Version: 8.7.x

Self-Managed Commerce 8.7.x Release Notes

Learn about changes to Self-Managed Commerce for this release. Fixes since the release are summarized in the changelog.

Changelog

The changelog contains the list of fixes and improvements made to Self-Managed Commerce 8.7 since its release date. To learn how to consume the updates, see Consuming Support Fixes.

Commit	Description	Badges	Release Date
6a07f446	Upgraded Tomcat from 10.1.60 to 10.1.61 to address CVE-2026-101296, CVE-2026-101356, CVE-2026-88041, CVE-2026-74048, CVE-2026-93446, CVE-2026-74049.	Security	5‑Nov‑2026
82b5e8e4	Upgraded the Google Guava library from 32.0.1 to 33.7.2 to address a high-severity security vulnerability (CVE-2026-102554).	Security	4‑Nov‑2026
2031267c	Fixed a Cortex performance issue where api-platform was dispatching `LINK` and `ADVISE` operations to resource families already cached as not allowed.	Performance	4‑Nov‑2026
e126a80d	Build stability fix.		4‑Nov‑2026
566be0ac	Fixed a performance issue with inefficient localized attribute key parsing by caching parsed results and eliminating repeated regex compilation per call.	Performance	3‑Nov‑2026
ba156714	Upgraded the PostgreSQL JDBC driver from 42.7.13 to 42.7.14 to address CVE-2026-107314 and CVE-2026-107315.	Security	2‑Nov‑2026
741e9816	Fixed an issue where Tomcat-based Commerce containers shut down immediately on `SIGTERM`, interrupting in-progress heap dumps instead of allowing the Java process to finish gracefully.	Build Tools	29‑Oct‑2026
87c36486	Fixed an issue where a malformed or unresolvable entry in `extensions.json` or `plugins.json` was silently ignored, causing all configured extension overrides to be discarded at startup.		27‑Oct‑2026
ec4ab8f1	Fixed an issue where a single failing or repeatedly duplicated search index notification could permanently stall the index update queue, causing indexes to go stale and eventually run out of memory during rebuilds.	Data model changes	27‑Oct‑2026
3884851f	Fixed a performance issue where the outbox message relay job lacked an optimized database index, causing inefficient queries against the outbox message table.	Performance Data model changes	27‑Oct‑2026
d36234ff	Upgraded Jackson from 2.22.3 to 2.22.4 to address three security vulnerabilities (CVE-2026-104895, CVE-2026-106554, CVE-2026-110879).	Security	26‑Oct‑2026
79868d63	Search Server's in-memory cache entry limit is now capped during index rebuilds, preventing out-of-memory errors on large catalogs.		26‑Oct‑2026
da6b0402	Fixed an issue where concurrent reads of cached product attributes caused threads to spin indefinitely, driving CPU usage up until the service was restarted.		23‑Oct‑2026
a8318495	Updated the ActiveMQ container image to allow tuning ActiveMQ `storeUsage` and `tempUsage` limits and totals. Default values are set in the image but can be overridden with new container environment variables.	Build Tools	23‑Oct‑2026
7efb854c	Fixed an intermittently failing deadlock retry integration test that could exhaust its retry budget due to a livelock, and added a missing error log when all retry attempts are exhausted.		22‑Oct‑2026
8c884343	Fixed an issue where upgrading across a major Lucene version permanently broke search indexes, causing all storefront and Commerce Manager searches to return no results.		21‑Oct‑2026
27aa151e	Fixed an issue where orders with three or more partial captures against the same payment reservation failed with a duplicate key error, leaving orders partially charged and requiring manual intervention.		21‑Oct‑2026
51da6f6c	The Operational Insights report now includes OpenJPA level 2 data caches alongside application caches, giving operators visibility into the memory footprint of the persistence cache tier.		21‑Oct‑2026
0193d747	Removed msgpack-core dependency to address CVE-2026-90472.	Security	20‑Oct‑2026
5d61c2ae	Upgraded Logback from 1.6.3 to 1.6.5 and SLF4j from 2.0.18 to 2.0.19 to address CVE-2026-104721.	Security	20‑Oct‑2026
bd1000d5	Updated the Cortex Studio CSS compiler dependency to address 8 Javascript vulnerablilities.		20‑Oct‑2026
84c6956e	Fixed an issue where Commerce Manager failed to load extension classes that used the Log4j 2 API directly.		15‑Oct‑2026
adbd4ed7	Fixed an issue where keyword searches with long multi-word phrases returned no results due to the search server rejecting queries that exceeded its maximum clause count.	Data model changes	14‑Oct‑2026
6012a533	The Operational Insights Data Shape section now includes a record count for the index notification table (`TINDEXNOTIFY`).		14‑Oct‑2026
81963f82	`@ResourceRepository` and `@ResourceService` annotations can now be used in non-prototype classes such as permission parameter strategies without requiring a `configurePrototypes` workaround.		14‑Oct‑2026
1ffa62e6	Fixed an issue where eight Cortex storefront resources evaluated every promotion rule twice per request, causing redundant pricing calculations when rendering cart totals, discounts, and applied promotions.		13‑Oct‑2026
4aef5f7c	Upgraded certified Java version from 17.0.18 to 17.0.20.	Security	9‑Oct‑2026
f9be12e4	Fixed an issue where the Search Server threw `OutOfMemoryError` during index rebuilds because queued index notifications were loaded entirely into memory before deletion.		8‑Oct‑2026
1149e2f3	Fixed XML external entity injection vulnerabilities in the Import/Export module that allowed crafted import payloads to read server files or trigger outbound requests from the server.	Security	8‑Oct‑2026
f1eb975d	Upgraded httpclient5 from 5.6.3 to 5.6.4 to address CVE-2026-71290.	Security	7‑Oct‑2026
fd91dd85	Replaced the unmaintained `com.github.java-json-tools:json-schema-validator` library with `com.networknt:json-schema-validator` 2.0.7 to resolve three security vulnerabilities (CVE-2026-86321, CVE-2026-86511, CVE-2026-86513).	Security	6‑Oct‑2026
d625f0ce	Fixed multiple reliability issues in Operational Insights report generation.		6‑Oct‑2026
6a3a8f0e	Upgraded Extension Point Framework connectivity library build to Java 17.	Security	6‑Oct‑2026
f18cd64d	Upgraded Tomcat from 10.1.59 to 10.1.60 to address CVE-2026-86350, CVE-2026-77762, CVE-2026-78383, CVE-2026-78437, CVE-2026-75973, CVE-2026-73581, CVE-2026-77756.	Security	2‑Oct‑2026
827714ae	Upgraded Jackson from 2.22.1 to 2.22.3 to address CVE-2026-83557, CVE-2026-19032, CVE-2026-68497, CVE-2026-89425, CVE-2026-89407, CVE-2026-91776, CVE-2026-91777.	Security	1‑Oct‑2026
6eb10a1c	Fixed an issue where importing an order with a mixed-case store code failed with a foreign key violation.		1‑Oct‑2026
cb164bd8	Upgraded ActiveMQ from 5.19.10 to 5.19.11 to address CVE-2026-74761.	Security Build Tools	29‑Sep‑2026
c9c27f6e	Fixed an issue where Cortex permission checks bypassed a required pre-check and passed resource identifiers from unrelated resource types to parameter resolution strategies.		28‑Sep‑2026
18114504	Operational Insights cache sizing now uses a custom heap estimator that requires no JVM flags, replacing the previous engine that failed or silently under-reported on modern JVMs.		25‑Sep‑2026
366f794d	Removed unused snappy-java 1.1.10.8 dependency to address CVE-2026-90559.	Security	25‑Sep‑2026
f7afc635	Removed unused t-digest 3.3 dependency to address CVE-2026-87822, CVE-2026-87962.	Security	24‑Sep‑2026
64c0f754	Upgraded ant from 1.10.14 to 1.10.18 to address CVE_2026-78254.		24‑Sep‑2026
a04ed42c	Upgraded the Node.js version used to build Cortex Studio from 6.x to 26.x.		24‑Sep‑2026
24ac3c24	Upgraded Zookeeper from 3.9.5 to 3.9.6 to address CVE-2026-79993, CVE-2026-59969, CVE-2026-59739, CVE-2026-84439, CVE-2026-84501.	Security	24‑Sep‑2026
0a7484c6	Build stability improvements.		22‑Sep‑2026
69c306cc	Upgraded the certified MySQL 8.4 RDS version from 8.4.8 to 8.4.11.		22‑Sep‑2026
9962dd60	Upgraded the certified MySQL 8.0 RDS version from 8.0.43 to 8.0.46.	Security	22‑Sep‑2026
cf2663d2	Upgraded the certified PostgreSQL 16 Amazon Aurora version from 16.10 to 16.14.		21‑Sep‑2026
84415b3f	Added ability for Import/Export to convert an existing product to a bundle, or a bundle to a product.		21‑Sep‑2026
8bbdb077	Cleaned up Cortex Studio npm dependencies by dropping unused packages and bringing package-lock.json back in sync with package.json.		21‑Sep‑2026
25272393	Fixed an issue where completing a physical shipment paid with a retried charge incorrectly marks the order as failed and throws an unhandled exception.		16‑Sep‑2026
a750a9ea	Fixed an issue where upgrading Logback to 1.6.x caused JLine stack traces to appear in the Cortex startup logs and silently broke colorised console output for local development.		16‑Sep‑2026
fbdf0c67	Removes MySQL 5.7 (RDS and Aurora) entries from the certified database configuration file so the database support report accurately reflects supported technologies for version 8.9.0.		15‑Sep‑2026
b036a69b	Renames the Tomcat build tools configuration file from `server9.xml` to `server.xml` to remove a misleading version suffix.	Build Tools	15‑Sep‑2026
8de8cd82	Upgraded Camel from 4.18.3 to 4.18.4 to address CVE-2026-59230.	Security	15‑Sep‑2026
00534427	Upgraded jsoup from 1.15.3 to 1.23.2 to address CVE-2026-71497.	Security	14‑Sep‑2026
f94d47f0	Upgraded Postgresql JDBC driver from 42.7.11 to 42.7.13 to address CVE-2026-54291.	Security	14‑Sep‑2026
d5023461	Upgraded Netty from 4.1.136.Final to 4.1.137.Final to address CVE-2026-75595 and CVE-2026-75596.	Security	14‑Sep‑2026
c7086c30	Upgraded Logback from 1.5.35 to 1.6.3 to address CVE-2026-19880.	Security	14‑Sep‑2026
ea776d52	Upgraded httpclient5 from 5.3.1 to 5.6.3 and httpcore5 from 5.2.4 to 5.4.3 to address CVE-2026-64607, CVE-2026-54399, CVE-2026-54428.	Security	11‑Sep‑2026
32331fd8	Replaces the unmaintained org.fusesource.jansi:jansi 1.18 library with org.jline:jansi 4.3.1.		8‑Sep‑2026
30882f68	Fixed an issue where multiple Commerce Manager instances can claim and execute the same CSV import job concurrently, causing duplicate data.	Data model changes	3‑Sep‑2026
35f2c333	Upgraded Tomcat from 10.1.55 to 10.1.59 to address multiple high-severity vulnerabilities.	Security	2‑Sep‑2026
a46e28a3	Upgraded Apache ActiveMQ from version 5.19.6 to 5.19.10 to address 8 vulnerabilities with scores from 5.9 to 8.8.	Build Tools	1‑Sep‑2026
9a0a9797	Fixed an issue where transacted JMS consumers open and tear down a real TCP connection to the ActiveMQ broker on every receive cycle, causing significant connection churn at idle and under load.		1‑Sep‑2026
df132783	Fixed an issue where MySQL upgrade tests on 8.5.x fail with a datetime truncation error caused by test price list assignments being created with a start date at or too close to the Unix epoch.		31‑Aug‑2026
73d7049f	Fixed an issue where Camel JMS request-reply (InOut) routes fail with an `IllegalArgumentException` after connection pooling changes removed a required connection factory property.		28‑Aug‑2026
cc762464	Fixed an issue where OpenID Connect token exchange requests send a malformed scope parameter, causing sign-in to fail with Microsoft Entra ID.		27‑Aug‑2026
27a9f443	Removed the unmaintained Natty date-parsing library from the test application to resolve a security vulnerability (CVE-2025-48924) in its transitive dependency on Commons Lang.	Security	24‑Aug‑2026
f15c948c	Build stability improvements.		21‑Aug‑2026
a9278025	Updated the ActiveMQ container entrypoint to ensure signals reach the broker JVM process	Build Tools	21‑Aug‑2026
a083ab1e	Removed the Spring Batch dependency from Commerce Manager by replacing the price list CSV export with a direct opencsv-based implementation, resolving CVE-2026-41710.	Security	20‑Aug‑2026
