26.1.0

🎉🎉 Welcome to Maho 26.1.0 "Triple Heart" 🎉🎉

2025 was an outstanding year for Maho. We removed PrototypeJS, jQuery, and all legacy Zend Framework components, replacing them with modern alternatives: Doctrine DBAL for database operations, Symfony for caching and sessions, Monolog for logging, and TipTap as our WYSIWYG editor. We also introduced passkeys authentication, a self-hosted GDPR-compliant captcha, customer segmentation, a blog module, dynamic categories, and official Docker images.

Now we're kicking off 2026 with yet another monumental milestone: multi-database support. For the first time ever, Maho can run on PostgreSQL and SQLite alongside MySQL!

But that's just the beginning. This release also brings passwordless authentication, a complete gift card module, automated product linking rules, dozens of frontend improvements, and full PHP 8.5 compatibility. We've also upgraded to Symfony 7.4 and Emogrifier 8.

26.1.0 is our most feature-rich release yet.

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

---

🚀 New features and major improvements

Multi-Database Support

This is the big one. Thanks to our migration to Doctrine DBAL 4.4, Maho now officially supports three database engines: MySQL, PostgreSQL, and SQLite.

PostgreSQL brings enterprise-grade capabilities for high-traffic stores, while SQLite enables lightweight deployments perfect for development, testing, or small shops. In fact, our demo store now runs on SQLite and performance is stellar, with reindex times almost 50% faster than MySQL!

Install with your preferred engine:

./maho install --db_engine mysql   # Default
./maho install --db_engine pgsql   # PostgreSQL
./maho install --db_engine sqlite  # SQLite

Magic Link (Passwordless Login)

Passwords are so 2010. Maho now supports passwordless authentication via secure email links.

Configure two modes:

• Hybrid Mode: Traditional passwords plus optional magic link
• Passwordless Mode: Email-only login/registration with password fields completely hidden

Security features include cryptographically secure 32-character tokens, configurable expiration (default 10 minutes), rate limiting (3 requests/email/hour, 10 requests/IP/hour), and silent failure for non-existent accounts to prevent email enumeration. Zero database changes required. Read the full documentation.

Gift Card Module

A complete gift card system is now built into Maho, contributed by @trabulium!

Features include:

• Create gift card products with fixed or custom amounts
• Apply gift cards at checkout with partial payment support
• Automatic balance tracking with transaction history
• PDF export with QR codes and barcodes (using BaconQrCode and Picqer libraries—no external APIs)
• Email notifications for recipients
• Refund support that credits balances back to cards

Gift cards are a proven revenue driver and customer acquisition tool. Now they're native to Maho. Read the full documentation.

CatalogLinkRule: Automated Product Relationships

Stop manually linking related products, upsells, and cross-sells. The new Maho_CatalogLinkRule module automates product relationships through condition-based rules. Manage your rules in Catalog > Product Relationship Rules.

How it works:

• Define source conditions (e.g., "products in Electronics category over $100")
• Set target conditions for linked products
• Configure sort order (random, price, alphabetical, newest)
• Set maximum link limits and date ranges for seasonal promotions

Rules process via daily cron (3 AM by default) in batches of 100 products. A powerful SourceMatch condition lets you dynamically match target attributes against source attributes.

USPS REST API Migration

USPS is retiring their legacy XML API, so we've migrated to the modern REST API with OAuth 2.0.

New capabilities:

• Shipping label generation (previously unavailable!)
• Enhanced tracking with detailed event history
• ~90% fewer API requests: single call retrieves all rates vs. 10+ calls before

⚠️ Breaking Change: Merchants must obtain new OAuth credentials from developer.usps.com and configure Client ID, Client Secret, and API environment in admin.

Enhanced Admin Dashboard Analytics

Third-party analytics platforms come with growing legal complexity: GDPR compliance, cross-border data transfer restrictions, cookie consent requirements, and privacy regulations that vary by country. Our enhanced dashboard gives you powerful insights while keeping all data on your own server. No cookie banners, no compliance headaches, no data leaving your infrastructure.

The admin dashboard now includes real-time visitor statistics and new visualization tabs:

• Visitors chart: 30-day trend visualization
• Devices & Browsers: Device breakdown with browser icons
• Engagement: Conversion rates and visitor categorization
• Entry & Exit Pages: Top landing and exit page analysis
• Traffic Sources: Referrer domain breakdown
• Languages: Visitor preferences with flags

---

Major, but not headline

• AJAX add to cart with offcanvas minicart – Products add without page reloads, minicart slides in automatically
• Unified tabbed login interface – Login, registration, and password recovery combined into one sleek page
• Fullscreen product image gallery – Click to expand with scroll-snap navigation and swipe support
• File attribute type for EAV – Native file uploads for products, categories, customers with automatic orphan cleanup
• Improved layered navigation with price input filter – New tag-based active filters UI and from/to price inputs
• Discount percentage badges on product prices – Visual savings indicators in grid, list, and detail views
• Customizable maintenance page – Store-specific templates with proper 503 headers
• Sample data installation in web installer – One-click demo data with progress tracking
• Varien to Maho namespace migration – 70 files updated from Varien_* to Maho\* classes

---

TipTap WYSIWYG: Building towards a page builder

We're continuing to enhance TipTap, laying the groundwork for a full-fledged page builder. This release adds powerful new editing capabilities:

• Multi-column layouts – 6 layout presets (2/3/4 equal columns, sidebar left/right, wide center) with responsive stacking on mobile
• Drag & drop section reordering – Rearrange content blocks visually
• Improved table editing – Dropdown menus for table operations and cell alignment support
• Fixed media browser and widget dialogs – Resolved issues with image insertion and widget handling

