Maho 26.9.2, the maintenance patch that changes the API

26.9.2 is a maintenance patch for the 26.9 line: no new features, only fixes backported from main. The catch is that some of these fixes change what the REST API returns, so read the “Before you deploy” notes before upgrading, not after.

Prices and customer groups

#1563 makes catalog price rules and the customer group of the caller apply to API product reads and API carts. Before, an authenticated customer could get NOT LOGGED IN prices and even place orders at those prices.

A customer cart already saved as NOT LOGGED IN takes the correct group on its next write, so its prices change. Custom code must read the group with Mage::helper('customer')->getCurrentGroupId(), not from the customer session.

Stock quantity in the product response

With #1532 the exact quantity is no longer visible to everyone: anonymous callers and customers get stockQty only when the quantity is at or below the Catalog > Inventory > Stock Options > Only X left Threshold. The default threshold is 0, so in practice those callers get null and must use stockStatus, or an API user with a products grant.

Guest orders and cart data

Two changes on the same theme:

• #1573 answers 403 with “Guest checkout is not allowed for this cart” when the settings refuse a guest checkout, instead of a misleading 401. The case includes a cart with a downloadable product, which the default settings refuse;
• #1565 keeps gift messages, bundle data, downloadable links and uploaded files on orders placed through the API or the CLI, as a storefront order does.

The second one also brings a side effect worth knowing: the observers that copy cart data to the order now run in the global area. A module that turned them off in frontend or adminhtml must turn them off in the global area.

Configurable variants and prices

#1574 fixes GET /api/rest/v2/products/{id}, which returned a price of 0 for every variant of a configurable product. It now shows the price the cart charges for that variant, and finalPrice includes a tier price for a quantity of 1, as the cart does. The method Mage_Catalog_Model_Product_Type_Configurable_Price::_calcSelectionPrice() becomes the public calcSelectionPrice(array $priceInfo, float $productPrice): float.

The other fixes in the patch

• #1514 makes import:config and config:set save a value through the backend model of its field, as the configuration panel does: a value the admin rejects now fails the command.
• #1533 redirects the identifier URL of the CMS home page to the base URL with a 301, keeping the query string.
• #1536 fixes the sitemap, llms.txt and the 404 breadcrumbs when the home page or the 404 page is saved as an identifier plus a page id.
• #1540 sends one 103 Early Hints response per page, with every preload Link header, instead of one per CSS or JS file.
• #1550 keeps the option price of each line of one configurable product after the cart is loaded again.
• #1553 makes the editor keep the class and style attributes on images.
• #1555 shows a swatch on an active filter chip only when that option really has a swatch image.
• #1560 removes the strlen(null) deprecation in rule conditions on products without a value.
• #1562 loads the Top pages and Entry/exit tabs and the On Sale widget on case-sensitive filesystems. The class Mage_CatalogRule_Block_Product_Widget_OnSale becomes Mage_CatalogRule_Block_Product_Widget_Onsale, while the widget type does not change.
• #1579 finishes the request trace of actions that call exit(), such as downloads and the WYSIWYG image preview.
• #1584 stops the OAuth authorization page from showing the custom admin path to a visitor who is not signed in.
• #1586 writes the canonical URL of each page in the sitemap, following Trailing Slash Behavior, so search engines stop flagging those URLs as “Page with redirect”.

Before you upgrade

If you have custom code, three points deserve a check: how you read the customer group for API prices, any override of Mage_Core_Helper_Url::addOrRemoveTrailingSlash(), which receives one more optional $store parameter, and any override of Mage_Sitemap_Model_Sitemap::writeSingleSitemapFile(), which must be public.

For the picture of the 26.9 line, with the changes this patch carries forward, the overview is on the Discover MahoCommerce page.