5b8ab058	Upgraded Tomcat from 10.1.56 to 10.1.57 to address CVE-2026-59084, CVE-2026-59083.	Security	20‑Aug‑2026
60b69792	Fixed an issue where importing a registered customer whose username already exists in the target store causes the entire import batch to fail with a raw duplicate key database error.	Data model changes	19‑Aug‑2026
d91b64dd	Fixed an issue where a Software Composition Analysis security scan falsely reports Bouncy Castle vulnerabilities by excluding unused Shiro crypto dependencies from the Maven dependency graph.	Security	18‑Aug‑2026
0bcc267b	Fixed an intermittent cache eviction error during search indexing caused by several Ehcache cache key classes not implementing `Serializable`.		18‑Aug‑2026
e4f1c95e	Upgraded Log4j from 2.25.4 to 2.26.1 to address CVE-2026-49844.	Security	17‑Aug‑2026
e3e5c962	Upgraded Jackson from 2.21.4 to 2.22.1 to address CVE-2026-59889, CVE-2026-54515.	Security	17‑Aug‑2026
4217e2cd	Upgraded Netty from 4.1.135.Final to 4.1.136.Final to address CVE-2026-59901.	Security	17‑Aug‑2026
fc94d838	Fixed an issue where Selenium tests intermittently fail with a stale element reference error when calling `click`, `doubleClick`, or `setChecked` on a `RAPTable` row, resolved by adding retry logic to each method.		14‑Aug‑2026
c7e01138	Fixed an issue where Cucumber test suites silently pass when step definitions are missing or unimplemented, by enabling strict mode across all 17 Java runners and 7 parallel runner templates.		14‑Aug‑2026
d5a35238	Fixed spurious "Unrecognized collection class" warnings logged by StrictDetachmentStrategyImpl in Cortex whenever an entity with a null collection-valued association is detached before caching.		14‑Aug‑2026
403ccfb0	Fixed a bug where transacted JMS routes built on `CRSCEnabledRouteBuilder` consume only one message and stall permanently, by removing the onCompletion hook that deadlocks the consumer thread on Camel 3 and later.		14‑Aug‑2026
a735bdb3	Fixed a bug in Commerce Manager where saving a customer record after adding a new address caused the address to appear duplicated in the address list.		14‑Aug‑2026
f882032d	Fixed an issue where the coupon table migration generates random GUID values, causing the same coupon records to have different identifiers across environments, breaking data synchronization and import/export matching.		13‑Aug‑2026
d8271b87	Fixed intermittent test failures where the ORDER_CREATED message assertion fails because the message is consumed before the listener is fully initialized.		13‑Aug‑2026
911b2980	Build stability improvements.		13‑Aug‑2026
d8b3f3eb	Parallelizes previously serial isolated Cucumber regression tests by scoping test data and configuration to unique stores, catalogs, and scenarios per test run, reducing pipeline duration by approximately 20–30 minutes.		13‑Aug‑2026
553e5d16	Add missing `storeTestPersister` bean definition to fix `AccountAssociates.feature`.		12‑Aug‑2026
5d964176	Fixed intermittent `VirtualCatalog.feature` failures by improving reliability of menu item widget interactions.		9‑Aug‑2026
447036ed	Refactored `AccountAssociates.feature` so its scenarios can run concurrently.		8‑Aug‑2026
efc5f659	Upgraded parsson from 1.1.7 to 1.1.9 to address CVE-2026-9563.	Security	7‑Aug‑2026
22f191cf	Improves Commerce Manager Selenium test reliability by removing broken stale-element wait methods, consolidating redundant wait call stacks, introducing stale-safe widget wrappers, and cleaning up dialog handling.		7‑Aug‑2026
396482c5	Added new RAPMenuItem test widget to standardize menu access in Selenium tests.		7‑Aug‑2026
59a5d52b	Fixed incorrect equality, hash code, and string representation behavior due to missing annotation parameters in the `XPFHttpCookie` class.		4‑Aug‑2026
918bdb65	Fixed issue with Cortex Studio issuing a redundant `GET` request after a `followlocation` form `POST`.		29‑Jul‑2026
37e15028	Fixed incorrect `@EqualsAndHashCode` and `@ToString` annotations in the `XPFDeliveryPolicy` class.		29‑Jul‑2026
61fb8257	Removed unused Cortex bundles `wrapped-spring-security-config`, `wrapped-spring-security-data`, `wrapped-spring-data-commons`.	Security	28‑Jul‑2026
0a9ced7d	Fixed an issue where the `XPFOrderHold` default constructor fails to initialize the non-null `holdDescription` and `orderHoldStatus` fields.		28‑Jul‑2026
7dbc4a9b	Upgraded Camel from 4.18.2 to 4.18.3 to address CVE-2026-42527, CVE-2026-43866, CVE-2026-46584.	Security	27‑Jul‑2026
92c2757c	Customer and shopper records for single-session (public) users are now created lazily, only when a cart or profile resource is accessed, rather than at token creation time.	Data model changes	24‑Jul‑2026
5939a93d	Fixed a race condition in `CustomerCreationFilter` where simultaneous customer creation across multiple Cortex instances could result in an error instead of returning the existing customer record.		24‑Jul‑2026
c53a0a21	Adds a new `downloadChecksumWithAlgorithm` field to `ops-spec.json` for all four tool entries (Java, Maven, Tomcat, ActiveMQ), enabling vendor-published `SHA-256`/`SHA-512` hashes to be used directly instead of manually calculated `MD5` values.	Build Tools	23‑Jul‑2026
2bf188a5	Fixed intermittent parallel Maven build failures with "Could not acquire write lock" on a cold local cache by increasing the artifact lock acquisition timeout from 30 to 120 seconds.		23‑Jul‑2026
3ea096e6	Upgraded Tomcat from 10.1.55 to 10.1.56 to address CVE-2026-55276, CVE-2026-53404, and CVE-2026-55956.	Security	22‑Jul‑2026
b39d327a	JMS message consumers now use dedicated, non-pooled connections instead of shared pooled connections, preventing consumers on low-traffic queues from becoming stranded when a broker connection fails silently.		21‑Jul‑2026
96c8c63e	Operational Insights revenue metrics now only count completed orders, using the order completion date instead of the creation date, preventing historical revenue figures from changing retroactively.		16‑Jul‑2026
b82e0693	Fixed issue with bundle price list cache using excessive memory due to holding entire `ProductBundle` in the cache key.		15‑Jul‑2026
5dad2bd1	Upgraded Jackson from 2.21.2 to 2.21.4 to address CVE-2026-54513, CVE-2026-54512, CVE-2026-54516, CVE-2026-54514, CVE-2026-54517.	Security	15‑Jul‑2026
5c76fdc1	Upgraded Solr from 9.10.0 to 9.10.1 to address CVE-2026-22022.	Security	15‑Jul‑2026
bc8695d8	The promotion rule recompilation trigger interval has been reduced from 5 minutes to 10 seconds by default, and the delay and interval are now configurable via the ep.rule.compilation.delay and ep.rule.compilation.interval properties.		13‑Jul‑2026
f3649cf6	Fixed an issue where unit tests failed with a missing class error when run from IntelliJ by restoring the Hamcrest Core transitive dependency in JUnit 4 and upgrading it to version 2.x.		11‑Jul‑2026
80d33359	Fixed a build failure after running `set-ep-versions.sh` caused by incorrect version placeholders for the Commerce Manager extension libraries and repository dependencies in the bill of materials.		9‑Jul‑2026
15927eb4	Upgraded Logback from 1.5.32 to 1.5.35 to address CVE-2026-9828, CVE-2026-10532, and CVE-2026-13006.	Security	9‑Jul‑2026
3601b67e	Upgraded Spring Security from 6.5.10 to 6.5.11 to address multiple vulnerabilities (fix for previous commit).	Security	9‑Jul‑2026
45751d06	Upgraded Spring Security from 6.5.10 to 6.5.11 to address multiple vulnerabilities.	Security	8‑Jul‑2026
7f4eb207	Upgraded Netty from 4.1.133.Final to 4.1.135.Final to address CVE-2026-45416, CVE-2026-50010, and CVE-2026-44249.	Security	7‑Jul‑2026
f231fc87	Upgraded Spring from 6.2.18 to 6.2.19 to address multiple vulnerabilities.	Security	6‑Jul‑2026
6d70497f	Upgraded Shiro from 1.13.0 to 2.2.1 to address CVE-2026-23901, CVE-2026-43828, and CVE-2026-49268.	Security	29‑Jun‑2026
b425ce75	The Commerce Manager `test-util` module no longer uses PhantomJS to run JavaScript tests, fixing build failures on systems with OpenSSL 3.x (such as Debian Trixie); tests now run via HtmlUnit and JUnit.		26‑Jun‑2026
7d8382ae	Refactored `ShoppingCart` to include transient fields for selected payment instruments, to be consistent with how selected addresses and shipping options work. This also allows us to eliminate some database operations during checkout.		23‑Jun‑2026
4539082a	Upgraded certified Oracle version from 19.0.0.0.ru-2025-10.rur-2025-10.r1 to 19.0.0.0.ru-2026-01.rur-2026-01.r3.	Security	23‑Jun‑2026
1e5be97c	Upgraded certified PostgreSQL version from 16.10 to 16.14.	Security	22‑Jun‑2026
2f54b8fd	Merchandisers can now switch an existing shopping cart promotion between no-coupon, public coupon, and private coupon activation modes without needing to recreate the promotion from scratch.		16‑Jun‑2026
8cf5e2fd	Build stability improvements.		10‑Jun‑2026
d70c8f35	Removed an obsolete reference to a non-existent method (`getCurrentLupNumber`) from the sync service merge filter configuration; this is a cleanup change with no functional impact.		9‑Jun‑2026
a7dc1ff8	Upgraded Netty from 4.1.130.Final to 4.1.133.Final to address CVE-2026-42583.	Security	8‑Jun‑2026
e868a4bb	Upgraded Logback from 1.5.21 to 1.5.32 to address CVE-2026-1225.	Security	4‑Jun‑2026
c2c2898d	Upgraded Liquibase from 4.27.0 to 4.33.0 to address a bug with the latest PostgreSQL JDBC driver.	Security	4‑Jun‑2026
35331425	Upgraded Postgresql JDBC driver from 42.4.4 to 42.7.11 to address CVE-2026-42198.	Security	3‑Jun‑2026
54d761fc	Upgraded Log4j from 2.25.3 to 2.25.4 to address CVE-2026-34480, CVE-2026-34478, CVE-2026-34479, and CVE-2026-34477.	Security	2‑Jun‑2026
73061af0	Upgraded Tomcat from 10.1.54 to 10.1.55 to address CVE-2026-43512 and several other vulnerabilities.	Security	2‑Jun‑2026
8d216698	Upgraded `JJWT` from 0.10.6 to 0.12.7 to address CVE-2024-31033.	Security	2‑Jun‑2026
82bf4010	Build stability improvements.		1‑Jun‑2026
e14a42d6	Apache Camel has been upgraded from version 4.11.0 to 4.18.2 to address CVE-2026-40860, CVE-2026-33454, and CVE-2026-40453.	Security	27‑May‑2026
c5946f93	A Liquibase changeset has been added to automatically run `ANALYZE` on PostgreSQL databases during each data population run, preventing query performance issues caused by missing table statistics after a major PostgreSQL version upgrade.	Performance	26‑May‑2026
7e9343c1	Fixed a bug where copying a promotion reused the original's selling context, causing changes to one promotion's shopper conditions to affect the other. A database migration script separates any previously affected promotions.	Data model changes	22‑May‑2026
4ddf904b	Fixed an issue where promotion carrots were not displayed for products in a category referenced by a shopping cart promotion condition, caused by incorrect category GUID comparison logic.		21‑May‑2026
8b84d533	Upgraded Spring Security from 6.5.9 to 6.5.10 to address CVE-2026-22754, CVE-2026-22753, CVE-2026-22746, and CVE-2026-22751 .	Security	19‑May‑2026
1e7498ea	Moved spring-tx bundle from bundles to bundles level 4 to prevent intermittent Cortex startup failure.		17‑May‑2026
2fe8d696	Upgraded certified Oracle version from 19.0.0.0.ru-2025-07.rur-2025-07.r1 to 19.0.0.0.ru-2025-10.rur-2025-10.r1.	Security	16‑May‑2026
536048b6	Upgraded certified Aurora MySQL 8.0 version from 8.0.mysql_aurora.3.08.2 to 8.0.mysql_aurora.3.10.3.	Security	16‑May‑2026
a689a20c	Upgraded certified MySQL 8.4 RDS version from 8.4.6 to 8.4.8.	Security	15‑May‑2026
7a4b3721	Upgraded Apache ActiveMQ from version 5.18.7 to 5.19.6 to address CVE-2026-40466, CVE-2026-41044, and CVE-2026-39304.	Security	14‑May‑2026