---

Important, but not major

• Refactored web installer UI – Modern HTML5 validation, PostgreSQL/SQLite support, cleaner UX
• Cart shipping estimate form converted to AJAX – No more page reloads for rate calculations
• Modernized product reviews with dialog-based form – Cleaner review submission flow
• Admin toolbar modernized with CSS position: sticky – Replaced 220+ lines of JS with 4 lines of CSS
• Admin image preview using MahoDialog – No more deprecated window.open() popups
• Debounce and request cancellation for autocomplete – 200ms debounce, AbortController for in-flight requests
• Global AJAX loader for frontend – Consistent loading indicator across all async operations
• Parent Products tab in product edit form – See which configurable/grouped products include this simple product
• Improved crosssell layout in checkout – Better visual presentation
• Better checkout first step alignment – Cleaner billing/shipping address layout
• Improved product page buttons layout – Refined add-to-cart area
• Unified cart item options styling with SKU display – Consistent product options presentation
• [Improved gift message display in order view](https://githu...

25.11.0

🎉🎉 Welcome to Maho 25.11.0 "Core Fission" 🎉🎉

This has been one of the most intensive releases we've ever shipped, and the name says it all, Core Fission represents the moment Maho stops being a fork and becomes a drop-in modern replacement for the Magento 1 framework, the ecommerce framework that everybody loved, with complete compatibility. We've eliminated every last piece of Zend Framework, purged all the old JavaScript libraries for modern vanilla, and migrated the entire Varien namespace to proper Maho classes with PHP 8.3+ namespacing.

This isn't just cleaning house, it's splitting off from two decades of accumulated tech debt to emerge as something entirely new. Maho's framework is now based on Symfony, Doctrine, Laminas, and other major modern maintained libraries that will be around for years to come.

The result? A cleaner, faster, more maintainable platform that drops right into your existing setup and is ready for the next decade of ecommerce.

This release also introduces what might just be the best email automation platform ever built into an ecommerce system, giving you enterprise-level marketing tools right out of the box.

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

Added email automation system for customer segments

We're introducing a complete email automation system that rivals enterprise marketing platforms, built right into Maho's customer segmentation module. You can now create sophisticated multi-step email campaigns that trigger automatically when customers enter or exit segments, think cart abandonment recovery with progressive discounts, welcome series for new customers, post-purchase follow-ups, VIP nurturing campaigns, or win-back sequences for inactive shoppers.

Each sequence can include multiple steps with configurable delays (from minutes to days), and here's where it gets really powerful: every email can automatically generate unique, personalized coupon codes with custom prefixes and expiration dates, all integrated with your existing sales rules. The system tracks each customer's progress through your campaigns, respects newsletter subscriptions and GDPR requirements, and runs on dedicated cron jobs that handle everything from email processing to automatic cleanup of expired coupons.

Maho goes 100% vanillaJS

Maho 25.11 completely removes all javascript libraries from our repo for a complete modern vanillaJS experience of both frontend and backend.

In detail: Rewrote adminhtml/loader.js, Rewrote adminhtml/giftmessage.js, Rewrote adminhtml/events.js, Rewrote adminhtml/tabs.js, Rewrote store/switcher/enhanced.phtml, Rewrote applicable_country.phtml, Rewrote system/config/js.phtml, Rewrote customer/tab/addresses.phtml, Rewrote bundle related phtml files.

No Zend Framework anymore

We finally cuts the cord with Zend Framework (which is no longer part of this repo) - the aging monolith that's been weighing down the codebase since the Magento 1 days. Maho is completely built on the shoulders of the best modern PHP giants - Symfony, Laminas, Doctrine DBAL and so much more - projects that are actively developed and will be around for years to come. The payoff is real: a cleaner, faster, more secure codebase that actually makes sense to work with, all while keeping full backward compatibility (as much as possible) for extensions so nobody gets left behind.

In detail: Removed Zend_File_Transfer, Removed Zend_Translate, Removed Zend_Feed, Removed Zend_Oauth, Removed Zend_View, Removed Zend_Controller, Removed Zend_Acl, Migrated from Zend_DB to Doctrine DBAL

No Varien anymore

This release migrates all Varien classes from lib/Varien/ to lib/Maho/ with proper PHP namespaces, converting underscore-based pseudo-namespaces (e.g., Varien_Data_Form) to modern namespaced classes (e.g., Maho\Data\Form).

To ensure a smooth transition, we've implemented PHP 8.3+ eager class aliases for all ~108 Varien classes, maintaining 100% backward compatibility with third-party extensions while giving us a clear path forward with consistent, professional naming throughout the platform.

New design for the web installer

The web installer got a complete visual overhaul with a modern, responsive design.

We've rebuilt it with pure CSS and vanilla JavaScript, adding smooth CSS animations, a proper step-by-step progress indicator, password strength indicators and an interface that actually looks professional.

Sure, web installers might feel a bit old-school in today's containerized DevOps world where everything's automated, but they're still crucial for new users and smaller deployments who just want to get Maho up and running without wrestling with deployment pipelines.

Major, but not headline

• Added Array Adapter to the ImportExport module for direct PHP array imports, removing the need for 3rd party modules like AvS_FastSimpleImport
• Added SVG support for favicon and placeholder uploads with security sanitization

Important, but not major

• Added user prompt for image duplication when duplicating products
• Removed database media storage functionality
• Fixed composer replace versions for Roave Security Advisories compatibility

Less important changes

• Removed deprecated code
• Fixed concurrent duplicate key violation in tax observer during order processing
• Improved Use of Time Zone Constants
• Removed unused filesystem token configuration system
• Removed unused PayPal related backend files

25.9.0

🎉🎉 Welcome to Maho 25.9.0 "Titan Surge"! 🎉🎉

Maho 25.9.0 is here, delivering a robust set of modern enhancements designed to boost performance, streamline management, and elevate both user and manager experiences. Maho is not just ready for the future, Maho is the future!

