Configured Commerce Upgrade Watch: May 2026 (LTS)

Release 5.2.2604.644+lts, published May 28, 2026. Each month we read what Optimizely says shipped, then go verify it against the actual source — frontend and backend — so you get more than a changelog recap.

The 30-Second Version

• Headline fix: Product Recommendations were tracking purchases of a variant as if they belonged to the parent product. A new shared selector, mapCartLinesToItems, now decides which SKU to credit based on your enableStandaloneVariantProducts setting — and it's wired into cart, checkout, and order tracking consistently.
• Worth knowing: react-router and react-router-dom are bumped from a pinned 7.5.2 to ^7.12.0 to close known dependency vulnerabilities — a plain, unambiguous version bump.
• Also notable: The Storefront User Administration grid's Name column was sorting by last name while labeled (and expected to sort) by first name — now fixed.
• The verdict: This is an LTS rollup, so it's judged differently than a monthly release — see below for what that means. Where we could check the frontend evidence against the hotfix list, it held up cleanly; most of the 57 items are backend-only and outside what we could verify this cycle.

The Headline: Product Recommendations Were Crediting the Wrong SKU

Unlike Configured Commerce's monthly STS releases, this is an LTS (long-term support) release — it bundles everything from four months of STS releases (January through April 2026) plus a standalone list of 57 "included hotfixes" unique to the LTS branch itself. Optimizely's own "Features and bug fixes" section for this release just links out to those four monthly articles, so this post focuses on what's new here: the hotfix list.

The most substantial of those hotfixes touches storefronts running with standalone variant products enabled. When a shopper added, checked out, or completed an order containing a product variant, the recommendation-tracking code always reported the parent product's erpNumber — never the variant's own. On a catalog where variants are managed as standalone products, that meant recommendation data was being attributed to the wrong SKU across the board.

The fix is a new shared selector function:

export function mapCartLinesToItems(state: ApplicationState, cartLines?: CartLineModel[] | null) {
    const { enableStandaloneVariantProducts } = state.context.settings.settingsCollection.productSettings;
    return cartLines?.map(o => ({
        refCode: enableStandaloneVariantProducts ? o.erpNumber : o.parentProductErpNumber || o.erpNumber,
        ...
    })) || [];
}

Instead of leaving each tracking handler to work out on its own which identifier to send, mapCartLinesToItems centralizes the decision and is reused directly by PrepareCart.ts, PrepareCheckout.ts, and PrepareOrder.ts — the three points in the funnel where recommendation events fire.

<br>

<br>

If you're running standalone variant products and rely on recommendation reporting or merchandising rules that key off purchase history, this is worth confirming against your own catalog after upgrading.

What Else Shipped

No breaking changes were called out in this release's hotfix list — it's a straight bug-fix rollup. A few items are worth flagging depending on your configuration:

• Payments: CVV bypass support was added for Adyen, TokenEx card-editing errors were resolved, Payflow Pro's ppRef value now has a dedicated Token2 storage field, and Spreedly/Cybersource token handling was improved.
• Search: Commerce Search v3 gained an "Use Modified Date for Lookback" system setting, its facet value limit rose from 50 to 300, and several indexing and duplicate-result issues were addressed. We couldn't locate a corresponding frontend change for the facet limit or the duplicate-results fix in this repo — likely because they're driven server-side — so these are worth testing directly against a running instance if search behavior matters to your rollout.
• Admin & CMS: Fixes landed for Admin Console redirects after an Opti ID session timeout, page type selector display with duplicate allowedParents, CMS content translation through the Generate Translation modal, customer segment groups on CMS content variants, and a timezone issue affecting published CMS page versions.
• Storefront housekeeping: The Storefront User Administration Name column now sorts by first name instead of last name, matching its label. The Add to List dialog no longer hides its "schedule a reminder" checkbox when list reminders are enabled. Storefronts no longer fail to boot for visitors who decline marketing cookies.
• Platform/infra: Polly was added to the allowed third-party libraries list, IronPDF retry logic was hardened, the TinyMCE license key was version-locked for 8.1.2, S3 file streaming and image upload jobs were made more robust, and a binding redirect was added for Microsoft.IdentityModel.Tokens.

