QUALITY PATCH

ACSD-68499: The GraphQL updateCartItems mutation in Adobe Commerce incorrectly returns success…

The GraphQL updateCartItems mutation in Adobe Commerce incorrectly returns success response when updating quantities beyond available stock, causing inflated cart totals and quantities. Quality patch ACSD-68499 for magento/module-quote-graph-ql applies to Magento Open Source and Adobe Commerce 2.4.4 to 2.4.8-p5.

Categories: GraphQL, Shopping Cart
Components: magento/module-quote-graph-ql
Origin: adobe-commerce-support
Since QPT: 1.1.74

Issue

The GraphQL updateCartItems mutation in Adobe Commerce incorrectly returns success response when updating quantities beyond available stock, causing inflated cart totals and quantities.

Steps to reproduce

1. Create an empty cart. 1. Add a product with limited stock (for example, 10 units available) to the cart. 1. Query the cart and note the cart_item_id. 1. Update the cart item quantity to 100 (exceeds available stock of 10) using the following mutation: mutation ($cart: String!, $cartItemId: Int!, $quantity: Float!) { updateCartItems( input: { cart_id: $cart cart_items: [{ cart_item_id: $cartItemId, quantity: $quantity }] } ) { cart { items { product { name } quantity } prices { grand_total { value currency } } } } } 1. Query the cart again to verify the actual quantity.

Adobe's page lists 2.4.4 - 2.4.8-p3 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.9.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-68499. On Cloud, add ACSD-68499 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-68499/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

magento/magento2-base >=2.4.4 <2.4.9

Magento Open Source: 2.4.8-p5, 2.4.8-p4, 2.4.8-p3, 2.4.8-p2, 2.4.8-p1, 2.4.8, 2.4.7-p10, 2.4.7-p9, 2.4.7-p8, 2.4.7-p7, 2.4.7-p6, 2.4.7-p5, 2.4.7-p4, 2.4.7-p3, 2.4.7-p2, 2.4.7-p1, 2.4.7, 2.4.6-p15, 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p17, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p18, 2.4.4-p17, 2.4.4-p16, 2.4.4-p15, 2.4.4-p14, 2.4.4-p13, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4
Adobe Commerce: 2.4.8-p5, 2.4.8-p4, 2.4.8-p3, 2.4.8-p2, 2.4.8-p1, 2.4.8, 2.4.7-p10, 2.4.7-p9, 2.4.7-p8, 2.4.7-p7, 2.4.7-p6, 2.4.7-p5, 2.4.7-p4, 2.4.7-p3, 2.4.7-p2, 2.4.7-p1, 2.4.7, 2.4.6-p15, 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p17, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p18, 2.4.4-p17, 2.4.4-p16, 2.4.4-p15, 2.4.4-p14, 2.4.4-p13, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4
Replaced with: ACSD-69541
Patch file: patches/os/ACSD-68499_2.4.8-p2.patch

vendor/magento/module-quote-graph-ql/Observer/CheckAndUpdateQtyObserver.php (added)
vendor/magento/module-quote-graph-ql/etc/graphql/events.xml