Shopware 6 Updates: An Overview of All Changes

What changes in day-to-day shop operations

• Rules once again consider all cart line items Since 6.7.14.0, rules in the Rule Builder that check the cart had only been considering normal products. If another line item was in the cart, such as a credit or a line item from a plugin, Shopware reported that shipping methods could disappear or promotions could fail to apply when the rule was phrased negatively, for example with “are none of”. Now the rules consider all line items again. Nothing needs to be changed in plugins.
• Theme files remain for a day after recompiling After recompiling a theme, for example during an update, Shopware could delete the previous theme files immediately. Pages that were still served from the cache or a CDN then no longer found their stylesheets and scripts. Now the old files remain for at least 24 hours after the switch before Shopware cleans them up.
• GARAN label in the order confirmation, third change in a row Shopware has once again reworked the technology behind the label in the email, according to the company so that it also works during a running update with servers operating in parallel. Shops with an unchanged standard template get this automatically. Anyone who has customised the template themselves must, according to Shopware, adjust it once more, see the developer section.
• Digital products: order quantity again follows the setting Since 6.7.14.0, customers could only buy one unit of a digital product per order, regardless of what was configured on the product. Now the maximum purchase quantity on the product applies again. Anyone who wants to stick with one unit enters 1 there.
• Sales channels of the product comparison type can be saved again Since 6.7.15.0, sales channels that are neither Storefront nor headless could no longer be saved if their default currency was not in the currency list. This works again now.
• Full guarantee notice in the checkout A new setting in the cart settings displays the statutory guarantee notice in the checkout as full text below the terms and conditions instead of just as a link. It is off by default and requires the notice to be switched on. The 6.6 series has had this since 6.6.10.28; you can find the background in the entry there. Merchants must assess for themselves whether and how this applies to their own shop.

What you should check before the update

• Digital products After the update, customers can once again buy more than one unit if no maximum purchase quantity of 1 is set on the product. Review this once beforehand.
• Customised rules Anyone who has reworked rules to work around missing shipping methods or blocked promotions should review them once after the update. The conditions now apply again as they did before 6.7.14.0.
• Custom order confirmation email Anyone who has maintained the template themselves must adjust the GARAN part again. With an unchanged standard template, nothing needs to be done.
• If you are still below 6.7.15.0 Go directly to 6.7.15.1 and observe the notes on the Administration rework from the entry for 6.7.15.0.

For developers and connected systems

• Rule Builder The line item conditions now evaluate a line item based on the data it carries, no longer based on its type. Since 6.7.14.0, custom and credit line items as well as line items from extensions were affected, according to Shopware for example under “Item with tag / All / Are none of”. Custom line item types work again without any adjustment.
• Theme directories Previously, the age of public/theme/ was counted from compilation, not from the switch; a theme compiled weeks ago was removed immediately during the next cleanup, and pages from the HTTP cache or CDN ran into 404s. The scheduled task theme.delete_files now works in two stages: first it marks an unused directory with a .retired file, provided all files are older than 24 hours, and in a later run it deletes it once the marking is at least 24 hours old; with the daily interval, this means 24 to 48 hours after the switch. A reactivated directory (for example theme:change --no-compile) loses the marking, and a directory with a running compilation remains untouched. theme:compile and theme:change no longer clean up themselves, which 6.7.14.0 had introduced; --no-cleanup is deprecated, has no effect, and will be removed with 6.8.0.0, so remove it from deploy scripts. Since cleanup now only runs via the scheduled task, as we read it, nothing happens without running scheduled tasks.
• GARAN in email templates The order confirmation reads the label from the new template variable garanLabels; the Twig filter sw_garan_label_mail from 6.7.15.0 is deprecated. In customised templates, replace nestedItem.productId|sw_garan_label_mail(context) with garanLabels[nestedItem.productId] ?? null, and in the text version replace lineItem.productId|sw_garan_label_mail(context) with garanLabels[lineItem.productId] ?? null. garanLabels is passed to every email template that references the variable and has an order in its data. According to the changelog file for the parallel 6.6 change, GaranLabelMailSubscriber sets the variable on MailBeforeValidateEvent, so that in a blue-green deployment templates do not need a filter that nodes with older code do not recognise; the filter therefore continues to work. A migration only rewrites the template in shops that have never edited it.
• Digital products maxPurchase applies again; if the value is missing, for example with products created via the API, core.cart.maxQuantity takes effect. For one unit per order, set maxPurchase to 1.
• Sales channels Types other than Storefront and headless (product comparison, Agentic Commerce, types from extensions) are no longer rejected with SYSTEM__NO_GIVEN_DEFAULT_CURRENCY_ID when the default currency is not in the currency list. Storefront and headless still require it.
• Guarantee notice New system configuration core.cart.showLegalGuaranteeNoticeInline, effective only when core.cart.showLegalGuaranteeNotice is active. Placement via the blocks page_checkout_confirm_legal_guarantee_notice_inline and page_checkout_confirm_legal_guarantee_notice_inline_bottom.
• Upgrade notes UPGRADE-6.7.md does not contain a dedicated section for 6.7.15.1.

What changes in day-to-day shop operations

• Umlauts in file names are preserved When uploading images and other media, Shopware previously removed umlauts and other special characters from the file name, turning “Erdmännchen.jpg” into “Erdmnnchen.jpg”. Now they are retained. Only invisible control characters are removed; Shopware rejects file names with broken character encoding.
• Umlauts in links and image addresses On some servers, Shopware converted umlauts in links and image addresses incorrectly, so the address was no longer correct. According to Shopware, the affected servers were those whose system library treats certain characters as control characters. This is fixed; addresses that have already been converted once are also not converted a second time.
• GARAN label in the order confirmation The same change as in 6.7.15.1: the mail template is shipped with the labels ready-made, so that, according to Shopware, the order confirmation goes out cleanly even when old and new servers run at the same time during an update. According to Shopware, the building block from 6.6.10.28 continues to work; however, Shopware recommends switching custom templates to the new variant, see the developer section. Shops with an unchanged default template receive this automatically.
• Redirects on app requests If an app's server forwarded a request from Shopware, Shopware, according to its own statement, carried over the parameters of the original request and thereby overwrote those of the target. Now Shopware leaves the redirect to the built-in default function for this, as already in the 6.7 line. This should only affect shops with apps whose servers forward requests.
• Log for system activities Shopware now records who creates users or integrations and who uploads, installs, updates, activates, deactivates or removes plugins and apps, in each case indicating whether a user, an integration or the system itself is behind it. Passwords and secret keys are not recorded. By default, the entries end up in the same logs as the previous events.

What you should check before the update

• Custom order confirmation mail If you have maintained the template yourself, adjust the GARAN part again after the update. If the default template is unchanged, nothing needs to be done.
• File names with umlauts New uploads keep their umlauts. If you have a connection that expects file names without umlauts, such as an export or an image synchronisation, check this beforehand.

For developers and connected systems

• URL encoding UrlEncodingTwigFilter::encodeUrl() (Twig filters sw_encode_url and sw_encode_media_url) parses URLs with GuzzleHttp\Psr7\Uri instead of parse_url(); on platforms whose libc treats the bytes 0x80 to 0x9F as control characters, characters such as Ä, Ö, Ü and ß became %C3_. Each path segment is decoded and re-encoded individually: no more double encoding, an encoded %2F stays in its segment, user information in the authority is preserved.
• Media file names MediaUploadController and MediaCreationSubscriber now only remove control characters and invisible Unicode format characters (zero-width space, soft hyphen, bidi overrides). Upload, renaming and name assignment reject file names that are not valid UTF-8 with CONTENT__MEDIA_ILLEGAL_FILE_NAME.
• GARAN in mail templates GaranLabelMailSubscriber passes the labels on MailBeforeValidateEvent as the variable garanLabels; the order confirmation reads from it, the filter sw_garan_label_mail continues to work. In custom templates, replace nestedItem.productId|sw_garan_label_mail(context) with garanLabels[nestedItem.productId] ?? null, and in the text version replace lineItem.productId|sw_garan_label_mail(context) with garanLabels[lineItem.productId] ?? null. garanLabels is passed to every mail template that references the variable and has an order in its data. Migration Migration1790751498ReadGaranLabelFromMailTemplateData only rewrites the template in shops that have never edited it.
• App system HTTP client According to the pull request, PinningAppSystemHttpClient followed redirects itself and in doing so reapplied the query option of the original request, which replaced the target's query. The middleware-based implementation from 6.7 has been backported to 6.6: Guzzle follows redirects natively, AppSystemHttpMiddleware checks and pins every request behind the redirect layer; the custom client is dropped, along with a new exception path for blocked requests and adjustments to the checking of trusted URLs and private IP addresses. No separate changelog file.
• System activities SystemActivitySubscriber logs on the Monolog channel system_activity at level info: creation of users and integrations, upload, installation, update, activation, deactivation and removal of plugins and apps. Actors are user (userId, username), integration (integrationAccessKey) or system for CLI and background jobs; plugin updates carry previousPluginVersion, app removal carries keepUserData; null fields, passwords and secret keys are absent. By default it is stored in log_entry via the buffered business event handler. Redirect in config/packages/monolog.yaml; if you only want to keep business events in the database, set the channels of the business_event_handler_buffer handler to ['business_events'].
• Upgrade notes UPGRADE-6.6.md contains only the GARAN section for 6.6.10.29.

What changes in day-to-day shop operations

• New look in the Administration The main menu, header and search bar have been reworked, as has the bar with the buttons at the top of each page. According to Shopware, spacing, font sizes and the grouping of menu items have been re-adjusted, and it is quicker to see which area you are currently in. On top of this there is a dark mode: in the profile settings you can, according to Shopware, choose between light, dark or the operating system default; Shopware describes the feature as experimental. What stands out immediately: the icons in the main menu and in the search results are no longer colourful as before, but monochrome. If you prefer the colourful icons, you can switch them back on in your own profile settings (setting for the module colours); this then applies only to your own user.
• GARAN label in the order confirmation now also in Gmail and Outlook Since 6.7.14.0 the label has been included in the order confirmation, but in a graphic format (SVG) that Gmail and Outlook do not display in mails. Now Shopware embeds the label as a regular image (PNG) in the mail. In addition, the label now has a fixed size and sits in the column with the item description of the respective order line item. Previously it was in its own row across the full width of the mail, and some mail clients, according to Shopware, enlarged it heavily and cut it off. The alternative text that mail clients show when images are not displayed is now translated instead of empty. As with 6.7.14.0, the following applies: Shopware only adjusts the mail template automatically if it has never been edited. Those using a custom template must adjust it themselves after the update, see the checklist and the developer section.
• Warranty duration limited to 50 years In the field for the warranty duration, any value above 24 months could previously be entered in half-year increments, even 500 years. Now, according to Shopware, a maximum of 600 months is permitted, and the input field in the Administration no longer allows anything else. Higher values already saved are retained, the label continues to be displayed. You only need to correct the value the next time you save the product.
• GARAN label: long details stay within the graphic Long texts, according to Shopware, did not always fit into the designated places on the label: a long manufacturer number ran over the edge on the right, a long brand name slipped into the model designation, and a warranty duration such as “2.5” lay over the calendar icon. Now the font is set narrower where needed so that the text fits within its area. Nothing changes about the label itself; its appearance is, according to Shopware, prescribed by the EU regulation. This fix does not appear in the detailed release information, only in the list of included changes.
• No more duplicate orders from a single cart If the same cart was submitted twice almost simultaneously, for example because the order completion page was open in two browser tabs or a click was repeated, two orders could previously be created. Shopware now checks again at completion whether the cart still exists at all, and rejects the second order. This is matched by a change on the product page: after being clicked, the buy button shows a small loading indicator and cannot be clicked again until the cart has been loaded. An impatient second click therefore no longer adds the product to the cart twice.
• Individual promotion codes are released again If you remove a promotion from an order or delete the order, the customer can use their individual code again. Since 6.7.0.0, an individual code that had been used once was permanently considered redeemed, even if you had removed the promotion from the order again. According to Shopware, this often happens when a payment fails and the order is reworked; previously you then had to generate a new code for the customer and send it. In 6.6 this had already worked, and now it works again.
• Second code of the same promotion If a customer enters a second individual code of the same promotion at checkout, previously either nothing happened at all, or a meaningless error message appeared. Now the second code is discarded, and the customer receives a clear note that a promotion applies only once per order. The note text is a snippet and can be customised.
• Order confirmation can be deselected for orders created in the Administration Anyone creating an order in the Administration will find a new toggle in the options step: send order confirmation to the customer, yes or no. It is enabled by default, so nothing changes unless you switch it off. When switched off, the order is created completely normally, only the mail to the customer is withheld. Orders that customers place themselves in the shop are not affected by this.
• Shipping costs: gross and net linked In the price matrix of a shipping method there is now, per currency, a single price field with gross and net instead of two separate number fields. Using the lock icon, both can be coupled: Shopware then calculates the net price from the gross price and the tax rate of the shipping method. New prices are coupled from the start, existing ones stay as they are saved.
• Managing several extensions at once Under “My extensions” you can now select several extensions and install, activate, deactivate, update or uninstall them in one step. Each action is only clickable if it makes sense for at least one of the selected extensions, and shows how many of them are affected. The same permissions apply as when editing a single extension. If you select nothing, you see the list as before.
• New document generation for testing Shopware has rebuilt the technology used to generate invoices, cancellation invoices, delivery notes and credit notes. From one document, according to Shopware, several file formats are created at once: HTML, PDF, ZUGFeRD XML and PDF with embedded ZUGFeRD XML, all from the same data and with the same document number. Which formats you need, you define per document type. ZUGFeRD is thus no longer its own document type, but a format of invoice, cancellation invoice and credit note. With each generation Shopware remembers the state of the order, so a document always shows what was in the order at that point in time. The company details on the documents (name, address, tax and bank data, logo) move to a new area under Settings > Basic information and apply there per sales channel instead of per document type. The previous details are not transferred automatically. As long as the new area is empty, Shopware continues to use the old details from the document settings; but as soon as even a single field is filled in, Shopware, by its own account, ignores the old details completely. So anyone starting out should fill in the area completely right away. If name, street, postcode, city or country is missing, Shopware aborts with an understandable error message instead of creating an incomplete document. Important: all of this is only active if a developer switches it on via configuration (feature flag). Otherwise everything works as before, and according to Shopware you can go back again at any time. The schedule according to Shopware: optional in 6.7, standard with 6.8, with 6.9 the old generation will be removed. In our assessment this is not yet anything for the live shop, but it is for a first look on a staging system.
• Dynamic product groups follow every change to the conditions Previously, Shopware only recompiled the products of a group when a condition was added, not when one was deleted, changed or moved. As a result, rules, promotions and product exports might work with an outdated state of the group. Now the group is recompiled with every change. A group without conditions is therefore empty, and a product export for such a group aborts instead of exporting the old state.
• Product path despite a hidden category The path information at the top of the product page (breadcrumb) appears again, even if the product's main category, or its only category, is hidden in the navigation. The setting now only hides the category in the menu, no longer in the path. If there are several categories, Shopware still prefers a visible one; inactive categories are left out.
• Translations of app payment methods are retained If you have translated the name or description of a payment method that comes from an app yourself, an app update no longer overwrites these texts. The texts from the app are now only used for languages for which you have not stored your own translation.
• Empty fields can be saved Some fields are allowed to be empty but could not be cleared in the Administration: when saving, the message appeared that the value must not be null. This affects snippets, including those from apps: a cleared snippet now saves an empty value instead of an error.
• Update wizard recommends the Shopware CLI The update wizard in the Administration now asks for the update method before the web installer starts. Shopware recommends the command line (Shopware CLI) for developers and for managed hosting environments; the web installer remains available, however. On systems with several servers (clusters), Shopware no longer offers the web installer. Anyone who applies updates via the command line or an automated workflow anyway can have the update menu item, including the note about an available update, hidden entirely, see the developer section.
• Customer import checks the customer number When importing customers, Shopware now checks whether the customer number matches the pattern of the number range in the respective sales channel. Rows where this does not match are rejected and end up in the file with the faulty records. So before an import, adjust either the numbers in the file or the pattern in the number range.
• Checkout and customer account The browser now checks postcodes immediately on submitting the form against the pattern stored for the country; previously the message only appeared once the rest of the form was in order. The ticks for the terms and conditions and the right of withdrawal and the customer's comment are retained when a page in the checkout reloads, for example after changing the payment method. If the customer closes the browser, they are gone; previously they were stored permanently. They are also deleted as soon as the cart is emptied, the order completed or the customer logged out. And anyone who changes the payment method of an existing order in the customer account now sees the payment method of that order preselected there, and no longer the one last used in the shop.
• Privacy and warranty notices If you do not require a mandatory checkbox for privacy in the settings, the privacy notices on contact and newsletter forms and on forms with terms and conditions consent are now phrased as a plain notice and no longer as if the customer had actively consented. The statutory warranty notice now also appears, according to Shopware, provided it is switched on, below forms where the customer confirms the terms and conditions, for example at registration, and this applies regardless of whether the privacy checkbox is mandatory. In the checkout, the terms and conditions text and the warranty notice are now two separate snippets instead of one shared one. Anyone who had customised the shared snippet must transfer the customisation, see the checklist.
• Product page, cart and search engines For the essential characteristics in the cart, custom fields of the types selection, entity selection and price are now also displayed. Anyone who changes the quantity in the cart with the arrow keys no longer triggers a reload with every keystroke, but only when leaving the field or confirming with Enter. And search engines may now also retrieve the scaled-down product images (thumbnails); the default robots.txt file permits this.

Shopware Commercial Features

• Product Bundles The feature has, according to Shopware, left the beta phase. Customers can select the appropriate variant within a bundle and adjust the quantity of individual bundle items.
• Copilot The “Copilot Agentic” mode has, according to Shopware, left the beta phase and now also supports Advanced Search, B2B Budget Management, B2B Advanced Product Catalogs, Dynamic Access, Multi-Warehouse, Subscriptions and Product Bundles. Copilot can, according to Shopware, be assigned to specific user roles. Plugins and apps can, according to Shopware, make their functions available to Copilot via the MCP interface.
• Shopware Analytics With “Copilot Data Insights” you ask Copilot, according to Shopware, in plain language for a metric, transfer the result into the dashboard and compose your own dashboards from it.
• 3D files 3D files are, according to Shopware, automatically reduced in size on upload without any loss of quality; together with the 3D Preview Generator they are intended to load faster in the Storefront as a result.

What you should check before updating

• Extensions that intervene in the main menu, the header or the search bar With the rebuild, Shopware has removed some places where plugins could previously hook in, and dropped parts of the styling. Plugins that introduce their own menu items or their own appearance there, for example an entry in the user menu at the bottom of the sidebar, can, according to Shopware, look broken or lose their styling after the update. Before the update, ask the provider for a version for 6.7.15.0 and click through the Administration completely once in the staging environment.
• Custom order confirmation mail If the template has ever been edited, the GARAN label within it stays as it was: without a fixed size and in a format that Gmail and Outlook do not display. Anyone who also wants to show the label to Gmail and Outlook recipients should replace the section in the template after the update, see the developer section.
• Customised snippets and theme templates in the checkout The shared snippet for terms and conditions and the warranty notice has been replaced by two separate ones; anyone who had customised the old one loses that customisation after the update. For the privacy notices without a checkbox there are new snippets. And themes that build the country selection in address forms themselves lose the new browser-side postcode check if they are not updated accordingly. Details in the developer section.
• Dynamic product groups Because Shopware now also recompiles the groups after deleted or changed conditions, different products may be in a group after the update than before, and this also changes what rules, promotions and product exports do with that group. Groups without valid conditions are empty, exports for them abort. After the update, take a look at the most important groups and exports once.
• Themes with multi-level inheritance If your theme builds on several other themes, it now inherits the snippets from all of them. If one of the themes in between has defined a text that previously fell by the wayside, this text may change in the Storefront.
• Customer import Before the next import, check the customer numbers against the pattern of the number range, otherwise the rows end up in the error file.