dae6dcec	Upgraded Spring from version 6.2.17 to 6.2.18 to address CVE-2026-22740.	Security	14‑May‑2026
751ff406	Upgraded Jackson from 2.19.1 to 2.21.2 to address WS-2026-0003 (CVSS3 7.5), with SnakeYAML also upgraded from 2.4 to 2.5.	Security	8‑May‑2026
cb9412ca	Automated `ast-grep` upgrade recipes have been added to assist customers in migrating customizations from version 8.5.x to 8.6.x.		6‑May‑2026
ec782fce	Automated `ast-grep` upgrade recipes have been added to assist customers in migrating customizations from version 8.6.x to 8.7.x.		6‑May‑2026
a88aae81	Fixed issue in Commerce Manager where switching between "cart level" and "line item level" rules on an existing promotion did not show or hide the correct conditions and actions, which could cause unexpected behavior when saving.		5‑May‑2026
187e7e78	Upgraded plexus-utils from 3.5.1 to 3.6.1 to address CVE-2025-67030 (CVSS3 score 9.8).	Security	5‑May‑2026
7cb5c729	Fixed a memory inefficiency in `StoreProductSkuFactoryImpl` where cached `StoreProductSku` proxies unnecessarily retained a reference to the factory singleton.		4‑May‑2026
ebda9bf7	Removed BouncyCastle dependencies from Commerce Manager to address CVE-2026-0636, CVE-2026-5598, CVE-2025-14813.	Security	2‑May‑2026
33aba3f0	Upgraded Tomcat from 10.1.53 to 10.1.54 to address CVE-2026-34500, CVE-2026-34483, CVE-2026-34487, CVE-2026-34486	Security	2‑May‑2026
d5d48a24	Improved Selenium test widgets: Fluent table-cell assertions, text-field clear, sharper retry classification in both `retryAttempts`, and `retryFunction`.		2‑May‑2026
6cfdc8b3	Resolved a race condition where simultaneous checkout requests for the same cart could cause a duplicate order constraint violation to be silently swallowed, resulting in a failure indicating that payment instruments are missing.		1‑May‑2026
d426ae6e	Upgraded SOLR from 9.9.0 to 9.10.0 to address CVE-2025-12383 and CVE-2025-58457.	Security	1‑May‑2026
6b80065d	Fixed inconsistent `ASM` dependency version and cleaned up `requireUpperBoundDeps` plugin definition.		28‑Apr‑2026
bb3744de	Fixed issue with inventory cache using excessive memory due to holding entire Product SKU in the cache key.		23‑Apr‑2026
f2840c75	Fixed intermittently failing Catalog Syndication Integration Tests.		23‑Apr‑2026
0eb57581	Upgraded Spring Security from 6.4.6 to 6.5.9 to address CVE-2025-41248 and CVE-2026-22732.	Security	21‑Apr‑2026
4a8ff75c	Upgraded Zookeeper from 3.9.4 to 3.9.5 to address CVE-2026-24281 and CVE-2026-24308.	Security	18‑Apr‑2026
60c97af3	Upgraded mvel2 from 2.4.13 to 2.5.2.	Security	17‑Apr‑2026
e0351d04	Modified build parameters to remove `ReservedCodeCacheSize 128m` setting and use JDK default instead.	Build Tools	16‑Apr‑2026
79c734ab	Upgraded Spring from 6.2.8 to 6.2.17 to address CVE-2025-41242, CVE-2025-41249, and CVE-2026-22735.	Security	14‑Apr‑2026
b1b787fc	Added missing `distributionManagement` to `boms/pom.xml` that was causing Maven deploy operations to fail.		13‑Apr‑2026
63b67d4a	Fixed issue with `Line item product is from category []` condition matching all products regardless of category.		13‑Apr‑2026
25866527	Upgraded pf4j from 3.10.0 to 3.15.0 to address CVE-2025-70952.	Security	11‑Apr‑2026
822875c6	Improved `2026-03-carttype-guid-unique-constraint` Liquibase changeset to avoid a potential unique constraint error in Data Population.	Data model changes	9‑Apr‑2026
ee5154bc	Updated handling of promotion category exclusions so that if the excluded category is a subcategory of the included category, products belonging to both the included and excluded category satisfy the condition.		9‑Apr‑2026
79edd01d	Upgraded Tomcat from 10.1.49 to 10.1.53 to address CVE-2026-24734, CVE-2026-24733, and CVE-2025-66614.	Security	8‑Apr‑2026
fedd24cc	Fixed `maven-deploy-plugin` configuration that was causing Maven deploy operations to fail.		7‑Apr‑2026
de581c86	Fixed issue with Cortex not producing logs in deployed environments after the Logback 1.5 upgrade.		4‑Apr‑2026
edb86222	Updated Selenium tests to properly embed HTML source in reports.		3‑Apr‑2026
3ef3c7ce	Fixed intermittent failure in "Syndication Сategory flow tests: Create and then Delete Category, check ep.catalog JMS message, check created option projection via API" Cucumber test.		3‑Apr‑2026
00d918ba	Updated Jetty versions in transformed solr-core module to remove vulnerable Jetty dependencies from build.	Security	2‑Apr‑2026
f0689b2e	Added `assertColumnContainsExactly` method to `RAPTable` class.		2‑Apr‑2026
a1ee39be	Improved Import/Export logging to show localized message instead of code for warnings and errors.		1‑Apr‑2026
0149e297	Added `assertDoesNotContainRow` method to `RAPTable` class.		1‑Apr‑2026
fc789459	Fixed potential wrapped-ehache bundle issues due to bundle load order inconsistency.		1‑Apr‑2026
5a281a34	Fixed test teardown issue in `MergeEngineImplITest` that can cause `SyncToolLauncherMultipleExecutionsITest` to fail.		31‑Mar‑2026
059ed7c5	Fixed issue with duplicate `TCARTTYPE` records being created when importing stores through Import/Export.	Data model changes	29‑Mar‑2026
3d21daf7	Additional fixes for "context has been closed" exceptions in batch named queries with list parameters when casting to `OpenJPAQuery`.		27‑Mar‑2026
7ea00bf2	Updated Git configuration to ignore `.claude` folders.		26‑Mar‑2026
1c9983fc	Upgraded Byte Buddy to version 1.18.4.	Security	25‑Mar‑2026
a03d8d2b	Fixed issue with Price List Assignment search in Commerce Manager not properly clearing the list when there are no search results.		24‑Mar‑2026
a61bac86	Removed unnecessary Geronimo dependencies.		24‑Mar‑2026
eaa2ff41	Updated OpenID Connect functionality to support RFC-compliant cookie headers and avoid generating "Invalid cookie header" warnings.		21‑Mar‑2026
40c6ad9b	Data sync change to ensure that only changed values are updated in the target entities. This also ensures that products and skus are not reindexed when a new sku option value is added.		21‑Mar‑2026
f278fe98	Additional fixes for "context has been closed" exception in Cortex when setting entity fields that were loaded from the cache.		20‑Mar‑2026
419db9d7	Added the ability to override the P2 repository locations.	Build Tools	20‑Mar‑2026
66e9496e	Added `retryAttempts()` to Selenium test framework to safely nest retries inside `retryFunction()`.		19‑Mar‑2026
cfdf9624	Fixed a race condition in `Utils.uniqueCode()` used during tests.		18‑Mar‑2026
8cc99180	Modified Commerce Manager modules to allow them to access ext-core classes directly.		17‑Mar‑2026
6e7657f1	Ensure that ext-commerce-engine-wrapper exclusions on ext-core are synchronized with ep-core.		16‑Mar‑2026
6636f089	Upgraded certified Java version from 17.0.16 to 17.0.18.	Security	16‑Mar‑2026
33197c48	Updated `ci-settings.xml` mirrors to remove unused `eclipse-p2-updates` mirror and add `eclipse-p2-birt-updates` mirror.		12‑Mar‑2026
fa8279cc	Fix for intermittent "context has been closed" exception in Cortex when accessing fields of bundle constituent products or product SKUs.		12‑Mar‑2026
e4ece812	Added `camel-direct` dependency within `ep-camel-bundle` to support the direct Camel component.		12‑Mar‑2026
dcd43f6b	Removed deprecated ServiceMix dependencies and replaced with wrapped bundles maintained by Elastic Path.		11‑Mar‑2026
1d1a397b	Fixed issue with promotion conditions that are based on attribute values not working if the attribute key contains lower-case characters.		11‑Mar‑2026
43b15f65	Upgraded okhttp from 3.14.1 to 4.12.0 to address CVE-2021-0341.	Security	11‑Mar‑2026
9e205931	Upgraded rhino from 1.7.7.2 to 1.7.14.1 to address CVE-2025-66453.	Security	10‑Mar‑2026
5066d548	Fixed issue with descender characters (g, p, y, j, q) being cut off in Commerce Manager table headings.		6‑Mar‑2026
cd560321	Fixed bug with Abandoned Cart Cleanup job deactivating the wrong shopping carts.		6‑Mar‑2026
7f9c0c5b	Improved Selenium test reliability and maintainability by introducing typed widget APIs that query the widget model directly, replacing brittle CSS selectors with strict element assertions, automatic retry on transient errors, and session cleanup.		3‑Mar‑2026
55142632	Fixed multiple bugs with promotion exception logic and reverted behaviour change of the "cart contains category" promotion condition done in a previous patch.		24‑Feb‑2026
c2a0f516	Improved promotion caching to ensure that the rule base is only retrieved if it has actually changed.		24‑Feb‑2026
7f1f9719	Added cleanup job to delete shopping cart line items that are soft deleted.		23‑Feb‑2026
241fdc79	Upgraded AssertJ from 3.11.1 to 3.27.7 to address CVE-2026-24400.	Security	20‑Feb‑2026
e12d9e5d	Upgraded Log4j from 2.24.3 to 2.25.3 to address CVE-2025-68161.	Security	19‑Feb‑2026
3834feb1	Added support for `CC` and `BCC` recipients in the Extension Point Framework Notification Events and `EmailProperties`.		17‑Feb‑2026
b27f6863	Fixed null pointer exception that can occur when retrieving inventory details for a bundle with no constituents.		12‑Feb‑2026
4ffbdd43	Removed Lombok usage in ep-core tests.		11‑Feb‑2026
8b63918a	Updated all `com.mysql.jdbc.Driver` references to `com.mysql.cj.jdbc.Driver`.		11‑Feb‑2026
d9b336c1	Removed the `runAlways` flag off of the `FK-BATCH` Liquibase changesets to avoid creating repeat `DATABASECHANGELOG` entries in the database.	Data model changes	10‑Feb‑2026
4e1c1249	Added new `with-snapshot-api-platform` and `with-snapshot-ep-xpf-spi` profiles for building with development versions of these dependencies.		5‑Feb‑2026
81c9039e	Fixed bug in which removing an attribute from a product type causes all attribute values to be deleted (instead of just the ones for products/skus assigned to that product type).		4‑Feb‑2026
fdd85d05	Upgraded msgpack-core from 0.8.13 to 0.9.11 to address CVE-2026-21452.	Security	3‑Feb‑2026
e959f08d	Added support for custom headers in Cortex Studio.		3‑Feb‑2026
4683153e	Improved reliability of `WebDriver` management in Selenium tests.		2‑Feb‑2026
3a13aa20	Cleaned up `EmailStepDefinitions` by removing inappropriate `TestExecutionListeners`		2‑Feb‑2026
fd47d437	Added new `XPFJSONSerializationHelper` to support JSON marshalling/unmarshalling of Extension Point Framework entity objects.		30‑Jan‑2026
0f427f40	Fixed intermittent failures in Performance Insights tests caused by resetting the database between each test.	Performance	28‑Jan‑2026
a852dfc0	Build stability improvements.		27‑Jan‑2026
33f0abe8	Fixed broken `getLogLevel/setLogLevel` JMX operations in Commerce Manager.		27‑Jan‑2026
ed5c2521	Improved reliability of search-related Commerce Manager test steps to avoid race conditions.		21‑Jan‑2026
04972eb4	Fix for intermittent `context has been closed` exceptions in Cortex under high load.		20‑Jan‑2026
6ed646db	Added more detail to assertion output when Cortex Cucumber step definitions fail.		15‑Jan‑2026
ff529cc7	Removed unused `org.apache.felix.webconsole` dependency from bill-of-materials POM.		15‑Jan‑2026
cb131c3a	Fixed issue causing Order Cleanup jobs to fail when order has associated order holds.	Data model changes	14‑Jan‑2026
4442595b	Increased default Cargo timeout that fails if services don't start quickly enough.		12‑Jan‑2026
aff4f8ea	Allow IntelliJ to download sources for Eclipse RAP dependencies in Commerce Manager classes.		9‑Jan‑2026
7558556c	Removed zoom graph builder functionality in Cortex Studio.	Security	8‑Jan‑2026
496ef1d0	Updated Commerce Manager to allow attribute value editor to be opened when product, SKU, or category is locked in changeset mode.		8‑Jan‑2026
