Medusa.js
Medusa 2.20.1 closes a field-filter data exposure — patch now
Medusa 2.20.1 makes field filters strip disallowed fields without the RBAC flag. What the gap exposed, how to upgrade from 2.19.x, and how to test it.
Read articleBlog
Engineering notes, not brochure filler
Magento 2 and Adobe Commerce operations, commerce migrations to Medusa.js and Vendure, Next.js storefronts, and the hard parts of cutting over without freezing the business.
Vendure
Vendure 3.7.3 patches eleven vulnerabilities — upgrade now
Vendure 3.7.3 fixes eleven reported vulnerabilities, four critical, plus channel-scoping and shipping-line changes that alter behaviour after upgrade.
Read article
Vendure
Vendure scheduled tasks run in the server's timezone, not yours
Vendure evaluates cron expressions in the Node process timezone, so nightly jobs fire at the wrong local hour and drift at DST. How to audit and fix it.
Read article
Medusa.js
Medusa fulfillment providers cannot see variant metadata
In Medusa 2.19.0 the admin create-fulfillment flow drops items.variant.metadata, so dropship and print-on-demand providers get line items they cannot map.
Read article
Next.js
Next.js 16.3.3 patches two critical unauthenticated RCE flaws
Next.js 16.3.3 fixes two critical advisories — Windows-hosted server RCE and Image Optimization AVIF RCE. Here's who is exposed and how to mitigate.
Read article
Medusa.js
Medusa can oversell stock under concurrent checkouts
Medusa 2.19.0's inventory reservations are not concurrency-safe when called directly — here's where the race is and how to detect and close it.
Read article
Vendure
Vendure 3.7.2 patches a critical privilege escalation
Vendure 3.7.2 fixes four reported vulnerabilities and tightens channel scoping on update and delete paths — here is what to test before you ship it.
Read article
Medusa.js
Medusa 2.18 broke order export: the shipping method version trap
Order exports in Medusa 2.18.0 and 2.19.0 fail silently on any order with a shipping method. How to confirm it and what to do until it's fixed.
Read article
Medusa.js
Medusa 2.19 cache invalidation can OOM your API container
Why Medusa 2.19.0's caching module runs unbounded invalidation on worker_mode: server processes, how to confirm it, and what to change before a migration
Read article
Vendure
Vendure 3.7 security advisories: why patching to 3.6.x is not enough
Vendure 3.7.0 fixes five advisories, including a critical account takeover never backported to 3.6.x. Who is exposed, and what the upgrade actually costs.
Read article
Magento 2
Recovering a Magento 2.4.x store from the SessionReaper attack
How to confirm a SessionReaper/PolyShell compromise on Magento 2.4.x, remove the injected backdoors, restore wiped catalog data, and close the entry point.
Read article
Magento 2
Magento 2 extension debt - what to fix before it owns you
How Magento 2 and Adobe Commerce shops accumulate extension debt, how to inventory it, and when rescue work is cheaper than a full replatform.
Read article
Migrations
Medusa.js vs Vendure for Magento and WooCommerce exits
A practical comparison of Medusa.js and Vendure when you are leaving Magento 1, Magento 2, Adobe Commerce, or WooCommerce - without the hype.
Read article
Next.js
Next.js storefronts that are not theme shells
What enterprise Next.js commerce work actually includes when Magento, Medusa.js, or Vendure owns the cart - and when headless CMS fits.
Read article