Medusa: v2.22.3: RBAC, Adyen Off-Session Payments, Tailwind CSS 4 Support

Source available — automated, not human-reviewed

Component: medusajs · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-04.

Automated impact estimate — compatibility not verified

📄 .MD

✨ Features 2 ⚡ Improvements 2 🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

Medusa v2.22.3 introduces end-to-end Role-Based Access Control (RBAC) across the admin dashboard, API routes, and JS SDK, along with off-session payment support for Adyen. Additionally, this release adds Tailwind CSS 4 support and fixes several bugs across CLI handling, routing, and Redis event processing.

Visit Medusa Official Site ↗ Official Release Source ↗ All Medusa Releases 📡 Medusa RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Engineers can leverage the new RBAC module and JS SDK integration for granular permission management and implement off-session payments using the Adyen provider.

📊 Product & Engineering Leads

Product managers gain enterprise-level role permission configuration for admin users and the ability to enable subscription and recurring billing flows through Adyen.

⚙️ DevOps & Security

DevOps teams should take note of multiple minor dependency updates and a fix addressing infinite CLI hanging on broken stdout pipes.

✨ New Features & Capabilities (2)

End-to-end Role-Based Access Control (RBAC) across dashboard UI, API routes, core flows, JS SDK, and dedicated module (requires Enterprise License)
Off-session payment support in the Adyen payment provider for subscription and recurring billing scenarios

⚡ Performance & Enhancements (2)

Added support for Tailwind CSS 4 in UI packages
Added Aruban Florin (AWG) currency support across dashboard, loyalty plugin, and utilities

🔧 Bug Fixes & Patches (6)

CLI now exits properly when stdout encounters a broken pipe instead of spinning indefinitely
Applied request locale to store product options routes
Re-registered restricted fields middlewares when API routes are reloaded via HMR in the framework
Forwarded `with_deleted` query parameter in `GET /admin/shipping-options` API route
Prevented silent event loss in `clearGroupedEvents` within `event-bus-redis`
Skipped customer account email validation when auth identity lacks an email, and added a validate hook to `createCustomerAccountWorkflow`

📄 View Raw Release Notes (Original Developer Log)