0c97ae1a	Added the ability to set and distinguish between present and not present boolean customer attribute values in Commerce Manager.		8‑Jan‑2026
6faa48e2	Refactored confusing `Amount of transaction should be (.*)` Selenium test definition.		8‑Jan‑2026
828e0d9f	Allow IntelliJ to properly resolve Eclipse Remote Application Platform dependencies in Commerce Manager classes.		6‑Jan‑2026
c8af96d6	Updated protobuf-java version from 3.16.3 to 3.25.5 to address CVE-2024-7254.	Security	6‑Jan‑2026
893129dc	Upgraded certified Oracle version from 19.0.0.0.ru-2025-01.rur-2025-01.r2 to 19.0.0.0.ru-2025-07.rur-2025-07.r1.	Security	6‑Jan‑2026
097bd5df	Fixed intermittently failing Pre/Back-Order Cucumber tests.		5‑Jan‑2026
49fc843a	Fixed resource leak when using programatic test data generation.		19‑Dec‑2025
e14f11d4	Fixed Selenium test issue causing `Multiple elements (2) found for selector: div[widget-id*='Sh'][appearance-id='ctab-item'][seeable='true']` warnings in the logs.		18‑Dec‑2025
05ec5af5	Upgraded SLF4j from 1.7.x to 2.0.x and Logback from 1.2.x to 1.5.x to address CVE-2024-12798, CVE-2024-12801, and CVE-2025-11226.	Security	17‑Dec‑2025
b774e165	Upgraded certified MySQL RDS version from 8.4.5 to 8.4.6.	Security	16‑Dec‑2025
610d8410	Added support for MySQL 8.4 in Build Tools. The default MySQL version that gets built by the `build_base_images.yml` playbook is now 8.4.	Build Tools	11‑Dec‑2025
2770c815	Updated Payment Configuration Cucumber tests to generate new stores and prevent intermittent failures when running tests concurrently.		10‑Dec‑2025
0d6153e0	Upgraded certified PostgreSQL version from 16.9 to 16.10.	Security	9‑Dec‑2025
d16ad575	Added support for creating new stores to isolate Cucumber tests and prevent intermittent failures when running tests concurrently.		9‑Dec‑2025
27bb1299	Updated coupon service to ensure that whitespace is trimmed when new coupon codes are created.		5‑Dec‑2025
20f3fa92	Upgraded certified MySQL 8.0 RDS version from 8.0.41 to 8.0.43.	Security	4‑Dec‑2025
4b7a1c08	Changed caching configuration for Performance Insights to make the query count results more consistent.	Performance	4‑Dec‑2025
b3c16a31	Fixed potential date truncation error during Search Server startup that prevents promotion rule compilation.		4‑Dec‑2025
7995597c	Minor fix to Selenium test startup instructions.		2‑Dec‑2025
53d28051	Fixed `AbstractPageObject#clearAndTypeText` to improve detection that ensures that the field text was correctly entered.		1‑Dec‑2025
7180cfb6	Replaced `ruleUpdate.properties` and `catalogPromo.properties` files written by the Search Server with a new `TJOBEXECUTION` database table.	Data model changes	26‑Nov‑2025
79a25a25	Improved how Checkstyle rules are defined to use suppression files for Integration Tests.		25‑Nov‑2025
2c6fbf72	Fixed issue where Java compiler warnings would fail build but not show the reason unless the fork configuration was removed.		24‑Nov‑2025
a7965e15	Upgraded jQuery UI from 1.11.4 to 1.13.2 to fix autocomplete UI issue in Cortex Studio.	Security	21‑Nov‑2025
ef6fdfc0	Fixed incorrect payment API response error message when refund fails.		20‑Nov‑2025
7fcff5cc	Upgraded MySQL JDBC driver from version 8.2.0 to 9.5.0.	Security	20‑Nov‑2025
05af7703	Upgraded Tomcat from 10.1.44 to 10.1.49 to address CVE-2025-55754, CVE-2025-55752, and CVE-2025-61795.	Security	20‑Nov‑2025
c1a45b5f	Fixed an intermittent failure in `Create Catalog` Selenium tests.		19‑Nov‑2025
6acdc7c0	Fixed issue in which a new master catalog with all languages configured could not be opened in Commerce Manager.		13‑Nov‑2025
3f81b742	Fixed issue with `code-checking-rules` JAR being included in some Commerce Manager JARs.		13‑Nov‑2025
edf51f4a	Fixed `NullPointerException` that can occur in Import/Export API when import fails.		13‑Nov‑2025
02877596	Fixed refund error that can occur if the order payment events include reverse charges.		12‑Nov‑2025
1c197361	Fixed issue where the JaCoCo test coverage Maven plugin was not executing.		10‑Nov‑2025
e34ca347	Fixed multiple issues related to null or blank customer profile attribute values.		10‑Nov‑2025
5d58b7e1	Upgraded Zookeeper from 3.9.3 to 3.9.4 to address CVE-2025-58457.	Security	6‑Nov‑2025
592df6d7	Updated `attributeByUidCache` cache max entries from unlimited to 10,000 in `ehcache-fast-updates.xml`.		5‑Nov‑2025
ad70e663	Ensure that Checkstyle verifies JavaDocs for all public, protected, and package private methods.		4‑Nov‑2025
252e1559	Fixed issue where the applied line item discount amount could exceed the line item subtotal if multiple promotions are stacked.		4‑Nov‑2025
11808da7	Set default `maxThreads` for all services to 250 to match Operational Insights recommendations.	Build Tools	3‑Nov‑2025
10789e34	Upgraded dependencies within Fluent RelOS Client to address CVE-2025-48924.	Security	30‑Oct‑2025
b97e577a	Upgraded fsevents from 1.2.8 to 1.2.11 to address CVE-2023-45311.	Security	30‑Oct‑2025
23bcb729	Fixed intermittent failures in "Shipment line item contains tax" Cucumber test due to a race condition.		29‑Oct‑2025
95df184f	Fixed comment on `releaseShipmentTrigger` cron expression.		28‑Oct‑2025
79b54788	Upgraded Zookeeper dependency in Apache Solr transformed module to address CVE-2024-51504.	Security	28‑Oct‑2025
e8e33337	Upgraded Eclipse Remote Application Platform for Commerce Manager from 4.2 to 4.4 to address CVE-2025-48976.	Security	24‑Oct‑2025
27952b2b	Modified `XPFTaxableShoppingItem` so cart tax calculation results are reusable at checkout by the `ElasticPathTaxCalculator` cache.		22‑Oct‑2025
6db74fcf	Added comments and improved the input validation in the ActiveMQ container entrypoint script.	Build Tools	21‑Oct‑2025
21890416	Updated certified Java version from 17.0.7 to 17.0.16.		20‑Oct‑2025
7ee5d8a1	Added a new index to `TCOUPONUSAGE` to improve performance for the query to find automatically applied coupons.	Performance Data model changes	19‑Oct‑2025
efd46d2e	Fixed product reindexing issues after updating sku option values in a catalog.		15‑Oct‑2025
c0f60b44	Fixed issue with some promotion condition exclusions being incorrectly ignored.		15‑Oct‑2025
44093d20	Switched default detachment strategy from strict to non-detaching to avoid `this.pcStateManager is null` exceptions while importing in the Import/Export API.		14‑Oct‑2025
a9646227	Fixed intermittently failing `AddToAndRetrieveItemsFromWishlist` scenarios.		14‑Oct‑2025
59e1161d	Added new `configuration` query parameter to the Import/Export API to allow clients to select different import configuration files to use for the import.		7‑Oct‑2025
67c58188	Upgraded jakarta.mail from 2.0.1 to 2.0.2 to address CVE-2025-7962.	Security	7‑Oct‑2025
e3bafc56	Removed unused fields from `AbstractRuleEngineImpl`.		2‑Oct‑2025
a0a4e547	Resolved the `localized message key: incompatible-configuration` warnings during service startup.		2‑Oct‑2025
c01bc0ea	Fixed checkout failure that can occur when resubmitting a shopping cart that previously had a payment issue.		29‑Sep‑2025
117dbcbd	Upgraded Apache Solr from 9.8.0 to 9.9.0 to address CVE-2024-51504.	Security	24‑Sep‑2025
cf1e02c9	Upgraded the EhCache servicemix version to make it consistent with the EhCache version.	Security	24‑Sep‑2025
74572f01	Fixed exception that occurred when copying a cart promotion with rule exceptions defined.		23‑Sep‑2025
4d700f6d	Upgraded angus-mail from 2.0.3 to 2.0.4 to address CVE-2025-7962.	Security	23‑Sep‑2025
2eb5b399	Upgraded netty-handler from 4.1.118.Final to 4.1.125.Final to address CVE-2025-58057.	Security	23‑Sep‑2025
abd80de1	Upgraded Jetty from 11.0.25 to 11.0.26 to address CVE-2025-5115.	Security	22‑Sep‑2025
f52582b0	Upgraded Checkstyle plugin from version 2.17 to 3.6.0.	Security	22‑Sep‑2025
137c0dc5	Upgraded certified PostgreSQL version from 16.6 to 16.9.	Security Data model changes	19‑Sep‑2025
42fad5a2	Fixed issues running `reset-db` on a local Oracle database.		18‑Sep‑2025
5f6bf8d0	Fixed `load.sh`/`unload.sh`/`replace.sh` scripts generated by the Maven Archetype when creating an external plugin so that they work properly with the new cargo-based service startup mechanism.		18‑Sep‑2025
87e7dbdd	Modified the max heap size for locally started services from 500mb to 2048mb.		17‑Sep‑2025
18f5eb36	Removed itext 2.1.7 from the build to address CVE-2017-9096.	Security	16‑Sep‑2025
87f91e66	Fixed data type issues with `TRMAGENERATOR` and `TORDERNUMBERGENERATOR` that required the database to workaround through implicit casts.	Data model changes	16‑Sep‑2025
f5e2a5a9	Fixed issue with Search Server taking up to an hour to process index update notifications by reducing the query cache timeout from 1 hour to 5 seconds.		15‑Sep‑2025
e6cbd071	Fix for potential "Value not present" error in Cortex if a new sku option value is added and assigned to a new product SKU before the sku option cache expires.		12‑Sep‑2025
fb86c674	Fixed an issue in the `data-pop` tool container entrypoint script where files from a secure-configuration repository were being ignored and not applied.		12‑Sep‑2025
06ac1642	Added new `cortex.headers.ignore` JVM parameter that instructs Cortex to ignore the specified headers.		9‑Sep‑2025
fd3cdf66	Re-enabled the Reporting module in Commerce Manager.		9‑Sep‑2025
44544a80	Fixed issue that restricted the number of promotion action parameters to 10 or less.		9‑Sep‑2025
e0dc248c	Fixed "Error during type conversion" exception that appeared in Integration Server logs after each Export API request.		5‑Sep‑2025
6798f5d2	Updated the `ext-container-layout` project to include the same assembly rules used in the `ext-deployment-package` project, specifically so builds will fail if artifacts don't exist.		4‑Sep‑2025
f522dc5a	Upgraded commons-lang from 3.10 to 3.18.0 to address CVE-2025-48924.	Security	3‑Sep‑2025
b2069f0b	Changed the behaviour of the "cart contains category" promotion condition so that exclusions only override categories that are explicitly included.		2‑Sep‑2025
42862cd6	Changed "No product was found for base amount" error to a warning.		28‑Aug‑2025
ff9b43cd	Upgraded Tomcat from 10.1.42 to 10.1.44 to address CVE-2025-52520, CVE-2025-53506, and CVE-2025-48989.	Security	26‑Aug‑2025
56be14d9	Modified the `XPFTaxableShoppingItem` so that its GUID matches the shopping cart line item GUID, so that the `ElasticPathTaxCalculator` cache doesn't miss on subsequent identical tax lookups. WARNING: Make sure to consume patch c01bc0ea at the same time as this patch to avoid potential checkout failures.		25‑Aug‑2025
745fc35c	Removed all ESAPI dependencies, which were not effectively protecting the Cortex API endpoints and were including vulnerable transitive dependencies.		20‑Aug‑2025
1db31ec0	Fixed issue with service level options in the Commerce Manager promotion actions not updating correctly after the selected stores are changed.		20‑Aug‑2025
29072bea	Removed extra `super.configure()` call in `ImportRouteBuilder`.		15‑Aug‑2025
9a281811	Upgraded Spring Security from 6.4.5 to 6.4.6 to address CVE-2025-41232.	Security	13‑Aug‑2025
92c97b7b	Upgraded ActiveMQ from 5.18.5 to 5.18.7 to address CVE-2025-27533.	Security	12‑Aug‑2025
f5b0852f	Upgraded Spring Framework from 6.2.6 to 6.2.8 to address CVE-2025-41234 and CVE-2025-22233.	Security	12‑Aug‑2025
cdb98f9c	Fixed duplicate guid in facet test data that was causing intermittent test failures.		12‑Aug‑2025
c2f2ee9e	Fixed issue on promotion editor where store and catalog assignments were not persisted if changed after an initial save.		12‑Aug‑2025
d34f8e00	Jakarta migration in committed source code.	Security	1‑Aug‑2025
df6cdeb4	Jakarta migration in replacer output.		1‑Aug‑2025

