Impact Score: 5/10
Medusa: v2.20.1: Field Filter Stripping Fix
Source available — automated, not human-reviewed
Component: medusajs · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Medusa v2.20.1. Source highlight: Field Filter Always Strips Disallowed Fields
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (3)
- **framework**: Always strip fields that a field filter doesn't allow (#16704) — @shahednasser
- Remove correlated flag on search until it is supported (#16703) — @sradevski
- Disallow using JSON for schema index specification (#16692) — @sradevski
📄 View Raw Release Notes (Original Developer Log)
<!--
# v2.20.1: Field Filter Stripping Fix
This patch release fixes a field-filter security gap that could expose disallowed fields.
CMS_BREAK -->
## Highlights
### Field Filter Always Strips Disallowed Fields
Previously, the `allowed` query config on a route and `http.restrictedFields` config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.
## Bug Fixes
- **framework**: Always strip fields that a field filter doesn't allow ([#16704](https://github.com/medusajs/medusa/pull/16704)) — [@shahednasser](https://github.com/shahednasser)
- Remove correlated flag on search until it is supported ([#16703](https://github.com/medusajs/medusa/pull/16703)) — [@sradevski](https://github.com/sradevski)
- Disallow using JSON for schema index specification ([#16692](https://github.com/medusajs/medusa/pull/16692)) — [@sradevski](https://github.com/sradevski)
## Contributors
Thank you to all contributors who made this release possible:
- [@shahednasser](https://github.com/shahednasser)
- [@sradevski](https://github.com/sradevski)