For developers and connected systems

• Document generation v2 Active only with the feature flag DOCUMENT_GENERATION_REWORK; the flag switches over all of Shopware's own paths (the document area of the order, Flow Builder actions, mail attachments, bulk editing, download routes for customers). New routes under /api/_action/order/document-v2/ (create, upload, preview, download/{format}, download-archive, available-types) are reachable independently of the flag. Plugins register types, data providers and renderers via the tags shopware.document_v2.type, shopware.document_v2.provider and shopware.document_v2.renderer; the old tags document.renderer and document_type.renderer and decorators of the old DocumentGenerator are not called by v2. Twig overrides of @Framework/documents/*.html.twig continue to work. New events document.generation.completed and document.generation.deleted, both selectable as triggers in the Flow Builder and for the old as well as the new pipeline. Apps register document types via the manifest block , plus a script hook document-generation. Company details are in the configuration domain core.basicInformation per sales channel; if mandatory fields are missing, the generation responds with DOCUMENT_V2__CONFIG_MISSING_REQUIRED_FIELDS. Duplicate file name infixes are rejected with DOCUMENT_BASE_CONFIG_DUPLICATE_FILENAME_INFIX. document.orderId and orderVersionId are now optional. The old classes under Shopware\Core\Checkout\Document carry the new attribute #[ExperimentalReplacement] (not yet deprecation), the admin services and modals of the old generation as well as the entities document_type and document_type_translation are already marked with @deprecated tag:v6.9.0.
• Admin interface Removed Twig blocks in sw-admin-menu (among others sw_admin_menu_toggle_sidebar* as well as sw_admin_menu_user_actions, _user_actions_label and _user_actions_list), sw-admin-menu-item, sw-version, sw-search-bar (sw_search_bar_version_display) and sw-sales-channel-menu. sw_admin_menu_user_actions_items now renders in an mt-action-menu; overrides with must be switched to mt-action-menu-group and mt-action-menu-item. In sw-page there is the new block sw_page_top_bar, sw_page_top_bar_actions is no longer in sw_page_search_bar, and the smart bar is now a
  . The CSS for .smart-bar__back-btn is gone. sw-page and sw-meteor-page are CSS containers (container-type: inline-size), so position: fixed in plugin content refers to the page instead of the window. ui.sidebar.close() in the Extension SDK closes asynchronously with an animation of around 400 ms. The snippet global.sidebar.buttonCollapse and the asset static/img/error-pages/app-error.svg have been removed. The module colour from Module.register() is still evaluated, but only if the user has switched on the module colours (core.userModuleIconColors).
• Price matrix of the shipping methods sw-price-field per currency instead of two number fields. Overrides of sw_settings_shipping_price_matrix_price_grid_currencies_list and styles for the removed class .sw-settings-shipping-price-matrix__price-input must be adjusted; the name attributes of the input fields are unchanged.
• Browser login for CLI tools The Admin API supports the OAuth 2.0 authorization code grant with PKCE for registered public clients. New routes GET /api/oauth/authorize, GET /api/oauth/authorize/info and POST /api/oauth/authorize, plus grant_type=authorization_code at POST /api/oauth/token; codes are single-use, refresh tokens rotate. The consent page is in the Administration under #/oauth/authorize. shopware-cli is pre-registered as a client, your own clients go under shopware.api.oauth_clients, the lifetime of the codes is controlled by shopware.api.auth_code_ttl (default PT5M). Decorators of ClientRepository or ScopeRepository should be aware of the new grant.
• MCP Toolsets can be named in the URL when connecting (/api/_mcp?toolsets=order,media or all); this only changes the visibility, not the permissions. Shopware runs on symfony/mcp-bundle 0.13 with mcp/sdk 0.8, both servers are registered declaratively. The tags shopware.mcp.* and shopware.store_api_mcp.* remain, the flat service IDs are gone: mcp.server is now called mcp.server.admin and mcp.server.store_api respectively, similarly .builder, .registry and .session.store. Request handlers for the Admin API attach to mcp.admin.request_handler, a handler on the global mcp.request_handler reaches no server. discovery.scan_dirs and mcp.pagination_limit have been removed (now shopware.mcp.pagination_limit), the bundle-side command is called debug:mcp:native. Store API sessions from before the update are not carried over, clients initialise once anew.
• Cart and checkout POST /store-api/checkout/order checks within the lock whether the cart is still saved, and otherwise responds with 404 CHECKOUT__CART_TOKEN_NOT_FOUND. AbstractCartPersister has been given exists() for this, with a default implementation that becomes abstract from 6.8.0.0: adjust your own persisters before the change. GET|POST /store-api/checkout/cart no longer loads the cart twice, CartLoadedEvent fires once; CartLoadRoute::load() takes the cart as an optional third argument, decorators should pass it through. New error code CHECKOUT__CART_INVALID_CHILD_LINE_ITEM_QUANTITY for invalid quantities of sub-items. The helper methods of PromotionCartInformationTrait are deprecated, use $cart->addErrors() instead. POST /api/_action/order/{orderId}/product/{productId} builds the line item via the LineItemFactoryRegistry, so decorators of a LineItemFactoryInterface also take effect when adding to existing orders.
• Store API and caching sw-include-seo-urls is now part of Vary and of the cache key; custom cache keys should add the header. With the header, the SEO URLs of headless sales channels now also come through. sw-currency-id is checked against availability in the sales channel; an outdated stored language or currency of a context token is discarded and replaced by the default. With CACHE_REWORK active, cacheable read responses no longer return the sw-context-token, clients keep their token as long as no response explicitly delivers one. Also with CACHE_REWORK, cacheable responses send No-Vary-Search: key-order; the value is configurable per policy under headers.no_vary_search, parameters that change the content (p, order, search, filters) must never be listed there. The routes under /api/_action/sales-channel-file/ require sales_channel_file:read, unsaved overrides additionally sales_channel_file:update. The time limits for media uploads via URL and external media links are configurable via shopware.media.url_upload_timeout and shopware.media.external_link_timeout.
• GARAN label in the mail In a customised order confirmation, replace the label row from 6.7.14.0 with the markup from src/Core/Migration/Fixtures/mails/order_confirmation_mail/en-html.html.twig and swap sw_garan_label_nested_uri for the new filter sw_garan_label_mail; the filter only exists from 6.7.15.0 onwards, so only touch the template after the update. The migration only rewrites the template in shops that have never edited it. Document generation v2, according to the upgrade notes, additionally stores an HTML version of every document, even if only PDF was requested.
• Storefront templates and snippets checkout.confirmTermsTextModalWithGuarantee is replaced by checkout.confirmTermsTextModal and checkout.confirmLegalGuaranteeNotice. Passive privacy notices use contact.privacyNoticeInformation and general.privacyNoticeInformation (plus the *TextModal variants), registration and checkout registration use account.registerSubmit and checkout.registerSubmit. The note for the second promotion code is called checkout.promotion-not-eligible-already-added. The checkout details are in the session storage, the plugin CheckoutCustomerStorageReset attaches to data-checkout-customer-storage-reset; themes that replace the emptied cart, the order confirmation page or the login page should keep the attribute. The country option needs data-zipcode-pattern and data-check-zipcode-pattern. The payment method on /account/order/edit/{orderId} comes from page.selectedPaymentMethodId, the context switch via frontend.account.edit-order.change-payment-method is deprecated. AddToCartPlugin knows loadingIndicatorPosition and the event removeLoader. Essential characteristics deliver an optional key display in the payload, only for line items after the update. With 6.8.0.0 the footer gets semantic elements (h2, ul, li). Themes with several ancestors in configInheritance inherit all snippets; theme.parent_theme_id points to the nearest ancestor, theme:refresh applies this. Theme compilation with StaticFileConfigLoader reads runtime values if a database is reachable, and runs without otherwise. robots.txt contains Allow: /thumbnail/*?ts=.
• Translations and installation translation:install --all no longer installs pseudo languages; an existing “Acholi (Pseudo Language)” can be removed in the Administration or via DELETE /api/_action/translation/{locale}. New is --offline, which creates languages from files already present without contacting the translation repository. The command now also creates the language and snippet set when the files are up to date, and exits with an error code if none of the requested languages can be installed; scripts that check the exit code are affected. system:install triggers SystemInstallCompletedEvent, upon which the Elasticsearch bundle creates empty indices and aliases, provided Elasticsearch indexing is active and the cluster is reachable.
• Database and state machine With configured replicas, the connection switches back to the replica between requests, even in long-lived runtimes such as FrankenPHP worker mode; a worker can thereby hold two open connections, ?keepReplica=0 on the DATABASE_URL restores the old behaviour. Several transitions with the same action name and initial status now resolve deterministically to the oldest transition; such duplicates are deprecated and will be removed with 6.8.0.0 and prevented by a unique constraint. Tags of orders and categories are now versioned; direct write accesses to order_tag and category_tag without a version ID hit the live version.
• Further extension points ProductConfiguratorLoader::loadFromCombinations(), CorsHeaderProviderInterface (tag shopware.api.cors_header_provider) for your own CORS headers, IdSearchResult::getPrimaryKeyData(), JsonField::addPropertyMapping() for entity extensions, ProductListingCollectSortingEvent for registering sortings at runtime, AbstractIncrementStorage::increaseToAtLeast(), country.advancedPostalCodePattern with up to 1024 characters. The new attribute #[ExperimentalReplacement] replaces the premature deprecation of classes whose successor is still experimental; the class Feature becomes final with 6.8.0.0. MailService now sets the translator to the sales channel of the mail itself; anyone who replaces AbstractMailService without calling the decorated service must reproduce this. Storefront snippets of apps are written into the translation file system on installation, changed texts only arrive after app:refresh with an increased manifest version.
• Hosting and app system Sitemaps are also generated for headless sales channels with an external Storefront domain; sitemap:generate again skips a channel that is currently locked with a message, instead of aborting. shopware.auto_update.hide_module: true (or SHOPWARE_AUTO_UPDATE_HIDE_MODULE=1) removes the update module including the note, the update endpoints then respond with 403; on cluster systems download-recovery also responds with 403. With the new option shopware.app_system.enable_url_validation: false, the target check for apps and webhooks can be switched off (HTTPS requirement, private networks, DNS pinning); the default is true, the development environment ships with false, in production the check stays on. The editor support for components in the native setup (.vue with script setup) now comes from composer admin:setup-extension-tooling, the copied workspace templates have been removed.

What changes in everyday shop operations

• GARAN label in the order confirmation now in Gmail and Outlook too Previously the label was embedded in the email in a graphics format (SVG) that, according to Shopware, Gmail and Outlook do not display. Shopware now embeds it as a regular image (PNG). The warranty period is also included as text: in the alternative text that mail clients show without image display, and in the plain-text version of the email. As with the previous GARAN changes, the following applies: Shopware only adjusts the template during the update if it has never been edited. Anyone maintaining their own order confirmation must replace the block themselves after the update, see the developer section.
• Warranty notice optionally as full text in the checkout With a new setting in the cart settings, the statutory warranty notice appears in the checkout as full text below the terms and conditions, instead of just as a link that opens a window with the text. According to Shopware, the link remains the default. The setting only takes effect if the warranty notice is enabled overall. According to the associated bug report at Shopware, the trigger was an assessment by the Händlerbund, according to which a mere link to the notice in the ordering process is not sufficient; merchants must assess for themselves whether and how this applies to their own shop. According to GitHub, the 6.7 line only receives this change with 6.7.16.0; it is not yet included in 6.7.15.0.
• Warranty notice also during registration If the notice is enabled, according to Shopware it now also appears below the registration form next to the privacy notice, as a short paragraph with the same link and window as in the checkout. This applies regardless of whether the privacy checkbox is mandatory.
• GARAN label: long entries stay within the graphic According to Shopware, long texts did not always fit into the designated areas on the label: a long manufacturer number extended beyond the right-hand edge, a long brand name slipped into the model designation, and a warranty period such as “2.5” overlapped the calendar icon. The font is now set narrower where necessary so that the text fits into its area; the model designation is not truncated in the process. The label itself does not change, as its appearance is prescribed by the EU regulation, according to Shopware. With very long entries, however, Shopware cites a period of “25.5” as an example, the narrower font is clearly visible.
• Filtered product lists show a matching variant If a customer filters a product list, for example by a property such as colour, by price or by manufacturer, Shopware now only shows the defined main variant for products with variants if it matches all set filters. If it does not match, a variant that does match is shown instead. Products for which the main product should be displayed in lists continue to show the main product. The setting with which Shopware shows the best-matching variant in search results again applies only to the search. If it is enabled, according to Shopware a filtered list additionally prefers to show the matching main variant or the main product rather than just any matching variant. The label and help text of the setting have been adjusted accordingly. According to GitHub, the 6.7 line only receives this change with 6.7.16.0; it is not yet included in 6.7.15.0.
• “Save and duplicate” with new products When creating a new product, the Administration already shows a provisional product number. According to Shopware, anyone who clicked “Save and duplicate” before the product had been saved for the first time could, under certain circumstances, receive an error message about a duplicate product number, because the copy received the same number. Shopware now first saves the original with a final number and assigns a second one to the copy.
• Rating stars no longer cover the product name In the product tiles, the area with the rating stars had a fixed height, according to Shopware. Anyone who greatly enlarges the font in the browser, for example to 200 percent, got larger stars but no larger area: the stars then overlapped the product name. The area now grows along with it.

What you should check before updating

• Custom order confirmation email Anyone using their own template who does not replace the block will continue not to see the label in Gmail and Outlook. Replace the block right after the update, not before: before the update, Shopware does not yet know the new block. Details in the developer section.
• Product lists with variants and filters Anyone who relied on the defined main variant always appearing in filtered lists may see other variants there after the update. After the update, click through a category with variants, set a few filters and check whether the setting for the best variant still fits; it now only concerns the search.
• Theme adjustments to the privacy block Anyone who has overridden the template of the privacy notice in the theme may, under certain circumstances, not see the warranty notice during registration. Details in the developer section.

For developers and connected systems

• GARAN label in the email New are GaranLabelInlineImage, which assembles the label as a PNG from the artwork under src/Core/Framework/Resources/garan, and GaranLabelMailSubscriber, which attaches the referenced label PNGs as inline parts on MailBeforeSentEvent. The new Twig filter sw_garan_label_mail returns the cid reference of the image and the formatted warranty period. In a customised order confirmation, sw_garan_label_nested_uri must be replaced by sw_garan_label_mail after the update (beforehand Shopware does not know the filter); the template is src/Core/Migration/Fixtures/mails/order_confirmation_mail/en-html.html.twig. The migration Migration1790078381EmbedGaranLabelInOrderConfirmationMail only rewrites the template in shops that have never edited it.
• Warranty notice New system configuration core.cart.showLegalGuaranteeNoticeInline, effective only when core.cart.showLegalGuaranteeNotice is active. In component/privacy-notice.html.twig there are the new blocks component_privacy_legal_guarantee_notice_paragraph, component_privacy_legal_guarantee_notice_modal, component_privacy_legal_guarantee_notice_modal_header and component_privacy_legal_guarantee_notice_modal_body; themes that completely replace the template must bring these across.
• Listing ProductListingLoader shows the main variant in filtered lists only if it satisfies all active filters; shouldLoadPreviews() has been changed so that core.listing.findBestVariant again only affects search results. LoadPreviewExtension has received the optional property postFilters, so that extensions replacing the preview resolution can apply the same rule. The label and help text in src/Core/System/Resources/config/listing.xml have been adjusted.
• GARAN artwork According to the pull request, the text adjustment in the Twig templates is calculated via the SVG attribute textLength rather than in the PHP renderer, so that the SVG embedded directly in the Storefront also benefits from it; textLength is only set if a value would otherwise overflow, along with a clip path per field.
• Duplicating a product According to the pull request, the product detail page passes the provisional number on to the clone modal, reserves a real number for the original first if required and only then a second one for the copy; the previous error was CONTENT__DUPLICATE_PRODUCT_NUMBER.
• Rating stars .product-rating uses min-height instead of height. Backport of #20929.

What changes in day-to-day shop operations

• Products and promotions can be duplicated again When duplicating, the Administration sent along values that Shopware has been checking against write protection since the security update of 16 September: the number of variants for the product, and the counters for how often the promotion has been redeemed in total and per customer. The copy could therefore be rejected with an error. Duplication now goes through again. According to Shopware, the product copy retains the correct variant count, and a duplicated promotion starts with zero total redemptions and no per-customer redemptions, instead of inheriting the counter value from the original. This answers the question from our entries on 6.7.14.2 and 6.6.10.26: the 6.6 series was equally affected by the bug.
• GARAN label in the order history In the order overview of the customer account, the label previously accessed a reference that could run into nothing for order line items. According to Shopware, an invalid reference could render the order history unusable. For order line items, the product ID is now used, while in the cart the previous reference remains. Order line items without a linked product, for example after an item has been deleted, do not show a label.
• Twig 3.29 Shopware ensures compatibility with the new Twig version. After the dependency issues around 6.6.10.24, this is the second Twig item within a week.

What you should check before the update

• Those on 6.6.10.25 or 6.6.10.26 Duplicating products and promotions can fail there, and customers with a GARAN product in an order may under certain circumstances be unable to open their order history. Both argue against waiting for the next maintenance window. The release contains only three changes, so the risk should be correspondingly small.
• Those still below 6.6.10.25 Go straight to 6.6.10.27. This version includes the GARAN labelling from 6.6.10.24, the security update of 16 September, the improvements from 6.6.10.26 and the two fixes from here.
• Custom templates for order line items Anyone who has overridden the template for the GARAN label on order line items should carry the change over. Details in the developer section.

For developers and connected systems

• Cloning Write-protected derived fields (childCount on the product, orderCount and ordersPerCustomerCount on the promotion) are no longer rejected as an invalid override during cloning. This is the backport of #20575, which was shipped in 6.7 with 6.7.14.2.
• GARAN template storefront/component/line-item/element/garan-label.html.twig now uses productId for order line items and continues to use referencedId for cart line items. Order line items without a linked product omit the label.
• Twig Compatibility with twig/twig 3.29 established. Together with the minimum version of squirrelphp/twig-php-syntax raised in 6.6.10.26 (^1.13.0), the package conflicts from September should now be resolved.

What changes in day-to-day shop operations

• Products can be duplicated again When duplicating, the Administration previously sent along the number of variants, a value that Shopware has been checking against write protection since the security update. The copy was therefore rejected with an error. Duplicating now works again, and according to Shopware the copy retains the correct variant count.
• Promotions can be duplicated again, and the copy starts from zero The same error affected promotions, here via the counters for how often a promotion was redeemed in total and per customer. Duplicating works again, and in the process one behaviour changes: a duplicated promotion no longer carries over the original's redemptions, but starts with zero redemptions in total and no redemptions per customer. Previously the copy inherited the counter value.

What you should check before the update

• If you are on 6.7.14.1 As long as the update has not been applied, duplicating products and promotions may fail. If you rely on this function in your daily work, you should not wait for the next maintenance window. The release contains only this one change, so the risk should be correspondingly small.
• If you are still below 6.7.14.1 Go straight to 6.7.14.2. This version includes the security update from 16 September, the GARAN labelling from 6.7.14.0, and the fix for duplicating.
• 6.6 line The security update 6.6.10.25 contains the same safeguard for duplicating. Whether the same error occurs there has not been documented by Shopware so far, and no corrected 6.6 version is available. If you are on 6.6.10.25, you should try duplicating once.

For developers and connected systems

• Cause according to Shopware Overrides passed in during cloning are checked against the write protection of the DAL before insertion. The Administration continued to send childCount on the product as well as orderCount and ordersPerCustomerCount on the promotion as overrides, which led to a violation of the write restriction.
• New field flag ResetOnClone A DAL field marked with it is skipped during the automatic copying of the clone data and falls back to the database default value; explicit overrides remain subject to the normal write protection. The promotion's orderCount and ordersPerCustomerCount now carry the flag. childCount on the product is still copied internally by the backend.
• Interfaces The Administration no longer sends the protected fields as overrides. According to the automatic check in the pull request, the schema of the Store API and Admin API remains unchanged. Anyone who clones via the Admin API themselves and sends along protected fields will still run into the error; this is intended.

What changes in day-to-day shop operations

• Twig bug after 6.6.10.24 fixed Shopware raises the minimum version of the package squirrelphp/twig-php-syntax to 1.13, because older versions are incompatible with the Twig versions required by Shopware. In our assessment, this resolves the bug report we mentioned in the entry on 6.6.10.24. Anyone who postponed the update because of it can now proceed.
• GARAN label in the order confirmation The label introduced with 6.6.10.24 appeared in the order confirmation email on its own line without any size information. According to Shopware, mail programs scaled it to the full width and cut it off. It now has fixed dimensions, an alternative text and sits next to the order line item. As with the original change, the following applies: the migration only adjusts templates that have never been edited. Anyone who maintains their own order confirmation and adopted the label must swap out the section themselves. And a note Shopware itself provides: Gmail and Outlook do not display the label in the email at all, because it is stored as an embedded SVG graphic. There, only the alternative text appears; in the Storefront and in the customer account the label remains visible.
• GARAN warranty duration capped and missing details made visible The warranty duration is now capped at a maximum of 600 months; previously any value above 24 months could be saved. Higher values already saved remain in place and only need correcting the next time the product is saved. There is also a new notice in the product: if the label is enabled for the Storefront, a banner lists which requirements are still missing, namely a warranty duration between 30 and 600 months in increments of six, manufacturer and manufacturer number. Unlike in 6.7, the input field itself deliberately does not cap the value, because in 6.6 the field would otherwise silently truncate entries.
• GARAN label inherited by variants Previously, variants did not adopt the “show label in the Storefront” setting from the main product, because the database column always carried its own value. After the migration, variants without their own setting inherit the value from the main product, just as they already did with the warranty duration. Variants where the label was explicitly switched off keep that setting. Anyone who relied on variants never showing the label while the main product shows it must now switch off the toggle on those variants.
• Quantities in the cart A typed-in quantity is now applied as soon as the field is left or the Enter key is pressed, instead of with a delay while typing. The plus and minus buttons retain the usual delay. In the off-canvas cart, the focus jumps back to the quantity field after a change.
• Additional cart fields The fields for product number and promotion code in the cart are no longer marked as required fields, the product number field has a visible label, and a field submitted empty gets a message instead of an empty search.
• Vimeo videos require their own consent Vimeo videos in Shopping Experiences previously depended on the YouTube cookie. There is now a dedicated Vimeo cookie, and videos load immediately after consent. Visitors who only consented to the YouTube cookie must consent to the Vimeo cookie once before Vimeo videos reappear.
• Product boxes with headings The product name in product listings can now be output as a heading, and the level can be selected in the Shopping Experiences element for product listings. Newly created elements use an H2 by default. Existing elements retain their previous output until the layout is saved again in the Administration.
• Filtered listings The setting for whether the best-matching variant is shown in listings now also applies to listings filtered by variant options or properties. When it is switched off, the Storefront display configured in the product (main variant or main product) is retained. The label and help text of the setting have been adjusted accordingly.
• Accessibility Another large block. Payment and shipping methods in the checkout are marked as groups, rating stars and the review form can be used with screen readers and the keyboard, timestamps on reviews have more contrast, the buttons in the cookie notice remain usable at high zoom levels, dialogues and off-canvas areas keep the focus, the address window in the checkout can be scrolled on small screens, the purchase area and the search field report correctly to assistive technology, and the line-item tables in plain-text emails are more readable.
• Minor items The wishlist gets its own cookie window. Emails carry a language declaration in the header. The file type of mail attachments is corrected.

