Current long-term support hotfixes

1 min

Subscribe to updates on this page using the notification and RSS feed options.

This article contains a list of hotfixes for the current long-term support branch. The most recent hotfix contains all previous hotfixes, so applying the latest hotfix automatically updates your environment to the current branch.

Note

Optimizely can hotfix the current LTS branch until code lock, which is one week before release.

Current Long-Term Support branch version: 5.2.2608

Date	Build	Description
5 November 2026	5.2.2608.752+lts	Added the Allow PunchOut in an iframe system setting (website-level, off by default), so PunchOut sessions work when a procurement system, such as SAP Ariba, renders your storefront in an iframe. When the setting is on, cookies written during a PunchOut session over HTTPS use SameSite=None and Secure. PunchOut requests are served without the X-Frame-Options header regardless of this setting. To prevent clickjacking, add a frame-ancestors directive that names the procurement system to the Content-Security-Policy setting. See Allow PunchOut in an iframe and IFrame limitations. Added the Enable Multi-Value Fields, Multi-Value Data Fields, and Minimum Multi-Value Length settings for Commerce Search v3 with Google Cloud Retail Search. These settings index each value in a list field separately, so shoppers can find a product by a single part number or keyword code. See Search settings and Multi-value field search. Added the WithConditionBoosts method to ISearchDescriptor, which lets custom extensions add inline boost rules to Commerce Search v3 search requests. You can promote or demote products at request time without changing core search code. See Inline boosting. Fixed the issue where an inactive customer could be selected as a website user's Default Customer in the Admin Console. Fixed the issue where opening a page by its URL while editing in Spire CMS displayed a blank page. Fixed the issue where the Last Sign In date did not update for Admin Console users who signed in with Windows single sign-on (SSO), so these users could be deactivated for inactivity. Fixed the issue where the Spire CMS rich text editor displayed a Froala license warning and saved "Powered by Froala Editor" into page content. Improved security.
23 October 2026	5.2.2608.730+lts	Updated Node.js to version 22.23.4.
22 October 2026	5.2.2608.722+lts	Fixed the issue where Shared Content could not be deleted on .NET sites. Fixed the issue where integration jobs on .NET stayed in processing and never finished when a job definition step used an integration connection override. If preparing a job fails, the job now ends in Failure with the message Unable to prepare Integration Job for processing: …. Fixed the CS0619 error that occurred when custom SEO Razor views on .NET Framework 4.8 sites failed to compile. Migrated card payments on Spire storefronts from the legacy Spreedly iFrame to the Spreedly Checkout SDK, ahead of Spreedly retiring the iFrame in March 2027. Existing gateway tokens, merchant profiles, and Strong Customer Authentication (SCA) provider keys continue to work. See [NOTICE] Payment Service customers must upgrade to 5.2.2609+ for more details.
15 October 2026	5.2.2608.714+lts	Fixed the Execution Timeout Expired error when retrieving product data on stores with very large catalogs. Fixed the issue where the Indexing section did not display in the Admin Console navigation when a custom search provider was selected. Fixed the issue where products with long part numbers were missing from search results in Commerce Search v3 when n-gram indexing was enabled. Fixed the issue where shared content could not be deleted in Spire CMS on sites with a large number of page versions. Fixed the issue where content could not be exported from Spire CMS. Fixed the issue where blueprints that included a pnpm dependency requiring a build script caused the build to fail. Improved security.
8 October 2026	5.2.2608.685+lts	Fixed the issue where orphaned Elasticsearch v7 indexes built up after search index rebuilds. Fixed the issue where the date fields in the saved order list filter were cramped at some screen widths in Spire storefronts. Fixed the issue where Spire storefronts could serve cached page content for the wrong host name. Fixed the issue where saved payment profile requests were not restricted for guest users. Improved security.