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

Added blog module with admin interface, frontend, search and APIs integration

A feature long requested to allow store managers to publish news to their customers. No longer you need commercial modules or bridge modules for wordpress, you now have a simple but effective implementation, with SEO friendly features. We coded our blog based on the powerful and expandable EAV system, so that you can customize the blog entity as much as you want.

The blog posts are also integrated in the search autosuggestion (if you want to).

Added Customer Segmentation module with rule-based targeting

This is an enterprise grade feature allows you to group customers based on a huge number of factors like demographics, account data, order history, shopping behavior, product interactions, time-based conditions and even cart content!

You'll then be able to integrate a segment into shopping cart promotion rules and in newsletter sending too!

Added image editing functionality to CMS Media Library

Need to quickly crop a picture that's already uploaded to your ecommerce website? No need to download it, open an image editor etc, since Maho 25.9 includes a customized version of FileRobot image editor (show them love for this amazing tool), something that only much bigger and expensive platforms provide (until now).

This editor is tightly integrated with Maho, automatically detecting image compression level and format, and provides advanced features like watermark, text adding, image color editing, and more!

Replaced Zend_Pdf with DomPdf

Generating PDFs for invoices and other documents was a major pain point of the M1 platform, so we thought enough was enough, we rebuilt the whole functionality from scratch bringing the power of phtml inheritance and customizability to PDFs too.

Thanks to DomPdf and our great frawork we can now create PDF templates as if they were normal web pages, and the system will take care of the conversion to PDF.

Replaced Zend_Log with monolog

Developers need a more powerful logging/reporting capability and there's nothing better than monolog in the PHP world.

By default Maho will now use 𝗹𝗼𝗴 𝗿𝗼𝘁𝗮𝘁𝗶𝗼𝗻, huge system.log files are finally in the rear mirror, but most of all you'll be able to 𝗰𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗹𝗼𝗴 𝗮𝗱𝗮𝗽𝘁𝗲𝗿𝘀 𝘃𝗶𝗮 𝗰𝗼𝗻𝗳𝗶𝗴 𝗫𝗠𝗟 and this is an immense benefit, why you ask?

Now you'll be able to have the default log file (with rotation) for all your normal logging need, and (for example) 𝗽𝗼𝘀𝘁 𝗮 𝗹𝗼𝗴 𝗲𝘃𝗲𝗻𝘁 𝘁𝗼 𝘆𝗼𝘂𝗿 𝙎𝗹𝗮𝗰𝗸 𝗰𝗵𝗮𝗻𝗻𝗲𝗹 when the severity requires it, or even 𝘁𝗼 𝗮 𝗧𝗲𝗹𝗲𝗴𝗿𝗮𝗺 𝗯𝗼𝘁 for immediate alert of some specific people in your company!

Check the complete logging documentation.

Improved guest-orders management

• Added "Missing order?" feature for guest order association to existing customer
• Added ability to edit guest order email addresses from admin panel

Added Speculation Rules API module

The Speculation Rules API lets you set smart rules for when the browser should prefetch or prerender pages by watching things like where the user is hovering, all with minimal effort but big rewards in speed and usability. In addition to support for BFcache (that we added previously) Maho now allows you to easily configure a set of CSS-style rules (targeting links on every web page) for every rendering mode and eagerness mode. And the best thing is that it's enabled by default (in conservative settings).

Added category search to autosuggest dropdown

In the past couple of releases we worked a lot on improving the built-in autosuggest functionality, in 25.9 we adding support for searching and autocompleting category names. The feature is completely configurable and it has fulltext support too.

Added region import functionality to admin interface

Localization is a primary effort for Maho and we want a frictionless implementation, that's why we created the Maho Directory Data project and added a super easy import of states/provinces (automatically translated in every langauge) into your store's database. This comes in addition to the possibility of manually adding/editing/remove/translate single entries (introduced in Maho 25.7.0).

This functionality also comes with its own CLI commands for terminal people.

Added built-in CSS/JS minification and 103 Early Hints support

We already had a great extension for CSS/JS minification but we wanted to have native 103 Early Hints support in the core so we decided to refactor that extension to integrate it in the best way possible, and now we've the benefit (on supported web servers like FrankenPHP) for early hits for even better performance.

Added category import/export

Traditionally the M1 platform could only import/export products and customers. We're want to fill the gap here starting with categories, now natively available via the System -> Import / Export section of the backend, and more feature will come in the near future.

Removed flatpickr and migrated to native input type date, time, datetime-local

Javascript datetime pickers are a whole world but in 2025 we believe there's no need for those anymore, browser support for native (and mobile native) date and time selectors is now so widespread that it was time for us to migrate away from javascript solutions. This has a lot of benefits: no js/css means faster rendering, automatically localized based on your browser locale, simpler protocols since the browser always submits the dates in ISO format regardless of the locale.

Replaced Zend components with modern alternatives

• Replaced Zend_Date with native DateTime
• Replaced Zend_Http_Client with symfony/http-client, removed Varien/Http
• Replaced Zend_Locale, Zend_Curreny with native PHP Intl. Removed Zend_Filter. Replaced Zend_Measure with php-units-of-measure
• Replaced Zend_Validate with symfony/validator
• Replaced Zend_Uri with new Maho filter/validate methods

Major, but not headline

• Added meta robots control for products, categories, and CMS pages
• Enhanced sitemap generation with file splitting and image support
• Fixed saving of static EAV attributes in entity models
• [Added HTTP Security Headers for Enhanced PCI DSS Compliance](#24...

