Mage-OS 2.3.0 – Maintenance & Security

We are pleased to announce the release of Mage-OS Distribution 2.3.0, a security-driven release that absorbs Adobe’s latest Magento Open Source patch into the Mage-OS core, inventory, and Page Builder packages. It also rolls out PHP 8.4 and 8.5 compatibility across our add-on module suite. We strongly recommend updating as soon as possible.

Our foundation

The majority of changes in this release come directly from upstream. Mage-OS 2.3.0 is built on Magento Open Source 2.4.8-p5, which delivers a broad set of security improvements including GraphQL hardening (query complexity, nesting depth, request body size, malicious-code filtering), file upload hardening, database charset/collation handling, and URL rewrite storage refinements.

For full details on what’s included from upstream, see the Magento Open Source 2.4.8-p5 security patch notes and the 2.4.8 release notes.

What’s changed

Core security import

• Magento 2.4.8-p5 security patches imported All upstream 2.4.8-p5 security fixes are now incorporated into Mage-OS core, including GraphQL hardening, file upload protections, and DB initialization improvements.

Mage-OS Add-on module updates

• Page Builder Template Import/Export updated to 1.8.0

  • Added a security check on external files referenced through template imports (@dadolun95)
  • Refined admin warning and success messaging (@rhoerr)
  • PHP 8.4 and 8.5 compatibility, including SearchResult signature fixes on setAggregations / setTotalCount (@SamueleMartini)

• Theme Optimization updated to 2.3.0

  • Improved bfcache eligibility on native Full Page Cache hits (#25) by @rhoerr
  • PHP 8.4 and 8.5 compatibility with type hardening (#26, #27)

• Automatic Translation updated to 2.1.2 PHP 8.4 and 8.5 compatibility. (#62) by @SamueleMartini

• Inventory Reservations Grid updated to 1.0.5 PHP 8.4 and 8.5 compatibility. (#17, #18) by @SamueleMartini

• Meta Robots Tag updated to 1.2.1 PHP 8.5 compatibility. (#7) by @SamueleMartini

• Page Builder Widget updated to 1.4.1 PHP 8.4 compatibility. (#19) by @SamueleMartini

Mirror updates

The latest Magento versions, including 2.4.8-p5, are also available from our public Magento mirror at mirror.mage-os.org. This mirror is a drop-in replacement for repo.magento.com (except Magento Marketplace), allowing you to install Magento without any login credentials.

Thanks to everyone who contributed!

This release was made possible by:

• @marcelmtz (Marcel Martinez) — Merged the core 2.4.8-p5 security changes
• @rhoerr (Ryan Hoerr) — Co-authored the core p5 import (USPS, MariaDB regex, system.xml conflict resolution), FPC cacheability fix and PHP 8.5 type hardening in Theme Optimization
• @SamueleMartini (Samuele Martini) — PHP 8.4 and 8.5 compatibility across six add-on modules
• @dadolun95 (Luca Visciola) — Security check for external files imported through Page Builder templates

Want to participate?

Mage-OS is a community-driven project, and we welcome contributions of all kinds. Whether you’re fixing bugs, adding features, improving documentation, or helping with testing, your contributions make a difference.

• Mage-OS GitHub
• Mage-OS Discord

Installation

New installations

composer create-project --repository-url=https://repo.mage-os.org/ mage-os/project-community-edition=2.3.0 <install-directory-name>

Upgrading from an older Mage-OS version

composer require mage-os/product-community-edition=^2.3 --no-update
composer update
bin/magento setup:upgrade

Migrating from Adobe Commerce or Magento Open Source

See our migration guide for detailed instructions on switching to Mage-OS.

We hope you enjoy Mage-OS 2.3.0. As always, please report any issues on GitHub and join the conversation on Discord.