Adobe Commerce upgrades and security: how to update your store without stopping sales

Why postponing the upgrade costs more

• Security patches stop arriving for unsupported versions.
• New extensions and PHP versions stop being compatible.
• Infrastructure requirements change. Example: for Adobe Commerce 2.4.6+, Adobe requires OpenSearch 3, with enforcement on 31 May 2027.
• The bigger the jump, the bigger the risk and the cost.

Step 1: inventory

Before updating anything, I list what exists:

• Current version, PHP, database, search, cache and messaging.
• Every extension, with its version and compatibility with the target.
• Custom code that overrides the core or depends on classes that changed.
• Integrations and scheduled jobs (cron).

Step 2: update outside production

The upgrade happens in a staging environment with anonymised real data. Composer, code fixes, setup:upgrade and recompilation. On Adobe Commerce Cloud some service changes require a ticket with Adobe's infrastructure: on the Pro plan, changing only .magento.app.yaml is not enough in Production.

Step 3: test what makes money

• Search, category and product pages.
• Cart, coupons and shipping rates.
• Checkout with every payment method.
• Integrations with ERP, CRM and marketplaces.
• Admin panel and import routines.

Step 4: a deploy without surprises

Deploy at low-traffic hours, maintenance mode for as short as possible, a verified backup and a written rollback plan. Then, monitoring of errors and orders in the first hours.