Badge legend

Security: Indicates that the patch includes security fixes.
Performance: Indicates that the patch improves system performance.
Data model changes: Indicates that the patch includes Liquibase scripts that make changes to the data model.
Requires downtime: Indicates that the Self-Managed Commerce services should be shut down while the Data Population Tool is executed.
Build Tools: Indicates that the patch includes changes to Build Tools.

`8.7.0`

Released: August 2025

Release highlights

Javax to Jakarta migration

For many years, Java EE was developed under the stewardship of Oracle, and core packages used the javax.* namespace (e.g., javax.servlet, javax.persistence). In 2017, Oracle donated Java EE to the Eclipse Foundation, and the platform was rebranded as Jakarta EE.

However, Oracle retained the rights to the javax namespace as part of the Java trademark. This created a major roadblock: although Jakarta EE could evolve independently, it could not modify any API under javax.*.

To move forward with innovation, the Eclipse Jakarta EE Working Group made the decision to rename all relevant packages to the jakarta.* namespace. This change officially occurred starting with Jakarta EE 9, released in December 2020.

Key changes included:

javax.servlet --> jakarta.servlet
javax.persistence --> jakarta.persistence
javax.ws.rs --> jakarta.ws.rs
And many more.

As a result, many of the Open Source dependencies used by Self-Managed Commerce have released new artifacts that use the jakarta.* namespace, often with updated Maven coordinates. In order to consume these updates, Self-Managed Commerce needed to migrate all dependencies using the javax.* packages to new dependencies that use the jakarta.* packages at once, so that they can use the API interfaces defined by the new Jakarta EE version.

This allowed Self-Managed Commerce 8.7 to upgrade key dependencies such as Spring 5.x to Spring 6.x, OpenJPA 3.2.x to 4.x, and Tomcat 9.x to 10.x. Without making these changes, Self-Managed Commerce would be unable to consume the new versions of these dependencies which include important security fixes and new features.

For information about the impact of these changes on your custom code, see Upgrade Notes: Jakarta migration.

Promotions Calculator extension point

A new extension point has been added that can be used to externalize promotion calculations. This means that developers can delegate the calculation of promotions to a third-party service, or to a separate Self-Managed Commerce environment that exposes APIs for promotion calculations.

By default, the ElasticPathPromotionsCalculator extension will implement this extension point, which reads promotion rules from the database and uses Drools to evaluate conditions.

For more information, see Promotions Calculator extension point.

Notification Events extension point

A new extension point has been added that allows developers to control how notifications are sent to customers and business users. This extension point is the basis for all notification events, including email, text message, and push notifications.

When Self-Managed Commerce needs to notify a customer or business user, all registered notification event extensions are notified by invoking the send method. The context passed to this method includes details such as the notification type, recipients, and placeholder values. It is the responsibility of the extension to both render and deliver the message to the recipients.

By default, the VelocitySMTPEmailSender extension will implement this extension point, which renders emails using Apache Velocity and uses SMTP to send out the emails. However, this extension can be replaced with integrations to third-party services such as SendGrid or Postmark, so that business users can modify email templates themselves without needing to involve the development team. Additionally, other extensions could be created to send notifications to customers via text message (using Twilio) or other push notification services.

For more information, see Notification Events extension point and Email Delivery.

Product Events extension point

A new extension point has been added that is notified when a product is created or updated. This is useful for notifying back-end systems when catalog changes occur in Self-Managed Commerce. Extensions will be notified no matter how the product was changed, including Import/Export imports, Data Sync, or changes made in Commerce Manager.

For more information, see Product Events extension point.

Full support for Trusted Header Authentication

Previously, Cortex had partial support for Trusted Header Authentication, which allows the use of headers to authenticate a shopper.

However, this functionality had two major limitations:

There was no support for creating a new customer record for an unrecognized X-Ep-User-Id header value.
There was no support for transitioning a PUBLIC shopper to a REGISTERED shopper.

These limitations were previously addressed by wiring in the Cortex Trusted Header Mode Accelerator, however, this functionality is now built into the platform.

For more information, see Trusted Header Authentication.

New in this release

In addition to the Release Highlights, this release contains the following updates:

Added support for `IS NULL` and `IS NOT NULL` in the EP Search Query Language

Added support for the IS NULL and IS NOT NULL operators when specifying a filter for an Import/Export export. This allows API clients to filter fields based on whether a value is set or not.

For more details, see EP Search Query Language.

JMX endpoints for logging

A new com.elasticpath.logging MBean server has been added to all Self-Managed Commerce services. This allows you to modify the log levels of running services in real time.

For more details, see Log level updates.

Added subquery support to `JpqlQueryBuilder`

The JpqlQueryBuilder class now supports generation of queries with subqueries. This is useful for using the results from one query as a filter for another query.

This feature is supported through the new void appendWhereInSubquery(final String fieldName, final JpqlQueryBuilder subQueryBuilder) method. This method adds a where clause to the query that ensures that the specified fieldName value is contained in the results of the subQueryBuilder result.

As an example, we can create a JPQL query that returns all customer records that are associated to a stores in the OPEN state:

// Create subquery that returns store codes for all stores in the OPEN state
JpqlQueryBuilder subQuery = new JpqlQueryBuilder(persistenceEngine, "StoreImpl", "store", "store.code");
subQuery.getDefaultWhereGroup().appendWhereEquals("store.storeState", StoreState.OPEN);

// Create query that returns all customer records that are associated to stores in the OPEN state
JpqlQueryBuilder query = new JpqlQueryBuilder(persistenceEngine, "CustomerImpl", "cust");
query.getDefaultWhereGroup().appendWhereInSubquery("cust.storeCode", subQuery);
query.getDefaultWhereGroup().appendWhereEquals("cust.sharedId", "test");

// Execute query
persistenceEngine.retrieve(query.buildQuery(), query.buildParameterList().toArray());

Local developers now use the Cargo plugin to start webapps

Starting webapps on a local developer machine now uses the Cargo plugin instead of the Tomcat plugin. Therefore, webapps are now started by running mvn clean package cargo:run from the appropriate webapp folder.

For more details, see Running Applications and Changes to webapp startup instructions for local development.

Added new Maven build parameter for quick builds

Developers can now use the -DskipSlowTests parameter with Maven to run a quick build with basic validation. This parameter is similar to -DskipAllTests, but also runs all static analysis checks and unit tests. Integration tests and Cucumber (and Selenium) tests are skipped. On a Mac M1, running mvn clean install -DskipSlowTests should take about 19 minutes to run.

For more details, see Building source code.

Enhancements to the Operations Specification

Added a new jvmRuntimeArguments field to the activemq section of the ops-spec.json file. This allows us to specify system properties to pass to the JVM when starting the ActiveMQ broker.

For more details, see Operations Specification.

Added build-time checks for multiple JARs providing the same classes

When a Java runtime classpath contains multiple JARs that provide the same fully qualified class name, the classloader will randomly choose one of the class implementations. This can lead to confusing intermittent issues such as MethodNotFound at runtime.

To prevent this, a new plugin has been added to the build process called duplicate-finder-maven-plugin, which detects this situation and will fail the build if it finds multiple JARs providing the same class.