What you should check before updating

• MySQL 8.4 Shopware now catches an error that could cause migrations on MySQL 8.4 to fail when a foreign key points to a non-unique column of the product table. According to Shopware, the statement is retried once with a relaxed check. On MariaDB and older MySQL versions nothing changes. Anyone who aborted an update to 6.6.10.24 or 6.6.10.25 because of a migration error has the likely reason here.
• Custom order confirmation email See above; the label must be swapped out by hand if the template has been edited.
• Variants with a GARAN label After the migration, check whether variants now show the label where this is not intended.
• Vimeo in custom theme overrides Anyone who overrides the Twig block for the Vimeo element must enter the new cookie name, otherwise the element stays tied to the YouTube cookie. Details in the developer section.
• Duplicating products and promotions The fix from 6.7.14.2 is not part of this release. Shopware has still not documented whether the 6.6 series is affected by the bug. After the update, try it out once.
• Connected systems that write roles via the API The roles interface now validates nested changes to users and integrations against the caller's permissions. A client needs the respective user or integration permissions for this. Shopware lists the item as a fix; there is no advisory on it.

For developers and connected systems

• Twig Minimum version of squirrelphp/twig-php-syntax raised from ^1.11.0 to ^1.13.0; older versions override Twig internals with signatures that do not match twig/twig ^3.26.0.
• MySQL 8.4 New class NonStandardFkGuard executes migration DDL and retries it once with a relaxed restrict_fk_on_non_standard_key when MySQL 8.4 rejects the statement due to MySQL bug 118151. Custom migrations can route raw DDL through the guard via MigrationStep::executeDdlStatement(); the method is marked as internal because it will be removed once MySQL fixes the bug. A PHPStan rule flags raw ALTER TABLE, CREATE INDEX and DROP INDEX calls in core migrations.
• GARAN GaranLabelProductValidator rejects guaranteeMonths above 600 with the existing error code INVALID_GARAN_GUARANTEE_MONTHS. New block sw_product_guarantee_form_requirements_notice in the form, new event sw-product-detail-save-success on the admin event bus. Migration Migration1788531955MakeProductGuaranteeConfirmedInheritable makes product.guarantee_confirmed nullable, sets variants with the default value 0 to NULL and queues the product indexer. Migration Migration1788531858FixGaranLabelInOrderConfirmationMail re-imports the mail template only for unedited templates; for customised templates, replace the line with the markup from src/Core/Migration/Fixtures/mails/order_confirmation_mail/en-html.html.twig.
• Vimeo New cookie entry vimeo-video in the CookieProvider. Anyone who overrides element_vimeo_video_inner adds cookieName: 'vimeo-video' in the pluginConfiguration. CmsGdprVideoElement._replaceElementWithVideo() now replaces the placeholder only if the cookie named in options.cookieName is set; consent integrations that trigger the CmsGdprVideoElement_replaceElementWithVideo event must set the cookie beforehand.
• Quantity field Custom change listeners on the quantity form receive the final value on blur or Enter; on cart quantity fields the events carry detail.submitImmediately: true. New option submitOnFinish, new methods cancel() and flush() on the return values of Debouncer.debounce().
• Themes DatabaseSalesChannelThemeLoader now resolves the themes in use from parent_theme_id and the configInheritance list; a theme with multiple ancestors in the theme.json receives the snippets of all of them.
• Product listings New element configuration boxHeadlineLevel on the listing element; ProductListingLoader::shouldLoadPreviews() follows core.listing.findBestVariant, and hasOptionFilter() also detects post-filters on properties.id and propertyIds.
• Store API Products with mixed custom fields (price and scalar fields) are encoded consistently regardless of the order.
• ACL role routes Nested write operations on users and integrations are validated with the caller's permissions.

What you should check before the update

• Apps and connected systems that use webhooks Webhooks are automatic notifications that Shopware sends to other systems on certain events. Four events are no longer reported: the request for a new password for administrators and for customers, as well as the two mail events before sending and after creating a message. All four remain available in the Flow Builder. According to Shopware, apps that react to one of these events can still be installed and updated up to 6.8, but will receive a notice that this will no longer be possible from 6.8. In addition, three values are now missing from the data that other notifications carry along: the customer session identifier at login, the confirmation link for double opt-in, and the link for the newsletter sign-up. Anyone who has processed these values in a connected system will have to make changes.
• Tools that duplicate users or integrations Users and integrations can no longer be duplicated via the Admin API. Such calls receive a 403 error.
• Headless frontends with custom evaluations On request, the Store API returns evaluations alongside a query, which Shopware calls aggregations, for example counts per filter value. The names of such evaluations and the labels of value ranges within them may no longer contain a backtick, question mark, colon or control characters. Such requests are rejected with a 400 error.
• Newsletter integrations If double opt-in is configured, a sign-up only becomes active after confirmation. Integrations that have previously activated recipients directly via the Store API should no longer exhibit this behaviour after the update.

The critical vulnerability

• Webhooks revealed more than the recipient was permitted to see – critical, CVSS 9.6 Shopware did not consistently check with webhooks whether the person who set up the notification was even permitted to see the event's data. A user or integration with the permission to create webhooks could thereby obtain customer, order and email data, as well as data from flows in the shop, that exceeded their own permissions. According to Shopware, in some cases this also included details that can be used to reset passwords, which could enable further account takeovers. Webhooks are now checked against the permissions of their creator, the owner and permissions of a webhook can no longer be changed without authorisation, and the events and values mentioned above no longer go to webhooks at all. According to Shopware, the issue was found internally.

The other four vulnerabilities

• Database readable via the Store API – high, CVSS 8.6 A Store API call without authentication could, via insufficiently checked evaluations (aggregations), alter database queries so that arbitrary data could be read from the database; the technical term for this is SQL injection. According to Shopware, the prerequisite is a PHP version prior to 8.4 together with a setting of the PHP database driver in which PHP assembles the queries itself rather than having them prepared by the database. According to Shopware, write access could not be demonstrated. In August, Shopware had already closed a similar vulnerability at the same location. In our assessment, this is a second variant of it.
• From restricted user to administrator – high, CVSS 8.1 Anyone permitted to log in to the Administration area and edit their own profile could, when saving the profile, include details that are actually protected, and thereby make themselves an administrator. A permission to edit other users was not required for this. The profile now only accepts a reference to a medium in the profile picture field; anything else is rejected with a 403 error.
• Administrator permissions when duplicating users – medium, CVSS 6.5 A logged-in user with the permission to create users could include protected details when duplicating a user and thereby obtain administrator permissions. According to Shopware, this can also affect other records that can be duplicated. The duplication of users and integrations via the Admin API has therefore been disabled.
• Newsletter sign-up without confirmation – medium, CVSS 5.3 With double opt-in enabled, a Store API call without authentication could activate a newsletter subscription without the owner of the email address having consented, including for addresses of existing customers. According to Shopware, the issue affects consent and the quality of the recipient list, not accounts or customer data.

Does this affect me?

• All shops According to Shopware, all versions prior to 6.6.10.25 and 6.7.0.0 up to and including 6.7.14.0 are affected. Patched are 6.7.14.1 and 6.6.10.25.
• Exploitable without authentication The database queries via the Store API, provided the shop runs on PHP prior to 8.4 and the mentioned database driver setting is active. Since it is active by default in PHP, the prerequisite should, in our assessment, be met on many installations running PHP 8.2 or 8.3. In addition, the newsletter sign-up without confirmation.
• Only exploitable with an account The critical webhook vulnerability requires a user or integration with the permission to create webhooks; the other two issues require an account in the Administration area. The risk here lies with employee accounts with restricted roles, with third-party integrations, and with access credentials that have already been leaked at some point.
• 6.5 line and older According to Shopware, these versions are also affected. There is no patched version for them; Shopware only names 6.6.10.25 and 6.7.14.1. Whether the Shopware Security Plugin already covers the five issues is not clear from the release notes.

If you cannot update immediately

• Restrict the permission to create webhooks to trustworthy administrators and integrations, review the existing webhooks and remove unexpected entries.
• Switch to PHP 8.4 or disable the mentioned database driver setting. You will find the technical name in the developer section below.
• Remove the permission to edit one's own profile and the permission to create users from roles that do not need them; review administrator accounts and logs for unexpected permission changes.
• Temporarily disable the public newsletter sign-up.

For developers and connected systems

• Webhooks user.recovery.request, customer.recovery.request, mail.before.send and mail.after.create.message are no longer delivered and have been removed from the generated reference of webhook events. An event opts out of delivery with the attribute #[Shopware\Core\Framework\Webhook\NotHookable]. From the payload, contextToken is dropped for checkout.customer.login, confirmUrl for checkout.customer.double_opt_in_registration and checkout.customer.double_opt_in_guest_order, as well as url for newsletter.register. In mail templates, {{ contextToken }}, {{ confirmUrl }} and {{ url }} continue to work. A value is kept out of webhook payloads with [EventDataCollection::HIDDEN_FROM_WEBHOOK => true] as the options argument of EventDataCollection::add(). From 6.8, Shopware rejects app manifests that subscribe to one of the four events.
• Store API and database According to the advisory, the SQL injection only takes effect with PHP < 8.4 with PDO::ATTR_EMULATE_PREPARES enabled. Remedy without an update: set PHP 8.4 or PDO::ATTR_EMULATE_PREPARES to false.
• Aggregations Aggregation names and keys of range aggregations with a backtick, question mark, colon or control characters are rejected with 400 and FRAMEWORK__INVALID_AGGREGATION_QUERY.
• Profile PATCH /api/_info/me now only accepts avatarMedia as {"id": ""}; any other form is rejected with 403 and FRAMEWORK__MISSING_PRIVILEGE_ERROR.
• Cloning POST /api/_action/clone/user/{id} and POST /api/_action/clone/integration/{id} respond with 403.
• Confirmation hashes The customer registration hash is no longer included in API responses and in customer payloads of webhooks. The internal confirmation flow is unchanged.
• Deprecation EventDataCollection will be declared final with Shopware 6.8.

The five points in brief

• Webhooks revealed more than the recipient was allowed to see – critical, CVSS 9.6 Webhooks are automated notifications that Shopware sends to other systems when certain events occur. Depending on the event, a user or integration with the right to create such notifications could receive customer, order and email data as well as data from shop workflows beyond their own permissions, in some cases, according to Shopware, also details that can be used to reset passwords. Webhooks are now validated against the permissions of their creator.
• Database readable via the Store API – high, CVSS 8.6 Without authentication, database queries could be manipulated via the Store API so that arbitrary data could be read from the database (technical term: SQL injection). According to Shopware, this requires a PHP version prior to 8.4 together with a PHP database driver setting in which PHP assembles the queries itself rather than having them prepared by the database. Shopware was unable to demonstrate any write access.
• From a restricted user to administrator – high, CVSS 8.1 Anyone allowed to edit their own profile in the Administration could submit protected details when saving and thereby make themselves an administrator.
• Administrator permissions when duplicating users – medium, CVSS 6.5 Anyone allowed to create users could submit protected details when duplicating a user and thereby gain administrator permissions.
• Newsletter sign-up without confirmation – medium, CVSS 5.3 With double opt-in enabled, a subscription could be activated without the owner of the email address consenting, including for addresses of existing customers.

Does this affect me?

• 6.6 line According to Shopware, all versions below 6.6.10.25 are affected.
• 6.7 line Affected are 6.7.0.0 up to and including 6.7.14.0; 6.7.14.1 is secured.
• 6.5 line and older According to Shopware, these versions are also affected. There is no secured version available for them; Shopware only names 6.6.10.25 and 6.7.14.1. Whether the Shopware Security Plugin already covers the five points is not clear from the release notes.
• Exploitable without authentication are the database queries via the Store API under the mentioned condition and the newsletter sign-up. The three other points require an account in the Administration or an integration with the corresponding permissions.

What you should check before updating

What changes in day-to-day shop operations

• GARAN label and statutory warranty notice Products gain two new fields for a voluntary manufacturer's guarantee that goes beyond the statutory two years. They are maintained in a dedicated card on the product detail page. The GARAN label is only rendered as a graphic if the guarantee is confirmed and the duration, manufacturer and manufacturer number are set. Independently of this, there is the statutory warranty notice in all 24 official EU languages, with English as a fallback. It is switched on after the update and can be disabled under Settings > Shop > Cart > Checkout. The label appears in the purchase area of the product page, on the line items in the cart and in the checkout; the notice appears as a modal on the confirmation page, linked from the terms and conditions text. According to Shopware, the basis for this is Implementing Regulation (EU) 2025/1960. According to Shopware, merchants must assess for themselves whether and how the requirements apply to their own product range.
• Permissions for number ranges and orders Reserving a number and previewing a number range now require read permission for number ranges. Without the preview parameter, reserving permanently increments the number range; previously any logged-in account could trigger this and thus create gaps in the number sequence. Also protected now are the endpoints for recalculating and converting orders as well as the check for whether a user address is already taken. Existing roles receive the necessary permission via migration, and according to Shopware this changes nothing for users in the Administration area. Integrations with their own permission list are the point that matters here, more on this below.
• Shipping methods need a usable price matrix An active shipping method must retain at least one row in the price matrix that yields a cost. Deleting or emptying the last row is rejected with an error, as is activating a shipping method without a price. When querying the available shipping methods, such methods no longer appear. Creating new ones without prices is still possible.
• E-invoices: reference price quantity corrected For ZUGFeRD invoices, the sales unit of a product was previously entered as the reference price quantity. Recipients who validate against the standard were therefore reported a rule violation for every line item with a sales unit other than 1. Line items now always carry a base quantity of 1, and the net price is written with four decimal places instead of two.
• Accessibility in the Storefront The largest single block in the release. The active page in the main navigation and the active category are now announced to screen readers, the footer uses appropriate HTML elements for this, icons are hidden by default, messages on page load and in the cart off-canvas are read out, the wishlist announces changes, the focus in the cookie bar is set earlier, labels in forms and in the off-canvas cart have been added, and labels on buttons may now wrap. The basic captcha has been given an image description and a label for the reload button. The settings now include a note that the basic captcha is not considered accessible.
• "Best results" sorting is translatable The name of this sorting previously came from the database, could not be edited in the Administration and existed only in German and English. It is now rendered as a snippet and can therefore be maintained for every language. All other sortings remain as they are.
• Product slider from dynamic product groups If the sales channel is configured to hide sold-out clearance items, this now also applies to sliders that draw their products from a dynamic product group. Hidden products no longer take up space in the slider.
• Currency selection In the off-canvas the currently selected currency is displayed as text again, and the currency symbol is correct.
• Login attempts The response time for a failed login has been aligned so that the duration no longer reveals whether an address is registered in the shop.
• Corrections to orders Orders with a shipping discount can be edited in the Administration area again without losing the delivery line items. Properties of deleted variants remain visible in the order. When an employee leaves the order detail page, the draft version that was created is now cleaned up. Also fixed: the cart lost its saved state during recalculation.
• Promotions and discounts Promotion conditions with "all" or "none of" now also apply correctly when there is not yet any promotion in the cart. Newsletter discounts work for freshly registered customers, and promotion codes are normalised before comparison.
• Minor details Users can now change their time zone themselves. In the price matrix of shipping methods, quantity tiers start correctly again and stay in sync when editing. Price fields per currency load all currencies. The selection of indexes when clearing the cache is based on the indexers that are actually registered. Subtitle files in VTT format may be uploaded.

What you should check before the update

• Connected systems and permissions ERP systems, marketplace connections or custom scripts that work with a manually maintained permission list will run into a 403 error as long as the new permissions are missing. Affected are reserving numbers, recalculating and converting orders including order addresses, and checking user addresses. Clarify this with your provider or agency before the update.
• Customised terms and conditions text in checkout The confirmation page now uses new snippets for the checkbox text, which contain the link to the warranty notice. Anyone who has overridden the terms and conditions text or the associated template block must adjust the override or disable the setting.
• Custom order confirmation email The migration adds the notice only to templates that have never been modified. Anyone using an edited template who also wants to show the notice in the email must add it by hand. The required snippet is in the developer section.
• Shipping methods without a price Active shipping methods with an empty price matrix or without currency values are no longer delivered as available and will therefore likely be missing in the checkout as well. It is worth taking a look at the shipping methods beforehand.
• Twig dependencies On 11 September, a bug report for this release was submitted in the Shopware repository. According to it, Composer can resolve twig/twig and squirrelphp/twig-php-syntax in a combination where the Administration and Storefront come to a halt with a fatal Twig error. Shopware has flagged the report as high priority; at the time of going to press, no fix was available. For this reason, install the update in the staging environment first and review the resolved package versions before going live.

For developers and connected systems

• GARAN in the code New are the product fields guaranteeMonths and guaranteeConfirmed, both inheritable and writable via the Admin API. guaranteeMonths must be empty or greater than 24 and divisible by 6. In addition there are the Twig filters sw_garan_label, sw_garan_label_nested, sw_garan_label_data_uri, sw_garan_label_nested_uri, sw_garan_label_duration, sw_legal_guarantee_notice and sw_legal_guarantee_notice_link. For headless frontends there is GET /store-api/product/{productId}/garan-label and GET /store-api/legal-guarantee-notice. The notice is toggled via core.cart.showLegalGuaranteeNotice, also per sales channel. A customised order confirmation should include {{ context.languageId|sw_legal_guarantee_notice_link }}.
• ACL requirement on admin endpoints number_range:read for /api/_action/number-range/reserve/{type}/{salesChannelId} and /api/_action/number-range/preview-pattern/{type}. order:update for the recalculation endpoints and the checkout proxy routes, order_address:update for the address endpoints, order:read for convert-to-cart, user:read for the uniqueness check of email address and username. If the permission is missing, Shopware responds with 403 and FRAMEWORK__MISSING_PRIVILEGE_ERROR.
• sw-expect-packages header This is no longer evaluated on routes without authentication, because the error message exposed installed package versions. Shopware now responds to such calls with 417 and FRAMEWORK__API_EXPECTATION_NOT_SUPPORTED. A client that sets the header indiscriminately must remove it for unauthenticated calls. On authenticated Admin API requests the behaviour stays the same.
• Sync API For deletion operations via criteria, permissions are now checked.
• Shipping methods The ShippingMethodValidator rejects write operations that would leave an active shipping method without a usable price, error code active_shipping_method_without_price with status 400. To remove a price matrix, the shipping method must be deactivated in a previous call. In the ShippingMethodRoute, onlyAvailable=1 filters out methods without a resolvable price; requests without the parameter are unchanged.
• ZUGFeRD The reference price quantity BT-149 is now always 1 instead of the product's purchaseUnit, and the unit price BT-146 is written with four decimal places so that the line item total at higher quantities remains within the rounding tolerance of PEPPOL-EN16931-R120. In addition, discounts and surcharges are now also output for tax-free orders.
• Sortings at runtime The new ProductListingCollectSortingEvent event is triggered after the available sortings are loaded and before the requested one is resolved. A ProductSortingEntity added there is selectable in the Storefront and is applied to the criteria.
• Cache info GET /api/_action/cache_info now returns a list of the registered indexers including subordinate updaters. Indexers that only run after an update are excluded.
• Product slider The ProductSliderCmsElementResolver has been given an additional constructor argument. The class is marked as internal.
• Miscellaneous The product export uses the configured main category for the breadcrumb in the feed. The HTML filters allow strong and em. In the Administration, a disabled select field will no longer drop a value that has not yet been resolved.

What changes in everyday shop operation

• GARAN label and statutory warranty notice Products receive a new field for a voluntary durability guarantee from the manufacturer beyond the statutory two years. If a manufacturer is set and the guarantee details are complete, Shopware renders the EU-standardised GARAN label as a graphic. Independently of this, there is the statutory warranty notice in all 24 official EU languages, matching the storefront's language and with English as a fallback. It can be switched on and off via a setting. Both appear on the product page, in the cart, during checkout and in the order confirmation. According to Shopware, the basis is Implementing Regulation (EU) 2025/1960, and there is accordingly no transition period. According to Shopware, the notice applies to all merchants selling physical goods to consumers in the EU, whereas the label applies only to products with a corresponding manufacturer's guarantee. According to Shopware, merchants themselves must assess whether and how the requirements apply to their own product range. Very important: the order confirmation email is only extended automatically if you have never changed the template. Anyone using a custom template who also wants to show the notices in the email must add the two building blocks manually. Details can be found in the developer section.
• New "Automation" menu item The Rule Builder and Flow Builder can now be accessed via a dedicated entry in the main menu. The existing entries under "Settings" remain in place.
• Ready-made flow for failed payments Shopware now ships a prepared flow together with a flow template and an email template for the case where a payment switches to the "failed" status.
• Order status history shows the trigger In the Administration, according to Shopware, it is now clearer to see what triggered a status change. If a customer changes the status via an action in the Storefront, the history shows "Customer".
• Add languages directly in the Administration According to Shopware, more than 40 translations maintained by the Shopware community can now be added and kept up to date under Settings > Languages, without shell access and without a plugin. The daily update can be switched off per language, directly on the language's detail page. New permissions for language management are available in the role editor.
• Electronic invoices: price base quantity corrected For ZUGFeRD invoices, the sales unit of a product (the field from the base price details) was previously entered as the price base quantity. Recipients validating against the EN 16931 standard were therefore reported a rule violation for every line item with a sales unit other than 1, and Peppol access points may have rejected such invoices. Line items now always carry the base quantity 1, and the net price is written with four decimal places.
• Shipping methods require a valid price matrix An active shipping method must retain at least one entry in the price matrix that yields costs. Deleting the last entry is rejected. In the Store API, shipping methods without a resolvable price no longer appear when querying available methods.
• Cross-selling via dynamic product groups A cross-selling no longer shows the product it is displayed on. For variants, the entire variant family is excluded, that is, the current variant, the main product and all siblings. Manually assigned cross-sellings remain as they are.
• SEO URLs are regenerated after a template change Anyone changing the template of an SEO URL no longer needs to start the indexer by hand. The affected URLs are regenerated in the background in batches of 250.
• No more error page on failed reCAPTCHA If Google reCAPTCHA fails on a non-AJAX form, the customer now sees a notice on the form instead of a 403 error page and can try again.
• "Best results" sorting is translatable The label of this locked sorting was previously only available in German and English. It now comes from a text snippet and can be customised for each language.
• Documents from both generators Documents created with the old and the new document generation can now be opened and downloaded across both.

