UPSTREAM FIX

magento2-40563: Increases the admin_user_session ip column length so IPv6 addresses fit

Community fix magento2-40563 merged into magento/magento2 on 2026-03-27, released in 2.4.9; applies cleanly to 33 releases from 2.4.6 to 2.4.8-p5.

Increases the admin_user_session ip column length so IPv6 addresses fit edited

Pull request title
Fix: Increase IP column length for IPv6 support in admin_user_session
Pull request
magento/magento2#40563
Issues
#40570 pr-derived
Author
@PaulMcGregory
Merged
2026-03-27
Fixed in
2.4.9
Reported on
—
Categories
Admin
Components
magento/module-security

Labels

Area
Account
Component
Admin
Priority
P3
Severity
—
Reported on (labels)
2.4.x

Issue

Title and steps come from the upstream issue and pull request.

The upstream issue and pull request have no structured description.

Code match per tag

Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.

LineCode match per tagTests
2.4.6
2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean
2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data
2.4.7
2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean
2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: no test data
2.4.8
2.4.8 clean 2.4.8-p1 clean 2.4.8-p2 clean 2.4.8-p3 clean 2.4.8-p4 clean 2.4.8-p5 clean
2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: no test data
2.4.9
2.4.9 conflictcontains the fix
2.4.9: no test data

Triage

Model @cf/cloudflare/clef. Probability this is a bug fix: 94.6%. Probability it is security relevant: 91.3%.

Show the model's answers and probabilities
QuestionAnswerProbabilitiesConfidence
Change kindbugfixbugfix 92.8%, feature 2.6%, refactor 2.3%, dependency 0.9%, tests_only 0.8%, docs_only 0.6%83.5%
Areaadminadmin 54.6%, customer 24.7%, framework 8.1%28.1%
Reported versionunspecifiedunspecified 20.8%, 2.4.6 3.5%, 2.4.8 3.4%4.3%
Scope0.15 of 20 88.2%, 1 8.3%, 2 3.5%68.0%
Risk1.50 of 22 71.6%, 0 22.1%, 1 6.4%34.8%
Worth backporting1.42 of 22 53.2%, 1 35.9%, 0 10.9%13.5%

Download

For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-40563/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.

Packages (1): magento/module-security
Bundle README (what the ZIP ships)
# magento2-40563

Community fix merged upstream into magento/magento2, adapted by magento.watch.
This is not a patch published by Adobe.

Pull request: https://github.com/magento/magento2/pull/40563
Issue: https://github.com/magento/magento2/issues/40570
Author: @PaulMcGregory
Source commit: a40f13677898ba31a0f4b9eb33490c71ed212514
Modifications: test files and documentation removed, paths rewritten relative to each Composer package.
Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code.
Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)

Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.

Sources

Łukasz Bajsarowicz
Built by

Łukasz Bajsarowicz, e-commerce architect

Magento and Adobe Commerce architecture, upgrades, performance and audits for merchants and agencies since 2015; magento.watch is the tooling I use on those projects.

Open source, maintained on weekends.