Along with this change, several conflicting dependencies have been resolved:

Multiple conflicting jars: jakarta.xml.bind:jakarta.xml.bind-api:2.3.3, javax.xml.bind:jaxb-api:2.3.1
- javax.xml.bind:jaxb-api was removed.
- jakarta.xml.bind:jakarta.xml.bind-api is now the primary JAR providing Java Architecture for XML Binding functionality.
Multiple conflicting jars: javax.servlet:javax.servlet-api:3.1.0, org.eclipse.jetty.toolchain:jetty-servlet-api:4.0.6
- org.eclipse.jetty.toolchain:jetty-servlet-api was removed.
- javax.servlet:javax.servlet-api is now the primary JAR providing servlet functionality.
Multiple conflicting jars: org.slf4j:jcl-over-slf4j:1.7.32, org.springframework:spring-jcl:5.3.39, commons-logging:commons-logging:1.1.1
- commons-logging:commons-logging was removed and banned.
- org.slf4j:jcl-over-slf4j is now the primary JAR providing commons logging functionality.
Multiple conflicting jars: aopalliance:aopalliance:1.0, org.glassfish.hk2.external:aopalliance-repackaged:3.1.1, org.springframework:spring-aop:5.3.39
- aopalliance:aopalliance was removed and banned.
- org.glassfish.hk2.external:aopalliance-repackaged is now the primary JAR providing Aspect-Oriented Programming functionality.
Multiple conflicting jars: jakarta.validation:jakarta.validation-api:2.0.2, javax.validation:validation-api:2.0.1.Final
- Core is only using javax.validation:validation-api (jakarta.validation-api was removed).
- Search Server is using both:
  - jakarta.validation-api version 3.0.2 which provides the jakarta.validation packages for SOLR.
  - javax.validation-api version 2.0.1 which provides the javax.validation packages.
Multiple conflicting jars: javax.el:javax.el-api:3.0.0, org.glassfish:jakarta.el:3.0.4
- jakarta.el:jakarta.el-api and javax.el:javax.el-api were removed and banned.
- org.glassfish:jakarta.el is now the only JAR providing expression language functionality.
Multiple conflicting jars: io.swagger.core.v3:swagger-annotations-jakarta:2.2.22, io.swagger.core.v3:swagger-annotations:2.1.13
- io.swagger.core.v3:swagger-annotations was removed and banned.
- io.swagger.core.v3:swagger-annotations-jakarta is now the only JAR providing Swagger annotations functionality.
Multiple conflicting jars: com.sun.mail:imap:1.5.6, com.sun.mail:jakarta.mail:1.6.7, com.sun.mail:javax.mail:1.5.6
- com.sun.mail:javax.mail, com.sun.mail:imap, javax.mail:mailapi, and javax.mail:mail and were removed and banned.
- com.sun.mail:jakarta.mail is now the only JAR providing mail functionality.
Multiple conflicting jars: com.sun.activation:jakarta.activation:1.2.2, com.sun.activation:javax.activation:1.2.0, jakarta.activation:jakarta.activation-api:1.2.2, javax.activation:activation:1.1
- com.sun.activation:javax.activation, javax.activation:activation, javax.activation:javax.activation-api, and jakarta.activation:jakarta.activation-api were removed and banned.
- com.sun.activation:jakarta.activation is now the only JAR providing activation functionality.

For more information, see Duplicate JAR finder.

Added new integration test for testing JPQL queries

A new integration test has been added to the ep-core-itests module to make it easier to test JPQL queries against a Self-Managed Commerce database.

For more information, see JPQL Query Test.

Added pagination support for wish list line items in Cortex

Added a new link to the wishlists.wishlist resource named lineitemspaginated. This returns the same elements as the existing lineitems link, but the results are paginated. The page size is defined by the COMMERCE/STORE/listPagination setting value.

For more information, see Read paginated wishlist line items.

Added a new setting to disable price faceting to improve search indexing performance

For customers with a large number of price lists, rebuilding the product search index may be very slow, since the price for each product in every price list must be determined and populated in the index. However, this functionality is only needed for a specific aspect of filtered navigation functionality which allows shoppers to filter their search results by price.

If this functionality is not needed, it can be disabled by setting the COMMERCE/STORE/FILTEREDNAVIGATION/priceFacetingEnabled setting to false. This has two effects:

The price faceting option is not shown when viewing facets on offer search results or category results.
Pricing is not calculated during product search indexing, and is not stored in the SOLR index.

If this setting is disabled, product search indexing may be significantly faster for some customers.

Multiple extension point framework improvements

See the Extension Point Framework release notes.

Fixed issues

Commerce Engine

Performance optimization for retrieving extensions for Extension Points

Profiling revealed that the XPFExtensionLookup#getMultipleExtensions and XPFExtensionLookup#getSingleExtension methods were a major performance bottleneck.

Within the call stack of these methods is a call to PluginManager#getExtensions. Although this call used a cache to avoid expensive extension instantiation costs, it still ended up doing classpath scanning to determine which classes support the passed extension point.

We were able to completely avoid doing this classpath scanning since we’ve already identified the available extensions within XPFInMemoryExtensionResolverImpl#init.

These changes resulted in approximately a 7% improvement in overall Cortex response times.

Corrected bundle availability logic

The previous availability logic for bundles was correct for fixed bundles but not always correct for dynamic bundles.

Previous behavior: If any constituent was OUT_OF_STOCK, then the entire bundle was considered OUT_OF_STOCK. New behavior: The bundle availability status is set to AVAILABLE when the number of available constituents is greater than or equal to the selection rule count, and OUT_OF_STOCK otherwise.

For example, given a scenario where the selection rule is 2, the bundle is assigned 5 constituents:

If 3 are out of stock, the bundle will show as AVAILABLE.
If 4 or more are out of stock, then the bundle availability will show as OUT_OF_STOCK.

Order shipment shipping discount is now persisted

The TORDERSHIPMENT table stores shipping subtotal (including discounts) in the SHIPPING_COST column. However, the shipping subtotal before discounts and the shipping discount were not stored separately.

To address this issue, a SHIPPING_DISCOUNT field has been added to track the shipping discount, and we use the previously ignored SHIPPING_SUBTOTAL field to track shipping subtotal before discounts.

To summarize:

Shipping subtotal before discounts: TORDERSHIPMENT.SHIPPING_COST
Shipping discount: TORDERSHIPMENT.SHIPPING_DISCOUNT
Shipping subtotal including discounts: TORDERSHIPMENT.SHIPPING_SUBTOTAL

note

Since it's not possible to retroactively derive these values, existing TORDERSHIPMENT records will contain null SHIPPING_DISCOUNT and SHIPPING_SUBTOTAL values. However, these fields will be populated for all newly created orders.

Added a new warning to the logs if application cache implementation is not being used

A new warning is now logged when a service using SwitchableProxyBinder is using the fallback implementation, which usually indicates that application-level caching is not working. This can happen if no OSGi or Spring beans registered a cache implementation binding with the SwitchableProxyBinder.

Example warning message:

WARN: Using fallback implementation of `com.elasticpath.service.pricing.PriceListAssignmentService`. This usually means that caching is disabled for this service. See https://documentation.elasticpath.com/commerce/docs/core/platform/cross-platform/ehcache.html#switchable-proxy-binder for more information.

For more information, see Switchable Proxy Binder: Determining if extensions are registered properly.

Added missing test modules to the Maven reactor

Previously, there were a number of modules that were not included in the Maven reactor. These modules are typically run tests that require a deployment to exist.

Since these modules are not included in the Maven reactor, they were not compiled or checked by the static analysis tools until the tests were actually run. This led to long delays in feedback about compilation, Checkstyle, and PMD errors.

Refactoring was much harder since IntelliJ wasn't aware of these classes. It also breaks the IntelliJ navigation to and from Cucumber features and their step definitions.

To address this issue, the following modules have been added to the Maven reactor:

ep-commerce/commerce-engine/core/ep-core-tool-itests
ep-commerce/extensions/cortex/ext-system-tests/cucumber
ep-commerce/extensions/catalog
ep-commerce/extensions/catalog/ext-system-tests
ep-commerce/extensions/catalog/system-tests
ep-commerce/extensions/system-tests/performance-tests/cucumber
ep-commerce/extensions/cm/ext-cm-modules/ext-system-tests
ep-commerce/extensions/cm/ext-cm-modules/system-tests/selenium

Cortex

Cortex OSGi console is no longer accessible by default

Previously, the OSGi console was accessible by default at the system/console path. Although this was secured with a username/password, the default credentials are very easy to guess, so this presented a security risk.

To mitigate this risk, the OSGi console is now blocked by default, unless the ep.management.port system property is set to the desired port. For production environments, we recommend setting this value to a port that is internally accessible for debugging production issues, but not externally accessible. Note that Tomcat must also be configured to listen on the specified port.

Commerce Manager

Added caching for `CartOrderService#getCartOrderGuidByShoppingCartGuid`

Normally, services handling shopper-controlled entities are not cached because they are changed frequently. However, the CartOrderService#getCartOrderGuidByShoppingCartGuid service is used to retrieve the cart order GUID for a shopping cart GUID, which will never change, so it's cacheable. This change eliminates several unnecessary database queries during shopping cart operations.

Search Server

Re-index products when catalog promotions are added

Fixed functionality to ensure that affected products are re-indexed when catalog promotions are added, modified, or become active or inactive to ensure that the indexed price is correct.

Tests

Consolidated and cleaned up Cucumber test Cargo configurations

Reduced duplication and complexity in the configuration of the Cargo plugins for Cucumber tests. Many of the properties, dependencies, and Cargo plugin configuration parameters have been moved out of the individual Cucumber module POMs and into extensions/pom.xml and root pom.xml. The root pom.xml contains the shared dependencies and Cargo plugin configuration needed by all modules, while the extensions/pom.xml contains specific execution configurations for starting each Self-Managed Commerce service for use by the Cucumber tests.

Additionally, the Cargo configuration defined in the root pom.xml is reused by the webapp modules when local developers are starting the webapps with mvn clean package cargo:run.

Database

Added missing Liquibase checksums to changesets that were updated during the Liquibase upgrade.
Fixed preconditions in core-changelog-2020-08-cleanup-expired-failed-orders-job changeset to avoid potential upgrade error.
Removed checksum validation from core-changelog-2024-07-expired-data-point-values-job changeset due to required changes in earlier versions.
Fixed SchemaSpy document generation on PostgreSQL.
Upgraded SchemaSpy plugin from 1.0.4 to 5.3.0.

Additional Commerce Engine fixes

Modified the build process to fail if ops-spec.json isn't a valid json file.
Fixed Core Request-Scoped Caching to ensure that retrievals with different load tuners or fetch groups are cached separately.
Removed unused CustomerTagStrategy interface.
Removed unused PricingCacheKey class.
Removed unnecessary methods from the PriceListService interface.
Enabled Checkstyle and PMD for the webapp-smoketests module.
Enabled Checkstyle and PMD for the http-mock-server-services module.
Modified AspectJ logging to use the same format as the rest of the application.
Added new entries to .gitignore: .sonarlint/ and .vscode/.
False-positive FindBugs warnings are now suppressed with @SuppressFBWarnings instead of @SuppressWarnings, to ensure that Static Application Security Testing tools can ignore these false-positive warnings properly.
Minor code refactoring for TimeIntervalCacheImpl#get to simplify implementation.
Added debug logging for SwitchableProxyBinder.
Fixed race condition in TimeIntervalCacheImpl that can result in a NoSuchElementException when retrieving values from the cache.
Colored logging in Self-Managed Commerce services is now disabled by default; only enabled for local development deployments.
Fixed issue where the shopping cart memento object was not correctly passed to bundle items during instantiation.
Fixed issue with logging of some Catalog Syndication failures.
Fixed infinite recursion bug in CacheableFacetService#findAllFacetsForStore.
Fixed issue where resending a Gift Certificate for a specific order line item was resending all order gift certificates to the specified recipient.
Fixed an issue where domain events are not always triggered as expected if the domain class has been extended.
Added calls to super.configure() within configure methods of route builders extending CRSCEnabledRouteBuilder.
Fixed issue with Extension Point Framework entities missing all non-localized attribute values when a localized attribute contains a non-localized fallback value.
Fixed issue that was sending messages to VirtualTopic.ep.catalog containing an error message when Catalog Syndication was triggered.
Fixed multiple issues with limited usage promotions:
- Promotion wizard not saving the limited use promotion setting.
- An error was occurring when checking out with limited use promotions: Attempt to attach a modified class com.elasticpath.domain.rules.impl.PromotionRuleImpl which has @ShopperReadOnly annotation.
- Potential race condition when incrementing the promotion usage count during checkout, causing some uses to be missed.
Fixed potential race condition for limited use coupons when incrementing the coupon usage count during checkout, causing some uses to be missed.
Fixed issue with CouponUsageDaoImpl#findEligibleUsagesByEmailAddressInStore passing wrong value to named query when email address is empty.
Fixed behavior of the first time buyer flag if the shopper's first order fails.
Fixed Tax Calculator extension IndexOutOfBoundsException exception for empty tax records collection.
Fixed incorrect environment subfolder names in ext-data.
Ensure that affected products are re-indexed when catalog promotions are added, modified, or become active or inactive to ensure that the indexed price is correct.
Fixed stack trace logging on Camel routes for event-based extension points.
Changed the way that SkuOptionValue is associated with ProductSkuOptionValue, using a lazy load approach instead of the Eager Field Post Load Strategy, to prevent possible "context has been closed" exceptions.
Fixed error handling for shipping option determination so that the actual underlying error is reported rather than a NullPointerException.
Fixed vulnerability in DownloadServiceHandler.
Fixed SQL injection warnings identified by SAST tooling in ep-persistence-openjpa.
Refactored ProductAssociationQueryBuilder to use JPQLQueryBuilder and optimized generated query for determining product associations.
Fixed NullPointerException in coupon auto-apply role transition if registered user email was null.
Fixed NullPointerException that could occur if looking up a non-existent compound GUID with CategoryLookup#findByCompoundCategoryAndCatalogCodes.
Fixed NullPointerException that could occur if RuleService#findByRuleGuid is called with a non-existent guid.
Fixed a race condition in service health checks that could report false health check failures if multiple requests were submitted concurrently.
Fixed LibJarUtil parser to properly exclude #runtime refs when scanning the payment plugin classpath.
Updated the Log4j configuration for all services to ensure that log file sizes are limited by using a fixed window rolling policy.
Improved warning "Setting retrieval strategy threw an exception." to ensure that full stack trace is logged.
Fixed all query strings defined on beans for Catalog Syndication JpaPagingItemReader instances to ensure they have an ORDER BY clause.
Non-physical skus were treated as always available, regardless of the product availability rule setting. Now their availability is determined by the availability rule.
Fixed issue where importing entities did't properly invalidate the application cache in some circumstances.
Refactored assertThat imports from org.assertj.core.api.AssertionsForClassTypes and org.assertj.core.api.Java6Assertions to org.assertj.core.api.Assertions. A new checkstyle IllegalImport rule was also configured to flag if these imports are used in the future.
Modified how email locale is determined to ensure that the customer's preferred locale is used (if specified) instead of the store default locale.
Fixed issue in which CM_USER_CREATED event is sent before user is persisted.