25.7.0

🎉🎉 Welcome to Maho 25.7.0 "Heavy Drop"! 🎉🎉

This release focuses on delivering a big set a important new features, our goal is to have everything you need ready to go right out of the box! Of course, we haven't forgotten little tweaks and regular maintenance along the way!

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

Replaced TinyMCE with TipTap 3.0 with custom Maho plugins

With TinyMCE changing its license to GPL (not compatible with OSL3), we decided to take the hard task to look for the best open source replacement and the king, today, is for sure TipTap, its modern, well developed, supported and maintained and we fell in love with its API, which allowed use to develop brand new plugins for widgets, variables, images and much more, this release introduces MahoSlideshow, which is just the first step into building a full fledged page builder! It also provides a much stronger validation of the produced HTML, which, in the long run, will allow for much stronger safety of your store.

Added minimal layout for checkout (no header, no footer)

One single flag (enabled by default) and the checkout experience of your store will be completely decluttered, like all major successful store are using nowadays, stripping away header and footer distractions to seriously boost your conversion rates.

Added "Dynamic Categories" feature: rule-based product assignment

This release brings an intelligent category management system that automatically assigns products to categories based on configurable rules, saving you hours of manual work by letting products organize themselves into seasonal collections, price-based groupings, or whatever complex hierarchies you need.
Need a shop-by-brand navigation? This feature does it for you with no need for commercial modules.

Added "payment restrictions" functionality

There are times where you need to restrict certain payment methods to a specific set of customers (eg: cash-on-delivery only for returning buyers), our new rule-based payment method restriction system uses Maho's existing rule engine with the intuitive tree-like interface you already know, so you can set up sophisticated payment control based on customer location, order value, groups, or any combination you need for your business workflow.

Frontend: Implemented global offcanvas navigation and CSS-only tabs in product page

Mobile navigation has been completely revolutionized with modern off-canvas, almost fully CSS based, with just a few lines of vanilla javascript code (to optimize the number of DOM elements). This PR also rewrites the tab-based section of products page with a CSS-only solution.

Added Admin Activity Log functionality

We built a comprehensive audit trail system that tracks all administrative actions (and successful/failed logins), essential for compliance, knowing who did what and recover lost information (up to a certain degree).
All of the data is encrypted and the unique diff-like interface is something else.

Added Media Library to CMS admin section

Before Maho 25.9 you could only access the media file manager from the rich-text editor, but now a new menu item in the CMS section will take you to the same file-manager view, for a quick and independent management of your files. But this is only the start for Maho of a full media editing experience which will come in the next releases so... stay tuned for this!

Added tier pricing support for configurable products

Previously, tier pricing only considered individual variant quantities, now it's based on the total quantity across all variants of the same configurable product, like it should have been from the start.

Added admin interface for managing countries, regions, and their translations

No more manually editing database tables when you need to add a new province/state to your project. With Maho 25.9 you have a comprehensive CRUD interface for directory data management with full translation support. This also removes the Zend_Locale dependency for regional settings.

Replaced session management with symfony/http-foundation

Session handling has been completely ripped out and replaced with Symfony's rock-solid HTTP Foundation component, which includes Redis support out-of-the-box and improved security, removing the need for 3rd party modules.

Replaced Zend_Soap with Laminas_Soap, Zend_Json with native json_encode/json_decode, Zend_Json_Server with Laminas_Json_Server and Zend_XmlRpc with Laminas_XmlRpc

In the quest of providing the most lean and modern ecommerce platform we're removing old dependencies, migrating to new maintained and optimized ones, and making optional as many dependencies as possible, so that your installation will be smaller and safer in case you don't use those features!

Major, but not headline

• Set PHP 8.3 as new minimum version
• Added configurable trailing slash behavior and remove default .html URL suffixes
• Added simple defer javascript functionality in tandem with load-on-intent
• Frontend: 2columns-left layout is now default, instead of 3columns

Important, but not major

• Added region support to SMTP functionality
• Added single product reindexing capability to Maho CLI
• Added possibility to disable product compare and recently viewed
• Added possibility to disable Add To Cart buttons in product listings
• Improved accessibility with ARIA labels, semantic HTML, and enhanced keyboard navigation
• Added dd global function, using symfony/var-dumper
• Introduced xssKillah
• Fixed gift message bug where quote and item IDs could collide during checkout
• Fixed shipping methods configuration to handle array method titles
• Moved category title just below breadcrumbs for better spacing

Less important changes

• Added --force option to maho install
• Upgraded Altcha to 2.0.0
• Added stdin support to maho translations:missing
• Removed deprecated methods
• Removed deprecated code from shipping, sitemap, and tag modules
• Fixed TypeError when getimagesize() returns false in Product Image model
• Finished removing Zend_Mail
• Mage_Core_Helper_Data::decrypt() can be called with NULL now
• Fixed field dependence and coupon code toggle on Sales Rule edit page
• Removed obsolete Mage_GoogleCheckout module

Full Changelog: 25.5.0...25.7.0

25.5.0

🎉🎉 Welcome to a new release of Maho, the ecommerce platform that innovates without reinventing the wheel! 🎉🎉

This release focuses on fortifying Maho's core with essential security upgrades, performance optimizations, and developer tools that modernize the platform while eliminating legacy dependencies.

