HCL Commerce 9.1.20.0
HCL Commerce 9.1.20.0 is a feature (mod pack) release for HCL Commerce Version 9.1.
- HCL Commerce 9.1.20.0 was released on May 12, 2026.
For a full list of the release files and their associated MD5 checksum values, see HCL Commerce eAssemblies.
Security updates
| Affected software | CVE(s) | Vulnerability |
|---|---|---|
|
IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, IBM HTTP Server and IBM Java SDK included in: HCL Commerce 9.1.0 - 9.1.19.0 |
CVE-2024-29371, CVE-2026-21945, CVE-2026-21925, CVE-2025-14914, CVE-2025-14917, CVE-2026-29063, CVE-2025-14915, CVE-2026-1561, CVE-2025-13333, CVE-2025-14923, CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007, CVE-2026-3621, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-21933 | Multiple vulnerabilities in various IBM products affect HCL Commerce |
|
HCL Commerce 9.1.0 - 9.1.19.0 |
CVE-2026-4867, CVE-2026-33532, CVE-2026-1225, CVE-2024-38828, CVE-2024-38820, CVE-2026-24880, CVE-2026-40973 | Multiple vulnerabilities in open source components affect HCL Commerce |
|
WebSphere Application Server, WebSphere Application Server Liberty, and IBM HTTP Server included in: HCL Commerce 9.1.0 - 9.1.19.0 |
CVE-2025-66200, CVE-2025-59375, CVE-2025-65082, CVE-2025-59775, CVE-2025-58098, CVE-2025-1263 | Multiple vulnerabilities in various IBM products affect HCL Commerce |
Feature enhancements
The following features have been introduced in this release. Review the following list to ensure that your site is prepared once this update is applied.
- Search
-
- Elasticsearch-based search updates
- Elasticsearch-based search updates are made and documented between releases; review Keeping Elasticsearch-based search up-to-date for details on important changes and upgrade considerations for Elasticsearch-based search schemas, NiFi, Ingest, and Query services.
- Introduced HCL Commerce Developer Solr-based Search environment
- The HCL Commerce Developer Solr-based Search environment enables customization and debugging of search functionality using Solr 9.7. It replaces the legacy IBM RAD-based development environment with a simplified development approach using Maven, Open Liberty, and Eclipse. It supports the Solr-based Search runtime built on Solr 9.7 and enables faster development.
- Redisson version is upgraded to 4.2
- Starting with HCL Commerce 9.1.20.0, the supported Redisson version is upgraded to 4.2. As a result, if you are using the Solr 7 search application, you must update the /SETUP/hcl-cache/redis_cfg.yaml file with the required configuration values.
- Tools
-
- Angular version update
- Angular is upgraded from version 19 to 21. See the commerce-tooling/package.json file within the Tooling SDK for information regarding exact version levels. To download the Tooling SDK, see Downloading HCL Commerce software.
- Deployment
-
- IBM Rational Application Developer 9.7 support
- This release introduces support for IBM Rational Application Developer(RAD) 9.7. Support for RAD version 9.6 ends September 30, 2026.
- Ingress controller and gateway support
- F5 NGINX Ingress and Envoy Gateway are now supported. Support for Community Ingress-NGINX ends in March 2026; customers should migrate to a supported option such as F5 NGINX Ingress, Emissary Ingress Controller, or Envoy Gateway.
- wc-server.xml update
- Cache-Control and Pragma headers are now enabled by default for runtime environments to improve REST response caching behavior.
- Developer Solr-based Search environment
- Support for a new Solr (version 9.7) based Developer Search environment is introduced, replacing the legacy RAD-based setup.
- Build Solr v9-based search customization package
- For Solr v9-based search, use the WCB HCL Commerce
Build tool (WCB tool) included in ts-utils to package customized
Solr search code. Ensure the
solr.version.v9property is set totruein thewcbd-build-search.propertiesfile. For other server types, ensure this property is not set totrue. For more information, see Packaging customized code for deployment Packaging customized code for deployment.
- Build Bitnami Redis Docker images
- In 9.1.20.0, Bitnami Redis 8.4.1 is certified on xLinux, and the corresponding Bitnami Redis Helm chart is bundled with the 9.1.20.0 xLinux Helm chart. You must build the Bitnami Redis 8.4.1 Docker image yourself.
- Utilities
-
- checkDuplicateJars.bat utility
- The
checkDuplicateJars.batutility identifies duplicate JAR files in the HCL Commerce Developer toolkit and provides an interactive option to review and remove redundant libraries.
- Logging services
-
- Enhanced trace logging security
- Enable the option to activate the Sensitive Log and Trace Guard and prevent sensitive data from being logged.
- Performance
-
- Redisson
- The
tcpandkeepAlivedeployment-level parameters have been deprecated and moved to theConfigobject. Additionally, thekeepAliveparameter has been renamed totcpKeepAlive.HCL Commerce now retrieves these settings from the
Configconfiguration instead of deployment-level parameters.
Defect fixes
See Version 9.1.20.0 in Fixes that are included in HCL Commerce releases for a detailed list of defects that were fixed in this release and its associated fix pack.
Supported software
HCL Commerce
9.1.20.0 has been tested with the following supported
software. The 
icon highlights software updates for version 9.1.20.0.
| Commerce | Supported software | Database | Browsers |
|---|---|---|---|
| HCL Commerce Version 9.1.20.0 |
|
|
|
7.17.29
7.17.28