Magento 2.4.7: what changes for payments and checkout
Magento 2.4.7 adds rate limiting for payment APIs, changes the checkout email check and supports PHP 8.3. What that means for shops and payment extensions.
Magento Open Source and Adobe Commerce 2.4.7 were released on 9 April 2024. For the checkout, two changes matter most, and the supported PHP versions change as well. Here is what to look out for when upgrading.
Rate limiting for payment APIs
Shops are regularly abused for carding: attackers use the REST or GraphQL API to test stolen card numbers automatically. From 2.4.7 the number of such requests per time window can be limited. The feature is built in, but it has to be enabled and configured.
Changed email check in the checkout
The isEmailAvailable query (GraphQL and REST) now always returns "available" by default. This stops the checkout from revealing whether an email address has an account in the shop. If you need the old behaviour, "Enable Guest Checkout Login" brings it back, along with that information leak. Test custom checkout code that relies on this query before upgrading.
PHP 8.3 and 8.2
2.4.7 supports PHP 8.3 and 8.2, but no longer PHP 8.1. Upgrading to 2.4.7 is therefore often a PHP upgrade too, and that affects every extension in the shop. Older payment modules are a frequent source of trouble here.
What I check when upgrading
- Extension compatibility with 2.4.7 and the PHP version
- Upgrade on a staging environment with a copy of the live data first
- Every payment method in sandbox mode, including refunds and partial shipments
- Rate limiting enabled, with limits that match the shop's order volume
- Go-live in a quiet time slot, with a backup and a way back
If you would rather not do the upgrade yourself, write to me.