# medusa v2.20.1 — v2.20.1: Field Filter Stripping Fix, Search Stability, Schema Index Validation

- Product: medusa (https://whatsnew.fyi/product/medusa)
- Vendor: medusa
- Date: 2026-09-03
- Version: v2.20.1
- Original notes: https://github.com/medusajs/medusa/releases/tag/v2.20.1
- Permalink: https://whatsnew.fyi/product/medusa/releases/v2.20.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Always strip fields that a field filter does not allow, removing the RBAC flag requirement
- **fixed** — Remove correlated flag on search until it is supported
- **fixed** — Disallow using JSON for schema index specification

<!--

![v2.20.1](https://res.cloudinary.com/dza7lstvk/image/upload/v1788428096/Releases/v2-20-1-7f2142.png)

#### v2.20.1: Field Filter Stripping Fix

This patch release fixes a field-filter security gap that could expose disallowed fields.

CMS_BREAK -->

##### Highlights

###### Field Filter Always Strips Disallowed Fields

Previously, the `allowed` query config on a route and `http.restrictedFields` config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.

##### Bug Fixes

- **framework**: Always strip fields that a field filter doesn't allow ([#16704](https://github.com/medusajs/medusa/pull/16704)) — [@shahednasser](https://github.com/shahednasser)
- Remove correlated flag on search until it is supported ([#16703](https://github.com/medusajs/medusa/pull/16703)) — [@sradevski](https://github.com/sradevski)
- Disallow using JSON for schema index specification ([#16692](https://github.com/medusajs/medusa/pull/16692)) — [@sradevski](https://github.com/sradevski)

##### Contributors

Thank you to all contributors who made this release possible:

- [@shahednasser](https://github.com/shahednasser)
- [@sradevski](https://github.com/sradevski)