# Medusa v2.17.0 — Release & Upgrade Intelligence
- **Product:** Medusa (https://medusajs.com)
- **Version:** v2.17.0
- **Released:** Jun 24, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/medusajs/updates/v2.17.0/

## Executive Summary (TL;DR)
Medusa v2.17.0. Source highlight: **IMPORTANT:** This release contains a regression around worker instances. You should not upgrade to this but instead 2.17.1.

## Breaking Changes & Deprecations
- 🚧 Breaking change Product options in Medusa can now be global — defined once at the store level and reusable across any number of products. Previously, options such as "Size" or "Color" had to be recreated independently for each product. With this release, you define an option once, attach it to as many products as you need, and manage values from a single place. This unlocks consistent variant modeling across large catalogs and reduces duplication when building storefront filters or admin tooling.
- 🚧 Breaking change Auth verification (email, phone, etc.) has been reworked into a flexible, provider-based system. You can now declare exactly which verifications are required per actor type and auth provider via the new `authVerificationsPerActor` config — for example, require email verification for customers using `emailpass`, but skip it for those signing in with Google. Codes are issued and confirmed through pluggable code providers, with a built-in token provider out of the box.
- This is a breaking change: - The verification endpoints moved from `POST /auth/:actor_type/:auth_provider/verification/request` (and `/confirm`) to flat `POST /auth/verification/request` and `POST /auth/verification/confirm`. The request route is now authenticated and takes `entity_id`, `entity_type`, and `code_provider` in the body instead of actor/provider in the URL.
- fix(dashboard): prevent URL param collision breaking pagination in price list add products modal by [@Tusharkhadde](https://github.com/Tusharkhadde) in [#15704](https://github.com/medusajs/medusa/pull/15704)

## New Features
- feat: global product options by @willbouch in #13817
- feat(order,types): add line_item_metadata to order responses by @NicolasGorga in #15727
- feat(dashboard): allow already registered actor to accept admin invite by @NicolasGorga in #15791
- feat(file-s3): add acl option to disable ACL headers on uploads by @mrpackethead in #15764
- feat: Revamp auth verification setup by @sradevski in #15696
- feat(admin-shared,dashboard,draft-order,loyalty): LayoutComposer, injection zones for plugins by @leobenzol in #15478

## Bug Fixes
- fix: handle bodyparser errors by @peterlgh7 in #15749
- fix: Run linting by default if eslint plugin is installed by @sradevski in #15816
- fix(medusa): update variant mutation endpoints query config to its retrieve query config by @NicolasGorga in #15735
- fix(core-flows): include order shipping method names in tax context by @gaoflow in #15783
- fix(dashboard): don't call hooks after an early return in UserLink by @merkelis-p in #15751
- fix(dashboard): don't call useTranslation inside NavItem items.map() by @merkelis-p in #15750