v2.20.1 v2.21.0
medusajs/medusaSep 3, 2026 → Sep 11, 20268 days between releases
What's New
Store API enforces strict allowed fields; exports Admin dashboard components
Breaking Changes
- Every Store API route now enforces a strict allowed list, stripping fields not explicitly defined.
- The `disallowed` list configuration has been removed from Store API routes.
- Field matching is now exact; selecting a relation like `region` no longer implies nested fields like `region.id`.
New Features
- New `allowFields` middleware allows re-exposing specific fields if needed.
- Admin dashboard components, hooks, and utilities are now exported from `@medusajs/dashboard`.
- Support for metadata management in promotions.
- New ESLint rules for `req.allowed`, `allowFields`, and `req.disallowed` middleware.
Improvements
- Store API security is hardened by enforcing an overridable set of allowed fields and relations.
Upgrade Notes
Update Store API queries to explicitly define allowed fields and relations, as the `disallowed` list and implicit nesting are no longer supported. Use the new `allowFields` middleware if you need to re-expose specific fields.
The Two Releases
v2.20.1: Field Filter Stripping Fix
Sep 3, 2026· 2 months ago
This patch release addresses a critical security vulnerability regarding field filters and improves search stability by removing unsupported flags and adding schema index validation.
Full release notesv2.21.0: Strict allowed fields in Store API and Exported Admin Components
Sep 11, 2026· 1 month ago
This release introduces security improvements to the Store API by enforcing a strict list of allowed fields and relations to prevent data leaks. It also exports internal Admin dashboard components, hooks, and utilities for customization.
Full release notes