What's New in Magento Open Source 2.4.9

Magento Open Source 2.4.9 shipped on May 12, 2026. It makes PHP 8.5 the supported runtime, moves every Symfony dependency to 7.4 LTS, and raises the rest of the stack to MariaDB 12.3, OpenSearch 3 and Valkey 9. The features are modest. The upgrade work is almost entirely in the platform underneath.

That's actually the right way to read this release. Adobe's 2.4.9 release notes run to hundreds of fixed issues, and most of them won't touch your code. A handful will. Here's how I'd sort them.

PHP 8.5 is the supported version, even though 8.3 still installs

Open vendor/magento/framework/composer.json on a 2.4.9 install and you'll see this:

"php": "~8.3.0||~8.4.0||~8.5.0"

So Composer will happily install 2.4.9 on PHP 8.3 or 8.4. But Adobe's system requirements list exactly one PHP version for 2.4.9: 8.5. Adobe is also explicit that it "supports only the system requirement combinations listed" and doesn't validate anything else. The constraint is wider than the support.

My take: target PHP 8.5 for any 2.4.9 upgrade, and treat 8.3/8.4 as a temporary bridge while you get there. It's the same pattern 2.4.8 had with PHP 8.2 (see what's new in 2.4.8), and it's the combination Adobe actually tests.

The good news is that 8.5 gives you some nice things to use in your own modules, like the pipe operator (|>), clone with property overrides, and array_first() / array_last(). The less fun news is that every third-party module in your composer.json needs to declare 8.5 support too, and that's usually what holds an upgrade up.

Symfony 7.4 LTS is the real code change

The release notes describe it plainly: all Symfony dependencies used by magento/composer moved to Symfony 7.4 LTS, and custom classes extending Symfony core classes need updated type declarations and method signatures before you upgrade.

Diffing the root composer.json between the 2.4.8 and 2.4.9 tags shows how far that goes. symfony/console, symfony/intl, symfony/process, symfony/string, symfony/mailer and symfony/mime all jump from ^6.4 to ^7.4.

The one that bites most Magento developers is symfony/console. Every custom bin/magento command extends Symfony\Component\Console\Command\Command, so run your static analysis against 2.4.9 before anything else. If you aren't already doing that, static analysis with PHPStan is the fastest way to find signature mismatches across a codebase, and it beats finding them one bin/magento call at a time.

The rest of the dependency diff

That same composer.json diff turns up a few more changes worth knowing about:

• laminas/laminas-mvc and magento/magento-zf-db are gone from the root requirements, and php-db/phpdb is new. If a custom module reaches into Laminas MVC classes directly, it's time to rewrite that code.
• symfony/cache and predis/predis are new. There's a Symfony-based cache adapter in Magento\Framework\Cache\Frontend\Adapter now. magento/zend-cache is still installed, so this is additive, but it shows you where the cache layer is heading.
• web-token/jwt-framework jumps from ^3.4 to ^4.0, and the carlos-mg89/oauth library is replaced with native PHP OAuth functions. Adobe says the JWT bump has no impact on existing functionality, but if you wrote code against either library, retest it.
• The admin WYSIWYG editor is HugeRTE now. On 2.4.8, lib/web/ ships tiny_mce_6. On 2.4.9, that directory is gone and lib/web/hugerte is there instead. Any custom editor plugin or RequireJS path pointing at tiny_mce_6 will break.
• Composer: the system requirements list Composer 2.10 for 2.4.9, and the root requirement on composer/composer moves from ^2.0, !=2.2.16 to ^2.2.
• A batch of JS libraries got upgraded, including jQuery UI 1.14.1, jQuery Validate 1.21.0, Less.js 4.2.2, Underscore 1.13.7, Uppy 4.13.4 and Chart.js 4.5.0. If your theme or admin customizations lean on any of these, give them a click-through.

The new stack requirements

Here's what Adobe's system requirements page lists for 2.4.9 on-premises, next to the latest 2.4.8 and 2.4.7 patches:

Adobe updates this table with every patch, so check the system requirements page right before you plan an upgrade.

Two things stand out. Elasticsearch is no longer listed at all, and neither is Redis: Valkey 9 is the only cache listed. Adobe also says it outright: "Adobe Commerce 2.4.9 is tested with MariaDB 12.3. Upgrade to MariaDB 12.3 before you upgrade to 2.4.9." Plan your database upgrade as its own step, not as part of the code deploy.

