	Removed
xmlgraphics-commons-2.9.jar	Version changed from 2.6
xom-1.2.10.jar	Removed
zookeeper-3.9.2.jar	Version changed from 3.6.2
zookeeper-jute-3.9.2.jar	Version changed from 3.6.2

Upgrade notes

The upgrading Elastic Path guide provides general instructions on upgrading Elastic Path projects.

ShopperReadOnly annotation

A new annotation has been added to the platform called @ShopperReadOnly. This annotation should be added to all JPA domain classes for tables that should never be modified by Cortex. For example, shoppers should not be able to modify catalog, product, setting definition, or payment configuration records.

When this annotation is added to a class, a JPA entity listener in Cortex called ShopperReadOnlyEntityListener is executed on attempts to insert, update, or delete JPA managed entities. This listener will throw an exception if the entity is represented by a JPA entity class with the @ShopperReadOnly annotation. This provides a safeguard to ensure that any logic errors in the code do not allow business data to be modified through the Cortex API.

Additionally, two new PMD rules have been added that look for the @ShopperReadOnly annotation to ensure that JPA entity classes are configured properly. These rules are described in the sections below.

Ensure Transactional Entities have the JPA data cache disabled

This rule ensures that the JPA data cache is disabled for JPA domain classes that are expected to be modified in Cortex.

If a class has an @Entity annotation, does not have a @ShopperReadOnly annotation, and does not have a @DataCache(enabled = false) annotation, a build-time PMD failure will be reported:

Commerce transaction JPA classes must be read-only or have data cache disabled to avoid concurrent modification issues

This failure should be resolved by adding the @DataCache(enabled = false) annotation to the class, or adding the @ShopperReadOnly annotation to the class if it should not be modified by Cortex.

Ensure Transactional Entities use table generator with high allocation size

This rule ensures that the table generator for JPA domain classes that are expected to be modified in Cortex have the allocation size set to HIGH_CONCURRENCY_ALLOCATION_SIZE. This is a performance optimization that prevents unnecessary queries against the JPA_GENERATED_KEYS table.

If a class has an @Entity annotation, does not have a @ShopperReadOnly annotation, and has a @TableGenerator annotation on any method that does not have the allocationSize = HIGH_CONCURRENCY_ALLOCATION_SIZE attribute set, a build-time PMD failure will be reported:

Commerce transaction JPA classes with table generators must be read-only or use high allocation size to ensure performance

This failure should be resolved by adding the allocationSize = HIGH_CONCURRENCY_ALLOCATION_SIZE attribute to the @TableGenerator annotation on the class, or adding the @ShopperReadOnly annotation to the class if it should not be modified by Cortex.

Cortex API change: Payment instrument selection

As part of the Split Payments feature, the behaviour of payment instrument selections has changed that may affect API clients. When a payment instrument is selected, any currently selected payment instruments are no longer automatically deselected because multiple payment instruments can now be selected on a cart order.

A payment instrument can be selected on a cart order in several ways:

• A client manually selects an existing payment instrument on the cart order by following a paymentinstrumentselector --> choice link on the cart order and posts to the selectaction link.
• A client creates a new payment instrument on the cart order by following a paymentmethodinfo --> element --> paymentinstrumentform link on the cart order and posts to the createpaymentinstrumentaction link.
• A client creates the first payment instrument on the user's profile by following a paymentmethods --> element --> paymentinstrumentform link on the shopper or account profile and posts to the createpaymentinstrumentaction link.

