--- title: Configured Commerce STS release highlights slug: configured-commerce/release-notes/configured-commerce-sts-release-highlights docTags: createdAt: 2026-09-25T18:13:28.000Z --- Subscribe to updates on this page using the notification and RSS feed options. ::::VerticalSplit{layout="left"} :::VerticalSplitItem [October 2026 release](docId\:wCfTQsJfQ9NeENrSI6Wr5) ::: :::VerticalSplitItem - **PunchOut inside procurement systems** – Make it easier for procurement-driven customers to order from you by letting buyers shop your catalog inside SAP Ariba and other procurement systems that display suppliers in an iframe. Turn on the **Allow PunchOut in an iframe** setting, and buyers stay signed in from the first page through checkout. A `frame-ancestors` directive in your Content-Security-Policy keeps you in control of which procurement systems frame your storefront. See [Allow PunchOut in an iframe](docId\:nFx7ajsIOfc8nR1HTN2w1). - **Stronger storefront account protection** – Protect your buyers and your revenue from account takeover and unauthorized orders, with safeguards that are mostly on by default. Password reset now limits repeated failed attempts and can add a reCAPTCHA check, the **Remember Me** cookie is signed and tied to your website, and deactivating a user ends their API access immediately, including in the mobile app. Single sign-on (SSO) now links a first-time sign-in to an existing account only when the identity provider confirms the email address. - **Faster-loading web fonts** – Deliver your brand typography to shoppers faster and more reliably, while lowering the load on your servers. Your content delivery network (CDN) now caches the web fonts that Spire serves, and intermittent font 404 errors are fixed. Existing font URLs keep working, so no theme or configuration changes are needed. See [Use web fonts](docId\:zjT0087q8SNlmr4IsBBPL). - **Self-service order and invoice exports** – Give buyers the order and invoice data they need, when they need it, without waiting on a sales representative or administrator for a report. With one click, buyers export their order or invoice history from the storefront to a comma-separated values (CSV) file that includes the records matching their filters, not just the current page. See [Export order or invoice history](docId\:hWhUr0k7fhQhYC7Wo07kn). ::: :::: :::::VerticalSplit{layout="left"} :::VerticalSplitItem [September 2026 release](docId\:nvDj3TWUeA3r6aIDhLDXF) ::: ::::VerticalSplitItem - **Accessible Admin Console reordering** – Reorder any list in the Admin Console using just the keyboard, with screen-reader announcements that confirm each move, so merchandising and operations teams can work with controls that meet modern accessibility standards. Keyboard reordering and translated announcements now cover product images, list columns, export columns, promotion rule groups, multi-value settings, user roles, and product relationships. - **Unified multilingual catalog URLs** – Gives multilingual sites one clean, consistent URL structure for cleaner search-engine indexing and simpler navigation, with no language prefix on every root path and no duplicate language tokens in brand URLs. Enable the new **Use Home Page Url Segment Across Catalog Pages** setting (Catalog → URL Mapping) to extend the home page URL segment across catalog, product, brand, and search pages. See [Translate URLs](docId\:FsKI_axt91zmH0g2aoxZ8). *(Enabled for new websites; existing websites keep their current behavior.)* - **Self-service .well-known file hosting** – Cuts verification-file publishing from a developer sprint cycle to a direct upload, removing deployment bottlenecks for mobile app and third-party service setup. Implementers upload app-site association, domain verification, and mobile link verification files directly to `/userfiles/_system/.well-known`, and Spire serves them at `/.well-known/` without requiring a code change or a production release. See [Media library](docId\:qE9bmTD4KmAlWZzWiB_fO). - **Content Security Policy (CSP) controls** – Lets security teams test stricter browser policies safely in observation mode before enforcing them, without risking storefront downtime or broken checkout flows. The storefront and Admin Console now have separate, configurable policies, each with a report-only mode (**Content-Security-Policy-Report-Only** and **Admin Content-Security-Policy-Report-Only**) that surfaces blocked scripts and connections before strict rules apply. See [Set security headers](docId:6jcuTLDHaNikXInxiay4l). - **Search v3 reliability improvements** – Protect the shopper search experience during outages and high-demand periods. If Commerce Search v3 ever experiences downtime, storefront search now automatically fails over to Elasticsearch, so shoppers can keep finding and buying products without requiring emergency manual intervention from your team (see [Rate limits](docId:7YwAtgZYx1fDdO80PRR5L) for more details). Optimizely has also improved how the Search Service manages its internal resources, keeping memory usage and performance stable during sustained, high-volume shopping periods. This reduces the risk of slowdowns as demand grows. see [Commerce Search v3](docId:7YwAtgZYx1fDdO80PRR5L). - **Spreedly Checkout SDK migration** – Stay ahead of Spreedly's iFrame retirement with a seamless, zero-touch migration. Payment Service card capture has transitioned from Spreedly's legacy iFrame to the Spreedly Web Checkout SDK. Configured Commerce instances using the Payment Service must upgrade to version 5.2.2609+ by December 31, 2026, ahead of Spreedly's retirement of the legacy iFrame in Q1 2027. All existing merchant and gateway configurations, including 3DS/SCA setup, carry over automatically, no manual reconfiguration required. :::hint{type="warning"} **Important** Configured Commerce instances that use the Payment Service must upgrade to version 5.2.2609+ by December 31, 2026 (end of Q4 2026). If you do not upgrade by this date, card capture and payment processing may stop working. See [\[NOTICE\] Payment Service customers must upgrade to 5.2.2609](docId\:NJd6WHHyzHSHdEZWHTfxa)for more details. ::: :::: :::::