Shopware Commercial Features

• B2B Components Employees of other companies can be assigned to an organisation and given a role in the process, as well as an organisational unit in the same step. In addition, there is a global switch that allows individual functional areas of the B2B Components to be switched on or off.
• Buy now, pay by invoice in Shopware Payments Buy now, pay by invoice is available as a new payment method, processed via Ratepay. According to Shopware, this is the second most used online payment method in Germany. Anyone using Shopware Payments has had the payment method enabled automatically.

What you should check before updating

• Connected systems and permissions A whole range of Admin API endpoints now require an appropriate permission where previously plain authentication was sufficient. Affected, among others, are reserving number ranges, recalculating orders, SEO URL management, media uploads, the message queue and the preview of product exports and email templates. For users in the Administration, according to Shopware, nothing changes as a rule — the necessary permissions are granted automatically via migration or at runtime. For the media routes and the preview endpoints, however, Shopware also mentions users who need to adjust their role. Integrations with their own permission list, such as an ERP system or a marketplace connection, on the other hand receive an error 403 as long as the permissions have not been added. Clarify this with the provider or your agency before the update.
• Custom order confirmation email If the template has ever been edited, the GARAN label and warranty notice will be missing from it after the update. If they are to appear there, both must be added manually — see the developer section.
• Search ordering with Elasticsearch Results that contain the entire search term in the correct order are now weighted higher. The same products are found, but the order and the score values shift. Anyone who has set a minimum score for results should run through the search once after the update.
• Shipping methods without a price Active shipping methods whose price matrix is empty or contains no currency values are no longer returned when querying available shipping methods and are therefore likely to be missing in the checkout as well. Before the update, it is worth taking a look at the shipping methods.

For developers and connected systems

• GARAN in custom email templates A customised order confirmation should include {{ nestedItem.productId|sw_garan_label_nested_uri(context) }} and {{ context.languageId|sw_legal_guarantee_notice_link }}. For the Storefront there are the Twig filters sw_garan_label, sw_garan_label_nested and sw_legal_guarantee_notice, and for headless frontends the Store API routes /store-api/product/{productId}/garan-label and /store-api/legal-guarantee-notice. The notice can be toggled via core.cart.showLegalGuaranteeNotice.
• XML configuration is deprecated Symfony configuration from XML files (services.xml, routes.xml, packages/**/*.xml) is deprecated for plugins, bundles and the config/ directory and will no longer work with Shopware 6.8, because Symfony 8 removes support for it. Shopware now reports which file and which bundle is affected. Migrate to services.php or routes.php; both formats can coexist. Shopware's own XML formats such as config.xml or app manifests are not affected.
• ACL requirement on Admin endpoints Now newly required, among others, are number_range:read for reserving numbers, order:update and order_address:update for recalculating and converting orders, user:read for the uniqueness check of users, seo_url:update and seo_url:create, media:create and media:update for media routes, mail_template:update and product_export:update for preview endpoints, as well as the new permissions system:queue:process, increment:manage, system:app:change and flow:dispatch. If the permission is missing, Shopware responds with 403 and FRAMEWORK__MISSING_PRIVILEGE_ERROR. External workers should continue to use the CLI commands messenger:consume and scheduled-task:run, which are not affected.
• Header sw-expect-packages This is no longer evaluated on unauthenticated endpoints, because the error message revealed installed versions. Affected, among others, are /api/oauth/token and the health check. A client that sets the header by default must remove it for unauthenticated calls, otherwise even the token request fails with 417.
• Plugin metadata read-only plugin.path and plugin.managedByComposer can no longer be changed via generic Admin API write access.
• New app script hook cookie-group-collect Apps can adjust or remove cookie groups and entries via a script, for example to hide cookies of a payment method that is not active. Older Shopware versions simply ignore the hook.
• New Store API routes GET /store-api/snippet returns resolved text snippets for the current sales channel (experimental, planned to be stable with 6.8, with ETag support), and GET /store-api/shop-settings the non-sensitive part of the system configuration. Both are aimed at headless frontends.
• SEO URLs for headless sales channels Sales channels of the API type now generate SEO URLs via their own store-api.* templates and can be used for product exports. The prerequisite is a domain marked as an external storefront.
• Template change to SEO URLs triggers regeneration This applies to every write path, including the Sync API and deployment scripts. Anyone writing seo_url_template on every deployment should compare the value beforehand, otherwise a full regeneration runs every time.
• Vue Single File Components in the Administration Components can now be written as a .vue file with and extended via swDefinePublic() and swDefineOverride(). Experimental until 6.8.
• MCP server without feature flag The endpoints /api/_mcp and /store-api/_mcp are now always available; the classes remain experimental until 6.8. Tools are only shown after a request, and permissions for associations are checked as in the Admin API.
• Product export Pagination now runs via a keyset cursor instead of LIMIT/OFFSET, which eliminates the timeout for large catalogues; getTotal() is deprecated. Media URLs in the export body are RFC 3986 encoded, which benefits Google Merchant Center feeds. --force now also regenerates scheduled exports.
• Fewer deadlocks during indexing Category and SEO URL indexing write with INSERT ... ON DUPLICATE KEY UPDATE instead of REPLACE INTO and read child counters without a lock. No configuration required.
• Thumbnails media:generate-thumbnails --force regenerates existing thumbnails, and media:delete-local-thumbnails supports --force and --orphans. New setting shopware.cdn.path_cache_buster for stable media paths.
• Theme commands clean up theme:compile and theme:change delete unused theme directories older than 24 hours, which previously only a scheduled task did. --no-cleanup disables this. theme:create supports --full and individual options for the scaffold.
• Storefront plugins PluginManager.override() now also works for asynchronously loaded plugins, and PluginBaseClass gains a destroy() method. Each extension bundle uses its own webpack chunk global.
• Miscellaneous Criteria::resetFields() and resetExcludedFields(), a configurable translation system via shopware.translation, new BC change attributes instead of @deprecated reason:*, swagger-php 6.4, polyfills as real dependencies, retry on MySQL 8.4 migrations, an optional Clear-Site-Data header on customer logout, SERVICE_REGISTRY_URL limited to Shopware domains in production.

What you should check before updating

• Apps that report data to other systems Shopware now only sends such notifications (webhooks) in encrypted form and only to publicly reachable addresses. Such connections will break after the update unless they have been explicitly allowed. In our experience, this mainly affects custom apps and directly connected systems on the internal network, and less often extensions from the Shopware Store.
• The configured shop address The link for resetting the administrator password is now built from the configured address (APP_URL) rather than from the respective request. If that does not contain the public address of your shop, the link leads nowhere.
• Custom template adjustments If your theme or a plugin uses the affected Twig functions with a function name as a string, an error message may appear after the update. This should only affect a few shops, but it is quick to check.

The three critical vulnerabilities

• App sandbox escape – critical, CVSS 9.6 A malicious or compromised app could bypass the execution restrictions of the App Scripts and run arbitrary PHP functions as well as operating system commands. According to Shopware, this allowed access to configuration and credentials, changes to files and access to internal services. The find filter and the has some and has every operators therefore now reject string callables that are not explicitly allowed.
• Takeover of administrator accounts – critical, CVSS 9.3 The administrator password reset process did not sufficiently validate the host used. An attacker without credentials could point the link in the recovery email to an address of their own and hope that an administrator would click it.
• SQL injection via field names from app manifests – critical, CVSS 9.1 Names from custom entity definitions were not sufficiently validated before being turned into tables and columns. An app could thereby execute arbitrary SQL with the privileges of the database connection.

The other six vulnerabilities

• SQL injection via the Store API – high, CVSS 8.6 Anyone holding a valid access key for a sales channel could manipulate a database query via aggregation names. Shopware points out that these keys are often exposed in headless setups.
• Privilege escalation via role assignment – medium, CVSS 6.5 A logged-in administrator with the privilege to edit users could assign additional roles to themselves and thereby gain privileges that were not intended for them. ACL roles can no longer be created or modified via general write access through the Admin API.
• Internal services via media import – medium, CVSS 6.3 Importing media by address could trigger requests to services on the internal network. The validation of the target address could be bypassed by changing the name resolution between validation and connection setup.
• Unapproved product reviews visible – medium, CVSS 5.3 Through nested associations in the Store API, the content, rating and display name of reviews that the shop had not yet approved could be retrieved. No authentication was required for this.
• Missing limit on guest documents – low, CVSS 3.7 Anyone with a document link and the associated email address could try the requested postcode an unlimited number of times and thereby obtain invoices and delivery notes. The same limit as for guest logins now applies.
• Internal services via the app system – low, CVSS 3.1 The same bypass as with the media import, here via webhooks and the interfaces for payment, tax and checkout. This requires a malicious or compromised app.

Two additional hardening measures

• File extensions for media If the file extension was set via a direct write access instead of an upload, it previously bypassed validation. The same allow list now applies in both cases.
• Very large Criteria The sales channel restrictions apply to the first 99 nodes of a Criteria. If this limit was exceeded, the remainder previously went unfiltered. Such requests are now rejected instead of returning partially unfiltered data.

For developers and connected systems

• Twig The find filter and the has some and has every operators reject string callables that are not listed in shopware.twig.allowed_php_functions. This already applied to map, filter, reduce and sort. Arrow functions (v => ...) are not affected.
• Webhooks Targets are validated before every request and before every redirect, requiring HTTPS and a public IP. The result of the name resolution is bound to the request (DNS rebinding). Exceptions via shopware.app_system.allow_unencrypted_traffic and shopware.app_system.allowed_private_ip_addresses in the shopware.yaml.
• Media import Every resolved address is validated instead of only the first IPv4, and the request goes to the validated address. A custom FileUrlValidatorInterface implementation can still reject, but can no longer allow anything private. For imports from internal networks: set shopware.media.enable_url_validation to false.
• Media Direct write access to media.fileExtension runs against the same allow list as uploads, error code MEDIA_ILLEGAL_FILE_EXTENSION.
• Apps and plugins Entity and field names from the Resources/entities.xml are validated during installation and update; letters, digits, underscores, $ and the non-ASCII characters supported by MySQL or MariaDB are permitted. A hyphen in a name results in a clear error message.
• Store API Aggregation names may no longer contain control characters.
• Product reviews via nested associations The same visibility rules as at the top level now apply. Interfaces that read reviews in this way may consequently receive fewer records.
• Large Criteria Requests with more than 99 nodes are rejected with a 400 and SYSTEM__CRITERIA_TOO_MANY_NESTED_CRITERIA. Such requests do not arise from the Storefront; at most, custom interfaces are affected, which then have to be split into several requests.
• Deprecation Shopware.Service('integrationService').updateAdmin() will be removed with Shopware 6.8, replaced by the integration repository.

Two important fixes

• Search If a mapping references an analyzer or normalizer that the running index does not know, the update fails. Instead of leaving an outdated mapping in place, the affected entity is now marked for a reindex into a freshly created index. This affects shops using Elasticsearch or OpenSearch whose analysis settings change.
• Documents Invoices and delivery notes no longer break when the twig service has been extended by a plugin. Please note: the sales channel's time zone setting only takes effect as long as Shopware's own TwigEnvironment is in use, otherwise rendering happens in Twig's default time zone.

The three critical vulnerabilities

• Breakout from the app sandbox – critical, CVSS 9.6 According to the advisory, a malicious or compromised app could bypass the execution restrictions of the app scripts and run arbitrary PHP functions as well as operating system commands. As possible consequences, Shopware cites access to configuration and credentials, changes to files, and access to internal services.
• Takeover of administrator accounts – critical, CVSS 9.3 The process for resetting the administrator password did not sufficiently verify the host used. An attacker without credentials could redirect the link in the recovery email to their own address and hope that an administrator clicks on it.
• SQL injection via field names from app manifests – critical, CVSS 9.1 Names from custom entity definitions were not sufficiently validated before they became tables and columns. An app could thereby execute arbitrary SQL with the privileges of the database connection.

The remaining six points

• SQL injection via the Store API – high, CVSS 8.6 Anyone holding a valid access key of a sales channel could manipulate a database query via the names of aggregations. Shopware points out that these keys are often exposed in headless integrations.
• Privilege escalation via role assignment – medium, CVSS 6.5 A logged-in administrator with the privilege to edit users could assign additional roles to themselves and thereby gain privileges that were not intended for them.
• Internal services via media import – medium, CVSS 6.3 Importing media by address allowed requests to services on the internal network to be triggered. The validation of the target address could be bypassed by switching the name resolution between validation and establishing the connection.
• Unapproved product reviews visible – medium, CVSS 5.3 Through nested associations in the Store API, the content, rating and display name of reviews that the shop had not yet approved could be retrieved. No authentication was required for this.
• Missing limit on guest documents – low, CVSS 3.7 Anyone who had a document link and the associated email address could try the requested postcode an unlimited number of times and thereby gain access to invoices and delivery notes.
• Internal services via the app system – low, CVSS 3.1 The same bypass route as with the media import, here via webhooks and the interfaces for payment, taxes and checkout. This requires a malicious or compromised app.

Does this affect me?

• 6.6 series All versions below 6.6.10.23 are affected. For individual points, the affected range starts later, for example from 6.6.6.0 for the product reviews. The exact ranges are listed in Shopware's security advisories.
• 6.7 series Affected are 6.7.0.0 up to and including 6.7.13.0. The fixes are included in 6.7.13.1, see the entry above.
• 6.5 series Two advisories also name 6.5 versions as affected, for the sandbox breakout from 6.5.4.0. As patched versions, the advisories only list 6.6.10.23 and 6.7.13.1. Anyone still running 6.5 should consider upgrading and, until then, discuss with their agency what safeguards are possible.

What changes in everyday shop operations

• Convert guest accounts into registered customer accounts Guest customers can set a password directly after completing their order and thereby convert their guest account into a regular customer account. The order just placed remains assigned to the account. In the Administration, you will find the new action “Convert to a registered account” in the customer detail view under “General”. Two options are available for setting the password: a secure reset link sent by email (recommended by Shopware) or manually setting a password without notification. Order history and contact details are retained in both cases.
• Variant display in dynamic product groups configurable Dynamic product groups have the new option “Display matching variants grouped”. If you turn it off, matching variants are output individually instead of being combined under a shared main product. This takes effect in categories, cross-selling areas and CMS product sliders. Existing product groups retain their previous behaviour after the update, as the option remains enabled by default.
• Faster category management When creating or editing a category, Shopware now only reindexes the affected category and its subcategories. Previously, the entire branch including sibling categories was reprocessed. According to Shopware, this reduces the database load, and shops with large category structures save noticeably faster.
• Several SEO fixes in the Storefront Paginated listing pages receive the page number in the canonical URL, so that each page of a series is referenced unambiguously. Categories of type “Link” get their own SEO URLs again and redirect to their configured target instead of returning a 404 page – relevant for old bookmarks or external links, for example. In addition, the default robots.txt now allows crawling of product feed URLs with tracking parameters. These were previously blocked across the board, which could lead to products being rejected in the Google Merchant Center.
• Payment change after purchase is enforced If “Allow payment method change after order completion” is disabled for a payment method, it can now no longer be selected for an existing order via the Store API either. Previously, the setting only acted as a filter in the interface, so that payment methods with their own payment button could bypass it.
• Translations stay up to date without intervention A new scheduled task automatically updates installed translations once a day. In addition, managing translations can now be done via the Administration – listing, installing, updating and removing no longer depend on command line access. Shops without an installed translation remain unaffected.
• Documents: time zone and ZUGFeRD corrective documents Sales channels receive an optional business time zone according to which documents are rendered. Without a specification, the previous behaviour remains in place. For ZUGFeRD cancellation and corrective documents, shipping details are now output according to their business significance: refunded shipping costs as a credit, charged return costs as a surcharge, zero values not at all.
• Images and media JPEG preview images are now saved progressively. As a result, they appear earlier as a rough preview and become sharper as they load, which improves image rendering especially on slow connections. In addition, batch processing no longer aborts completely if a single file cannot be processed. Text-based files are delivered with an explicit character set declaration, so that umlauts are displayed correctly when delivered via CDN or object storage.
• Administration On the snippet detail page, it is now visible whether a snippet originates from a language file and has been changed. The original value is shown, and inheritance can be restored. In the search settings, the modes are also named more clearly as “Broad search (OR)” and “Exact search (AND)”; nothing changes in the saved configuration.

For developers and technicians

• Store API works statelessly Shopware lists this point as a critical fix. Store API requests no longer start a PHP session unless application or extension code explicitly does so. Previously, various event subscribers could create a session, which caused the session storage to grow unnecessarily and could trigger session locks. The behaviour of the Storefront session remains unchanged.
• Purchase prices no longer in Store API responses The order line items of the Store API no longer contain purchase prices. Headless frontends, apps and integrations must no longer read this field; there is no replacement via the Store API. At the PHP level, the value remains accessible. The change also applies to already existing orders.
• Define custom fields declaratively Plugins and apps can describe their own fields via a file Resources/config/custom-fields.xml. Shopware handles creation, updating and removal along the extension lifecycle, and the previous installer code is no longer required. In addition, a field can be marked directly as searchable via .
• New Admin API endpoints for managing translations as well as for downloading media files.
• New entry point for preview images After each individual thumbnail is written, an event is triggered. Extensions can hook in there to optimise images afterwards.
• Permission behaviour for write events Subsequent write operations from event listeners now run in the system context. As a result, API users only need the permissions for the data actually sent, not additionally for entities that a plugin writes in the background. The visibility of private media is explicitly not weakened by this.
• Further improvements Webhooks are signed with the current secret after an app secret change. The SVG validator accepts more passive content from extensions and themes but still blocks active content. dal:validate checks foreign keys for compatibility with MySQL 8.4. A failed plugin activation is now cleanly rolled back. With Criteria::excludeFields(), individual heavy columns can be excluded from loading. Via the variable GENERATE_SOURCEMAPS, you control whether sourcemaps are generated in production builds.
• Search According to Shopware, Elasticsearch support has been expanded, among other things in phrase matching and in the configuration options for ranking.

Note on deprecations

• The field maintenanceIpWhitelist on the sales channel is replaced by maintenanceIpAllowlist. Both fields are kept in sync during the transition period.
• EntitySearchResult and the derived result classes for product listings and reviews change their behaviour. Collection methods should in future be called on getEntities(), in Twig accordingly via .entities.
• The inline definition of custom fields in the manifest.xml of apps gives way to the new XML file.
• Further points concern the rendering of script responses in the core, the domain loader of the Storefront, the variable type in the templates of the address manager, several renamed Twig blocks in the Administration as well as three Composer dependencies that Shopware will no longer ship in future.

Commercial features

Classification

• Release type Patch release, no new features for the Storefront
• Target group Shops on Shopware 6.6.x
• Successor With 6.6.10.23 from 25/08, a security update has since been released. Anyone who has not yet installed 6.6.10.22 can go straight to 6.6.10.23.

Permission checks in the Administration

• Template rendering Endpoints that render templates now require write permissions.
• Actions in the backend Endpoints for actions, for media and for SEO now require the respective permission.
• Message queue and counters The endpoints for the message queue and for the queue statistics are also no longer accessible without permission.
• Apps and extensions Requests via the Extension SDK and from Administration modules are checked against the app's permissions.

Important bug fixes

• Discounts and promotions The price definition of a shipping discount was not handled correctly when the value was zero. Also fixed: a bug in the calculation of set promotions and a case in which the composition of a promotion was not retained.
• SEO URLs Editing and clearing SEO URLs works as intended again.
• Variant bulk editing The visibility in sales channels was not applied correctly during the bulk editing of variants.
• Categories and navigation External links in categories retain their protocol, and child entries in the footer navigation tree are resolved correctly as a page URL. Additionally fixed: the focus in the name field of a tree entry could jump away under certain circumstances.
• Integrations Saving an integration in the Administration failed in certain cases.

For developers

• Default permissions for Administration users According to Shopware, users in the Administration now receive default permissions at runtime.
• App payment methods The AppPaymentHandler now supports linking to a translation code.
• Plugin file system The metadata in the plugin file system is now protected.

Important fixes

• Test email for the cancellation form works again When previewing email templates, sample data for custom form fields was missing. As a result, the test email for the cancellation request could not be generated. This sample data is now provided, so the preview runs through again.
• Cache settings remain backwards compatible Since the July release there have been new configuration keys for cache compression. If only the new keys were set, extensions and tools that still read the old names were unable to work with them. Shopware now automatically sets the old keys as well when only the new ones are configured.
• Updated PDF library The dompdf library, which Shopware uses to generate documents such as invoices and delivery notes, has been updated to version 3.1.6. According to Shopware, the aim was to address security notices relating to this third-party component. A dedicated security advisory for Shopware was not published for this.

Important fixes

• Payment method changes after purchase reliably secured If “Allow payment method change after order completion” is disabled for a payment method, this payment method can now no longer be selected for an existing order via the Store API either. Previously, the setting only acted as a filter in the interface, so payment methods with their own payment button (such as PayPal) could bypass it.
• Store API no longer starts unnecessary sessions Store API requests could trigger session management, which caused the session storage to grow unnecessarily and could trigger PHP session locks. The behaviour of the Storefront session, including customer impersonation, remains unchanged.
• ZUGFeRD correction and cancellation invoices For correction and cancellation documents, the shipping details are now correctly derived from the document data. Refunded shipping costs, charged return costs and zero values are cleanly distinguished in the XML.
• Linked categories redirect again For categories of the link type, the redirect behaviour works as intended again.
• Further fixes Bulk processing for arbitrary document types, a race condition in the filter panel of the Administration, and the update of the PDF library dompdf to version 3.1.6. According to Shopware, the dompdf change resolves security notices relating to this third-party component; a dedicated security advisory for Shopware was not published for this.

Important fixes

• Fixed start-up error A changed cache configuration caused an error when booting the system in 6.7.12.0 (internally “Frozen container parameter bag”). This error has been fixed, making the version installable again.
• Twig 3.28 In addition, compatibility with Twig 3.28 has been established.