Commerce Engine changes

• The getUidPkInt method was removed from the Product interface. Use the getUidPk method instead.
• The unused WishListService#shareWithList method has been removed.
• Cleaned up duplicate com.h2database:h2 dependency definition in ep-test-application.
• Removed several unused classes from the ep-core module:
  • SeoUrlBuilderImpl
  • BreadcrumbsImpl
  • SearchRequestImpl
  • SearchResultImpl
  • AdvancedSearchRequestImpl
  • CatalogViewRequest
  • CatalogViewResult
  • SfSearchLogImpl
  • ShopperBrowsingActivity
  • ViewHistoryImpl
  • ViewHistoryProductImpl
  • ProductXmlServiceImpl
  • SearchServiceImpl
• The RandomGuidImpl class has been removed. Use UUID#randomUUID instead.
• The JpaAdaptorOfSkuOptionValueImpl class has been renamed to ProductSkuOptionValueImpl to improve clarity.
• All Groovy dependencies have been removed from ep-core. This includes the maven-compiler-plugin configuration for compiling Groovy classes. All remaining unused classes for dynamically rendering Groovy scripts have also been removed.
• All hsqldb dependencies have been removed, and all tests have been refactored to use h2.
• A separate PMD rule configuration is used for integration test modules, which excludes a number of checks that are normally executed on production modules. Some of those exclusions have now been removed, increasing the number of checks that are run on integration test modules. The following checks have been enabled:
  • AvoidFieldNameMatchingMethodName
  • AvoidFieldNameMatchingTypeName
  • CompareObjectsWithEquals
  • FinalFieldCouldBeStatic
  • IfElseStmtsMustUseBraces
  • IfStmtsMustUseBraces
  • ImportFromSamePackage
  • PackageCase
  • SuspiciousConstantFieldName
  • UnnecessaryFullyQualifiedName
  • UnusedFormalParameter
  • UnusedImports
  • UnusedLocalVariable
  • UnusedPrivateField
  • UnusedPrivateMethod
  • UseEqualsToCompareStrings
• Consolidated duplicate EmailValidator classes.
  • The com.elasticpath.commons.validator.impl.EpEmailValidator class has been removed.
  • Custom code using the removed com.elasticpath.commons.validator.impl.EpEmailValidator class or the deprecated org.apache.commons.validator.EmailValidator class should use org.apache.commons.validator.routines.EmailValidator instead.
• The deprecated solr.LRUCache filter cache references in the *.config.xml files in the ep-search module have been replaced with the updated solr.search.CaffeineCache class.
• The inventory allocation functionality in the UpdateOrderCheckoutAction class was moved to a new checkout action class: AllocateInventoryCheckoutAction.
• Service class caching wrappers for entities with a time range (CachingRuleServiceImpl, CachingPriceListAssignmentServiceImpl, and CachingProductAssociationServiceImpl) now make use of the new TimeIntervalCache class which ensures that the cache remains efficient and valid results are returned for these time-sensitive entities.
• Unused service methods were removed:
  • CouponDao#doesCouponCodeOnlyExistForThisRuleGuid and the associated COUPON_CODES_BY_COUPON_CODE_NOT_RULE_GUID named query.
  • CouponUsageDao#findByCode and the associated COUPON_USAGE_FIND_BY_COUPON_CODE named query.
• Several caches were renamed to improve consistency:
  • cachingAttributesByProfileCache -> attributesByProfileCache
  • cachingAttributeServiceAttributesCache -> attributeServiceAttributesCache
  • cachingAttributeServicefindByKeyCache -> attributeServicefindByKeyCache
  • cachingCategoryServiceFindCodeByUidCache -> categoryServiceFindCodeByUidCache
  • cachingSolrQueryFactorySearchableAttributeCache -> solrQueryFactorySearchableAttributeCache

Commerce Manager changes

• Several unused reporting modules have now been deleted from the source:
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.stockallocation
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.registration
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.promotiondetails
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.giftcertificatesummary
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.lowstock
  • com.elasticpath.cmclient:com.elasticpath.cmclient.reporting.giftcertificatedetails

Import/Export changes

• The promotions --> promotion --> availability --> enabledate field is now required for all promotion imports. This makes Import/Export consistent with the required enable date when creating promotions in Commerce Manager.
• Removed the Price field from the Product fields available for doing product exports. Attempting to use this field was causing an error.