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

Migrated encryption library from mcrypt to libsodium

This critical security upgrade replaces the deprecated mcrypt extension (removed in PHP 7.2 and provided through a polyfill until now) with the modern, high-security libsodium cryptographic library. The migration delivers state-of-the-art encryption algorithms, constant-time implementations to prevent timing attacks, and significantly improved performance. Beyond meeting modern security standards, this change future-proofs Maho's cryptographic foundation while maintaining backward compatibility with existing encrypted data.

This change also adds the ./maho sys:encryptionkey:regenerate CLI command, which allows you to generate a new encryption key and re-encrypt all the encrypted data in your database automatically (for core database tables) or manually (hooking into the new encryption_key_regenerated event, check this sample implementation in the Mage_Payment module). sys:encryptionkey:regenerate also adds health check for key migrations mcrypt -> libsodium and more.

Now it's possible to implement real encryption key rolling routines, like any modern ecommerce project should.

Replaced internal image generation with intervention/image

Up until now, the M1 platform had custom code to handle image generation, resize and conversion, which had limitations and bugs and was falling short in a modern world with new image compression formats. This is why we completely removed the legacy code and replaced it with the most used image handling package in the PHP world, with 150M+ downloads: intervention/image.

In case you have the high performance VIPS library installed, the new Maho::getImageManager() automatically loads and use it for you, providing, among other things, HEIC format support.

Frontend: an autocomplete that actually makes sense

The search autocomplete experience has been completely rewritten from the ground up and now, without the need for any 3rd party module, it's fully functional like never before.

The new Autocomplete previews products matching the search criteria, showing product name, prices and the thumbnail picture, in a mobile optimized layout.

Added Meta Pixel (Facebook Pixel) support to the GoogleAnalytics module

Any modern ecommerce platform should provide complete support for Google Analytics 4 and Meta Pixel, with enhanced ecommerce data, and Maho 25.5 fills the gap for this last point.

Rewrote the whole cache subsystem based on symfony/cache, removing the old Zend_Cache

Symfony cache component provides us with performant, well maintained and secure cache layer for Maho, and it also provides us with built-in Redis support (no 3rd party modules required anymore!)

Added possibility to set local.xml content via environment variable MAHO_LOCAL_XML

Deployment and environment management just became significantly more flexible with the addition of environment variable configuration for local.xml. This DevOps-friendly improvement allows you to inject your entire configuration through the MAHO_LOCAL_XML environment variable, eliminating the need for file-based configuration management in containerized environments.

Official docker images based on FrankenPHP

25.5.0 marks the start of our official Docker images repository, available on Docker Hub and automatically built via Docker Cloud Build through our Docker images source repository.

We are supporting a comprehensive list of tags, covering all possible usages:

• nightly which will replicate all changes on our main development branch
• latest which will point to our latest stable release (25.5.0 in this moment) with latest FrankenPHP and available PHP version
• and a tag for every Maho release since 25.5.0

Replaced Zend_Locale_Data with IntlDateFormatter in Mage_Adminhtml_Block_Report_Sales_Grid_Column_Renderer_Date

As we moved away from prototypejs for the whole frontend (backend in work in progress), we will need to move away from Zend Framework 1 sooner than later, and 25.5.0 marks the first major step in this direction. Modern PHP provides highly performant and feature rich set of locale related functions that we start to leverage with this release. There's no visible change here, but it's very important nevertheless.

Added "redirect to product page if search generates one result" feature

A minor technical change, but a good quality of life improvement. Simply browse to System -> Configuration -> Catalog -> Catalog Search and enable it, as simple as that!

Major, but not headline

• Added MahoCLI command to generate PHPStorm metadata by @fballiano in #143
• PHPStan plugin v3 - raised PHPStan to level 6 by @justinbeaty in #66
• Mage::getVersion() now returns Maho version by @fballiano in #164
• BC: Encrypted SMTP username/password settings by @fballiano in #153

Important, but not major

• Removed possibility to disable CSRF
• Added the possibility to disable advanced search
• Added MahoCLI command to connect to database
• Unified image processing quality setting
• Removed "popular search term" functionality from frontend
• Removed unsupported UPS XML APIs, rewrote UPS javascripts without prototypejs
• New default values for search configurations
• Added default main_table. prefix to filter_index in grids that use the additional _grid table

Less important changes

• Fixed negated JS instanceof calls
• Rewrote mage/adminhtml/sales.js without prototypejs
• Removed obsolete and unused Mage_HTTP_* classes
• Removed unused configuration_update_time setting
• Removed phpseclib/phpseclib as a dependency
• Removed Mage_Media module
• Removed HTTP(s) schema from URLs in web installation process
• Removed Varien_Db_Adapter_Pdo_Mysql::_removeDuplicateEntry() when creating an index
• Solved CodeQL issue 68

Full Changelog: 25.3.0...25.5.0

25.3.0

🎉🎉 Welcome to a new release of Maho, the ecommerce platform that innovates without reinventing the wheel! 🎉🎉
We worked extremely hard these past two months to bring you an extensive set of big new features, 25.3 was an very challenging release to create, we hope you'll enjoy it!

Creating Maho is a massive effort that requires all the help possible, please consider joining our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

New header layout

Isn't this new layout amazing? modern, compact, with new icons and new layout, responsive optimized, you really don't need much more! Our goal is for our default theme to be really used by all stores that now rely on 3rd party commercial themes.

Self-hosted GDPR compliant captcha module

This is a first in class for sure! At Maho we're all about privacy and GDPR (especially for European companies) is a must, but some services (and captcha is one of them) are always based on 3rd party platforms that gather data about your store and your customers. Not anymore, we're the first platform to provide a self-hosted, cookieless, GDPR compliant captcha solution based on the open-source project called Altcha.

