[NOTICE] Payment Service customers must upgrade to 5.2.2608.722+lts or newer
Important
Configured Commerce instances that use Payment Service must upgrade to version 5.2.2608.722+lts or newer by December 31, 2027. If you do not upgrade by this date, your instance risks losing card capture and payment processing.
The deadline follows a change from Spreedly, Optimizely's payment gateway partner. Spreedly stops updating its legacy iFrame on October 31, 2026, and retires the iFrame entirely in 2028.
Action required
Upgrade to Configured Commerce version 5.2.2608.722+lts or newer by December 31, 2027. You do not need to reconfigure anything. Your existing merchant and gateway configurations carry over automatically after the upgrade.
Why this upgrade is necessary
In version 5.2.2608.722+lts and newer, Payment Service captures cards through the Spreedly Web Checkout SDK, not the legacy iFrame. Instances that still use the legacy iFrame cannot process card payments after Spreedly retires it in 2028.
Optimizely recommends that you upgrade now, because the legacy iFrame receives no updates after October 31, 2026. The Web Checkout SDK is more secure than the legacy iFrame and receives regular security fixes and improvements.
Security improvements in the Web Checkout SDK
The Web Checkout SDK requires a server-generated signature for every tokenization session. Tokenization converts card details into a secure token. The signature blocks replayed requests and any request that the back end did not authorize.
On the web, the SDK supports Subresource Integrity (SRI) and Content Security Policy (CSP). On mobile, it uses secure native components that prevent screenshots.
Additional resources
Spreedly describes the migration and its security features in the following articles:
If you have questions about this upgrade, submit a ticket with Optimizely Support.