:quality(75))
8 September 2022 is the final day of support for Adobe Commerce (Magento) 2.3.x. After it, Adobe issues no more security patches, no quality fixes and no technical support for the 2.3 line, and makes no guarantees on compatibility or dependency updates.
What that looks like over time
Immediately after: vulnerabilities already fixed in newer versions stay unfixed in yours. You inherit known risk on day one.
At 6-12 months: new vulnerabilities start being found, and none of the fixes are coming back to 2.3.
At 1-2 years: the gap is wide enough that PCI DSS compliance becomes difficult to argue.
Why the line is ending
2.3 was released in February 2019 — over three years ago. Security frameworks, performance, GraphQL, dependency management and cloud infrastructure have all moved since, and 2.3 gets none of it.
Where you go
To 2.4.x. Version 2.4.0 was released in November 2020, and 2.4.5 is current as of August 2022. What you get is performance improvements, modern payment integrations, GraphQL support, operational stability — and 3 more years of support ahead of you instead of none.
Planning it
Audit the codebase. Assess the infrastructure. Write the test plan. Allocate the people. Stage the migration. Schedule the downtime. None of that is a surprise, and all of it takes longer than the first estimate anyone gives you.
What this means for you
If you are on 2.3.x, this is the priority — ahead of the feature list. An upgrade costs what it costs, and it is a number you can plan around. A breach is not.