Open Source

API clients had no way to tell a database error from an application bug without server log access. The generic 500 now carries DATABASE_ERROR, PERSISTENCE_ERROR or INTERNAL_ERROR, the transient-database 503 gains DATABASE_UNAVAILABLE plus a requestId, and SQLSTATE parsing rejects Node error codes such as ECONNREFUSED, with nothing from the raw error leaking into the body.

Magento\Framework\HTTP\Client\Curl sets no default timeout, so a stalled connection to the rules endpoint blocked fetchRules() indefinitely. That call runs from a cron job in a separate process, and Magento’s schedule lifetime only prunes stale rows after the fact — it never kills the hung worker.

The plugin injects the WAF eagerly, so every request paid for a point SELECT on the flag table before it could decode the rules — a round trip for a value that only changes when the five-minute cron writes it. Caching in front of that lookup, without reintroducing the cache-only storage the module had deliberately dropped, since cache:flush or a disabled cache type must not leave the WAF ruleless.

Select::validateValue and Multiselect::validateBySource used a loose falsy check on the source’s return value, so an option whose label was literally "0" got rejected with “Attribute X does not contain option with Id Y” since PHP treats the string "0" as false. Swapped in a strict === false comparison so only the real “not found” sentinel triggers the error.

hasSingleStore() called getStores(true) and counted the result on every single invocation, a TODO left over since MAGETWO-39902 acknowledged it needed caching. Now the result is cached on the instance and invalidated in reinitStores() and _resetState(), so repeated calls skip the store collection load entirely.

Warden installed Mutagen from a Homebrew tap that no longer exists, so a fresh warden sync on macOS failed before it ever started. Repointed the install to the maintained mutagen-io tap.

The generated VCL rejected PATCH with a synthetic 405, which broke REST clients doing partial updates behind Varnish. One line in the method whitelist, years of head-scratching saved.

nginx.conf.sample left PWA manifests and EOT/OTF fonts out of gzip_types, so they shipped uncompressed on every store built from the sample. Also dropped the gzip_disable "msie6" workaround.

Product import derived its row hash from whatever algorithm the environment happened to offer, so the same CSV produced different hashes on different PHP builds and re-imported unchanged rows. Pinned to xxh128.

Editing an order silently dropped rules limited by uses-per-customer: the new quote re-validated usage while the original order — the one about to be canceled — still held the usage slot. Same defect hit coupon validation.