:quality(75))
Released 9 April 2024, Adobe Commerce (Magento) 2.4.7 is a compliance-forward release. It prepares you for PCI DSS 4.0 and tightens platform security. It is not a features drop — it is the release you take so the mid-year security cycle is quieter.
Security and compliance
2.4.7 introduced stricter Content Security Policies and safer defaults around script execution, improving protection against XSS and supply-chain injection. GraphQL parser improvements and validation hardening reduced the attack surface for headless builds. With dependency refreshes on top, the platform ships with a cleaner baseline for a security review.
Payments and checkout
PCI DSS 4.0 raises expectations around authentication, session handling and evidence. This release is a good moment to get in front of that: verify SameSite and Secure cookie attributes, confirm token storage practices, and review 3DS/SCA flows with your payment providers. For B2B flows, check session lifetime and idle timeouts against your own policy.
Why it is worth treating as a milestone
Most of this work is work you have to do anyway. Doing it as one piece — align CSP, rotate secrets, document controls — means future audits and incident response run faster. For composable teams, confirming GraphQL traffic behaves under the new parsing and validation rules avoids a surprise later.
Upgrade checklist
Rebuild CSP allowlists; enable report-only first, monitor, then enforce.
Validate payment and checkout extensions against PCI DSS 4.0; confirm cookie flags and session policies.
Load test GraphQL and storefront integrations under realistic concurrency; verify cache behaviour.
Refresh lower environments to mirror production versions and config; eliminate drift.
Update runbooks and evidence collection for audits — screenshots, logs, config exports.
What this means for you
2.4.7 sets a safer, more auditable baseline. Take it, do the checklist alongside it, and you go into the June cycle with fewer unknowns and documentation you can hand to an auditor.