Database changes

• Deleted unused setting definition records:
  • COMMERCE/SEARCH/minimumResultsThreshold
  • COMMERCE/SEARCH/maximumResultsThreshold
  • COMMERCE/SEARCH/maximumSuggestionsPerWord
  • COMMERCE/SEARCH/accuracy
  • COMMERCE/SYSTEM/CATALOGSYNDICATIONHISTORYCLEANUP/batchSize
  • COMMERCE/SYSTEM/CATALOGSYNDICATIONHISTORYCLEANUP/maxHistory
• Deleted unused setting value context records:
  • COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context wishListSharedEmailHander.
• Added new setting definition records:
  • COMMERCE/SYSTEM/INACTIVECARTSCLEANUPJOB/minAge
  • COMMERCE/SYSTEM/MESSAGING/SHOPPINGCARTS/channelUri
  • COMMERCE/SYSTEM/MESSAGING/SHOPPINGCARTITEMS/channelUri
  • COMMERCE/SYSTEM/ABANDONEDCARTEVENTS/batchSize
  • COMMERCE/SYSTEM/ABANDONEDCARTEVENTS/maxHistory
  • COMMERCE/SYSTEM/MESSAGING/CACHE/channelUri
• Added new setting value context records:
  • COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderReleaseExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context customerEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/SHOPPINGCARTS/channelUri with context shoppingCartEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/SHOPPINGCARTITEMS/channelUri with context shoppingCartItemEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/DOMAIN/deadLetterChannelUri with context orderReleaseExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/DOMAIN/deadLetterChannelUri with context customerEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/DOMAIN/deadLetterChannelUri with context shoppingCartEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/DOMAIN/deadLetterChannelUri with context shoppingCartItemEventsExtensionHandler
  • COMMERCE/SYSTEM/MESSAGING/DOMAIN/channelUri with context domainCacheHandler
• Removed several duplicate database indexes:
  • I_TBASEAMOUNT_FK_GUID on TBASEAMOUNT (covered by I_TBASEAMOUNT_OBJECTS)
  • I_CMUSERCATALOG__USER_UID on TCMUSERCATALOG (covered by the primary key)
  • I_CMUSERPL_USER_UID on TCMUSERPRICELIST (covered by the primary key)
  • I_CMUSER_USER_UID on TCMUSERROLEX (covered by the primary key)
  • I_CMUSERSTORE__USER_UID on TCMUSERSTORE (covered by the primary key)
  • I_CMUSERWH__USER_UID on TCMUSERWAREHOUSE (covered by the primary key)
  • I_CUSTOMER_TYPE on TCUSTOMER (covered by I_TYPE_LAST_EDIT)
  • I_CUST_STORE_CODE on TCUSTOMER (covered by I_CUSTOMER_STORECODE_OIDCSUBJECT)
  • I_CUSTOMER_SHAREDID on TCUSTOMER (covered by TCUSTOMER_SHARED_ID_TYPE_UNIQ)
  • I_INVENTORY_WAREHOUSE_UID on TINVENTORY (covered by TINVENTORY_UNIQUE)
  • I_TPRICEADJUSTMENT_FK_PL_GUID on TPRICEADJUSTMENT (covered by I_TPRICEADJUSTMENT_KEYS)
  • I_PC_PUID on TPRODUCTCATEGORY (covered by TPRODUCTCATEGORY_UNIQUE)
  • I_STORE_ASSOCIATE_UID on TSTOREASSOCIATION (covered by the primary key)
  • I_USERACCOUNTASSOC_USERID on TUSERACCOUNTASSOCIATION (covered by USER_CUSTOMER_GUID)
• Added new indexes to improve performance of shopping cart events:
  • Added index to TCARTORDER on BILLING_GUID.
  • Added index to TCARTORDER on SHIPPING_ADDRESS_GUID.
  • Added index to TSHOPPINGCART on STATUS.
• Added new index to improve performance of changeset lookups:
  • Added index to TCHANGESET on NAME and STATE_CODE.
• Moved wishlist line items from TCARTITEM to TWISHLISTITEM:
  • Created TWISHLISTITEM table.
  • Copied TCARTITEM records to TWISHLISTITEM where WISHLIST_UID is not null.
  • Deleted TCARTITEM records where WISHLIST_UID is not null.
  • Dropped WISHLIST_UID field from TCARTITEM table.
• Modified TCMUSER table to support OpenID Connect for business users:
  • Added OIDC_SUBJECT field, with unique constraint index.
  • Changed USER_NAME and PASSWORD fields to allow nulls.
  • Removed unique constraint index on EMAIL field.
• Modified TSHOPPINGITEMRECURRINGPRICE so it's no longer used for shopping items, only order items:
  • Deleted TSHOPPINGITEMRECURRINGPRICE records where CARTITEM_UID is not null.
  • Dropped CARTITEM_UID column from TSHOPPINGITEMRECURRINGPRICE table.
• Modified TCARTITEM table to improve how the parent/child relationship is defined.
  • Added PARENT_ITEM_GUID field.
  • Migrated PARENT_ITEM_UID values to the PARENT_ITEM_GUID field (with transformation).
  • Migrated CHILD_ITEM_CART_UID values to the SHOPPING_CART_UID field.
  • Changed SHOPPING_CART_UID field to disallow null values.
  • Dropped CHILD_ITEM_CART_UID and PARENT_ITEM_UID fields.
  • Added a unique constraint index on the GUID field.
• Modified TCARTITEM table to support "soft deletes":
  • Added REMOVED field.
• Modified TRULE table to support shopping cart line item promotions.
  • Added EVALUATION_OBJECT field.
• Modified TCUSTOMERAUTHENTICATION table so that uniqueness is enforced for records with the same username and store code:
  • Added REGISTERED_STORE_CODE_UPPER field to TCUSTOMERAUTHENTICATION.
  • Migrated TCUSTOMER.STORE_CODE values to TCUSTOMERAUTHENTICATION.REGISTERED_STORE_CODE_UPPER.
  • Added a unique constraint index on the USERNAME_UPPER and REGISTERED_STORE_CODE_UPPER fields.
• Added support for address line 3:
  • Added STREET_3 field to TADDRESS table.
  • Added STREET_3 field to TORDERADDRESS table.
  • Added STREET_3 field to TWAREHOUSEADDRESS table.
• Dropped unused tables:
  • TSFSEARCHLOG
  • TDIGITALASSETAUDIT
  • TCATALOGHISTORY
• Changed default value of COMMERCE/SYSTEM/FILTEREDNAVIGATION/separatorInToken setting from _ to ~ to reduce likelihood of collisions with existing values.
• Added a non-null constraint to the following fields:
  • TCUSTOMERAUTHENTICATION.USERNAME_UPPER
• If you are using PostgreSQL in your local development environment, the postgresql-dev-db profile in your settings.xml must now define the epdb.schemaname parameter. To maintain backwards compatibility, set this to public. See the extensions/maven/settings.xml file for a template to use for your local ~/.m2/settings.xml file.