Magento 2.4.9 Is Here (and So Is Mage-OS 2.3.0): What Changed and How to Upgrade

May 2026 was a big month for the platform. Magento Open Source 2.4.9 went generally available on 12 May, and the community Mage-OS 2.3.0 distribution followed on 13 May. Both are worth your attention — not because of headline features, but because they redraw the supported stack: which PHP version you must run, which search engine, which cache backend, and which database. This post is a practical, no-fluff read on what actually changed and how to plan the jump without burning a weekend on composer conflicts.

Two releases, two tracks

It helps to keep the two announcements straight, because they target different audiences:

• Magento Open Source 2.4.9 (Adobe) — the latest minor on Adobe’s release train. New platform requirements, the largest set of bug fixes, and the version most third-party extensions will start certifying against.
• Mage-OS 2.3.0 (community) — the community fork that mirrors Magento Open Source and re-applies upstream security patches fast. 2.3.0 is built on the 2.4.8-p5 security baseline, so it sits one minor behind Adobe’s newest but stays fully patched and is governed in the open.

If you have never had to choose between them, our breakdown of Adobe Commerce vs Magento Open Source covers the licensing and support angle; the short version is that both 2.4.9 and Mage-OS 2.3.0 are free, open-source, and API-compatible with the extensions you already run.

What changed in Magento 2.4.9

This is a platform-requirements release as much as a feature release. The four changes most likely to bite during an upgrade:

1. PHP 8.4 or 8.5 — 8.2 and 8.3 are out

2.4.9 requires PHP 8.4 or 8.5. If you are still on 8.1/8.2, this is the single biggest task in the upgrade: third-party modules and any custom Panth\* code have to be audited for PHP 8.4 deprecations (implicit nullable parameters, E_STRICT removal, dynamic-property warnings) before composer will even resolve.

php -v
# Need: PHP 8.4.x or 8.5.x

# Static-analysis pass for 8.4 deprecations before you upgrade core
vendor/bin/phpstan analyse app/code --level=6

2. Valkey 8 joins Redis as a supported cache backend

Redis 7.2+ is still supported, but Valkey 8 — the Linux Foundation fork of Redis that started after Redis changed its license — is now an officially supported, drop-in alternative for the default and page caches. Because Valkey speaks the Redis protocol, switching is a config change, not a code change:

<?php
// app/etc/env.php — Valkey is wire-compatible, so the Redis cache backend stays
'cache' => [
    'frontend' => [
        'default' => [
            'backend' => 'Magento\Framework\Cache\Backend\Redis',
            'backend_options' => [
                'server' => '127.0.0.1',
                'port'   => '6379', // point at your Valkey instance
                'database' => '0',
            ],
        ],
    ],
],

On a multi-tenant box where Redis is shared, Valkey is an easy way to dodge the licensing question without touching application code.

3. OpenSearch 3.x, Elasticsearch on the way out

2.4.9 targets OpenSearch 3.x (Adobe recommends 2.19+ as the floor), and Elasticsearch is firmly deprecated. If your hosting still pins Elasticsearch 7/8, plan the search-engine migration and a full reindex as part of the upgrade window — not as an afterthought.

4. Symfony Cache replaces Zend_Cache, MySQL 8.0/MariaDB 10.6 dropped

Internally the legacy Zend_Cache abstraction is gone, replaced by Symfony Cache. Most stores will not notice, but any custom module that referenced Zend_Cache classes directly will break. On the database side, MySQL 8.0 and MariaDB 10.6 are dropped — check your DB version before you start.

What Mage-OS 2.3.0 brings

Mage-OS 2.3.0 is the conservative choice: it stays on the 2.4.8 line but ships the latest security work and a few hardening wins.

• 2.4.8-p5 security baseline — all upstream Adobe security patches through p5 are folded in, so you are not exposed while you wait to move to a new minor.
• PHP 8.4 and 8.5 compatibility across the Mage-OS add-on modules (admin theme, PCI 4 compatibility, and friends), so the distribution runs cleanly on the same PHP versions 2.4.9 demands.
• Tighter Page Builder template-import security — the import path that historically allowed crafted templates to slip through is locked down. If you run Page Builder with content authored by non-admins, this alone is worth the update.

Which one should you run?

A rough decision rule:

• Run 2.4.9 if you want the newest platform, are comfortable being early on PHP 8.5, and your extension vendors have certified against it.
• Run Mage-OS 2.3.0 if you value open governance, want to stay fully patched without chasing every Adobe minor, or have extensions that are not yet 2.4.9-ready.

Either way you land on PHP 8.4/8.5, so the migration work overlaps heavily — the PHP and search-engine prep is identical.

The upgrade checklist

The order matters. Do the environment work before you touch composer, or you will spend the afternoon fighting unresolvable dependency trees.

1. Bump PHP to 8.4/8.5 on a staging clone and run static analysis on app/code.
2. Move search to OpenSearch 3.x and confirm a full reindex completes.
3. Audit every third-party extension for a 2.4.9-compatible release. The ones without one decide your timeline — see our notes on extension compatibility and custom development.
4. Run the composer upgrade on staging:

# Magento Open Source 2.4.9
composer require magento/product-community-edition 2.4.9 --no-update
composer update

bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento indexer:reindex
bin/magento cache:flush

5. Smoke-test checkout, search, and the admin on staging with production-like data before you schedule the production window.

The deadline you can’t ignore

Even if 2.4.9 feels early, the calendar is forcing the conversation: Magento 2.4.6 reaches end of support on 11 August 2026, and 2.4.7’s regular support runs into 2027. Staying on an unsupported minor means no more security patches — the exact risk Mage-OS exists to close. If you want to size the effort before committing, our Magento upgrade cost calculator gives a quick estimate, and we handle the full jump end-to-end as a fixed-scope Magento upgrade service.

Bottom line

2.4.9 and Mage-OS 2.3.0 are less about shiny features and more about the stack underneath your store moving forward: PHP 8.5, OpenSearch 3, Valkey, Symfony Cache. The work is mostly environment and extension-compatibility prep — do that on staging, in the right order, and the core upgrade itself is anticlimactic. The thing not to do is wait past August and run an unpatched store.