Full SMTP support

Do you remember the time when you had to install a 3rd party module to have SMTP support? Not with Maho 25.3, full SMTP support is now bundled in the core (we re-created all the code from scratch for it to be as modern as it can get), technically it's based on the amazing symfony/mailer which allows you to connect to a huge variety of services (SES, Azure, Mandrill, SendGrid and many more) without the need for custom coding!

Passkey authentication for backend

Backend security has been significantly enhanced with Maho 25.3! Passkey passwordless authentication method leverages FIDO2 standards, providing phishing-resistant access to admin users through biometric verification or hardware security keys. Which, in addition to native 2-factor authentication (which we added in 25.1) makes the backend of your store stronger than a safe in a bank!

5800+ icons library (thanks to Tabler) and Mage_Core_Block_Abstract::getIconSvg()

We want Maho to be the best ecommerce platform there is, and the graphic design system is one of the areas that we wanted to tackle, and we did it in the biggest possible way introducing a huge set of SVG icons, based on what we think it's the best, which is Tabler icons, and that you can add to your template thanks to the new ->getIconSvg() method and that you can customize via CSS (color, size and stroke width!).

Frontend: added srcset 2x to all templates

Did you ever think your magento-based project had kinda-blurry thumbnails for the past 15 years? Well, the world was waiting for Maho to solve it, introducing srcsetfor retina displays (at the moment only 2x, in order to avoid an uncontrolled growth of the image cache), a simple improvement that was much needed and that propels our frontend theme a step forward!

Move products to a different attribute set + EAV scheme cleaning

If you worked with any of the Magento based platform you've seen this feature requested many many times. And we built it right into the core, in a simple yet effective way (which is our motto anyway). And after you change the attribute-set of a product, a scheduled routine will take care of cleaning all the orphaned records in the EAV tables (which, by the way, will make your store healthier anyway, especially if you had used custom import tools like Magmi). By the way, if you make a mistake, you'll have a few hours to revert the change back before the cleaning routines kick-in, better safe than sorry!

RWD is dead, long live RWD!

RWD was the main addon theme of the M1 platform for many years, it was the de-facto default but technically it wasn't, really. There was a base theme that has suffered from abandonement for too long (leading to far too many problems). We decided it was time to merge the two together and make RWD the new base theme, ensure a better feature set, easier filesystem structure and more updates/maintenance without any cons.

Less important but still very important

• Configurable Product Improvements (#106)
• Expose config.xml//events/args node to observers (#113)
• Fix Mage_Customer_Helper_Address::getAttributeValidationClass() method (#114)
• Added a few rector rules (#115)
• Deprecated Mage_Core_Helper_Data::decorateArray() (#120)
• Removed Mage_Adminhtml_Block_Notification_Security Block (#122)
• Replaced Mage::helper('core')-> methods with equivalent $this-> methods (#121)
• Replaced adminhtml/system_config_source_yesno with boolean (#124)
• Removed <em>*</em> from frontend templates (#123)
• Rewrote adminhtml/sales/packaging.js without prototypejs (#125)
• Removed password from admin_user_authenticate_after and added admin_user_authenticate_failed event (#99)

And much more, check the full changelog at:
25.1.0...25.3.0

25.1.0

🎉🎉 Welcome to a new release of Maho, the new ecommerce platform you already know! 🎉🎉
First release of 2025, huge release already, fasten your seatbelts for this ride, cause we powered through the holidays, cramming ~150 commits into Maho 25.1, shaking the foundations of open source ecommerce once more!

Creating Maho is a massive effort that requires all the help possible, please consider joining our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

Foundation

Maho 25.1.0 is based on OpenMage 21.0-beta2 + all the patches merged in the main branch up to 13th Jan 2025.

🚀 New features and major improvements

Completely removed prototypejs from our frontend!

This doesn't really need an explanation right? PrototypeJS was an ancient javascript library that was at the base of the M1 platform but that became anachronistic and unsupported, its last release was in 2015... It had to go, but removing it from the frontend was a huge, huge effort that took years in rewriting and testing thousands of lines of code. We focused on the frontend first because it's for sure the most important part, backend will come later. Better security, modern code, lighter frontend with hundreds of KB of javascript saved at each request.

Converted all colors into variables for easy color scheme customization

Customizing the color scheme of your store was never this easy!

We've reviewed 10k lines of CSS, extracted and cleaned all colors and moved them into 25 CSS variables to allow you to have complete control, but also to make a another step forward in the modernization of Maho's frontend.

Added optional 2 Factor Authentication for backend

In 2025 security is no joke to anybody, 2FA was a requested feature since long time and we wanted Maho to have native support for that.

With Maho 25.1 your backend users can decide to enable 2FA, scan the autogenerated SVG QR code (no temporary image files are generated, for enhanced security and easier sysadmin maintenance), save, done.

Added Order Status color

Having a great support for modules was the key to the success of the M1 platform, but at Maho we believe that key functionalities should be bundled in the core, that's why we decided to add support for assigning a color to each order-status, something that a lot of stores were already using with 3rd party code.

Now, natively, with just a few clicks, store managers have an easier way to overview the orders, allowing for faster workflow and less possibility to forget to process an order.

Composer plugin v3

Bootstrapping Maho now just requires 3 lines of code, gone are the days of including bootstrap.php, Mage.php and then still it wasn't working.
Our composer plugin v3 enables full composer autoload for the whole platform, autoloading performance improvement and full support for Modman based modules.