Additional Cortex fixes

Fixed issue with structured error messages from some shopping item validators not showing a link to the affected shopping item.
Fixed race condition that can occur when multiple users execute keyword or navigation searches with different sort keys.
Removed unused bundles from Cortex: javaparser-core, big-math, and antlr4-runtime.
Fixed issue where dependent items could not be removed from dynamic bundles in the shopping cart.
Fixed Cortex keyword search functionality so it correctly reads the COMMERCE/SEARCH/* system configuration settings.
Suppressed misleading "JWT signature does not match locally computed signature" errors in the Cortex log.
Added JVM system property to ensure that Log4j always uses the BasicContextSelector to avoid OSGi issues in Cortex.
Hardcoded mobee and vestri values removed from scope autocomplete in Cortex Studio.
Changed coupon validation failure code ERROR_COUPON_USAGE_MISSING to ERROR_EMAIL_NOT_ASSIGNED to improve clarity.
Added additional details to the structured error message response when a coupon is determined to be invalid.
Fixed Cortex structured message response when purchase form is submitted with validation errors.
Fixed Cortex applied promotions response for cart subtotal promotions to ensure that it returns the applied 'best of' promotion instead of all eligible promotions.
Suppressed misleading "JWT signature does not match locally computed signature" errors in Cortex log.
Fixed issue with Cortex attempting to write logs to a folder based on the build machine home folder instead of the runtime machine home folder.
Payment method elements returned by Cortex are now returned in a consistent order (alphabetical based on configuration name).
Removed support for user-name and user-company fields in JWT metadata payload, which was leading to unique constraint errors in PunchOut.
Fixed bug that caused a 404 error to be returned for wish list elements if the product or sku became unavailable.

Additional Commerce Manager fixes

Fixed performance issue when adding actions to catalog promotions in Commerce Manager when database contains a large number of price lists.
Improved performance in Commerce Manager when removing an attribute from a product type.
Fixed potential table scan when retrieving the order list in Commerce Manager.
Fixed split packages issue in com.elasticpath:shipping-calculation-epcommerce that was caused by ep-core being embedded.
Updated Commerce Manager cookies to always set the HttpOnly flag for improved security.
Fixed parent references in Commerce Manager modules to improve Maven reactor hygiene.
Fixed error that can occur when editing boolean attributes in Commerce Manager.
Fixed Commerce Manager error that occurs when searching for products using Advanced Search Query Builder.
Fixed problem with "All Stores" filter being ignored on the customer search tab.
Fixed sorting for "Enabled" and "Expiration Date" columns on cart and catalog promotion search results in Commerce Manager.
Removed unused Felix Webconsole dependency from Commerce Manager.
Fixed issue with the simulated selling context dialog in Commerce Manager in which labels were not appearing.
Fixed issue with order hold getting stuck in RESOLVE_PENDING if order lock is present.
Fixed issue with private use coupons not working after adding new users to an existing promotion.
Enabled state comparison version strategy on order holds to ensure that two users don't resolve the same hold simultaneously, leading to the order hold getting stuck in the RESOLVE_PENDING state.
Improved order hold resolution error handling to ensure that order holds don't get stuck in the RESOLVE_PENDING state.
Changed the orders list on the customer record in Commerce Manager to sort by created date instead of order number to avoid alphanumeric sorting issues.
Fixed issues with the shopper conditions user interface in Commerce Manager where conditions were sometimes duplicated or could not be removed.
Fixed potential NullPointerException that could occur if opening an address with a null sub-country in Commerce Manager.
Removed line from com.elasticpath.cmclient.core/plugin.xml that caused the XML to be invalid.
Fixed the "Cancel order" button to ensure that it is disabled for orders that have already been released.
Fixed error that was occurring on the Commerce Manager exchange wizard after modifying items to be exchanged.
Improved clarity of the dialog that appears in Commerce Manager when editing an order that has been edited by another user.

Additional Search Server fixes

Fixed issue where the parentCategoryCodes field was not populated in the SOLR index for linked categories.
Enabled HTTP/2 support for Solr replication.
Fixed parsing of queries in LuceneRawQueryComposerImpl that was causing problems for the search server when processing some index notifications.
Fixed search index rebuild when a product was added or updated using Import/Export.
Fixed search indexing issue in which delete requests were ignored if there are no corresponding add/update requests.
Fixed SolrFacetAdapter to consistently expect searchCriteria.getSearchHint("priceSourceIds") to contain a list of strings.
Fixed issue that causes search indexing to fail if multiple attribute values exist for the same attribute with the same locale.

Additional Integration Server fixes

Fixed Spring circular dependency that was causing NullPointerExceptions during Integration Server startup.
Removed unused CXFServlet references from Integration Server web.xml.

Additional Batch Server fixes

Fixed out of memory error that could occur on the Batch Server if the database contains a large number of TCUSTOMERCONSENT records.

Additional Data Sync fixes

Fixed a NullPointerException that can occur when publishing multi-sku products through the Data Sync Webapp.
Fixed issue with Data Sync Webapp where changesets containing base amounts were causing multiple product index notifications to be created and were also holding the base amount objects in memory until the service was restarted.

Additional Import/Export fixes

Fixed Import/Export to ensure that the necessary product search indexes are rebuilt when base amounts are updated.
Renamed notsoldseperately to notsoldseparately in the Snap-it-up products.xml.

Additional Operational Insights fixes

Fixed issue with Operational Insights interpreting serviceResponseWaitTime in minutes instead of milliseconds.
Fixed the Operational Insights revenue calculations to exclude failed orders.
Added java.base/java.lang.ref add-opens JVM parameter to prevent possible failures when Operational Insights evaluates cache sizes.
Fixed bad value for type int error that appeared in the logs when running Operational Insights with a PostgreSQL database.
Improved performance of the Operational Insights revenue query.

Additional Performance fixes

Eliminated unnecessary shopper and shopping cart lookups during cart order retrieval.
Fixed a performance issue in LocalizedAttributeKeyUtils#getLocaleFromLocalizedKeyName by removing a complex regular expression and caching Locale instantiation.
Fixed an issue that was causing unnecessary TORDER and TORDERAUDIT update queries to be created.
Fixed issue with Core Request Scoped Caching where some database lookups were not being cached.
Added missing indexes to PostgreSQL and Oracle that were created implicitly in MySQL.
Changed featuredoffers link on navigations resource from a conditional to a static link to avoid an unnecessary product query.
Fixed issue with ProductDaoImpl#findUidBySkuCode that could cause OpenJPA to read all product skus from the database in rare circumstances.
Updated product, product sku, and category default cache timeouts from 1 second to 1 hour.

Additional Test fixes

Fixed intermittent failure in the "Verify price facets are updated when a promotion is changed" Selenium test.
Fixed intermittent failure in "Sort products by product code" Selenium test.
Fixed intermittent failure in "Export Import all data - same server" Selenium test.
Fixed intermittent failure in "Search product for Merchandising Associations can be filtered by brand" Selenium test.
Improved "View Disabled Data Policy for Customer" Selenium test to not fail on retry.
Fixed intermittent failure in ExternalPluginTest integration tests.
Allow Cucumber tests in coupon-apply-validation.feature to pass in Trusted Header Mode.
Refactored b2b-buyer-functionality.feature to use client.authRegisteredUserByName instead of JWT authentication.
Removed unnecessary product/category cleanup after Cucumber tests and fixed issue that allowed bundles to be created in Commerce Manager without a valid sku code.
Fixed NullPointerException in ShippingOptionInfoSelectorRepositoryImplTest unit test.
Fixed intermittent Selenium issue related to the ErrorDialog class.
Fixed issue where Selenium cucumber tests in extensions/cm/ext-cm-modules/system-tests/selenium did not have access to all test step definitions.
Fixed connection leak in DBConnector classes.
Fixed issue where Commerce Manager errors were not being logged until after the error dialog was acknowledged and closed.
Fixed intermittent failure in Selenium tests due to problems verifying that a user interface element contains the expected value.
Fixed intermittent failure in Selenium tests due to problems obtaining focus on a user interface element.
Improved assertion output in CatalogBatchIntegrationTest.
Improved assertion output in RawJsonTestFacade.
Fixed issue with a NullPointerException appearing in Operational Insights when the webapp smoketests were run.
Fixed Catalog Syndication cucumber test stability issue.
Fixed issue where Selenium tests were executed multiple times when using cucumber.options to attempt to run a single Selenium test.
Removed some unnecessary log output while running Selenium tests.

Supported technology updates

Self-Managed Commerce 8.7.0 is compatible with the following Elastic Path releases:

Elastic Path Component	Compatibility
Extension Point Framework	Extension Point Framework compatibility matrix
CloudOps for Kubernetes	CloudOps for Kubernetes compatibility matrix
Self-Managed Commerce Docker	Self-Managed Commerce Docker compatibility matrix

Additionally, the following changes have been made to the Supported Technologies:

Dropped certification for MySQL 5.7. MySQL 5.7 reached its end-of-life on October 31, 2023. We recommend that customers upgrade to MySQL 8.0 or MySQL 8.4.
Added certified support for MySQL 8.4.
Upgraded certified PostgreSQL version from 16.6 to 16.8.
Upgraded certified MySQL 8.0 Aurora version from 8.0.mysql_aurora.3.04.2 to 8.0.mysql_aurora.3.08.2.
Upgraded certified MySQL RDS version from 8.0.35 to 8.0.41.
Upgraded certified Oracle version from 19.0.0.0.ru-2024-01.rur-2024-01.r1 to 19.0.0.0.ru-2025-01.rur-2025-01.r2.

Dependency changes

Many dependencies were updated as part of Self-Managed Commerce 8.7.0. The highlights are shown below:

Upgraded JavaEE 8 to JakartaEE 10.x.
Upgraded Tomcat from 9.0.x to 10.1.x.
Upgraded Spring Framework from 5.3.x to 6.2.x.
Upgraded Camel from 3.x to 4.x.
Upgraded OpenJPA from 3.2.x to 4.0.x.
Upgraded Eclipse Remote Application Platform from 3.5 to 4.2.
Upgraded Quartz from 2.3.2 to 2.5.0.
Upgraded Solr from 9.4.1 to 9.8.0.
Upgraded Wiremock from 2.x to 3.x.