What changes in day-to-day shop operations

• Improved search and search discovery The search now understands more notations of product identifiers, such as sizes like 32/34, decimal values with a comma or full stop as well as manufacturer numbers with and without spaces (AB123 or AB 123). In addition, the ranking of results has been reworked. Exact matches remain at the top, and weakly matching results are filtered out more frequently. Even a particularly large number of keywords no longer gives a product an automatic advantage.
• AI Discovery Files for AI searches Sales channels can now provide so-called AI Discovery Files, specifically the files llms.txt and agents.md. These machine-readable files help AI assistants and AI search engines to classify your shop and to recognise how they should interact with it. You maintain the content per sales channel in the Administration, see a preview and can add your own notes. For anyone who wants to prepare their shop for AI-assisted product search, this is an important building block.
• Rule Builder – new condition “Quantity per line item” This allows rules to be based on the quantity of a single cart line item rather than on the total quantity of all products. Some labels have also been named more clearly, and invalid entries in conditions are now displayed per field.
• Google Ads Enhanced Conversions The Google Analytics integration now supports Enhanced Conversions. After a purchase, the customer's email address is passed to Google Ads in hashed form. This improves the attribution of conversions when classic cookie tracking is restricted or when the purchase is completed on a different device. It can be enabled per sales channel in the Analytics settings.
• Double opt-in email is sent again automatically If a customer logs in with an unconfirmed double opt-in account and correct credentials, Shopware automatically resends the confirmation email, provided the first email was sent longer ago than a configurable interval. This reduces the support effort for lost confirmation emails. A successful password reset will also confirm such an account in future.

For developers and technical users

• Storefront performance Cache handling has been reworked, and the cache hash no longer depends on the language ID. In addition, product listings can load a shortened description excerpt (descriptionTeaser) instead of the full description. This is active on new installations and disabled on existing shops; it can be enabled per sales channel via core.listing.partialDataLoading.
• Extended Elasticsearch support a dedicated field for the autocomplete of the admin search as well as the option to find variants via the name of the main product (field parent.name, off by default). After the update, a reindex via bin/console es:admin:index is required.
• More flexible thumbnail processing in addition to GD, Imagick is now also supported, switchable in the shopware.yaml.
• Email templates and theme configuration Mail templates can access the Storefront's theme configuration (theme_config()), which makes sales-channel-specific templates easier.
• Further tools including a new sha256 Twig filter, reworked period options in the order date filter and a consistent CLI output format (--format json).

Note on deprecations

Commercial features

Important fixes

• Purchase prices no longer exposed via the Store API Purchase prices are no longer output in the order line items of the Store API. This rules out an unintended price disclosure.
• Private media stays private During write operations via the data abstraction layer, the visibility of private media is reliably preserved.
• Webhooks after a secret change After changing the app secret, webhooks are signed with the current secret. This is important for reliable communication with connected apps.
• Tightened permission check Write events no longer require more additional API permissions (ACL) than are actually necessary.
• Search returns complete results again Products with an inherited language (such as Swiss German) and search queries with transposed numeric terms are found correctly again.
• No more 500 errors caused by tracking URLs A faulty tracking URL no longer causes a server error on account and order overview pages in the Storefront.
• Further fixes including for promotions and discounts, in the cancellation form, in order status management as well as in several places in the Administration.

Important fixes

• More reliable import map in the Component System The generation of the JavaScript import map has been improved. It is part of the new Component System introduced in the Storefront with 6.7.11.0, and ensures that the associated scripts are correctly included. This fix is particularly relevant for shops that are already using the Component System.
• Login to the experimental MCP server An internal dependency in the authentication of the new MCP server has been corrected, so that login resolves reliably again. According to Shopware, the MCP server remains experimental and is only active via a feature flag. As such, only installations that have enabled it for testing purposes are affected.
• Footer navigation and page URLs Sub-entries in the footer navigation tree are now taken into account as page URLs. Previously, they were missing at this point. This is relevant wherever Shopware collects page URLs, for example for the sitemap.

What's changing in day-to-day shop operations

• Email preview per sales channel You can now display an email exactly as it will actually appear in the respective sales channel, including header and footer. The preview is also rendered in isolation, bringing the display closer to the real result. This makes checking before sending more reliable.
• Search jumps straight to the product If a customer enters an EAN or a manufacturer number that matches exactly one product, the search now redirects directly to the product page. Previously, this only applied to the product number. This saves a step, especially with large ranges and in B2B.
• Fix for the "Last quarter" filter In the backend, this date filter previously returned an incorrect period spanning over two years when used between January and March. This has been fixed, and it now correctly returns a three-month period from the previous year.
• Downloads after renaming media When you rename a media file, the associated address is automatically updated. As a result, downloads continue to work without any detour.
• Orders complete despite search server outages If the search server (Elasticsearch or OpenSearch) briefly went down during a purchase, an already saved order could previously fail with an error message. Going forward, the outage is logged and skipped, and the order is completed normally. This affects all shops running Elasticsearch or OpenSearch.
• Custom fields and read permissions Custom fields in several detail views are now locked if an employee only has read permissions. This prevents values from being changed accidentally.

Experimental MCP server for AI integration

For developers and theme customisations

• New component system and Vite dev server Shopware is introducing a component system for the Storefront based on Twig UX Components, describing it as the foundation for a future content system. This is accompanied by a new Vite-based dev server (composer storefront:dev-server). The previous watch:storefront command is deprecated.
• Theme configuration as CSS custom properties Colours and other visual settings are now also available as CSS custom properties, under the same name as the existing SCSS variables. In addition, theme.json now supports references to individual files from other bundles.
• Global JavaScript event system A new event system (emit/on) is now available via the central window.Shopware object, which is easier to use than the instance-bound events of the previous JS plugin system.
• Seven new foreign key resolvers for the Sync API Payloads can now reference entities via readable keys instead of UUIDs, for example via currency.iso_code, locale.code or payment_method.technical_name.
• Extended mail template API New routes for preview, simulation and sending allow a sales-channel-specific preview and the resolution of template data before sending.
• Configurable validity of order deep links via shopware.yaml (order.deep_link.expire_days).
• More robust state machine transitions They are now briefly locked per entity, so that concurrent calls no longer create duplicate history entries.
• Further tools a DAL flag IgnoreInUnusedMediaSearch for media:delete-unused, a bugfix for loading plugin snippets on a per-language basis, the new translation:list command including pseudo-languages, and a requirement-aware plugin installation order. Local filesystem adapters can now disable the enforcement of file permissions via enforce_file_permissions: false.

Note on deprecations

Particularly relevant

• Cancellation form – two fixes ahead of the deadline On MariaDB installations, the default page layout with the cancellation form was not displayed; this has been fixed. In addition, the cancellation button was only visible on smartphones and tablets after opening the footer column – now it is directly accessible. For 6.6 shops using the backported cancellation button, both fixes are important given the legal obligation coming into effect on 19 June 2026.
• Order completion during search server outages If Elasticsearch or OpenSearch briefly becomes unavailable during a purchase, an already saved order no longer fails (backport, same fix as in 6.7.11.0).
• reCAPTCHA v3 works again In the 6.6 line, Google reCAPTCHA v3 was skipped entirely. Protection against spam and bots in forms is now working again.

Further fixes

• Promotions More than 20 exclusions can now be stored.
• Order date filter A timezone error in the administration caused the filter to select the wrong orders. Fixed.
• PayPal "Pay Later" Now also available for orders created in the administration.
• Image element (CMS) Alignment and the "Stretch" option work correctly again.
• Order filter in the administration Some filters were not selected when clicked – this has been corrected.
• CMS language inheritance Content is once again correctly inherited across languages.
• Checkout The back button no longer inadvertently changes the quantity in the shopping cart.
• Shipping and payment method switching The storefront toggles now work reliably again with the checkout gateway.
• Rule Builder Fixed broken snippets in conditions, rule configuration is now reset after a condition change, and a date format issue in date range rules (DateRangeRule/Promotion) has been corrected.
• CMS block editing The editing elements remain accessible even when a large image has been inserted into a text element via HTML.
• Mobile navigation The menu no longer jumps to an unassigned root category instead of the main entry.
• Media management Replacing an image used in a teaser no longer triggers an error.

For developers

• Doctrine enum type mapping can be registered; corrected since-version in deprecation notices; an ACL key check in the PHPStan rule (backport); and MatchAllLineItems once again returns the correct result for an empty shopping cart.

The Security Fix

• Twig Security Update The Twig template engine used in Shopware has been updated to close a security vulnerability.
• Important – the Security Plugin does not help here Unlike other security updates, the Shopware Security Plugin cannot mitigate this vulnerability. The actual Twig update is required, which is only delivered with this patch release. Installing the update is therefore the only way to close the vulnerability.

Further Fixes

• Reduced server load when checking for extension updates (additional caching), removal of a no longer needed dependency, as well as a corrected shopware/conflicts version.

Important fixes

• Export download When downloading exported files via a temporary URL, the file name was missing. This has been fixed – downloads now receive a correct name again.
• Updated components Twig and Symfony have been updated due to security updates for these components.
• MariaDB An issue with default values under MariaDB has been fixed, and the associated database migrations have been adjusted.
• Permissions in the Administration Two permission fixes ensure that product translations can be read again and that tracking per sales channel receives the necessary permission.
• Further fixes This also includes minor adjustments, such as an updated Administration component library (Meteor) and the reuse of existing media files when importing icons for app payment methods.

Closed security vulnerabilities

• Administrator account takeover A recovery hash that was meant to be secret could be read via the Admin API and misused to take over someone else's admin account.
• Privilege escalation via the Sync API An administrator flag could be bypassed via an integration, allowing unauthorised elevated privileges to be obtained.
• Creating admin accounts without admin privileges A user with permission to create users, but without administrator status, could create fully-fledged admin accounts.
• Disclosure of admin usernames Minimal differences in the response times of the admin login could be used to determine valid administrator usernames.
• Order status changeable without sufficient permissions The status of orders could be changed via the Admin API without holding the permissions intended for this.
• Triggering payments for other people's orders Payment processes for other people's orders could be triggered without authorisation via the Store API.
• Open redirect via single sign-on Insufficient validation during SSO login allowed redirects to arbitrary targets – a typical entry point for phishing.
• Malicious code via SVG uploads Uploaded SVG files were not sufficiently sanitised, allowing malicious code to be injected (stored XSS).
• Manipulated server requests via media import The IP check during media import via URL could be bypassed, allowing the server to be tricked into making unwanted internal requests (SSRF).

What changes for file uploads

• Stricter validation of SVG uploads Shopware now checks uploaded SVG files against a fixed allow list before saving them. Active content such as scripts, event handlers or external references is rejected, while safe display elements remain permitted. Nothing changes for most shops – however, anyone using SVG graphics with special elements should check after the update whether these are still accepted. If needed, the allowed selection can be adjusted in shopware.yaml.
• Unified URL validation for media import URL validation during import via the external-link endpoint now follows the same rules as uploading from a URL. Relevant for custom adjustments: the previous method validateExternalUrl() is deprecated and replaced by assertValidExternalUrl(). Details can be found in UPGRADE-6.8.md.

Closed security vulnerabilities

• Takeover of administrator accounts A recovery hash that was meant to be secret could be read via the Admin API and misused to take over a third party's admin account.
• Privilege escalation via the Sync API An administrator flag could be bypassed via an integration, allowing unauthorised elevated privileges to be obtained.
• Creation of admin accounts without admin rights A user with permission to create users, but without administrator status, was able to create fully-fledged admin accounts.
• Disclosure of admin usernames Minimal differences in the response times of the admin login could be used to determine valid administrator usernames.
• Order status could be changed without sufficient permissions The status of orders could be changed via the Admin API without holding the permissions intended for this.
• Triggering payments for third-party orders Payment processes for third-party orders could be triggered without authorisation via the Store API.
• Malicious code via SVG uploads Uploaded SVG files were not sufficiently sanitised, allowing malicious code to be injected (stored XSS).

What's changing with file uploads

• Stricter validation of SVG uploads Shopware now checks uploaded SVG files before saving them and rejects active content such as scripts or external references. Nothing changes for most shops – however, anyone using SVG graphics with special elements should check after the update whether these are still accepted. The technical details of this change are documented in UPGRADE-6.6.md.

Bug Fixes

• Race condition during status changes Order and delivery status could fail or produce inconsistent states under high load. This issue has been fixed.
• Cart was unexpectedly emptied Under certain circumstances, the cart could be completely cleared during the session.
• Incorrect shipping cost tax for free items When a product became free through a promotion, the tax rate for shipping costs could be calculated incorrectly.
• Rounding error in price calculation A rounding issue in price calculation could, in rare cases, lead to cent differences.
• Salutation for delivery address ignored During registration, an individually selected salutation for the delivery address was not applied.
• Deleted SEO URLs not taken into account The SEO resolver did not correctly exclude deleted URLs during sorting.
• Timeout with large product quantities in promotions The selection field for additional fields in promotions ran into a timeout for shops with many products.
• Variant overview link missing The "Back to variant overview" link disappeared after saving the SEO URL.
• Cart error, empty price additional fields, incorrect order snippet, disabled purchase price field, modal display, cancellation form migration and API alias were also fixed.

Highlights

• Agentic Commerce Sales Channel (experimental) Shopware gains a new sales channel type for AI-powered sales. This allows product data to be provided as a JSONL feed for AI platforms such as ChatGPT. The Administration offers dedicated views for configuration, product mapping and usage statistics. The feature was already announced with 6.7.9.0 but is only now being delivered.
• Open Graph data for products Individual Open Graph data (title, description, image) can now be stored in the SEO section of product details. This ensures targeted previews when sharing product links on Facebook, LinkedIn and messengers – a long-awaited feature for social commerce.
• Live stock check on product detail pages For closeout products (clearance items), the quantity selector now checks the actual stock level live via a new Store API endpoint. This means customers always see the current availability, even on cached pages – important for shops with limited stock.
• 3D animations in the Storefront 3D models with embedded animations can now be played directly in the Storefront. Simply upload a model with animations, assign it to a product and display it in the shop.
• Sortable salutations Salutations (Mr, Mrs, etc.) can now be sorted via a new position field. This replaces the previous alphabetical sorting. The default salutations are automatically migrated – custom salutations should be checked in the Administration after the update and assigned a position if necessary.

Storefront

• More targeted variant display in listings Using the "Display best variant" setting, product listings and search results now automatically select the most suitable variant based on the current filtering. This means customers immediately see the most relevant version of a product.
• Cookie bar accessibility The cookie bar now automatically receives focus as soon as it is displayed – improving usability for screen readers and keyboard navigation. In addition, the cookie bar is moved to the beginning of the body element.
• Cancellation only for open orders The cancellation option in the customer account is now only displayed for orders with the status "open". Customers no longer see an invalid cancellation option for completed orders.
• Child line items for products Child line items (e.g. for bundles or configured products) are now displayed in the order confirmation, where available.
• Gallery with lazy loading The product image gallery now supports lazy loading and optimised thumbnail heights for faster page loading times.

Administration

• Internal comments in the order overview Internal order comments are now visible directly in the order list via a tooltip icon. This saves the detour via the detail page.
• More stable iframe integrations Iframe-based admin extensions (e.g. via the Meteor Admin SDK) are now correctly re-rendered when the location changes. Previously, outdated content could occur.
• Mixin route guards fixed Route guards in mixins (e.g. beforeRouteLeave) are now executed reliably – even for lazy-loaded routes.
• Media upload in batches Media uploads are now processed in batches to avoid overloading the browser and server when handling many files.

API & Core

• Extended rate limiters Login and OAuth endpoints now support additional rate limiters per user and per IP address. Configuration is optionally done via shopware.api.rate_limiter in shopware.yaml.
• JSONL export format In addition to CSV and XML, product exports now also support the JSONL format – the basis for the Agentic Commerce feed.
• SHA-256 for variant grouping The display_group field is now calculated using SHA-256 instead of MD5. The database column has been extended to VARCHAR(64). Plugins that access the old 32-character hash need to be adjusted.
• Search term indexing can be disabled The new shopware.product.search_keyword.indexing configuration allows search term indexing to be disabled – useful for shops using third-party search providers (e.g. Algolia, Doofinder).

App System

• App requirements validation Apps can now define requirements in the manifest (e.g. ). During installation, it is checked whether the app URL is reachable via HTTPS and does not point to a local development environment – misconfigurations are thus detected early.

Important Bug Fixes

• Dynamic product groups Fixed an error with dynamic product groups in Safari.
• Elasticsearch search Fixed an error where product search with Elasticsearch could produce a 500 error when a boolean custom field was configured as searchable.
• Order documents after customer deletion Document links in orders now remain available even after the associated customer has been deleted.
• Checkout comment Fixed an error when saving customer comments in the checkout.
• Variant sorting during migration The order of variant options is now correctly retained during migrations.
• CMS language inheritance Language inheritance for CMS content has been corrected – overrides in sub-languages are no longer lost.
• Robots.txt Duplicate directives for user agent blocks in robots.txt are now prevented.

Bug fixes

• Global modals in the Administration Global modal windows were rendered outside the content container of sw-desktop, which could cause display issues. The modals are now correctly placed within the content area.
• Default category layout during migration An error could occur during data migration if the default layout for categories did not exist. This case is now handled correctly.
• reCAPTCHA validation The removal of the required validator on reCAPTCHA input fields has been restored. Without this fix, forms with reCAPTCHA integration could not be submitted under certain circumstances.
• Cancellation form translations Duplicate translations in the CMS cancellation form have been cleaned up. This affects shops with a multilingual Storefront that use the new cancellation form introduced in 6.7.9.0.
• Minimum quantity for tiered prices The validation of the minimum quantity for price tiers (quantity range) has been adjusted – the stricter check will only take effect from the upcoming major version 6.8 onwards. This ensures backwards compatibility for existing configurations.

System requirements

• PHP Tested on PHP 8.2, 8.4 and 8.5
• Database Tested on MySQL 8 and MariaDB 11

Highlights

• Native right-of-withdrawal button (§356a BGB) Shopware integrates a complete, two-stage right-of-withdrawal process directly into the Core. Customers can now submit their withdrawal electronically via an online form – similar to the existing contact form. The solution can be flexibly placed in the shop via the Experience Worlds as a CMS element. A backport to Shopware 6.6 is also available. The feature is a free part of the Community Edition. Deadline for the legal requirement: 19 June 2026. Find out what you should do now in our detailed article on the right-of-withdrawal button.
• Structured data as JSON-LD The Storefront now optionally outputs structured data in the modern JSON-LD format – the standard preferred by Google. In concrete terms, this means Google can display your products in search results with star ratings, price, availability and further details (Rich Results). The Google Sitelinks search box is also supported. Enable via the JSON_LD_DATA feature flag (default: off). Technical details on the available schema types and extensibility can be found further below in the Storefront section. The previous microdata output is deprecated and will be removed with 6.8.0.
• Faster admin search with OpenSearch (experimental) Shops with large volumes of data can now run the Administration search via OpenSearch. This makes loading product lists and searching in the admin noticeably faster, and timeouts with large catalogues are a thing of the past. Enable via the ENABLE_OPENSEARCH_FOR_ADMIN_API feature flag.
• New "Agentic Commerce" Sales Channel Shopware introduces a completely new Sales Channel type specifically designed for AI-driven product distribution via platforms such as ChatGPT. A standard-compliant JSONL feed allows products to be made available directly to AI platforms, platform-specific feeds to be created (starting with the "OpenAI Product Feed"), and AI referral traffic to be measured via the existing affiliate infrastructure. A preconfigured feed template, customisable merchant metadata and ready-to-use feed URLs make setup easier. A forward-looking foundation for capitalising on growing AI-driven traffic for your own shop.
• SEO improvements with Open Graph data for products Individual Open Graph data can now be stored per product – title, description and image. This lets you control exactly how your products appear when shared on social networks (Facebook, LinkedIn, WhatsApp, X, etc.) or messengers. Together with the switch to JSON-LD, a real boost for SEO and social sharing.
• Internal comments on status changes Internal comments can now be added when the order, payment or shipping status changes, visible only in the Administration – not to customers. Useful for internal documentation and team communication.

Shopware Commercial Features (Evolve / Beyond)

• Shopware Nexus (Beta) A completely new Shopware service for the visual orchestration of workflows and integrations. Instead of setting up individual scripts or additional middleware, processes between Shopware and external systems such as ERP or CRM can be modelled event-based via a central workflow layer. This makes integrations more stable and easier to maintain in the long term. Currently available in beta status.
• Shopware Copilot – chat history The AI-powered assistant in the Administration now gets a chat history. Previous conversations and decisions remain directly visible in Copilot – there is no need to rebuild context from scratch.
• CAD-to-3D leaves beta The conversion of CAD files into web-ready .glb 3D models is now officially available. Converted models can be used as product media, in AR viewers, immersive layouts and scroll animations. Available via the Shopware Intelligence+ subscription or unlimited in commercial Shopware plans.
• Product Bundles (Blueprint) First version of the native bundle feature in Shopware. Merchants can create curated sets or cross-selling offers directly in Shopware. Variant support and quantity selection will follow in later development stages. Available from Shopware Evolve.
• Immersive Elements: Explosion Graphics Block New interactive 3D block for exploded views of complex products. Ideal for B2B applications such as machinery or spare parts management. Individual components can be annotated with explanations and linked to product detail pages. Available as an add-on module for €49/month.
• ZUGFeRD extensions Support for cancellation invoices, embedded cancellation invoices and credit notes in ZUGFeRD format. ZUGFeRD is based on the European e-invoicing standard EN 16931 and is increasingly becoming mandatory in Germany for standardised electronic invoice processing.
• Improved GMV collection Automatically installed in all Shopware shops running at least version 6.7.8. For Community Edition shops, acceptance of the terms and conditions from version 3.2 onwards, as well as a link to the Shopware account, is required.