Two dated deadlines are worth knowing, too. MySQL 8.0 reached end of support on April 30, 2026, and Elasticsearch 7.17 on January 15, 2026. If either is still in your stack, that's work you have to do regardless of which Magento version you land on.

Behavior changes that can break integrations

These are listed as fixes in the release notes, but they change what an API accepts, so an ERP or PIM integration can start failing on them:

• Bulk API request bodies must be arrays with consecutive keys starting at 0. Previously, arbitrary keys were accepted (and bulk item status didn't update properly).
• Orders without a billing address are rejected when created through the REST API, instead of being created and later crashing the Admin dashboard.
• Malformed REST request bodies or parameters return a 400 Bad Request instead of a generic 500. Better for everyone, but check any client code that branches on status codes.
• City validation rejects !, ", # and ? in customer addresses (a forward slash is allowed).
• Store-scoped admin users can no longer edit the Default Config scope.
• CAPTCHA on account creation now applies to REST and GraphQL, too, when it's enabled for the Create Account form.

None of these are hard to handle. They just tend to show up as a support ticket two weeks after go-live, so test your integrations against them up front.

Features worth knowing about

The feature list is short, and that's fine. The ones I'd actually use:

• GraphQL: clearCart is now available in Open Source (it was Adobe Commerce only). There's also a new clearWishlist mutation, an exchangeExternalCustomerToken mutation, OrderTotal.grand_total_excl_tax, reCAPTCHA on updateCustomer, updateCustomerV2 and contactUs, and an admin setting that controls how guest and customer carts merge on sign-in. If you build headless frontends, the GraphQL course covers how these resolvers are wired.
• SRI hashes are split per area, theme and locale instead of living in one large sri-hashes.json, so each page loads only the hashes it needs. Stores with lots of themes or locales benefit the most.
• Admin 2FA only requires one enabled provider per user. Previously, enabling both Google Authenticator and U2F meant every admin had to configure both before signing in.
• The minimum admin password length is configurable under Stores > Configuration > Advanced > Admin > Security, which helps with PCI DSS 4.0's 12-character minimum.
• Page cache access lists accept CIDR ranges, so you can allow a whole network to send purge requests.
• Async and bulk API performance is back after the slowdown introduced with the APSB25-08 security patch.

What to check before you upgrade

Where you're coming from decides how much of the above is your problem:

• From 2.4.8: PHP 8.3/8.4 to 8.5, MariaDB 11.4 to 12.3, Valkey 8.1 to 9, plus the Symfony 7.4 signatures and the HugeRTE swap. Elasticsearch 8 users also move to OpenSearch 3.
• From 2.4.7: everything above, plus the 2.4.8 changes (PHP 8.4, Elasticsearch deprecation, new indexers defaulting to Update by Schedule, encryption key rotation moving to bin/magento encryption:key:change).
• From 2.4.6: everything above, and you're likely leaving Elasticsearch and PHP 8.2 behind at the same time. That's a big jump. Budget for it like a project, not a patch.

On every path: check that each extension declares PHP 8.5 and Symfony 7.4 support, run static analysis against the 2.4.9 codebase, retest every integration against the API changes above, and upgrade the database and search engine before the code. Adobe also tests 2.4.9 with PHPUnit 12, so expect your test suite to need attention too.

Should you upgrade, and when?

The support dates on Adobe's lifecycle policy make most of this decision for you:

• 2.4.5 and 2.4.6: regular support ended in August 2026. Upgrade now, and go straight to 2.4.9. Landing on 2.4.8 only buys you a second upgrade.
• 2.4.7: standard support runs to May 31, 2027. Plan 2.4.9 for the next few months. The PHP jump is big enough that you want it done before the deadline is close.
• 2.4.8: standard support runs to May 31, 2028. There's no rush. Upgrade once your extension vendors support PHP 8.5 and your hosting can run MariaDB 12.3 and Valkey 9. Until then, stay current on 2.4.8 security patches.

If you're on 2.4.8, 2.4.9 is a platform upgrade you can schedule. If you're on 2.4.6 or older, it's the upgrade you've already been putting off.

Either way, the code side of this release is pretty contained: Symfony signatures, a few dropped libraries, and integrations that send sloppy payloads. The infrastructure side is where the time goes.

What's tripping you up on your 2.4.9 upgrade so far? I'd love to hear what you're running into.