Database changes

Added new setting definition records:
- COMMERCE/SYSTEM/EXPIREDDATAPOINTVALUECLEANUP/batchSize
- COMMERCE/SYSTEM/REVOKEDDATAPOINTVALUECLEANUP/batchSize
- COMMERCE/SYSTEM/CATALOGSYNDICATION/batchSize
- COMMERCE/STORE/FILTEREDNAVIGATION/priceFacetingEnabled
Added new setting value context records:
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderConfirmationNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderShipmentShippedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderShipmentReleaseFailedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context returnExchangeNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderOnHoldNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderCancelledNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserPasswordResetNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserCreatedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserPasswordChangedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context anonymousCustomerRegisteredNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context passwordChangedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context customerRegistrationNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context passwordForgottenNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/GIFTCERTIFICATES/channelUri with context giftCertificateCreatedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/GIFTCERTIFICATES/channelUri with context importJobCompletedNotificationHandler
- COMMERCE/SYSTEM/MESSAGING/DOMAIN/channelUri with context productEventsExtensionHandler
- COMMERCE/SYSTEM/MESSAGING/DOMAIN/deadLetterChannelUri with context productEventsExtensionHandler
Removed setting value context records:
- COMMERCE/SYSTEM/CUSTOMER/identifier with context punchout_attrval.
- COMMERCE/SYSTEM/CUSTOMER/identifier with context punchout_shared_id.
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderConfirmationEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderShipmentShippedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context orderShipmentReleaseFailedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/ORDERS/channelUri with context returnExchangeEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/GIFTCERTIFICATES/channelUri with context giftCertificateCreatedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/DATAIMPORT/channelUri with context importJobCompletedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context anonymousCustomerRegisteredEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context passwordChangedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CUSTOMERS/channelUri with context passwordForgottenEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserPasswordResetEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserCreatedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserCreatedEmailHandler.
- COMMERCE/SYSTEM/MESSAGING/CMUSERS/channelUri with context cmUserPasswordChangedEmailHandler.
Modified TCHANGESET table:
- Added PUBLISHED_DATE field.
Modified TCARTORDER table:
- Removed unused PAYMENT_METHOD_UID field.
Modified TCUSTOMER table:
- Removed unnecessary index on the CREATED_DATE field.
Modified TORDERSHIPMENT table:
- Added SHIPPING_DISCOUNT field.
Modified TAPPLIEDRULE table:
- Renamed RULE_UID field to RULE_GUID, and updated the values accordingly.
Created TRULEUSAGE table:
- UIDPK: BIGINT
- RULE_GUID: VARCHAR(50)
- USE_COUNT: BIGINT
Modified TRULE table:
- Dropped CURRENT_LUP_NUMBER field. This value is transferred into TRULEUSAGE.USE_COUNT.
Dropped all Spring Batch tables:
- BATCH_JOB_STEP_EXECUTION_CONTEXT
- BATCH_JOB_EXECUTION_CONTEXT
- BATCH_STEP_EXECUTION
- BATCH_JOB_EXECUTION_PARAMS
- BATCH_JOB_EXECUTION
- BATCH_JOB_INSTANCE
- BATCH_STEP_EXECUTION_SEQ
- BATCH_JOB_EXECUTION_SEQ
- BATCH_JOB_SEQ
Modified default setting definition values from 1 second to 3600 seconds (1 hour) for the following settings:
- COMMERCE/SYSTEM/CACHING/CATEGORY/timeToLive
- COMMERCE/SYSTEM/CACHING/CATEGORY/timeToIdle
- COMMERCE/SYSTEM/CACHING/PRODUCT/timeToLive
- COMMERCE/SYSTEM/CACHING/PRODUCT/timeToIdle
- COMMERCE/SYSTEM/CACHING/PRODUCTSKU/timeToLive
- COMMERCE/SYSTEM/CACHING/PRODUCTSKU/timeToIdle
- Note: These values will not be changed if they have already been modified to a different value.
Added new index to improve performance of Operational Insights revenue query:
- Added index to TORDER on CREATED_DATE, STORECODE, and CURRENCY.
Dropped unnecessary index on TCUSTOMER.CREATED_DATE field.

Database index consistency

In MySQL, if a foreign key constraint is added to a table and no index exists on the base column, the index is created automatically. However, in Oracle and PostgreSQL, if a foreign key constraint is added to a table and no index exists on the base column, the index is not created automatically.

As a result, some Self-Managed Commerce tables had implicit indexes on MySQL, but not on Oracle or PostgreSQL. To correct this, Liquibase changesets have been created to make the following changes:

On MySQL, these changes are applied to ensure that the index names are consistent with the index names in Oracle and PostgreSQL:

On the TAPPLIEDRULECOUPONCODE table, drop the TAPPLIEDRULECOUPONCODE_COUPON_GUID_FK foreign key constraint (to remove the implicit index), add the I_APPLIEDRULECOUPONCODE_COUPONGUID index, and re-add the TAPPLIEDRULECOUPONCODE_COUPON_GUID_FK foreign key constraint.
On the TCARTORDERPAYMENTINSTRUMENT table, drop the FK_CARTORDERPAYMENTINSTRUMENT_PI foreign key constraint (to remove the implicit index), add the I_CARTORDERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index, and re-add the FK_CARTORDERPAYMENTINSTRUMENT_PI foreign key constraint.
On the TCSDYNAMICCONTENTSPACE table, drop the FK_DELSPACE_CONTENTSPACE foreign key constraint (to remove the implicit index), add the I_CSDYNAMICCONTENTSPACE_DCCONTENTSPACEUID index, and re-add the FK_DELSPACE_CONTENTSPACE foreign key constraint.
On the TCUSTOMERCONSENT table, drop the FK_CONSENT_CUSTOMER foreign key constraint (to remove the implicit index), add the I_CUSTOMERCONSENT_CUSTOMERGUID index, and re-add the FK_CONSENT_CUSTOMER foreign key constraint.
On the TCUSTOMERPAYMENTINSTRUMENT table, drop the FK_CUSTOMERPAYMENTINSTRUMENT_PI foreign key constraint (to remove the implicit index), add the I_CUSTOMERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index, and re-add the FK_CUSTOMERPAYMENTINSTRUMENT_PI foreign key constraint.
On the TDATAPOLICYDATAPOINT table, drop the TDATAPOLICYDATAPOINT_IBFK_2 foreign key constraint (to remove the implicit index), add the I_DATAPOLICYDATAPOINT_DATAPOINTUID index, and re-add the TDATAPOLICYDATAPOINT_IBFK_2 foreign key constraint.
On the TORDERPAYMENT table, drop the FK_ORDERPAYMENT_PI foreign key constraint (to remove the implicit index), add the I_ORDERPAYMENT_PAYMENTINSTRUMENTGUID index, and re-add the FK_ORDERPAYMENT_PI foreign key constraint.
On the TORDERPAYMENT table, drop the FK_ORDERPAYMENT_PPC foreign key constraint (to remove the implicit index), add the I_ORDERPAYMENT_PAYMENTPROVIDERCONFIGUID index, and re-add the FK_ORDERPAYMENT_PPC foreign key constraint.
On the TORDERPAYMENTINSTRUMENT table, drop the FK_ORDERPAYMENTINSTRUMENT_PI foreign key constraint (to remove the implicit index), add the I_ORDERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index, and re-add the FK_ORDERPAYMENTINSTRUMENT_PI foreign key constraint.
On the TSHOPPER table, drop the SHOPPER_STORECODE_FK foreign key constraint (to remove the implicit index), add the I_SHOPPER_STORECODE index, and re-add the SHOPPER_STORECODE_FK foreign key constraint.
On the TSTORECUSTOMERATTRIBUTE table, drop the SCA_ATTRIBUTE_KEY_FK foreign key constraint (to remove the implicit index), add the I_STORECUSTOMERATTRIBUTE_ATTRIBUTEKEY index, and re-add the SCA_ATTRIBUTE_KEY_FK foreign key constraint.
On the TTAGALLOWEDVALUE table, drop the FK_TAGALLOWEDVAL_TAGTYPE foreign key constraint (to remove the implicit index), add the I_TAGALLOWEDVALUE_TAGVALUETYPEGUID index, and re-add the FK_TAGALLOWEDVAL_TAGTYPE foreign key constraint.
On the TTAGVALUETYPEOPERATOR table, drop the FK_TAGOPERATOR_TAGVALUETYPE foreign key constraint (to remove the implicit index), add the I_TAGVALUETYPEOPERATOR_TAGOPERATORGUID index, and re-add the FK_TAGOPERATOR_TAGVALUETYPE foreign key constraint.

On PostgreSQL and Oracle, these changes are applied to ensure that all expected indexes are present:

On the TAPPLIEDRULECOUPONCODE table, add the I_APPLIEDRULECOUPONCODE_COUPONGUID index.
On the TCARTORDERPAYMENTINSTRUMENT table, add the I_CARTORDERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index.
On the TCSDYNAMICCONTENTSPACE table, add the I_CSDYNAMICCONTENTSPACE_DCCONTENTSPACEUID index.
On the TCUSTOMERCONSENT table, add the I_CUSTOMERCONSENT_CUSTOMERGUID index.
On the TCUSTOMERPAYMENTINSTRUMENT table, add the I_CUSTOMERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index.
On the TDATAPOLICYDATAPOINT table, add the I_DATAPOLICYDATAPOINT_DATAPOINTUID index.
On the TORDERPAYMENT table, add the I_ORDERPAYMENT_PAYMENTINSTRUMENTGUID index.
On the TORDERPAYMENT table, add the I_ORDERPAYMENT_PAYMENTPROVIDERCONFIGUID index.
On the TORDERPAYMENTINSTRUMENT table, add the I_ORDERPAYMENTINSTRUMENT_PAYMENTINSTRUMENTGUID index.
On the TSHOPPER table, add the I_SHOPPER_STORECODE index.
On the TSTORECUSTOMERATTRIBUTE table, add the I_STORECUSTOMERATTRIBUTE_ATTRIBUTEKEY index.
On the TTAGALLOWEDVALUE table, add the I_TAGALLOWEDVALUE_TAGVALUETYPEGUID index.
On the TTAGVALUETYPEOPERATOR table, add the I_TAGVALUETYPEOPERATOR_TAGOPERATORGUID index.

Changelog​

Badge legend​

8.7.0​

Release highlights​

Javax to Jakarta migration​

Promotions Calculator extension point​

Notification Events extension point​

Product Events extension point​

Full support for Trusted Header Authentication​

New in this release​

Added support for IS NULL and IS NOT NULL in the EP Search Query Language​

JMX endpoints for logging​

Added subquery support to JpqlQueryBuilder​

Local developers now use the Cargo plugin to start webapps​

Added new Maven build parameter for quick builds​

Enhancements to the Operations Specification​

Added build-time checks for multiple JARs providing the same classes​

Added new integration test for testing JPQL queries​

Added pagination support for wish list line items in Cortex​

Added a new setting to disable price faceting to improve search indexing performance​

Multiple extension point framework improvements​

Fixed issues​

Commerce Engine​

Performance optimization for retrieving extensions for Extension Points​

Corrected bundle availability logic​

Order shipment shipping discount is now persisted​

Added a new warning to the logs if application cache implementation is not being used​

Added missing test modules to the Maven reactor​

Cortex​

Cortex OSGi console is no longer accessible by default​

Commerce Manager​

Added caching for CartOrderService#getCartOrderGuidByShoppingCartGuid​

Search Server​

Re-index products when catalog promotions are added​

Tests​

Consolidated and cleaned up Cucumber test Cargo configurations​

Database​

Additional Commerce Engine fixes​

Additional Cortex fixes​

Additional Commerce Manager fixes​

Additional Search Server fixes​

Additional Integration Server fixes​

Additional Batch Server fixes​

Additional Data Sync fixes​

Additional Import/Export fixes​

Additional Operational Insights fixes​

Additional Performance fixes​

Additional Test fixes​

Supported technology updates​

Dependency changes​

Database changes​

Database index consistency​