## Highlights ### End-to-End Role-Based Access Control Role-Based Access Control (RBAC) is now fully implemented across Medusa. Merchants can define custom roles with granular permissions and assign them to admin users, controlling what each user can view and do in the admin dashboard. The implementation spans the dashboard UI, API routes, core flows, the JS SDK, and a new dedicated RBAC module. Requires Enterprise License. [#15620](https://github.com/medusajs/medusa/pull/15620) --- ### Off-Session Payments in Adyen The Adyen payment provider now supports off-session payments, enabling recurring and subscription payment flows where charges are initiated without the customer being present at checkout. This unlocks use cases such as subscription billing and deferred payments for merchants using Adyen. [#17587](https://github.com/medusajs/medusa/pull/17587) ## Features * feat(dashboard,medusa,core-flows,framework,js-sdk,types,utils,link-modules,rbac): end to end RBAC implementation by [@NicolasGorga](https://github.com/NicolasGorga) in [#15620](https://github.com/medusajs/medusa/pull/15620) * feat: Add support for off-session payments in Adyen by [@sradevski](https://github.com/sradevski) in [#17587](https://github.com/medusajs/medusa/pull/17587) ## Bugs * fix(cli): exit instead of spinning forever when stdout is a broken pipe by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17640](https://github.com/medusajs/medusa/pull/17640) * fix(medusa): apply the request locale in store product options routes by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17638](https://github.com/medusajs/medusa/pull/17638) * fix(docs): fix stale property types in allOf response schemas of the OAS by [@shahednasser](https://github.com/shahednasser) in [#17633](https://github.com/medusajs/medusa/pull/17633) * fix: Clean up sandbox references, read a dedicated oauth secret by [@sradevski](https://github.com/sradevski) in [#17619](https://github.com/medusajs/medusa/pull/17619) * fix(framework): register the restricted fields middlewares again when reloading API routes with HMR by [@shahednasser](https://github.com/shahednasser) in [#17617](https://github.com/medusajs/medusa/pull/17617) * fix(medusa): forward with_deleted to the query in GET /admin/shipping-options by [@NicolasGorga](https://github.com/NicolasGorga) in [#17616](https://github.com/medusajs/medusa/pull/17616) * fix(utils,dashboard,loyalty-plugin): add the Aruban Florin (AWG) currency by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17613](https://github.com/medusajs/medusa/pull/17613) * fix(core-flows,utils): skip customer account email validation when the auth identity has no email, and add a validate hook to createCustomerAccountWorkflow by [@shahednasser](https://github.com/shahednasser) in [#17608](https://github.com/medusajs/medusa/pull/17608) * fix(event-bus-redis): don't silently lose kept events in clearGroupedEvents by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17600](https://github.com/medusajs/medusa/pull/17600) ## Documentation * docs: document filtering and sorting by linked data models in Query by [@shahednasser](https://github.com/shahednasser) in [#17645](https://github.com/medusajs/medusa/pull/17645) * docs: add security note to invoice generator store route by [@shahednasser](https://github.com/shahednasser) in [#17646](https://github.com/medusajs/medusa/pull/17646) * docs: address Kapa coverage gaps for 2026-10-01 [automated] by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17644](https://github.com/medusajs/medusa/pull/17644) * docs: fix Stripe provider option names to camelCase by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17629](https://github.com/medusajs/medusa/pull/17629) * docs: update API reference for v2.22.2 by [@shahednasser](https://github.com/shahednasser) in [#17597](https://github.com/medusajs/medusa/pull/17597) * docs: fix custom cell renderers file path in view configurations guide by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17541](https://github.com/medusajs/medusa/pull/17541) * docs: doc changes for next release [automated] by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17496](https://github.com/medusajs/medusa/pull/17496) ## Chores * chore(ui,ui-preset): support Tailwind CSS 4 by [@shahednasser](https://github.com/shahednasser) in [#17631](https://github.com/medusajs/medusa/pull/17631) * chore(auth-oidc): update openid-client to v6 by [@shahednasser](https://github.com/shahednasser) in [#17595](https://github.com/medusajs/medusa/pull/17595) * chore(deps): update mikro-orm to 6.6.17 by [@shahednasser](https://github.com/shahednasser) in [#17621](https://github.com/medusajs/medusa/pull/17621) * chore: update jest to v30.5.2 by [@shahednasser](https://github.com/shahednasser) in [#17618](https://github.com/medusajs/medusa/pull/17618) * chore(admin-vite-plugin,dashboard,telemetry,draft-order): update babel to v8 by [@shahednasser](https://github.com/shahednasser) in [#17611](https://github.com/medusajs/medusa/pull/17611) * chore(cli,orchestration,utils,workflows-sdk,test-utils,file-s3,workflow-engine-inmemory,workflow-engine-redis): update ulid to v3.0.2 by [@shahednasser](https://github.com/shahednasser) in [#17609](https://github.com/medusajs/medusa/pull/17609) * chore(payment-stripe,payment): update stripe to v23.1.0 by [@shahednasser](https://github.com/shahednasser) in [#17605](https://github.com/medusajs/medusa/pull/17605) * chore(utils): update graphql to v17 and graphql-tools/codegen majors by [@shahednasser](https://github.com/shahednasser) in [#17592](https://github.com/medusajs/medusa/pull/17592) * chore(auth,auth-google): update jwks-rsa to v4 by [@shahednasser](https://github.com/shahednasser) in [#17593](https://github.com/medusajs/medusa/pull/17593) * chore(admin-vite-plugin): update magic-string to v1 by [@shahednasser](https://github.com/shahednasser) in [#17594](https://github.com/medusajs/medusa/pull/17594) * chore(eslint-plugin,workflow-engine-inmemory): update cron-parser to v5 by [@shahednasser](https://github.com/shahednasser) in [#17590](https://github.com/medusajs/medusa/pull/17590) * chore(framework,medusa): update chokidar to v6 by [@shahednasser](https://github.com/shahednasser) in [#17584](https://github.com/medusajs/medusa/pull/17584) * chore(deps,caching,types,utils,framework): update awilix to 13.0.5 by [@shahednasser](https://github.com/shahednasser) in [#17574](https://github.com/medusajs/medusa/pull/17574) * chore(docs): upgrade typedoc to 0.28 by [@shahednasser](https://github.com/shahednasser) in [#17643](https://github.com/medusajs/medusa/pull/17643) * chore(docs): bump glob and minimatch in docs tooling to fix security alerts by [@shahednasser](https://github.com/shahednasser) in [#17627](https://github.com/medusajs/medusa/pull/17627) * chore: fix status field across OAS versions by [@shahednasser](https://github.com/shahednasser) in [#17607](https://github.com/medusajs/medusa/pull/17607) * chore: give the PR review action the PR's code, search, and Opus by [@shahednasser](https://github.com/shahednasser) in [#17589](https://github.com/medusajs/medusa/pull/17589) * chore(deps): bump glob from 13.0.6 to 14.0.2 in /www/utils/packages/docs-generator by [@dependabot](https://github.com/dependabot) in [#17620](https://github.com/medusajs/medusa/pull/17620) * chore(deps): bump the security-updates group across 1 directory with 2 updates by [@dependabot](https://github.com/dependabot) in [#17604](https://github.com/medusajs/medusa/pull/17604) * chore(deps): bump glob from 13.0.6 to 14.0.2 in /integration-tests by [@dependabot](https://github.com/dependabot) in [#17603](https://github.com/medusajs/medusa/pull/17603) * chore(docs): Generated + Updated UI Reference (automated) by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17583](https://github.com/medusajs/medusa/pull/17583) * chore(docs): Generated References (automated) by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17582](https://github.com/medusajs/medusa/pull/17582) * chore(docs): Update version in documentation (automated) by [@medusa-os-bot](https://github.com/medusa-os-bot) in [#17581](https://github.com/medusajs/medusa/pull/17581) **Full Changelog**: [v2.22.2...v2.22.3](https://github.com/medusajs/medusa/compare/v2.22.2...v2.22.3)

← Older Version Medusa v2.22.2

Newer Version → Latest Tracked Version ✓