v2.20.1

medusajs/medusav2.20.1Sep 3, 2026by medusa-os-bot[bot]

AI Summary

This patch release addresses a critical security vulnerability regarding field filters and improves search stability by removing unsupported flags and adding schema index validation.

Key Highlights

Fixed a security gap where field filters were not stripping disallowed fields unless RBAC was enabled
Improved search stability by removing the correlated flag until full support is available
Added validation to disallow using JSON for schema index specification

Full Release Notes

<!--

![v2.20.1](https://res.cloudinary.com/dza7lstvk/image/upload/v1788428096/Releases/v2-20-1-7f2142.png)

# v2.20.1: Field Filter Stripping Fix

This patch release fixes a field-filter security gap that could expose disallowed fields.

CMS_BREAK -->

## Highlights

### Field Filter Always Strips Disallowed Fields

Previously, the `allowed` query config on a route and `http.restrictedFields` config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.

## Bug Fixes

- **framework**: Always strip fields that a field filter doesn't allow ([#16704](https://github.com/medusajs/medusa/pull/16704)) — [@shahednasser](https://github.com/shahednasser)
- Remove correlated flag on search until it is supported ([#16703](https://github.com/medusajs/medusa/pull/16703)) — [@sradevski](https://github.com/sradevski)
- Disallow using JSON for schema index specification ([#16692](https://github.com/medusajs/medusa/pull/16692)) — [@sradevski](https://github.com/sradevski)

## Contributors

Thank you to all contributors who made this release possible:

- [@shahednasser](https://github.com/shahednasser)
- [@sradevski](https://github.com/sradevski)