Storefront

• New Storefront Component System Shopware introduces a new component system as well as a global JavaScript event system as the foundation for future Storefront enhancements. Developers benefit from a more structured basis for custom components and interactions.
• New JSON-LD schema types Newly added include a WebSite schema with SearchAction (Google Sitelinks search box), an Organization schema with shop logo, ItemList on category and search result pages, as well as VideoObject entries for product videos. The Product schema on the detail page now includes all product images, AggregateRating with correct ratingCount, up to 10 individual reviews, OfferShippingDetails, dimensions as QuantitativeValue, itemCondition, gtin13 (EAN) and mpn (manufacturer part number).
• JSON-LD templates extensible Each schema resides in its own Twig template under storefront/layout/structured-data/. Using the familiar sw_extends approach, plugins and themes can extend or override individual schemas – e.g. adding a ContactPoint to the Organization schema.
• HEAD requests no longer trigger double opt-in Some email clients send HEAD requests to links in emails, inadvertently confirming registrations. Now only genuine GET requests trigger the double opt-in.
• Checkbox for digital content moved The access confirmation for digital products is now located directly next to the order button – legally cleaner and clearer for customers.
• Runtime error overlay disabled in Webpack dev server The disruptive overlay for runtime errors in hot reload mode has been disabled. Errors remain visible in the browser console.

Administration

• Custom Open Graph data for products In product management, custom Open Graph data can now be stored per product – a separate title, description and image for display on social networks and messengers, independent of the product's standard metadata.
• CMS data mapping for media custom fields Media custom fields are now available as a data mapping source for image elements in category and product CMS layouts – no more workarounds needed.
• Product filter by product number with partial search The product list in the Administration now supports searching by parts of a product number.
• Natural sorting for variants Variants are now sorted naturally when sorting by name (e.g. "S, M, L, XL" instead of alphabetically).
• Bulk deletion of documents Documents can now be deleted in bulk via the Sync API and in the Administration.
• Loading indicator for CMS forms Submit buttons in CMS forms now show a loading indicator while processing.
• Filterable product types The product list can now be filtered by configurable product types.
• Administration: robots meta tag The Administration now sets noindex, nofollow – preventing accidental indexing by search engines.

Core

• Default CMS page is now stored persistently Previously, the default CMS page for categories was only set at runtime – it is now written to the database when saved. A migration automatically populates existing categories retroactively.
• Inheritance for product main categories Main categories are now inherited from the parent product if not explicitly set on the variant. This reduces maintenance effort for variant products.
• Reduced HTTP cache invalidation on config changes SystemConfigService::set(), setMultiple() and delete() now accept a new $silent parameter. When silent=true, the HTTP cache tag is not invalidated – preventing "invalidation storms" when writing internal config values.
• Automatic cleanup of expired password reset tokens A new scheduled task removes expired entries from the customer_recovery table daily (all older than 48 hours). The table no longer grows unbounded.
• New entity definition field types The attribute-based entity system now supports new types: FieldType::EMAIL, #[Password], #[ListField] and FieldType::PRICE.
• Product Slider CMS element Two new events (ProductSliderStaticCriteriaEvent, ProductSliderStreamCriteriaEvent) allow the product criteria in the slider to be adjusted via subscribers.
• Product stream deletion protection Product streams used in product exports can no longer be deleted. Foreign key changed to RESTRICT.
• Cart race condition fixed Carts that have already been deleted are no longer accidentally recreated during parallel requests.
• OAuth token revocation Implemented in compliance with OIDC 3.1.2.1 and RFC-7009.
• Heartbeat event for apps A new app.system_heartbeat event signals to apps on a weekly basis that the Shopware instance is active.

API

• Newsletter routes with response body Instead of 204 No Content, /store-api/newsletter/subscribe, /confirm and /unsubscribe now return 200 OK with {"success": true, ...}. The old methods are deprecated – please switch to the *WithResponse() variants.
• External thumbnail URLs for media Two new endpoints (POST/DELETE /api/_action/media/{id}/external-thumbnails) enable storing pre-generated thumbnails from CDNs. A thumbnails array can be provided directly when creating external media.
• Minimum values for product price quantities quantityStart and quantityEnd in ProductPriceDefinition now require a minimum value of 1.
• OpenAPI enums via DAL choice flag DAL fields can now declare permitted values, which automatically appear in the OpenAPI schema. Optionally with strict write validation.

Hosting & Configuration

• Long-lived MySQL connections Support for libraries such as doctrine-mysql-come-back, which wrap the standard DBAL connection – relevant for worker and consumer setups with long runtimes.
• System config overrides in staging mode The system:setup:staging command now allows preconfiguring system config keys via a YAML structure – including Sales Channel-specific overrides. Ideal for automated staging setups.
• Custom HTTP client for S3 S3 client creation now accepts an optional HttpClientInterface. This enables custom timeouts, retry strategies and HTTP protocol versions for S3 operations.
• Tested on PHP 8.2, 8.4 and 8.5 as well as MySQL 8 and MariaDB 11.

Deprecations (Preparation for 6.8.0.0)

• Microdata output All itemscope/itemtype/itemprop attributes in the Storefront are deprecated. From 6.8.0, only JSON-LD will be used.
• Newsletter route methods subscribe(), confirm() and unsubscribe() are deprecated – please switch to the *WithResponse() variants.
• cmsPageIdSwitched field Deprecated on CategoryDefinition and CategoryEntity.
• TemplateGroup class \Shopware\Core\Content\Seo\SeoUrlTemplate\TemplateGroup will be removed in 6.8.0.
• EntityDefinition default fields The application order of createdAt/updatedAt will change in 6.8.0 – please check any custom definitions that add these fields manually.
• Route /api/_action/mail-template/validate Will be removed without replacement.
• Twig block page_product_detail_product_buy_button_label Please use component_product_box_action_buy_button_label going forward.
• silent parameter in SystemConfigService From 6.8.0, silent=true will be the default. Clients should set the parameter explicitly from now on.

Important Bug Fixes

• Price inheritance for product variants Price inheritance is now applied correctly.
• Rating average for variants The rating average is now calculated correctly for products with variants.
• Promotion codes in lowercase Voucher codes are now redeemed correctly even when entered in lowercase.
• Cart merge with product set promotions Cart merges now work correctly again.
• Race conditions in the cart Several race conditions during concurrent cart usage (persist/load, order completion) have been fixed.
• Race condition on theme assignment (MariaDB) Error when using MariaDB fixed.
• Digital products Download in the Storefront reliably possible again.
• OpenSearch with NotEquals filters Faulty behaviour with NotEquals filters on nested fields corrected.
• ZUGFeRD documents Label and file name corrected; XML invoices are now correctly attached to emails.
• Sales Channel name in email templates Translations are now displayed correctly.
• Number ranges starting at zero An error whereby number ranges could start at zero has been fixed.
• Timezone error in date range rules Fixed.
• Numerous other fixes in Administration, Storefront, cache, Flow Builder, consent system and performance optimisations – the full list can be found in the official release notes on GitHub.

Classification

• Release Type Patch release
• Target Audience Shops on Shopware 6.6.x that have not yet migrated to 6.7
• Extended Support As part of Extended Support, the 6.6 series continues to receive bug fixes and security updates. Active development of new features is now taking place in 6.7.x.

Important New Features & Backports

• ZUGFeRD Documents (Backport from 6.7) Support for additional ZUGFeRD document types has been backported to the 6.6 series. Relevant for merchants who need to comply with the European e-invoicing standard EN 16931.
• ACL Checks for Twig Template Routes (Backport from 6.7) Specific ACL checks have been added for routes that render Twig templates. A security-relevant improvement.
• Translated CMS Slot Overrides Overrides of individual CMS slots in different languages are now handled correctly.
• Installer Now Uses DATABASE_URL The installer now takes the DATABASE_URL environment variable into account – relevant for container and cloud setups.

Administration

• Autocomplete Now Shows More Than 25 Entries The autocomplete fields in the backend previously only returned the first 25 entries – important addresses and records were left out. This behaviour has been corrected.
• History Log Now Shows the Correct User In the history log, the "Last changed" field sometimes failed to display the correct user. Fixed.
• Custom Field Data Mapping for Media Media custom fields were incorrectly treated as text in the data mapping. They are now correctly interpreted as the media type.
• Admin Search: Indexing Events & Iterator Versioning Improved handling of admin search indexing and versioning of the iterators.
• Removal of the Dependency on maltyxx/images-generator The library, which is no longer required, has been removed from the dependencies.

Storefront

• Revocation Form – Field Validation Errors in the field validation of the revocation form have been fixed.
• Revocation Form – Notice Text on Multiple Clicks A misleading notice text shown after clicking the submit button multiple times has been corrected.
• Order Cancellation Only Visible for Open Orders The cancellation function was mistakenly also shown for already completed orders. It is now only displayed for open orders.
• Google reCAPTCHA With Multiple Forms When multiple forms were embedded on the same page, reCAPTCHA was only checked for the first form. This behaviour has been corrected.
• Product Image Alt Text Falls Back to Product Name Again Since 6.6, the fallback to the product name on the product detail page was no longer active. Fixed.

Core

• Buy Box CMS Element: Missing Association Fixed The buy box element referenced a non-existent association. Fixed.
• Unknown Feature V6_8_0 An error in the feature flag handling for the upcoming major version 6.8.0 has been corrected.
• IncrementSqlStorage The return type for an empty database entry has been corrected – it no longer returns an incorrect string.
• MIN() Function in the cheapestPrice Accessor The cheapestPrice accessor now supports the SQL MIN() function. (Community contribution by Ullrich Löblein)
• PromotionRedemptionUpdater – Performance Performance optimisation in the processing of promotion redemptions.
• Race Condition Between Cart Persist and Cart Load A race condition already fixed in 6.7 has been backported to the 6.6 series.
• Promotion Code in Lowercase Individual promotion codes were not marked as redeemed when entered in lowercase. Fixed.
• Promotion Set Products Can Be Removed Again It was not possible to remove products from a promotion set in the cart. Fixed.
• Invoice Number Selection for Credit Notes and Cancellation Invoices The selection of the invoice number for credit notes and cancellation invoices has been corrected. (Community contribution by Justus Geramb)
• Product Search With Disabled Search Fields If all fields in product_search_config_field were marked as "not searchable", certain product searches would fail with an error. This is now handled correctly.
• Performance in Category Children Resolution Fixed a performance issue when resolving category children.

Critical bug fixes

• Webhook on order status change An error in the processing of webhooks for status changes (undefined array key) could lead to a server error when strict error display was enabled. This particularly affected shops with active Flow actions or app webhooks that respond to order status changes.
• Digital products – legacy states repair A bug in the indexer for the product.states field meant that rules and flows using the "Line item with product status" condition did not work correctly. This primarily affected the automatic dispatch of downloads after purchasing digital products. This release automatically repairs affected digital products with missing legacy states via a one-off UpdatePostFinishEvent subscriber. The repair runs automatically on the first update and is marked as complete in the app_config table.

Security fixes

• GHSA-c4p7-rwrg-pf6p – Duplicate signature verification during app re-registration During the app re-registration process, the signature verification was not performed correctly. This vulnerability has been closed to prevent tampering with app communication.
• GHSA-gqc5-xv7m-gcjq – Account enumeration via Store API It was possible to determine the existence of customer accounts via the Store API. This information disclosure has been restricted.
• GHSA-7vvp-j573-5584 – DeepLinkCode filter validation Validation of the deepLinkCode filter type has been tightened to prevent unauthorised access to order data.

Bugfixes

• Variant pre-selection in category listing The pre-selection of variants in product listings on category pages now works correctly again in the 6.7 series.
• Promotion rule "All – Are none of" The "Are None of" condition for promotions now delivers the expected results again.
• Regulation price for cart line items A missing regulation price (regulation price) for line items has been fixed.
• Accessibility Input fields now have the autocomplete attribute; various Level A accessibility issues in the customer account have been corrected.
• Document footer The placement of the footer in generated documents (invoices, delivery notes) has been corrected.
• Profiler fix $title is now correctly used as a key in start(), so that stop() reliably cleans up.
• Nested associations Reading associations via the parent entity with multiple associations of the same type has been fixed.
• 500 error with Commercial plugin An error with shop version 6.7.2.0 in combination with Commercial version 7.1.2 has been fixed.
• Migration command The database:refresh-migration command works as expected again.

Security Fixes

• GHSA-c4p7-rwrg-pf6p – Duplicate signature check during app re-registration The signature verification in the app re-registration process has been corrected.
• GHSA-gqc5-xv7m-gcjq – Account enumeration via Store API The ability to determine existing customer accounts via the Store API has been restricted.
• GHSA-7vvp-j573-5584 – DeepLinkCode filter validation Validation of the deepLinkCode filter type has been tightened.

Classification

• Release type Patch release (bugfixes & stability)
• Target audience Shops on Shopware 6.6.x that have not yet migrated to 6.7.x
• Extended Support The 6.6 series is in Extended Support and will continue to receive selective bugfixes and security updates until Shopware 6.8 becomes available

Highlights

• Internal comment on status changes Internal comments can now be added to the state machine history – visible only in the Administration, not to customers. Ideal for internal documentation when order statuses change.
• Internal product streams Product streams can now be marked as "internal" so that they do not appear in the Administration's selection lists – perfect for streams used by the system or by plugins.
• Session deadlock fix A critical fix for deadlocks with file-based sessions in combination with Symfony's cache stampede protection. Particularly relevant for environments without Redis.
• System requirements Tested on PHP 8.2, 8.4 and 8.5 as well as MySQL 8 and MariaDB 11.

Shopware Commercial Features

• New possibilities for videos Shopware 6.7.8.0 offers extended functionality for working with video content in the shop. Details can be found in the official Shopware blog post on the March 2026 release news.
• Extended B2B functionality with individual pricing B2B customers benefit from extended pricing with individual, customer-specific prices. This feature builds on the existing B2B Components and is available from Shopware Evolve onwards. More information can be found in the official Shopware blog post.

Administration

• Variant configuration groups as a computed property In sw-product-detail-variants, configSettingGroups has been converted from a data property to a computed property – more stable and consistent.
• Deprecation of the items prop in sw-entity-listing Going forward, dataSource should be used instead of items to ensure consistency with the parent sw-data-grid component.
• Reactive notification translations Notifications now store translation keys instead of pre-translated texts – switching languages updates notifications automatically.
• Help text for colour picker custom fields Custom fields of the "Colour picker" type now support a help text in the Administration.
• Adjusted clearable button behaviour The showClearableButton prop in sw-select-base now takes the required attribute into account – for non-required fields, the button is now shown by default.

Core & API

• Custom fields in the Elasticsearch index Custom fields used in product sorting, product streams or apps are now taken into account during product indexing in Elasticsearch.
• Deprecation of increment-based message queue statistics The previous system will be removed in v6.8.0.0. The new endpoint GET /api/_info/message-stats.json replaces GET /api/_info/queue.json. It can be disabled immediately via shopware.admin_worker.enable_queue_stats_worker: false.
• New TableHelper class \Shopware\Core\Framework\Util\Database\TableHelper enables straightforward checks for tables, columns, indexes and foreign keys.
• Improved migration generator Foreign key names now use the format fk____ instead of the previous dot-based format. In addition, CASCADE DELETE is now automatically set for translation tables.
• Optimised CategoryIndexer The tree/child count updater is now skipped if parentId has not changed; the breadcrumb updater only runs on name changes – resulting in significantly faster indexing on updates.
• Primary key validation in the dal:validate command Now detects discrepancies between database primary keys and entity definition flags, preventing silent errors during entity hydration.
• doctrine/dbal updated to version 4.4 Brings many deprecations, particularly in the SchemaManager – affected projects should review the upgrade guide.

Storefront

• Sales and packaging information on the PDP Products with advanced pricing now display sales and packaging information directly on the product detail page.
• Default breakpoints in the theme configuration The previously hard-coded breakpoints (xs to xxl) are now available as configurable theme config fields – ideal for theme developers who want to define custom breakpoints.
• Screen reader support for static alerts The new announceOnLoad parameter ensures that statically rendered alert boxes are reliably read out by screen readers after the page has loaded.

App System

• Custom headers for app flow action webhooks Custom headers in app flow action configurations are now correctly sent in asynchronous mode (message queue) as well – previously they only worked with synchronous processing.

Hosting & Configuration

• Deprecation of outdated HTTP cache reverse proxy options Several configuration options relating to shopware.http_cache.reverse_proxy (e.g. use_varnish_xkey, ban_method, purge_all) have had no effect since 6.7.0.0 and are now officially deprecated. They will be removed in 6.8.0.0.
• Configurable Elasticsearch shard and replica count The number of shards and replicas for Elasticsearch indices can now be controlled via environment variables (SHOPWARE_ES_NUMBER_OF_SHARDS, SHOPWARE_ES_NUMBER_OF_REPLICAS and the corresponding admin ES variables).
• Session deadlock fix for file-based sessions A new configuration option, shopware.cache.disable_stampede_protection: true, prevents ABBA deadlocks when using file-based sessions and cache simultaneously. Redis remains the recommended solution.

Important Bug Fixes

• Google reCAPTCHA Improved visibility of the input field and error handling for multiple forms on a single page.
• Image zoom modal Touch gestures in the zoom modal work correctly again.
• Tax inconsistency with variants Tax rates are now applied consistently for variant products.
• Partial entity loading Fixed an error with nested associations when using partial loading.
• Sales channel-bound customer logout Fixed an issue with logging out sales channel-bound customers.
• Offline theme compilation Fixed an error occurring during theme compilation without a network connection.
• Required fields with empty value Required fields can no longer be saved with an empty value.
• Promotion rule evaluation Fixed an error in the evaluation of promotion rules.
• Optimised default SEO category selection Improved the automatic assignment of the default SEO category for products.

Important bug fixes

• Customer account / addresses The address logic in the AddressDetailPageLoader was corrected so that customer addresses are once again loaded and processed reliably.
• Administration / orders Issues loading order editing in the Administration have been fixed – particularly relevant for more complex orders.
• Elasticsearch compatibility The Elasticsearch requirement in the core bundle was adjusted to avoid incompatibilities and setup issues.

Important Bug Fixes

• Customer Account / Addresses The address logic on the detail page was corrected so that addresses in the customer account are once again loaded and processed reliably.
• Administration / Orders Loading of order processing was stabilised – particularly relevant for shops with many orders or complex order processes in the admin.

Highlights

• Symfony 7.4 Update The Symfony components have also been updated to version 7.4 in the 6.6 LTS – important for long-term maintainability.
• Compatibility with older OpenSSL versions IAP decoding now works reliably again.
• More stable product display Product listings once again consistently show the main variant instead of random variants.

Core & Database

• Removal of outdated PDO constants Removes deprecated PDO usage and ensures better PHP compatibility.
• Optimised DAL queries Unfiltered many-to-many relations are no longer loaded unnecessarily – improved performance and reduced memory usage.
• Attribute entities reliably available Automatically configured attributes are now registered correctly.

Administration & Backend

• Improved stock editing Bulk edits now also allow negative stock levels (e.g. for pre-orders or backorders).
• Custom fields stabilised Fixed errors when inserting tables in custom fields.
• PHPStan updated Improved static code analysis for developers and CI pipelines.

Documents, Emails & Workflows

• Email attachments preserved Attachments are no longer lost during flow actions.
• Document footer corrected The placement of footer content in documents (e.g. invoices) is consistent again.

Highlights

• Symfony 7.4 update All Symfony components have been updated to version 7.4. Important: the PHP Redis extension is now required in version ≥ 6.1.
• Significantly improved DAL performance Nested filter groups now use EXISTS subqueries instead of multiple LEFT JOINs – massive performance gains for complex criteria.
• Product type instead of product states Introduction of the new product.type field (e.g. physical, digital) as a replacement for the previous states.
• Extended GA4 integration Significantly improved tracking data across the entire checkout and listing funnel.

Core, Performance & Architecture

• Accelerated product category denormalisation Optimised SQL queries reduce runtimes from several seconds to under 1 ms for large catalogues.
• Immutable DAL fields Critical fields such as custom_field.name or custom_field.type can no longer be changed after creation – protection against inconsistent system states.
• RequestParamHelper New helper as a replacement for the deprecated Request::get(), with a clean separation of query, request and attribute bags.
• Domain exceptions Factory methods now return concrete exception types instead of generic RuntimeExceptions.

HTTP Caching & Infrastructure

• Tag-based cache invalidation Additional Store API routes support cache tags with automatic invalidation.
• Fine-grained control via HttpCacheCookieEvent New doNotStore option allows targeted prevention of caching for individual responses.
• Flash messages no longer cacheable Prevents messages from appearing for other users.
• Logging for cache tags Invalidations can optionally be logged at info level.

Administration

• Loading indicator on Administration start A loading screen now appears during slow initialisation instead of a blank area.
• Media model viewer 3D models can now be viewed interactively directly within the media module.
• Configurable searchability for custom fields Searchability can now be explicitly enabled – smaller indexes and improved performance.
• Mail templates prepared for 6.8 Separation of templates and header/footer, with several deprecations announced.

Storefront & User Experience

• Language-dependent cookie consent Cookie consent is now stored per language – no repeated banner when switching languages.
• Improved accessibility Cookie dialog with toggle switches, ARIA attributes and semantic buttons.
• Navigation helper New JS variable window.activeNavigationPathIdList for individual navigation highlights.
• iOS Safari fix The first tap on product detail pages now works correctly again.

Tracking & Analytics (GA4)

• Extended event data for add_to_cart, purchase, view_item, and others.
• New events such as view_cart, add_shipping_info and add_payment_info.
• Optional tracking of the offcanvas shopping cart.
• Recommended funnel optimisation through targeted offcanvas control.

Administration & Internationalisation

• Reactive snippets The handling of language snippets has been revised so that changes to locale messages are now correctly reflected reactively in the Administration. This particularly improves working with multilingual setups and dynamic language changes.

HTTP Cache & Technical

• TypeError in HTTP cache fixed An error occurred when the _httpCache route attribute was defined as a string. This case is now handled correctly and no longer leads to runtime errors.

Performance & Stability

• Faster category denormaliser The processing and preparation of categories has been made more performant, which can have a positive impact on indexing and backend performance.
• DAL optimisation for complex filters For nested filter groups, more efficient conditions are now generated (EXISTS instead of LEFT JOINs) – this can noticeably speed up queries, especially with large volumes of data.