Removed the ancient ExtJS and replaced with Maho Tree

ExtJs is a powerful tool, but because of licensing, the version that was bundled in the M1 platform for 10+ years was extremely obsolete. Here again we rethought the whole thing, looking for alternatives and deciding to create our own minimal js tree library based on standard HTML elements like details/summary. HTML/CSS are extremely powerful now and we should always try to leverage the standards as much as possible, this will assure better maintainability, security and performance.

New design for star rating

The previous implementation looked old and outdated, it was time for a complete overhaul. It's not a big deal in the great schema of things, but reviews are still important for ecommerce websites and the need for a quick, clear and modern interface to allow customers to leave a review was absolutely necessary.

Dashboard charts are now based on Chart.js

Dashboard charts relied on a 3rd party server for many, many years, in the M1 platform. That is a problem on multiple levels, what if that server goes down? Also, in order to generate the charts, all the data was obviously sent to that service and... well.. let's say we don't want to leak our precious sales data. At Maho we are dedicated at tackling these infrastructural problems and here we are again, with a local-only chart solution for the backend dashboard, modern, interactive and safe.

Added "Cron Jobs" mask to "System -> Tools"

For many years the M1 platform had a few modules to see and modify cron jobs, we think such a configuration is better held via code, but it's extremely helpful to be able to see which cron jobs are running, for how long and if there are any errors. This is now possible without having to install any 3rd party module.

🐛 Minor bugfix, improvements and changes

• Fixed target file format conversion for images (#79)
• Added $this->getResponse()->setBodyJson() method (#85)
• Backend: Rewrote file uploader without flow.js (now removed from the repo) and prototype.js (#91)
• Backend: Rewrote WYSIWYG without PrototypeJS (#87)
• Backend: Removed double span element from HTML buttons
• RWD: Removed double span element from HTML buttons
• RWD: Removed DOM element span.swatch-label from layered navigation
• Frontend: Restyled swatches with flexbox, also made them slightly bigger to respect touch-point-sizing
• Frontend: Removed a few "go back" and "change" links from checkout for better readability
• Removed obsolete install scripts (#65)
• Fixed bug with Mage::getModel('core/url')->getUrl('', ['_current' => true, '_query' => false]) (#82)
• Fixed configurable swatches undefined array key warning (#80)

🛠️ Technical updates

• Updated PHPStan to 2.1
• Updated Rector to 2.0

And many more, be sure to check the full changelog.

24.11.0

🎉🎉 Welcome to a new release of Maho, the ecommerce platform you already know! 🎉🎉
Remember our last release two months ago?
Well, time must be an illusion since we managed to pack two years' worth of changes (about 300 commits) into this new one!
For this reason we had to condense these release notes to spare you from a document that would make Lord of the Rings seem short.

🚨⚠ DISCLAIMER ⚠🚨
Maho is a big shift in the M1 paradigm so please, for the time being, handle it with care. As much as we'd love to see production stores going live on Maho, be sure to test everything very carefully.

Before starting, a word about the future
We had to remove a major new feature from this release, the global attribute editor, Justin worked extremely hard on this (and not only on this ❤️), but the task is huge, it will bring a whole new set of features to our platform, and it simply requires a bit more time. We're confident that it will be ready for Maho 25.01 along with many other revolutionary changes, we aim for Maho 25.01 to have the first prototypejs-free frontend since the beginning of the M1 platform!

This massive effort requires all the help possible - please consider joining our sponsorship program. It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

Foundation

Maho 24.9.0 is based on OpenMage 21.0-beta2 + all the patches merged in the main branch up to 24th Nov 2024

Visible from outside: changes to the frontend theme

• Completely removed jQuery,
• All icons are now SVG
• Converted all font-size to rem for enhanced accessibility
• Removed google font and replaced it with Tailwind default font rule
• Removed elevateZoom and rewrote basic zoom functionality in vanilla js
• Removed slideshow js and rewrote them in modern CSS + basic vanilla JS
• Avoided content layout shift
• Removed modernizr.js
• Removed imagesloaded.js completely and rewrote funcionality with modern js, added lazy load to image gallery in product view

And many, many other minor improvements.

🚀 New features and major improvements

Added back/forward cache support for CMS/category/product pages

This will allow extreme performance improvements when using the back/forward buttons, better pagespeed scores, and could lead to big bandwidth/load saving on your infrastructure. (read more)

Added support for AVIF images

AVIF is a modern, open-source image format that offers superior compression efficiency while maintaining excellent image quality. It's particularly important because it supports advanced features like HDR, wide color gamut, and transparency, necessary to highlight the characteristics of specific type of products on your store. (example)

Added possibility to set a file format (default WebP) for all images processing (resize, thumbnails etc)

Convert all your catalog to WebP with a single click. (read more)

SEO: Added automatic hreflang tag

This starts an effort to bring a complete set of SEO related tools to Maho. (read more)

From now on, multi store website will be linked across languages so that search engines will understand the language correlation between pages, out of the box.

Removed Mage_Persistent and improved cookie handling

Remember the "remember me"? Well, this change removed the ancient Mage_Persistent module, consolidate and merged all templates, cleaned up a lot of code and completely rewrote the cookie management for session, you may not see the difference with your naked eye, but you will know it will work so much better.

Replaced js calendar by Mihai Bazon with flatpickr with lazyload

The javascript library used for dates in all M1 installation was extremely old (last release was almost 20 years ago!) and it had to go, and it's now replaced with a lightweight, moderd looking and modernly coded one called flatpickr.

Massive improvements to Maho's autoloaders

The idea at the base of Maho itself was the new set of autoloaders that allow all of the platform to live inside composer's vendor folder, like any other modern framework would and that was never possible in the Magento world. With this PR Justin took this concept and made it 10 times better.

