Optimizely has released version 5.2.2610.481+sts, its October 2026 Short-Term Support release for Configured Commerce. This release focuses heavily on security, B2B purchasing workflows, and storefront reliability. Highlights include improved PunchOut support for procurement systems like SAP Ariba, stronger account protections, self-service order and invoice exports, and several performance improvements for Spire storefronts.

There are also a few breaking changes that teams with custom PunchOut integrations and authentication workflows should review before upgrading.

Here is my read on what matters and where I would pay attention before planning your next deployment.

Improved PunchOut Support for Procurement Systems

One of the more significant additions in this release is improved support for PunchOut sessions within procurement systems that display supplier storefronts in an iframe.

Previously, procurement platforms like SAP Ariba could have trouble maintaining a shopper's session when loading a Configured Commerce storefront inside an iframe. Modern browser cookie restrictions can interfere with session persistence, resulting in authentication issues and interrupted purchasing workflows.

The new Allow PunchOut in an iframe setting addresses this by configuring PunchOut session cookies with SameSite=None and Secure attributes when served over HTTPS. This allows supported browsers to maintain the session while buyers navigate the storefront within their procurement system.

The setting is disabled by default, so existing implementations will retain their current behavior until it is enabled.

There is an important security consideration here. Allowing a storefront to be embedded in another application introduces potential clickjacking risks. Optimizely recommends configuring the Content-Security-Policy frame-ancestors directive to explicitly identify which procurement systems are permitted to frame the storefront.

Browsers that block third-party cookies entirely may still prevent these sessions from working, so testing against your customers' actual procurement environments is important.

If your implementation relies heavily on PunchOut, particularly with custom cXML processing, this is worth investigating. The release also changes the order in which PunchOut credentials are validated and introduces a new GetRequestCredentials pipeline. Custom handlers that modify credentials or depend on the previous pipeline order may require adjustments.

Stronger Storefront Account Protection

Security is arguably the biggest theme of the October release, with several improvements aimed at reducing unauthorized account access and strengthening authentication.

First, password reset functionality now includes rate limiting by default, with optional reCAPTCHA protection. This helps prevent automated attempts against the password reset process. Administrators can configure the rate limit window and maximum failed attempts at both the IP address and user levels.

The Remember Me functionality also received an important security update. Cookies are now cryptographically signed, tied to the specific website, and transmitted only over HTTPS. Signing out or changing a password also invalidates remembered sessions across the user's browsers.

One thing to prepare for: users with existing Remember Me cookies will need to sign in again after upgrading. This is expected behavior, but it may be worth communicating to customers ahead of deployment.

Single sign-on (SSO) received additional protection as well. When a user signs in through SSO for the first time, Configured Commerce now requires confirmation that their email address has been verified before linking the identity to an existing storefront account.

There is an override setting for trusted, single-tenant identity providers, but I would be cautious about enabling it unless you fully control the provider and its email verification process.

The release also addresses an issue where deactivated users could continue making authenticated API requests with previously issued tokens. Deactivation now takes effect immediately, including for mobile application users.

These changes may not be particularly visible to shoppers, but they close some meaningful security gaps.

Self-Service Order and Invoice Exports

One of the more practical enhancements for B2B customers is the addition of an Export All option to the Order History and Invoice History pages.

Buyers can now download their order or invoice records directly from the storefront as CSV files, making it easier to reconcile purchases, review outstanding invoices, and analyze purchasing activity in Excel or another spreadsheet application.

Importantly, the export respects the filters and sorting applied to the page rather than simply exporting the records currently visible in the table. Each export supports up to 9,999 records, so customers with particularly large transaction histories may need to filter by date range.

This is the kind of functionality that frequently comes up as a customization request, especially for B2B organizations with purchasing departments managing large numbers of transactions.

Providing it out of the box reduces the need for custom reporting endpoints or manual exports from the Admin Console.

What Performance and Platform Improvements Are Included?

There are several useful improvements behind the scenes in this release.

Spire storefronts now serve web fonts through CDN-friendly paths, allowing content delivery networks to cache font resources more effectively. Optimizely also fixed intermittent 404 errors caused by the way font files were cached across server processes.

The new paths use /.spire/content/font/ and /.spire/content/css/, while existing font URLs remain supported. No theme or configuration changes are required.

The ETag caching mechanism has also been improved to handle heavy traffic more efficiently. Database deadlocks during cache operations are now treated as cache misses instead of application errors, helping reduce unnecessary failures under load.

Another fix addresses product data requests timing out on websites with very large catalogs due to inefficient database query plans. For distributors managing hundreds of thousands of SKUs, improvements like this can have a meaningful impact on storefront reliability.

On the infrastructure side, Optimizely updated several Dockerfiles so containers no longer run as the root user by default. This should help organizations satisfy container security scanning requirements.

There is also a new Maximum Storefront API Request Size setting, defaulting to 30 MB, that rejects oversized requests to storefront API endpoints. Additionally, uploads through the Media Manager and certain integration endpoints are now restricted to approved file extensions.

That last change deserves attention if your integrations upload XML, HTML, JavaScript, or other files that are no longer permitted by default. The Additional Media Manager Extensions setting can be used to allow required file types.

Additional Bug Fixes Worth Noting

A few other fixes stand out, particularly around payments and account permissions.

An issue with Adyen payments could previously allow a credit card transaction to succeed at the gateway while the corresponding order remained in Pending payment status when the HMAC key was missing or invalid. Checkout now prevents the transaction from proceeding until the configuration is corrected.

The release also fixes eCheck payments through Braintree and Authorize.Net when using Optimizely's Payment Service.

On the authorization side, Optimizely corrected an issue where buyers or requisitioners could modify their own roles through the Account API, potentially bypassing order approval requirements. Role changes now require the appropriate permissions.

Guest users are also prevented from accessing saved payment information through the Payment Profile API.

These are meaningful fixes for sites relying on order approvals, purchasing permissions, and saved payment methods.

How I Would Approach This Upgrade

If your site uses PunchOut, custom authentication, or extensive integrations, I would give this release a closer review before deploying.

The PunchOut credential validation changes are classified as medium-risk breaking changes. Implementations with custom pipeline handlers should verify that authentication and cXML processing still behave as expected.

I would also review custom SSO integrations, file upload workflows, and any integrations that submit Spire authentication tokens across domains. The new same-site token restrictions may require changes to how those integrations authenticate.

For .NET deployments, another important change is the requirement to configure a unique Spire client secret. In non-development environments, the application will now refuse to start if the secret has not been configured, unless the explicit risk-acceptance override is enabled. Configuring a proper secret should be part of your deployment checklist.

For sites without significant customizations, the improved security defaults, caching enhancements, and new export capabilities make a strong case for upgrading.

Overall, October's STS release is less about introducing new storefront experiences and more about hardening the platform and improving existing B2B workflows. The PunchOut enhancements and order exports provide tangible benefits to buyers, while the security and performance fixes give development teams several good reasons to evaluate the upgrade.

As always, weigh the shorter STS support window against your maintenance schedule, and plan a regression pass through your custom integrations, authentication workflows, and checkout functionality before moving to production.

See the full patch notes here: Optimizely Configured Commerce October 2026 Release Notes.