Search

• Slash and backslash in search terms Characters such as / and \ now work correctly in search, provided they are configured as "preserved characters".

Checkout & Storefront

• Improved captcha validation Captcha validation now respects the errorRoute parameter, so users are correctly redirected to the right route in the event of errors.

Products & Prices

• Variant price across sales channels The cheapest price of a variant structure is now applied more consistently across multiple sales channels.

SEO & Sitemap

• New event for sitemap generation An event has been added that makes sitemap generation more extensible (e.g. for plugins or custom processes).

Technology, Composer & CI

• More stable Composer/Require Adjustment relating to minimum-stability to avoid unexpected dependency resolutions.
• CI improvements Optimisations for build/downstream processes (e.g. skipping when write permissions are missing) as well as internal maintenance adjustments for update pipelines.

Security Improvements

• Security Fix Fixed the processing of array callables in the security extension to prevent potentially abusive or unexpected calls.

Highlights

• HTTP caching rework (experimental) New caching policies enable cache behaviour per area (Storefront, Store API) and per route – can be enabled via the feature flag CACHE_REWORK.
• Store API becomes more cache-friendly Selected endpoints are marked as cacheable and return appropriate Cache-Control headers – for noticeably better performance in headless/Store API setups.
• Security boost for customer accounts New flow: when a password is changed, customers automatically receive a confirmation email – helpful for spotting suspicious activity more quickly.
• PHP 8.5 support Shopware is now fully compatible with PHP 8.5.

Store API & API

• Store API: HTTP caching for many routes Several core endpoints (e.g. navigation, categories, CMS, products, search, reviews) now support HTTP caching and have been optimised for GET requests.
• Complex criteria without URL limit Criteria can now be passed in compressed form in GET requests (JSON → gzip → base64url) – as a workaround until a standardised QUERY method becomes available.
• Improved document download Document downloads now return the file type based on the Accept header (default: PDF if the header is missing or set to */*).
• Video cover management New API endpoint for setting or removing a cover image for video media. References are automatically cleaned up when a cover image is deleted.

Core & Developers

• New caching logic & deprecations Previous mechanisms around sw-states and currency handling are being gradually phased out. Control over cache behaviour will in future be handled centrally via the sw-cache-hash cookie.
• Preparing for “Cache also for logged-in customers” The deprecations make it clear: in the next major version, HTTP cache will by default be more active for logged-in customers or filled shopping carts. Extensions should be prepared for this.
• New struct hydration (assignRecursive) For import/export & rehydration of complex data structures, a recursive assign method is now available that can also restore nested structs/collections (not intended for performance-critical loops).
• SEO URL performance for categories SEO URLs for child categories are no longer generated synchronously but asynchronously via the indexer – significantly speeding up category indexing.

Administration

• Loading screen for longer initial load times If the admin page takes longer than two seconds to load at startup, a loading indicator is now shown instead of a blank screen.
• Settings search There is now a search bar (top right) in the settings module to find settings more quickly using search terms.
• Numerous detail optimisations Various UX and performance improvements, including media upload, data grids, snippets, and form/editor display.

Storefront

• IDN email addresses Storefront validation now supports domains with internationalised characters (IDN). Default forms are prepared for this.
• UI/accessibility and detail fixes Numerous minor adjustments improve accessibility, stability, and display (including email/order communication, slider, offcanvas).

Hosting & Configuration

• Elasticsearch: language analyser configurable The SHOPWARE_ES_USE_LANGUAGE_ANALYZER setting controls whether search queries use language-specific analysers (fuzzier) or a whitespace analyser (more precise).
• Staging mode: automatically disable extensions New configuration allows defined extensions to be automatically disabled when staging mode is activated.
• Deprecated HTTP cache parameters Several previous HTTP cache parameters/environment variables are deprecated and no longer have any effect when CACHE_REWORK is active (removal planned for 6.8).

Security Improvements

• Improved input validation on the login page Request parameters are now validated correctly, reliably preventing manipulation attempts and invalid input.

Bug Fixes

• Theme Manager tabs fixed In the 6.7.x series, the tabs in the Theme Manager were sometimes not displayed. This behaviour has been fixed, so that all configuration areas are once again fully visible and usable.

Security Improvements

• Improved input validation on the login page To prevent manipulation and unauthorised input, parameters in the login form are now validated correctly. This further increases the security of sensitive customer information.

Content Management & Shopping Experiences

• Inheritance made visible: Admin now shows whether content in a Shopping Experience has been inherited or overridden locally.
• Live update of inheritance status: changes to content elements now update the status immediately.
• Resetting local adjustments: a new button allows the original layout to be restored.
• Warnings on layout changes or deletion: notices now appear when local changes would be lost.
• Improved CMS handling with clearer notices and corrected error messages when deleting sections.

Optimised Tax Logic for B2B & B2C

• Revised tax detection with a clear distinction between B2B and B2C customers.
• Error-free application of tax rules for configurations such as "tax-free for B2C".
• More stable checkout process, particularly for guest checkout and shipping method changes.

SEO, robots.txt & Search

• Extended robots.txt configuration with support for custom user-agent blocks.
• New parser logic with better error messages and more transparent handling.
• Improved SEO control for sensitive areas such as checkout and shopping cart.
• Improved URL composition and correct resetting of canonical IDs.
• Optimised search function: special characters now work reliably, and products are found more consistently.
• Improved OpenSearch compatibility.

Shopware Copilot & Commercial Features

• New Copilot Skills Overview providing a centrally accessible view of all skills.
• Transparent skill management as the foundation for upcoming automations.
• Current skills: Knowledge Assistant and Data Insights (beta); more to follow in 2026.
• Flexible extensibility for Shopware Commercial customers.

Admin & Backend Usability

• Improved select lists with reliable lazy loading on scroll.
• Search in Import/Export has been extended and now supports technical profile names.
• Stricter validation of product numbers to prevent errors.
• Clearer error messages for imports, documents & demo data.
• New table information, such as username, in the Import/Export list.
• Corrected sidebar display for more consistent UI width.
• New CLI command for replacing Sales Channel URLs.

Storefront, Navigation & User Experience

• Corrected review stars with improved accessibility.
• Optimised navigation logic: menus now close more reliably.
• New tooltips for product images in the category listing.
• Optimised cross-selling animation with adjustable speed.
• Corrected SVG display and fixed document search errors.

Products, Variants & Catalogue Logic

• Correct calculation of the lowest variant price across sales channels.
• Higher decimal precision for weight units.
• Pack unit can now be set as an essential characteristic.
• More stable deletion of variants with correct dependency checking.
• Bug fixes for dynamic product groups.
• New review filters in Admin.
• Media schema for LineItem covers for better API integration.

Checkout, Payments & Tracking

• More stable guest checkout with correct address processing.
• Blocked shipping methods now switch correctly without interrupting checkout.
• Transactions can now be finalised multiple times, making payment callbacks more stable.
• Improved tracking, preventing multiple triggers.
• Unique user IDs for analytics and more reliable activation of services.
• Corrected Google Consent Mode v2 and separated Vimeo/YouTube consents.

Theme, Media & Automatic Clean-up

• Theme configuration folder is now created reliably.
• New save dialogue for media in Admin.
• Corrected favicon path in Admin modules.
• Further rollout of the Meteor token styles.
• Fixed issues with the magnifier zoom.
• New clean-up task to automatically remove damaged media caused by aborted uploads.

Developer News & Technical Improvements

• Extended Store API documentation thanks to improved OpenAPI schema generators.
• New generic JWT framework for easy use of JWTs in Sales Channels.
• Improved database stability thanks to an overridable Doctrine wrapper connection.
• Improved sorting logic for exports.
• More stable app lifecycle for complex entity relationships.
• New service for detecting reserved URLs.
• Fixed conflicts with cache clearer and context token.
• Updated PHPStan setups and further code quality improvements.

Important Changes

• Improved shop ID verification In systems with atomic deployments, the shop ID is now checked more reliably, improving stability and consistency.
• Correct display of rating stars Partial ratings are once again displayed correctly positioned in the Storefront.
• Analytics fully active again Missing system services for Storefront Analytics and Google Analytics have been added.
• Shipping methods corrected Blocked shipping methods are now reliably switched, ensuring a valid shipping method is always available.
• Bug in guest checkout fixed Changing the default address no longer results in a 403 error for guest orders.

Security Vulnerability

• Password Recovery Password reset links did not automatically expire when an email address was changed. This behaviour has been corrected – links now expire properly following an email change.

Security Vulnerability

• Password Recovery A vulnerability caused password reset links not to be automatically invalidated when a user changed their email address. This behaviour has been fixed – recovery links now expire correctly upon every change.

General Improvements

• Optimised management of media, shipping details, and modal windows in the Administration.
• More stable processing for cache mechanisms and message queues.
• Improved error output and logic in the CI environment and the app loader.
• Updated health check API for more reliable system monitoring.

Administration & User Interface

• New user actions in the media sidebar and fixed media search navigation.
• Fixed errors in user creation, sidebar width, and SCSS colour validation.
• Revised inner spacing in the Admin modal and improved visual consistency of Admin components.
• Added Admin notification transformers for clearer system messages.

Storefront & User Experience

• Improved accessibility through aria-labels on CMS image links.
• Fixed non-functioning offcanvas cookie links and interactive cookie settings.
• Improved handling of Google Consent Mode v2 and separated consents for Vimeo & YouTube.
• Google reCAPTCHA is now only loaded once cookies have been accepted.
• Improved display and navigation within the cookie offcanvas area.

Products, Catalogue & Search

• Fixed an error in the clearance sale logic – discounts are now correctly applied to basket items as well.
• Search results now show products whose parent product number matches.
• Product streams can be loaded via OpenSearch – improved performance with large data volumes.
• Added an option to define additional sorting criteria for products.
• Fixed the SEO URL preview – generated previews now show correct paths again.

CMS & Experience Worlds

• Granular inheritance for slot_config overrides enables more flexible CMS structures.
• New Twig blocks in product boxes reduce redundant code.
• CMS image elements can now be given a fixed loading priority (fetchpriority="high").
• Added an option to trigger form validation automatically (FormAutoSubmit).

Technology & Developers

• Further improved compatibility with MySQL, Symfony, and OpenSearch.
• New configuration option to limit message size in the queue.
• Fixed an issue with global cache locking during kernel restarts.
• Implemented separate cookie consents for video providers.
• Improved handling of IAP decoding with older OpenSSL versions.
• Webhook logs are now reliably cleaned up, and errors in the queue process have been removed.
• Added new events for loading entities in the sitemap.
• The COMPOSER_PLUGIN_LOADER variable option is now taken into account in the CLI command.
• Plugin creation now includes automatically generated .gitignore files.

Highlights

• Compatibility Minimum version for MySQL raised, Symfony components updated and OpenSearch 3.x now supported.
• Performance & Stability Faster property retrieval for products and a fix for a recursive cart lock.
• Search & SEO Correct date/time format in Elasticsearch, more stable document number search in the admin, as well as several SEO URL corrections.

Storefront & Shopping Experience

• Fixed the zoom function to prevent oversized windows.
• Corrected the display of line item taxes when using a tax provider.
• Relevant products without a preview are now shown in the search.
• Fixed blank invoice pages and corrected a squashed document line list.
• Added a global format for blockquotes.

Administration & Orders

• Fixed duplicated address display in sw-order-detail.
• Searching for document numbers now returns results again.
• Correct exception when updating an entity fails due to a foreign key constraint.
• Fix for blank invoice pages and corrected slot configuration.

Products, Prices & Catalogue

• Fixed advanced prices for discounts on fixed-price items.
• Fixed an error when removing a product's "main category".
• Fixed inconsistent SEO URLs for cross-selling products and resolved a database error when changing SEO URLs.

Search & SEO

• Validation of canonical SEO URLs now also occurs on creation, even without a specified path.
• Elasticsearch: fixed the date/time format.
• Moved the search configuration loader class into the Core bundle and made use of the minimum search term length from configuration tables.

Technology & Developers

• Restored ResetInterface support in long-running runtime environments.
• Fixed an issue when removing Composer plugins.
• Custom fields with the same name as a foreign key are now handled correctly.
• The .docx file extension is now permitted.
• Updated SwitchContextEvent and fixed the API-aware flag for proxy requests.
• Fixed the customer context on login when the entry in sales_channel_api_context had expired.
• Fix for cache cookies to prevent cache poisoning.
• Fixed the initialisation of DiscountCampaignStruct and added additional properties.

What has been improved

• Enhanced data protection Confidential data is no longer accidentally included in the CSV export.
• Secure upload The plugin upload has been secured to prevent manipulation.
• More stable media management Media files are better protected against unauthorised access.
• Protection against external access Server requests via invoice functions can no longer be misused.
• Reliable cancellation logic Orders can now only be cancelled if refunds are enabled.

Further improvements

• Compatibility established with OpenSearch 3.x.
• Improved search in the Administration.
• Bug fix when deleting active customer addresses.
• Optimised processing of product rules and discount codes.

Important security improvements

• Secure handling of media files Unauthorised access to protected media content is now reliably prevented.
• Data protection during CSV export Personal or confidential information is no longer accidentally output during export.
• Protection against external requests (SSRF) Calls to external servers via invoice functions are now secured.
• Secure plugin upload Manipulation via plugin upload is no longer possible.
• Reliable cancellation rules Orders can now only be cancelled if refunds are enabled in the system.

Further improvements

• Minor technical optimisations for greater stability.
• Improved management of internal processes and more reliable sitemap generation.

Faster & more stable

• Optimised caching mechanisms for pages and categories ensure noticeably shorter loading times.
• Improved product search delivers more precise results and better sorting.
• Numerous internal optimisations to caching and data processing increase the system's response speed.

Simpler management

• Revised interface for language settings with a clearer structure.
• More stable creation and editing of orders in the admin area.
• New helper functions for searching, filtering and sorting products and properties.
• Improved translations and error messages in the shopping cart.

Design & user experience

• Numerous small frontend adjustments – including reviews, labels and navigation.
• Clearer display of product reviews and revised icons.
• Increased accessibility in the Storefront and Administration.
• New design tokens ensure a consistent appearance in light and dark themes.

Products & content

• Categories and properties can now be managed and filtered more easily.
• Product variants are now displayed correctly in search results.
• Errors when deleting or synchronising products have been fixed.
• CMS elements now display their type and content more clearly.

Technology & security

• New security and caching mechanisms prevent data conflicts.
• Compatibility with newer Symfony versions established – important for developers.
• Better support for read-only servers and restrictive file systems.
• Scheduled tasks run more stably and are automatically restored in the event of problems.

Bugfixes

• Profiler The Symfony profiler is now correctly disabled in production environments to avoid unnecessary load.
• Customer addresses Fixed a bug where active customer addresses could be incorrectly deleted.
• Validation Fixed a type error when using named arguments in the Length validation rule.

Security

• Escaping of active route parameters Closed a security vulnerability by correctly escaping active route parameters (GHSA-9v82-vcjx-m76j).

Bugfixes

• Promotions Fixed an issue where the product selection rule was missing in promotions.

New Features & Improvements

New Features & Improvements · Translations

• New command for downloading and installing translations.

New Features & Improvements · Search

• Minimum search length is now configurable.
• New sorting options for live search.
• Improved performance for product search in the Administration and Storefront.
• Support for numeric tokens in the Administration search.

New Features & Improvements · Design Tokens & Dark Mode

• Introduction of design tokens in the smart bar, dashboard, grid, tabs, tooltip, switch and help centre.
• Dark mode support for sidebar, selects and modals.

New Features & Improvements · CMS & Storefront

• Improved accessibility of the captcha.
• Bug fixes for CMS content, block rendering and slot configuration.
• New ARIA labels for sliders and optimised navigation.
• Added fetchpriority attribute for image sliders.

New Features & Improvements · Categories & Navigation

• Fixed category path display.
• Loading of all categories in the active path.
• Improved navigation cache invalidation.

New Features & Improvements · Administration

• Improved error display for CMS configuration and forms.
• Sidebar can now be resized by dragging.
• New events and extended API interfaces (e.g. cart data in the Symfony profiler).

New Features & Improvements · Documents

• New options for return addresses and display of tax policies.
• Bug fixes for credit notes and invoices.

New Features & Improvements · Technology & Core

• Support for soft purge in the HTTP cache.
• New scheduler for scheduled tasks.
• Improved handling of foreign key errors.
• Update to DBAL 4.3.1 and Symfony components.
• Raised minimum requirement for MySQL.
• New events for entity extensions and hooks.

New Features & Improvements · Elasticsearch & Caching

• Optimised Elasticsearch queries and indexing.
• Improved stale cache handling via queue.
• Extended caching strategies, including vary headers for context variables.

Bugfixes

• Fixed issues with media thumbnails and import of product images.
• Stabilised SEO URL generation, including for changes or variants.
• Resolved issues with cross-selling products, guest logout, app resets and Administration sessions.
• Corrected price calculations and rounding errors for advanced pricing.
• Several UI improvements for sidebar, modals, search fields and navigation.

Bugfixes & Improvements

• Properties Search Fixed sorting when searching for property values.
• Text Editor The classic sw-text-editor is used again instead of mt-text-editor.
• App Management Fixed an issue where active apps were not correctly reset after deactivation.
• Visibility Parameter Improved visibility check (backported from 6.7.1.0).
• Components createdComponent is set as synchronous again.
• Media Restored backwards compatibility for MediaThumbnailEntity.
• Cart Fixed an error when deserialising cart data.
• SEO URLs Fixed inconsistent SEO URLs for cross-selling products.
• Search
  • Moved the search config loader into the core bundle.
  • The minimum length for search terms is now also taken into account in configuration tables.
• Database Fixed an issue where the primary connection did not work when replication was configured.

Bugfixes & Improvements

• SEO URLs When creating SEO URLs, a canonical URL is no longer searched for when no path information is available.
• Theme Lifecycle Fixed an issue where refreshThemes was executed without existing plugin configurations.
• Theme Compilation Fixed an error that could cause corruption of the ThemeRuntimeConfig.

Administration & Core

• New state machine settings for improved management of payment and shipping statuses.
• Introduction of a measurement system module, including DAL, migrations and admin settings.
• New app commands (app:list), additional ACL hooks and improvements to the Admin SDK.
• Many Vuex stores replaced with Pinia stores → more stable and modern management.
• Improved theme configuration (validations, inheritance, loading optimisations).
• Better error handling in Storefront JS plugins and the Plugin Manager.

Performance & Stability

• Improved Elasticsearch search (scoring for numeric tokens, filter fixes, performance optimisations).
• Cart and checkout processes secured through locking, new events, improved filters and error handling.
• Indexing optimisations (e.g. skipping MediaIndexing for remote thumbnails).
• Better performance when loading categories, media files and product streams.

Storefront & UX

• Improved accessibility: including for sliders, navigation, forms, promotions and checkout.
• Extended CMS functionality: new Twig blocks, better slot selection, fixes for filters and sliders.
• New 3D/AR viewer handling, including DIVE support and improved camera setup.
• SEO optimisations: fixes for SEO URLs, landing pages and OpenGraph tags.
• Improved cart logic (locking for concurrent changes, line item handling, promotions).

API & Developer Features

• New APIs and events (including sitemap generation, SalesChannelContext adjustments, deduplicable messages).
• Extended entity attributes (ManyToMany, attributed entities).
• Enhancements to product and variant search (better matches for search terms).
• Improvements to documents (authentication for downloads, invoice and credit note numbers).
• New robots.txt configuration and flexible adjustments via the API.

Bugfixes

• Numerous fixes for promotions, orders and invoices.
• Fixes for multilingualism (fallbacks, translations, i18n).
• Fixed various errors in the Administration (grid display, tooltips, sidebar state, variable inheritance).
• Improvements to media management and uploads, including remote thumbnail URLs.
• Fixes for user permissions, sessions and login processes.

Improvements & New Features

• UX Pressing the ESC key in the modal now returns to the list view → more intuitive handling.
• Media Management Manufacturer images now use the new media modal instead of the sidebar.

Bugfixes

• Basket & Prices Stacked line items now correctly take advanced prices into account again.
• Search Live search no longer crashes when no data is available.
• ESI Rendering Errors when rendering ESI are no longer ignored, but handled correctly.

Improvements & new features

• SEO & URLs Improved display of SEO URLs in the registration form for customer groups.
• Product listing & search
  • Extensions from IdSearchResult are now correctly passed to EntitySearchResult in the ProductListingLoader.
  • Elasticsearch fixes for dynamic product groups with custom fields.
• Custom fields Improved translation of and access to custom field values.
• Technology & compatibility Vue 3 compatibility for template refs in cross-selling components.
• E-Invoices Support for vertical tax calculation in electronic invoices.

Bugfixes

• Products & variants
  • Fixed incorrect display of NaN% when generating variants.
  • Fixed an issue when creating essential product properties with more than two values.
  • Fixed empty state lists in variant positioning.
• Media & manufacturers The logo field for manufacturer media is aligned correctly again.
• Property groups Introduced a limit when loading options in the detail view to avoid performance issues.
• Storefront & login Consistent behaviour between the login and registration pages for guest customers.
• Routing & system Improvements when unpacking messages in routing.
• API Fixed the schema of the Store API criteria endpoints.

Improvements & New Features

• Privacy & Standards Replaced outdated privacy notices with up-to-date ones.

Improvements & New Features · Themes & Design

• New option skip-theme-compile when uninstalling apps.
• Improvements to theme assignment (mt-checkbox replaces the old component).
• Theme changes now cause less downtime.
• Fix for lost theme settings during fast navigation.
• Sidebar replaced with new media modal.
• Adjustments to the account design and tooltip styling.

Improvements & New Features · Administration

• Refactoring of the snippet set list.
• Promotion rules are now correctly displayed as a line item rule.
• Manufacturers without a link are now correctly displayed as
  instead of .
• Improved display of labels in customer details.
• Display of the rendered type for tax rule restrictions.

