Fast Times: Magento Open Source upgrade proposal, 2.4.7-p10 to 2.4.9

Your current version leaves support on 31 May 2027

Standard support for Magento Open Source 2.4.7 ends on 31 May 2027. After that date Adobe no longer commits to security patches or fixes for the version your store runs, so any vulnerability found from then on stays open. Adobe gives an extra year of extended support only to licensed Adobe Commerce, not to Magento Open Source, so 31 May 2027 is the date that counts for you.

We recommend you approve the upgrade to Magento Open Source 2.4.9 by 30 November 2026. That lets us release it by the end of April 2027, after the December to January trading freeze and with a month in hand before support ends. If approval slips past November, the release moves closer to the deadline and the margin for anything unexpected gets smaller.

Why 2.4.9, and what it gives you

• No gap in support. You stay on patched software, which reduces security and PCI exposure.
• The longest supported runway available. 2.4.9 has standard support until 31 May 2029. A move to 2.4.8 would need another upgrade before May 2028.
• Your custom modules on the current framework. Future patches then apply cleanly, without rework each time.
• A supported server stack at the same time. PHP, the database, search and cache all move onto supported versions.

2.4.9 is a foundations release with few new merchant-facing features. We recommend it for continued support, not for new features or speed. The case for it is reduced exposure, and the benefits depend on how the store and server are configured.

What changes in 2.4.9

2.4.9 is the largest architectural change in the 2.4.x line. Three parts of the framework are replaced:

1. Laminas MVC is replaced by Magento's own MVC.
2. Zend Cache is replaced by Symfony Cache.
3. The TinyMCE admin editor is replaced by HugeRTE.

Extensions and custom code that use Laminas or Zend Cache directly will break, so extension upgrades are the largest part of the work.

The server stack moves to Adobe's current requirements: PHP 8.5, MariaDB 12.3 (or MySQL 8.4), OpenSearch 3, Valkey 9, RabbitMQ 4.3, Varnish 8 and Composer 2.10.

Why this is a moderate to heavy upgrade

• Two release lines, from 2.4.7 to 2.4.9 (2.4.8 and 2.4.9).
• PHP moves from 8.2 or 8.3 (the only versions 2.4.7 supports) to 8.5.
• Your store carries a significant amount of custom code, so the Laminas and Zend Cache replacements are likely to reach your own modules, not only third-party ones.
• 22 third-party extensions to upgrade and test.
• Your integrations need testing end to end once the framework underneath them changes.

Estimate

Indicative timeline

We'll confirm exact dates once discovery is done.

Assumptions

• We'll confirm the PHP and database versions your store actually runs during discovery.
• The custom code hours cover the custom modules in your store's code today. In discovery we list each one by name in Appendix B and scan it for Laminas and Zend Cache use, and you confirm the list before custom code work starts. If the scan finds more work than expected, the contingency line covers it first.
• Work on a custom module added after that is quoted separately as a variation.
• We test each integration your store connects to end to end, in regression testing and again in UAT. We'll list those integrations with you in discovery.
• The work covers the upgrade only, with no new features. Any feature request found during discovery is quoted separately.
• The baseline speed check records load times on key pages before the upgrade, as a reference point. It isn't a performance report and promises no speed gain.
• The April 2027 release assumes approval in November 2026.

Exclusions

• Licence or renewal fees for third-party extensions.
• Replacing any extension that has no version compatible with 2.4.9. Discovery flags these early, and we quote each replacement as a variation.
• Fixing admin content that renders differently after the editor change, beyond the checks in testing.
• New features.

Risks

Next step

Approve the upgrade by 30 November and we'll start discovery straight away, so the custom code scan and extension review are done before the December freeze.

Kind regards,

Josh Camp
Chief Executive Officer
PH +64-09-9722636
Email josh@magebinary.com
Web www.MageBinary.co.nz
11/145 Kitchener Rd, Milford, Auckland 0620

Appendix A: Extension list

Your store runs 22 third-party extensions. In discovery we record each one in the table below, with the version you run today, the version that supports 2.4.9, and what it needs.

Any extension with no 2.4.9 version is flagged here, and its replacement is quoted separately.

Appendix B: Custom modules in scope

The 27 custom code hours cover the custom modules in your store's code today. In discovery we list each one by name, and you confirm the list before custom code work starts. Work on a module added after that is quoted as a variation.