Improved jstranslator.xml capabilities

Jstranslator gives you the possibility to add translation strings to frontend's javascript code, without having to write any javascript. It's a great feature but it needed some love. This new version separates frontend/backend strings, allows to define a string relatively to a module, scope or if a specific javascript file is included in the target page. (read more)

Added option to redirect to register page during checkout

When your customer registration form is too long, it's probably not the best to have it inside the checkout procedure, with this new option you can decide that your users will be redirected to the customer registration page if they choose to register during the checkout phase. Simple, but effective.

Added MahoCLI command to create a new command

When developing an ecommerce project, you will find yourself developing some quick command line scripts, you could already integrate them into Maho CLI but today this is easier than ever with ./maho create-command.

Introduced ./maho health-check and migrate to Maho guide

You asked us for a migration guide and we delivered, but we thought we needed something more, that's why we created ./maho health-check, which will help you keep your project in good health, but also will ./maho health-check that a project could have.

❗ Major changes you need to know

• [Products count is now disabled by default in layered navigation](https://gith...

24.9.0

🎉🎉 Welcome to the first public release of Maho, the new ecommerce platform you already know! 🎉🎉
This might sound odd, and that's intentional 😉 Maho is part of the M1 ecosystem, started in 2008 with Magento1, then followed by OpenMage and now here we are. A platform you're already familiar with, but brand new in many many aspects!

Maho wants to provide a forward-thinking approach, fun for developers, a modern environment but keeping our strong roots of the M1 platform.

We have about 250 commits for this release 🤯, ranging from minor tweaks to major feature additions, so... buckle up! And notice that we had to omit many minor details for brevity but we hope to have highlighted everything important.

🚨⚠ DISCLAIMER ⚠🚨
Maho is a big shift in the M1 paradigm so please, for the time being, handle it with care. As much as we'd love to see production stores going live on Maho, be sure to test everything very carefully.

Maho rocks! 🚀
https://mahocommerce.com

Foundation

Maho 24.9.0 is based on OpenMage 21.0-beta2 + all the patches merged in the main branch up to 18th Sep 2024

The new paradigm

Three main pillars set Maho apart from any other M1 based platform:

• Project structure: no duplicates files from the core is your project folder, like any other modern PHP project, frameworks and libraries live only in the vendor folder, thanks to composer, our new composer-plugin and our completely rewritten autoloaders.
  This means a clean project structure that only contains YOUR code and less possibilities for inexperienced developers to "patch the core".
• Built in CLI tool ./maho: with inspirations from Laravel Artisan, Laravel starter project and the great n98-magerun (three extremely important pieces of software both historically and in the current open source landscape) we decided to create our own CLI tool, make it as complete as possible, and bundle it. In the meanwhile we also made it expandable so that you can build your own commands.
• media, js and skin folders now live inside the public directory, it is now mandatory to set the document root of your web server (Apache, Nginx, Caddy or FrankenPHP) to public.
  This may be a bit more uncomfortable on some shared hostings, but it's needed to keep things simpler and, most importantly, more secure.

Important things you must know

• API: Adjusted WSDL attributes for Maho branding
  If your project has custom APIs you've to search for urn:Magento and urn:OpenMage and replace all occurrences with urn:Maho, to do that you can run these commands
  • on Linux find app -type f -exec sed -i 's/urn:\(Magento\|OpenMage\)/urn:Maho/g' {} +
  • on MacOS (be sure to have gsed installed) find app -type f -exec gsed -i 's/urn:\(Magento\|OpenMage\)/urn:Maho/g' {} +
• PHP 8.2 minimum: more performant end secure, this change also allows us to remove a lot of polyfills from our composer.json, slimming down your final vendor folder but also ensuring that you use native PHP functionalities instead of the less performant 3rd party polyfills
• The ancient Scriptaculous was completely removed, thanks to html5sortables and the creation of MahoAutocomplete and a basic vanilla js version of Prototype Effect
• Removed prototypejs/window.js (along many unused prototypejs subfiles) in favor of the new vanillajs/HTML5 maho-dialog.js
• The /errors folder doesn't exist anymore and it's replaced with mahoErrorReport()

New features

• Maho supports SVG format for product image placeholders
• Added ability to view orders paid with removed payment method without breaking
• TinyMCE WYSIWYG editor
  • TinyMCE is now optional and not required by the core anymore
  • The dependency has been moved to the Maho starter project. It was made this way so that you can remove it quickly and safely from your projects.
  • In the meanwhile we also fixed security vulnerability CVE-2024-29881.
• Added support for PHP 8.4, but also added PHP 8.3+ #[\Override] to all our codebase

Minor bugfix and changes

• Fixed a bug with swatches shown even for out-of-stock variants
• Removed obsolete Mage_All.xml and references to this file
• Adminhtml: Fixed active menu highlighting
• Web installer was simplified a restyled, removing a lot of unused files from the skin/install folder and some installation options that are no longer needed in 2024 (use_rewrites, enable_charts, skip_url_validation)
• phtml files now use short echo tags <?=
• Huge cleanup of old/unused files throughout the whole project
• Mage_Backup, Mage_Captcha and Mage_Sendfriend were removed, together with SCSS in RWD/admin themes
• In the backend, Magento1 theme is no longer available and the icons next to the page name were removed
• Redis modules are no longer required but only suggested

Upgrade from Magento1 or OpenMage

At the moment we don't have an upgrade script or an upgrade guide, we will work on both of them very soon.
Be sure to check all of the documentation we have at https://mahocommerce.com/getting-started