This release introduces an improved Promotions publishing workflow, improved Authorization Service security, and key open-source vulnerability fixes.

Functional Changes

New features and functional enhancements delivered in this release.

Promotions Admin Console

Direct publishing of promotion groups and promotions

Administrators can now publish promotion groups and individual promotions directly from the Promotions Admin Console, removing several manual configuration steps from the release workflow.

  • A new Publish button initiates publishing for all or a selected subset of promotion groups or promotions.
  • A new Configure Publish dialog within Promotion Groups and Promotions, exposing:
    • Publish Type — publish all or selected items, or push only incremental changes.
    • Target Environment, Target Business ID, and Target Store ID, Target Store Promotion Collection ID — publish directly to a target environment of the same store, without manual configuration changes.

The above capability is controlled by the following store and ZooKeeper properties that determine how promotion data is published and which fields are available in the Configure Publish pop-up:

Store Configuration

The new store property, promotionPublishExcludeCollectionProperties, configures a list of collection properties to exclude from promotion publish updates. During publishing, the specified properties are skipped, ensuring that existing target collection values are preserved.

Supported values: Comma-separated list of collection property names.
Example: timeZone, defaultLocale

ZooKeeper Property Configuration

The new ZooKeeper property liveEnvironment controls which fields appear in the Configure Publish pop-up.

  • true — Store-to-store publishing only. Shows Business ID and Store ID; no environment field.
  • false (default) — Cross-environment publishing. Shows Target Environment, plus:
    • Store ID, if the current environment is selected
    • Business ID, if any other environment is selected

API & Technical Changes

Changes to APIs, contracts, headers, or platform behavior that may require integrator action.

Authorization Service

OAuth Clients controller — credentials moved to request headers

The OAuth Clients controller no longer accepts session or bearer credentials in the URL query string. This change reduces exposure of sensitive tokens in server access logs, browser history, referrer headers, and proxy traces.

  • POST /openid/authorize — x-sessionId is now read from the request header. It was previously passed as a query parameter.
  • POST /sessions — x-bearerToken is now read from the request header. It was previously passed as a query parameter.

Open-Source Library Vulnerability Fixes

The unique security vulnerability that has been patched into the Infosys Equinox Commerce platform has 211 vulnerabilities.

The total number of vulnerabilities closed is: 9,419

Vulnerability severity levels are as follows:

Critical High Medium Low
622 3,216 4,645 936

Revision History
2026-06-29 | JP – Added Release 8.21.8 content.