magento2-38282: 500 error on POST /V1/order/{orderId}/ship when items is not an array
Community fix magento2-38282 merged into magento/magento2 on 2025-09-15, released in 2.4.9; applies cleanly to 33 releases from 2.4.6 to 2.4.8-p5.
Fixes the 500 error on POST /V1/order/{orderId}/ship when items is not an array edited
- Pull request title
- Internal Server Error in `/V1/order/{orderId}/ship` API Endpoint
- Pull request
- magento/magento2#38282
- Issues
- #35931 human
- Author
- @rogerdz
- Merged
- 2025-09-15
- Fixed in
- 2.4.9
- Reported on
- —
- Categories
- Web API
- Components
- magento/module-webapi
Labels
- Area
- APIs
- Component
- Api
- Priority
- P2
- Severity
- —
- Reported on (labels)
- 2.4.x
Issue
Title and steps come from the upstream issue and pull request.
Description
Steps to reproduce
2. Request endpoint: POST : //yourstore/rest/V1/order/{orderId}/ship
Payload:
_{
"items": "[]"
}_
Other below APi's also got effected and getting similar error in logs:
1. POST request to /V1/inventory/stock-source-links with payload:
_{"links": "[]"}_
2. POST request to /rest/V1/inventory/source-items with payload:
_{"sourceItems": "\\[]\\"}_
3. POST request to //V1/inventory/low-quantity-notification with payload:
_{"sourceItemConfigurations": ""}_
4. POST request to /rest/V1/inventory/stock-source-links-delete with payload:
_{"links": "\\[]\\"}_
Expected result
Actual result
Taken from the upstream issue.
Error signatures
- Returns a 500 status code from a null TypeError .
- [2022-08-01T12:54:49.463557+00:00] main.CRITICAL: TypeError: Magento\Sales\Model\ShipOrder::execute(): Argument ($items) must be of type array, null given
Code match per tag
Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.
| Line | Code match per tag | Tests |
|---|---|---|
| 2.4.6 | 2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean | 2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data |
| 2.4.7 | 2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean | 2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: test files do not apply to this releaseapi-functional: could not run before, could not run after |
| 2.4.8 | 2.4.8 clean 2.4.8-p1 clean 2.4.8-p2 clean 2.4.8-p3 clean 2.4.8-p4 clean 2.4.8-p5 clean | 2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: test files do not apply to this releaseapi-functional: could not run before, could not run after |
| 2.4.9 | 2.4.9 conflictcontains the fix | 2.4.9: no test data |
Triage
Model @cf/cloudflare/clef. Probability this is a bug fix: 96.8%. Probability it is security relevant: 2.0%.
Show the model's answers and probabilities
| Question | Answer | Probabilities | Confidence |
|---|---|---|---|
| Change kind | bugfix | bugfix 95.8%, refactor 1.6%, tests_only 1.1%, feature 0.6%, dependency 0.5%, docs_only 0.4% | 90.1% |
| Area | graphql_api | graphql_api 86.1%, checkout 6.3%, framework 3.5% | 71.0% |
| Reported version | unspecified | unspecified 29.6%, 2.4.0 3.2%, 2.4.4 2.0% | 8.4% |
| Scope | 0.83 of 2 | 1 43.8%, 0 36.3%, 2 19.9% | 4.5% |
| Risk | 0.39 of 2 | 0 67.8%, 1 25.4%, 2 6.7% | 29.4% |
| Worth backporting | 1.43 of 2 | 2 57.3%, 1 28.0%, 0 14.7% | 14.2% |
Download
For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-38282/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.
Bundle README (what the ZIP ships)
# magento2-38282 Community fix merged upstream into magento/magento2, adapted by magento.watch. This is not a patch published by Adobe. Pull request: https://github.com/magento/magento2/pull/38282 Issue: https://github.com/magento/magento2/issues/35931 Author: @rogerdz Source commit: 04a191bc07fd3120153d599d0ccf96ef0a0d4934 Modifications: test files and documentation removed, paths rewritten relative to each Composer package. Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code. Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)
Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.
