# Medusa v2.16.0 — Release & Upgrade Intelligence
- **Product:** Medusa (https://medusajs.com)
- **Version:** v2.16.0
- **Released:** Jun 18, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/medusajs/updates/v2.16.0/

## Executive Summary (TL;DR)
Medusa v2.16.0. Source highlight: This release comes with many improvements and bug fixes. We highly recommend updating to leverage these changes in your application.

## Breaking Changes & Deprecations
- v2.16.0 is a minor release with several breaking changes that require code or config updates. This prompt covers only the required upgrade steps and breaking changes — additive features in this release (tax line context hook, multi-shipping-method carts, new/custom admin injection zones) are intentionally out of scope; do not implement them.
- The breaking changes in scope: 1. **Package version bump to v2.16.0** for all `@medusajs/*` packages.
- - Cover only the required/breaking changes listed above. Do not implement additive features (tax line context hook, multi-shipping carts, injection zones) even if you notice opportunities — mention them only if the user asks.
- - The plan covers every in-scope breaking change that applies to the project, and explicitly marks the rest N/A with a reason.
- 🚧 Breaking change If you setup the ESLint plugin and config in your Medusa backend, linting will run by default in the `medusa build` and `medusa develop` commands. If there are lint errors, both commands will fail.
- 🚧 Breaking change MikroORM 6.6.12 is affected by [CVE-2026-44680](https://advisories.gitlab.com/npm/@mikro-orm/knex/CVE-2026-44680/). This doesn't impact Medusa applications by default, but can affect Medusa customizations if they're JSON inputs are not properly validated with Zod.
- This version updates MikroORM to 6.6.14. This comes with a breaking change in how MikroORM's `manager.find` method works. Previously, it ignored all relations that don't exist on an entity. Now, it will fail with an error.
- 🚧 Breaking change react-router-dom has also been updated to `6.30.4` due to a recent advisory. The previous version didn't impact Medusa applications; the update is a defensive measure only.

## New Features
- Add dev dependencies: `@medusajs/eslint-plugin`, `eslint`, and `jiti`. Install at the monorepo root for monorepos, or directly in the project for standalone projects (and in plugins). `jiti` is required: the config is written in TypeScript (`eslint.config.ts`), and ESLint 9 uses `jiti` to load and transpile a TS config file at runtime. Without it, linting fails to load the config.
- Add `"eslint.config.*"` to the `exclude` array in the backend `tsconfig.json` to avoid type errors on the config file.
- Add a `lint` script to the backend's `package.json` so the command is easy to run, e.g. `"lint": "medusa lint"`.
- Add `http.authVerificationsPerActor` under `projectConfig` in `medusa-config.*`. Its type is `Record<actorType, { entity_type: string; auth_provider: string }[]>`. An empty array for an actor type means no verification required. Example:
- `entity_type` (e.g. `"email"`) and an optional `metadata?: Record<string, unknown>` are **added**. `entity_id` is still the email/identifier.
- Cover only the required/breaking changes listed above. Do not implement additive features (tax line context hook, multi-shipping carts, injection zones) even if you notice opportunities — mention them only if the user asks.

## Improvements
- chore: improvements to reviewer and triager by @shahednasser in #15608
- perf(product): skip option work on scalar-only variant updates by @srindom in #15585

## Bug Fixes
- Note the new `medusa lint` command (supports `--fix` and `--quiet`) and the `--no-lint` flag for `medusa build` / `medusa develop`. Recommend running `medusa lint --fix` after upgrade and surfacing remaining lint errors to the user.
- fix(cli): replace unmaintained pg-god with direct pg.Pool CREATE DATA… by @dsumeet14 in #15635
- fix: product organization combobox search and cache invalidation by @PrathamRanka in #15634
- fix(dashboard): enforce locale-specific plural forms in translations by @radeknapora in #13268
- fix(index): subscribe to restored events and re-index on restore by @Tusharkhadde in #15654
- fix(payment-stripe): warn when webhookSecret is missing by @dsumeet14 in #15684