AdaptAddQuantityFilterPlugin: incorrect SKUs exclusion due to imploded string in NOT IN clause
Open
@engcom-Hotel is already working on this.
Since Aug 4, 2025.
- #3427 by @ChickenBenny — closed without merging
Issue: needs update
Reported on 2.4.x
Triage: Dev.Experience
- Dominant language
- PHP
- Stars
- 357
- Forks
- 262
- PR merge metrics
- No merged PRs in 30d
Description
Preconditions and environment
- Magento 2.4.x with MSI enabled
- Module: magento/module-inventory-bundle-product
- PHP 7.4 / 8.1 (any)
- Database: MySQL 8.0
Steps to reproduce
-
Setup
- Create a Bundle product with two or more child SKUs that are out of stock in the current MSI stock (so
inventory_stock_<id>.is_salable = 0). - Ensure that
\Magento\InventorySalesApi\Api\AreProductsSalableInterface::execute()returnsfalsefor those SKUs.
- Create a Bundle product with two or more child SKUs that are out of stock in the current MSI stock (so
-
Trigger the SQL
- On the storefront (or in a debugger), load the bundle product page so Magento builds the bundle-selection collection.
-
Inspect the generated SQL
- Look for the AdaptAddQuantityFilterPlugin filter clause. You’ll see something like:
… AND e.sku NOT IN('SKU1,SKU2')
- Look for the AdaptAddQuantityFilterPlugin filter clause. You’ll see something like:
-
Observe the bug
- Because the two SKUs are concatenated into one quoted string, neither SKU1 nor SKU2 is actually excluded.
Expected result
The SQL should exclude each SKU individually:
e.sku NOT IN ('SKU1','SKU2')
Actual result
Out-of-stock SKUs are not excluded, because:
// in AdaptAddQuantityFilterPlugin
if ($skusToExclude) {
$subject->getSelect()->where('e.sku NOT IN(?)', implode(',', $skusToExclude));
}
turns ['SKU1','SKU2'] into the single string "SKU1,SKU2", resulting in:
e.sku NOT IN ('SKU1,SKU2') -- only one entry, never matches SKU1 or SKU2
Additional information
Proposed fix
IN
vendor/magento/module-inventory-bundle-product/Plugin/Bundle/Model/ResourceModel/Selection/Collection/AdaptAddQuantityFilterPlugin.php
Replace
if ($skusToExclude) {
$subject->getSelect()
->where('e.sku NOT IN(?)', implode(',', $skusToExclude));
}
With
if ($skusToExclude) {
// pass the array directly so Zend_Adapter expands it into individual, quoted literals
$subject->getSelect()
->where('e.sku NOT IN(?)', $skusToExclude);
}
This lets the DB adapter render
e.sku NOT IN ('SKU1','SKU2')
Additional context
This bug causes unsalable children to slip into the “max price” calculation for bundle products and can lead to incorrect price ranges on both product and category pages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.