A large share of this release's 57 hotfixes are backend/.NET items — Admin Console, integration jobs, payment gateways, Application Insights toggles, and similar — that live outside the frontend repo we could check this cycle. They're real, documented fixes; we simply didn't have a current backend reference to verify them line-by-line this month.

What We Actually Found: One Shared Fix, Four Call Sites

Optimizely's hotfix note for the recommendation-tracking issue is a single line: "Fixed Product Recommendations tracking child variants as parent product." Read on its own, that reads like a one-file patch.

The actual diff is broader than that. Rather than patching each place recommendations get reported, the fix introduces one shared selector — mapCartLinesToItems — and threads it through cart tracking, checkout tracking, and order tracking as a single source of truth for which product identifier to send. A fourth file in the same area, PrepareOther.ts, was reworked in the same release from hardcoded URL-substring matching (checking for literal strings like /Catalog or /Product) to a page-type-based skip list keyed off getCurrentPage(state).type — a more structural way of answering "is this a page recommendations should track."

Four files touched by one underlying identity question, resolved by one reusable function rather than four separate patches, is more consistency work than the hotfix bullet lets on — worth noticing if you're the kind of reader who checks the diff instead of just the changelog.

Under the Hood

Wish list reminder checkbox now respects its own setting — AddToListModal.tsx previously showed the "schedule a reminder" checkbox unconditionally; it's now gated behind the site's list-reminder setting:

{wishListSettings.enableWishListReminders && (
    <Checkbox {...styles.scheduleReminderCheckbox} checked={isScheduled} onChange={scheduleReminderChangeHandler}>
        {siteMessage("Lists_Schedule_Reminders")}
    </Checkbox>
)}

User admin grid was sorting by the wrong column — UserListUsersTable.tsx's Name column header was wired to sorted("LastName"); it now reads sorted("FirstName"), matching what the column is actually labeled and displays first.

A pinned dependency finally moves — src/FrontEnd/package.json bumps both react-router and react-router-dom from a pinned 7.5.2 to ^7.12.0, closing known vulnerabilities in that dependency chain and switching it back to a caret range going forward.

Saved credit card editing no longer leaks iframes — both CreditCardDetailsEntry.tsx and SavedPaymentProfileEntry.tsx add a cleanup step, tokenExIframe?.remove(), to the effect that mounts the TokenEx iframe — so re-rendering the saved-card form no longer leaves an orphaned iframe behind from the previous mount.

What This Means for You

• If you run standalone variant products, re-check recommendation reporting and any merchandising rules that depend on purchase-history attribution after upgrading — this is the release's most consequential frontend fix.
• If you maintain a fork or customization of PrepareOther.ts, PrepareCart.ts, PrepareCheckout.ts, or PrepareOrder.ts, review this diff before merging; the shared selector changes the call signature these handlers rely on.
• If you pin react-router locally, confirm your pin (or any custom override) is compatible with ^7.12.0 before upgrading.
• Commerce Search v3 users should specifically test the facet limit increase (50 → 300) and duplicate-result behavior against a real index rather than assuming from the notes alone, since we couldn't trace these to frontend changes.
• TokenEx and Payflow Pro merchants should regression-test saved card editing and CVV/token flows as part of upgrade QA.
• Everyone on this LTS branch should also review the January–April 2026 monthly STS posts in this series, since "Features and bug fixes" for this release is entirely covered by those four articles rather than by anything new here.

Upgrading a Configured Commerce storefront and want a second set of eyes on what actually changed under a release before you take it? That's exactly the kind of review Nishtech does for clients every month — reach out and we'll walk through it with you.