Improvements & New Features · Technology & Core

• New context token for current requests.
• Meteor updated to version 4.12.1.

Bugfixes

• Storefront & Search
  • Fixed sorting of countries.
  • Fixed incorrect icons for search terms.
  • Fixed order of search results in MySQL preview.
  • Variant indicator in product listing visible again.
  • Navigation on the first level now works correctly.
• Media & Uploads Inline media upload now shows a correct preview image again.
• Elasticsearch Fix for dynamic product groups with price/percentage conditions.
• Orders
  • Fixed incorrect overwriting of the deepLinkCode during recalculation.
  • Fixed an error when generating new languages.

Improvements & New Features

• Icons & UI Variable icon names now permitted in sw_icon; small size added for search fields and rule selection.

Improvements & New Features · Navigation & Usability

• Added active styling class for the main navigation.
• Improved back button links in sw-page.
• Unnecessary empty subcategories are no longer displayed in the navigation.

Improvements & New Features · Forms

• Additional blocks for input fields in address and registration forms.
• Improved compatibility of captcha validation.
• New behaviour for validation of custom error messages.

Improvements & New Features · Checkout & Cart

• New locking mechanism for CartOrderRoute.
• Adjustment to visibility for PropertyGroupOption combinations.
• Improved extensibility of ESI templates.

Improvements & New Features · Elasticsearch

• Index mapping is now reliably adjusted after updates.

Bugfixes

• Admin Area
  • Fixed issues with promotions, assets containing underscores and password reset.
  • Corrected UI error in staging mode.
  • Improved compatibility with DDEV using the Vite watcher.
  • Fix for Rule Builder snippets.
  • Fixed incorrect sizes, proportions and placements in order views (tags, placeholders, collapse button).
  • Corrected issues when creating new rules in advanced pricing.
  • Adjusted admin watcher host handling for DDEV.
• Storefront
  • Corrected error in CMS page display for locked pages.
  • Correct display of tags in orders.
  • Search results within categories are scrollable again.
  • Fixed incorrect display of the collapse button in the order overview.
• Technology & Core
  • Reverted faulty admin ES error suppression.
  • Improved visibility of custom fields in StructEncoder.
  • Fixed error in RetryableTransaction handling.
  • Fixed incorrect order in search results.

Improvements & Features

• Category & Variants Improved assignment of variants to categories.
• Navigation & Slider Product cross-selling slider now shows navigation arrows again.
• Search
  • New event for queried category IDs.
  • Prefix search for synonyms disabled to avoid irrelevant results.
  • Search parameter in the API is now optional.
• OffCanvas
  • Hard OffCanvas elements are now removed correctly.
  • Added missing currency text in the OffCanvas selection.

Bug Fixes

• Forms Fixed side-by-side form fields on small screens; added missing js-search-form class in the header.
• Orders Fixed the behaviour of the shipping costs input field in Admin orders; impersonation as a customer is now only possible if the requirements are met.
• Data & API Fixed DAL inheritance for to-many fields with limits; fixed an error when dispatching webhooks for non-versioned events; fixed paging parameters for listing page overrides.
• Miscellaneous Fixed an error with nested line items; fixed issues with extension updates; adjusted the type definition in ThemeConfigField; removed the use of DeleteThemeFilesMessage in the ThemeCompiler.

Improvements & Features

Improvements & Features · Cookie Consent & Tracking

• GTag Consent Mode is now only set when Google Analytics is enabled.
• Improved accessibility of cookie settings.

Improvements & Features · Fonts

• The Storefront now uses the Inter Variable Font; the old non-variable fonts have been removed.

Improvements & Features · Promotions

• Fields are now correctly reset when duplicating promotions.
• Promotions can now be pinned for admin orders.

Improvements & Features · Login & Search

• Integrated login scripts into the window object.
• Improved accessibility of the search widget; optimised the search form for screen readers.

Bugfixes

• Fixed an issue with HTML quirks mode in the Storefront.
• Fixed loading of to-one associations with partial data.
• Fixed an issue with the Admin module loading limit (limit 500).
• Duplicated promotion fields are now correctly reset.

Bugfixes · CI & Developers

• Improvements to the CI workflow (tokens, permission management, WIP handling).
• Clean-up of the Storefront Stylelint configuration.
• Bumped the composer.stub version.

New Features & Enhancements

• New state machine settings in the Admin area.
• Twig extensions: new functions & tokens with alternatives for improved inheritance.
• New events when loading orders for document generation.
• New address manager modal for improved address management.
• Support for Google Tag Manager.
• Meta Author field for improved SEO in the frontend.
• Support for the og:video meta tag (social media optimisation).
• New filtering options: equals and equalsAny now allow empty values.
• Additional Twig blocks for CMS elements (e.g. image gallery).
• OAuth API Confidential flag introduced.
• New options for e-invoices: file type download and direct opening.

Performance & Architecture

• Refactoring: migration of numerous stores from Vuex to Pinia.
• Improved product export performance (fewer SEO URL calls).
• Optimised checkout domain performance.
• Elasticsearch: improved indexing for orders and product streams.
• Admin Vite proof of concept introduced + optimised logs.
• MySQL performance tweaks by removing unnecessary variables.
• doctrine/dbal updated to version 4.2.
• Improved product stream updater performance.

Storefront & Usability

• Product slider refactoring including speed configuration & animation.
• Numerous accessibility improvements (ARIA labels, keyboard navigation, screen reader optimisations).
• More consistent contrasts and focus handling.
• Bootstrap 5.3.3 integrated.
• Improved behaviour for off-canvas navigation (language/currency).
• New h1 heading in listing layouts for SEO.
• Wishlist page set to noindex.
• Cart deleted immediately after order → fewer inconsistencies.
• Improved display of addresses & documents in the Admin.

Administration & Developers

• Refactoring of MailService and switch to private file system processing.
• New attributes: AllowHtml and AllowEmptyString.
• New Admin components and Twig blocks.
• New internal comments possible in orders.
• New PHPStan rules (e.g. attribute classes final, validated return types).
• Deprecations: DomAccess helper, old spaceless Twig filter, various Vuex stores.

Bug Fixes & Improvements

• Fixed errors when creating customers with different addresses.
• Fixed translation scope errors in i18n.
• Fixed CMS block error (removable check).
• Fixed product review click error; fixed faulty display of progress bars.
• Session and Redis fixes (e.g. CartSavedEvent, CartPersister).
• Fixes in the Admin: bulk editing of custom fields, promotion module, slider animation, order detail card position.
• Fixed CMS layout overrides via category.

Bug Fixes & Improvements

• Fixed issues with Composer plugin updates.
• Ajax modal buttons are now controlled behind an accessibility flag.
• The Mailer transport is now only changed if it is actually present in the container.
• Improvements to the form validator: snippets are now correctly escaped to avoid errors with special characters (e.g. apostrophes).
• Fixed duplicate submission of forms with the reCaptcha plugin.

Bug fixes

• Fix in MessengerMiddlewareCompilerPass to prevent errors in message handling.
• Adjustment of Composer requirements with minimum stability stable.
• Fixed an issue with the Commercial update.
• Fixed error "Class SwTwigFunction not found".
• Bulk edit Fixed variant editing.

New Features & Improvements

• Support for Google Analytics BeginCheckoutEvent.
• New Meta Author field with display in the frontend.
• Extension points for ProductListingLoader and further Administration components.
• New .encode events for Store API routes.
• New address manager modal for improved address management.
• Extension of the SystemLanguageChangeEvent in the ShopConfigurator.
• Ability to use enum fields in the DAL.
• ESI introduced for header and footer, including global template data.
• New flag for persistent database connections.
• Speculation rules added for the Storefront.
• Support for MySQL compression.
• Improved Elasticsearch indexer logic; new aggregates for the Admin API.
• Live cart updates integrated into the Storefront.
• OAuth support for mail authentication.
• Custom Fields storeApiAware available.

New Features & Improvements · Accessibility

• Improved focus outline and consistent keyboard navigation.
• Numerous improvements to checkout, modals and form fields.
• Skip button introduced in the image gallery.
• ARIA labels added to price fields, forms and buttons.
• Improved readability of promotion information and discounts.
• Video embeds and 3D viewer optimised for accessibility.
• Mobile filter panel made more accessible.

Bug Fixes

• Fixes in the Flow Builder, promotions and Elasticsearch.
• Improved Administration refresh token and login session behaviour.
• Fixed errors with address editors, variant switching and the image gallery.
• Resolved issue with deletion of extensions with expired licences.
• Several bugs fixed relating to mail dispatch, coupons and payment methods.
• Fixed display issues in the checkout, shopping cart and filter options.
• Resolved stability issues relating to Hot Reload and the Symfony 7.2 update.

Technical Adjustments

• Twig updated to 3.18.0 and 3.19.0.
• Refactoring & internal clean-up (navigation, ProductSlider, CSS).
• Introduction of hydrator classes for Attributed Entities.
• Various deprecations: fine-grained caching, DISABLE_EXTENSIONS, setTwig in the Storefront controller, Messenger Bus, custom entities for plugins.
• Improvements to migrations, cache handling and preparations for doctrine/dbal:4.
• Consolidated cache constants and new header for cache invalidations.

New Features & Improvements

• Integrated SCSS validator for theme changes.
• New Store API endpoints for product and category breadcrumbs.
• Added Elasticsearch Explain Mode.
• Integrated extension point for Flow Executor and PDF renderer.
• Extended configuration options for attributed entities.
• New Twig blocks for line items and additional filter types for search.
• Option to exclude hidden products from the sitemap.
• Customisable order of city and postcode fields in checkout.
• Improvements to loading and performance behaviour in the Administration.
• Extensive accessibility optimisations: improved focus guidance, visible labels, optimised contrasts.

Bug Fixes

• Correct processing of delivery addresses in the order process.
• Cross-selling streams no longer load the product itself.
• Fixed error in VAT and VAT ID validation.
• Fixed issues in the Flow Builder and with promotions.
• Fixed errors in the management of custom fields and in bulk edit.
• Fixed image heights in the gallery slider and zoom modal.
• Improved session handling and imitation user.
• Snippets are editable again.
• Stabilised Elasticsearch indexing and stopword behaviour.
• Fixed error in the order process without items or with promotions.
• Storefront fixes: hero images, cart duplicates, quantity inputs, mini cart heading.
• Improved hot reload, fixed cookies and redirects.

Technical Changes

• Switch of the hash algorithm to xxh128.
• Removal of duplicate URL parameters in the HTTP cache.
• Unification of config files and stores.
• Preparation for native PHP typed properties.
• Optimisation of the MessageQueue Restrict Listener.
• Improvements to the Symfony Scheduler Bridge and in migration steps.
• Introduction of Prettier in the Admin area and adjustments to hot reload.

Bugfixes

• Twig Rendering Removal of a deprecated method that could lead to memory overflows.
• Redis Configuration Fixed an issue when using the shopware.cart_redis_url parameter, which could previously lead to exceptions.

Bugfixes

• Hot Reload Fixed an issue with cookies and redirects, so that development environments now work stably and reliably again.

New Features & Improvements

• Addresses & Forms Unique IDs for address forms, correct mandatory field validation and error handling on form submissions.
• CMS & Storefront Improvements to form reset, language selection, mobile slider, layout filter, display mode and preview.
• SEO & Sitemap New landing page providers, correct SEO URL resolution in CMS content, fixes for duplicate slashes in sitemaps.
• Store API Criteria titles in wishlist, generic API responses and breadcrumb endpoints.
• Performance & Stability Optimisations to caching, Redis configuration, Elasticsearch indexing and hot reload (incl. HTTPS/TLS proxy).
• Administration New wrapper blocks, revised UI/UX (button groups, input styles, colour picker, customer impersonation), Pinia migration and Prettier integration.
• Security CSP headers with frame-ancestors, validation improvements (VAT ID, promotions, reviews), blocking of newsletter opt-in via HEAD requests.

Bugfixes

• Fixed an error when creating customers via the Admin API despite validation errors.
• Cancelled orders can no longer be edited in the Storefront.
• Correct display of selected customers in the order pop-up.
• Fixed promotions & discounts in orders.
• Various fixes for cart discounts, form validations, breadcrumbs, variants tab, indexing and snippets.

Developer Changes

• Introduction of WriteBatchInterface and new events.
• Switch to the xxh128 hash algorithm.
• Removal of obsolete methods & flags.
• Extended configuration and testing options (e.g. cache:clear:all, directory code coverage).
• Improved error messages & typing (PromotionGateway, defaults, criteria).

Bugfixes

• WriteCommandQueue Fixed an incorrect execution order of WriteCommandQueue commands.

New Features & Improvements

• Store API New endpoints for product and category breadcrumbs.
• Import/Export Introduction of a new batch import strategy.
• App System New app filesystem for improved abstraction.
• Elasticsearch Optimised product indexing for improved performance.
• Sitemap Correct domain for sitemap locations.
• System Checks JSON output now available for the system:check command.
• Smart Bar Toggle option added in the admin.
• Design & UX Improved text and editor formatting in the Storefront.
• Accessibility Improved focus handling in the checkout and off-canvas basket; visual focus states added; slider plugin optimised.
• Product Variants New option to add variants only.

Bugfixes

Bugfixes · Checkout & Orders

• Fixed incorrect discount and tax calculation for shipping costs.
• Promotions with rules and quantity conditions now work correctly again.
• Fixed language, billing address and tax logic for bulk invoices.
• Removed duplicate state changes for SEPA direct debit.

Bugfixes · Media Management

• Fixed an error when renaming files with remote thumbnails.
• Simplified sorting of product media.

Bugfixes · CMS & Experience Worlds

• Fixed loading issues with demo entities.
• Improved performance for layouts with many elements.
• Removed duplicate blocks in Twig.

Bugfixes · Administration

• Fixed an error when unlocking/cancelling newsletter opt-ins.
• Improved performance for order statistics and admin search.
• Added ACL rules and criteria events for countries and states.

Technical Changes & Deprecations

• Hashing Switched from md5 to xxh128 for improved security and performance.
• Twig Updated to version 3.14.0.
• ESLint New rules added.
• System Configuration Legacy format in the system:config:get command deprecated.
• Autoprefixer Officially marked as deprecated.
• Address Cards Template address-card deprecated.

Bugfixes & Optimisations

• Product slider Fixed unwanted slides occurring when clicking on slider elements.
• Base slider plugin Fixed an error in _initAccessibilityTweaks, improving stability and accessibility.
• Basket calculation Optimised data hash calculation for correct price calculation.
• Cache Fixed cache naming to ensure clean caching.
• Orders Fixed a duplicate save-edits method call when saving an order.

New Features & Improvements

• Storefront Pagination Via anchor links → more accessible & SEO-friendly paging.
• Affiliate & Campaign Codes Directly editable in the Administration.
• Customer Impersonation For test scenarios and support cases.
• Flow Builder New trigger "Customer before delete".
• System Health Checks Introduced for better monitoring of integrity & stability.
• ElasticSearch Limiting text length for indexing + improved error handling.
• Composer Composer name added to the plugin list command.

New Features & Improvements · Core & Technology

• Improved context objects, aggregation validation and silent token validation.
• Caching optimised through improved cache tags.
• Significantly improved Administration performance for layouts with many elements.
• Message queue with size limit for more stable processing.
• App lifecycle: upsert for custom fields and extended validations.
• Added PHPStan rules for ACL names and exceptions.

New Features & Improvements · Media & CMS

• 3D Viewer New setting option for light intensity.
• Dynamic URLs can now be linked to media.
• Improved thumbnail generation, including fixes in strict mode.
• CMS & product sliders: fixes for variant display and accessibility.
• New Twig & wrapper components (sw-popover, sw-tabs, sw-select-field, sw-textarea-field, among others).
• Signed static iFrame modules for enhanced security.

New Features & Improvements · Customers, Orders & Checkout

• Customer groups now correctly displayed in SEO URLs.
• Fixes for shipping addresses and customer creation (salutation error, register route).
• Promotions: fixes for rules, maximum usage per customer and applicability.
• New filters for customer and order numbers in Administration lists.
• Order line items: promotionId is now writable via the AdminAPI.
• Improved pre-calculation of shopping carts; the cart is no longer saved on every request.

New Features & Improvements · Accessibility

• Improved focus control for modals, offcanvas and forms.
• Storefront filters optimised for screen readers.
• New visible focus states for buttons (wishlist, scroll-up, slider, etc.).
• Form elements: improved labelling & error messages.

Bug Fixes

• Product slider now displays products from dynamic groups again.
• Address management in checkout stabilised.
• Fixed price validation in custom fields.
• Fixed TCPDF constant error caused by Opcache.
• Admin grid: fixed column arrangement and icons.

Core & Technology

• Improvements to the context object for more stable data processing.
• Optimised validation of aggregation names to avoid errors in complex queries.
• Improved silent token validation for feature flags.

Payments & Shipping

• Fixed an issue with filtering via decorated payment and shipping method routes.

Media

• Adjusted type hints in MediaUrlPlaceholderHandler for improved consistency.

Products & Variants

• Variant Generation New option for whether variants should be generated or merely added when creating them.
• Product Search Improved scoring logic for exact matches; searching by product number now redirects directly to the detail page.
• Bulk Edit Fixed an error that occurred when editing >25 products simultaneously.

Orders & Documents

• Filter Options Order and customer numbers can now be filtered in admin lists.
• Invoices & Cancellations Cancellation totals are now correctly displayed as negative values.
• Language Assignment Manually created orders now reliably save the selected language.
• Intra-Community Deliveries New notice added to tax-relevant documents.
• Promotions Automatically applied promotions are retained after saving the order.

Payments & Checkout

• Improvements to payment handlers and the payment process.
• App Payment Timeout increased to 20 seconds.
• New parameters in checkout error translations.

Customers & Administration

• Customer Impersonation Admins can now log in as a customer.
• Improved login sessions in the Administration.
• Fixed ACL and sales channel checks in the customer module.
• Removed default payment method for customers.

CMS & Shopping Experiences

• Link Selector Added media option.
• Shopping Experience section settings can now be opened directly via the context menu.
• Fixes to CMS data mapping for nested translations.
• Additional Twig blocks in CMS and order templates.

Search & SEO

• MySQL Search Maximum search term length limited (performance).
• Improved SEO resolver priorities and context checks.
• Fixed SEO headings on product detail pages.

Media & AR

• New default values for augmented reality media.
• Improvements to the AR icon label and 3D placeholder.
• Fixed media URLs without thumbnails.
• File types can now be filtered in media search.

Developers & Technical

• Flow Builder Service converted to TypeScript; new blocks & functions.
• APIs Endpoints for listing all API routes; additional search criteria.
• Elasticsearch Improved handling of special characters & performance.
• Profiler Extended paths for the Storefront profiler.
• Deprecations including sw-select-number-field, sw-dashboard-statistics.
• Improved Composer, Jest/Lint workflows and plugin commands.

Bugfixes & Improvements

• Fixed duplicate company addresses.
• Fixed errors with comma values in price fields.
• Prevents negative reviews offsets.
• Accessibility Skip-to-content link; improved labels for form elements.
• Numerous minor fixes to cache handling, ACL, translations and the UI.

Search & Performance

• Search optimisation Limitation of the length of search terms in MySQL searches to avoid performance issues and errors.

Products & Catalogue

• Dynamic Product Groups Custom fields can be integrated via entity select.
• External Files Integration also possible without a file extension via URL.
• Currency & Prices Fix for broken currency modal with price-based settings.
• Promotion Handling Improved validation of discount IDs.

Orders & Customers

• Shipping Costs Can be correctly changed again after the order has been submitted.
• Customer Management Addresses (including company name) now taken into account in the admin ES index.
• Admin Orders Fix for when the default language is not available in the sales channel.
• Customer Security New attribute check in the login context.

CMS & Storefront

• CMS forms now correctly clear data from local storage.
• Accessibility Improved contrasts, more accessible slider, alt texts in the review widget.
• Navigation & UI: Search icon and burger menu better aligned.
• Wishlist: Icon cache disabled in the product box.

Flow Builder & Automation

• Email: Default recipient adjusted for the "product review" trigger.
• Debugging: Additional debug information in mail headers in staging mode.

Developers & Technology

• New maker commands (CLI) for faster plugin development.
• Migration to Pinia instead of Vuex.
• Staging banner now displays the admin URL.
• SEO & snippets: Fixes for form validation, snippet handling, migrations.
• System configuration: Values can now also be set via YAML.
• Performance: Improved pagination, optimised error output, cleanup of line items during recalculation.

Development & Technology

• Composer optimisation More stable & performant execution during the plugin lifecycle (install, update, uninstall).

CMS & Experience Worlds

• New wrappers for sw-tabs, sw-select-field, sw-textarea-field, sw-datepicker, sw-password-field, sw-colorpicker, sw-external-link, sw-skeleton-bar, sw-url-field, sw-progress-bar.
• CMS SDK: fixed an error when switching between SDK elements.
• Improved alt texts & labels for line items; media usage in slot configurations now correctly detected.

Flow Builder & Automation

• Unified SendMailAction constants; update event is now hookable; new criteria events for orders.

Products & Orders

• Introduced Checkout Gateway; improved address validation in the cart.
• Promotions are no longer processed when the cart price equals 0.
• New event for variant selection when loading the product detail page.
• Document number search now stable even with a large number of documents.

Communication & Newsletter

• SendMailAction: language can now be passed.
• Newsletter: new OpenAPI schemas; filtering by SalesChannelId; configurable maximum length for mail bodies.

Search & Elasticsearch

• Performance & error handling improvements; exceptions in the ES stack now caught cleanly; debugging & indexing stabilised.

Storefront

• Feeds: added Last-Modified header.
• Icons & focus: fixed multicolour icons; visible focus indicators.
• Customer account: added VAT information; fixed missing backdrops in checkout address modals.
• Fixed review filters.

Developers & Technology

• Removed hard Redis dependency; more stable configuration.
• composer remove now possible after the kernel response.
• OpenAPI: new schemas (documents, addresses, order routes, line items, prices) & linting rules.
• Admin: autocomplete for inputs; new mt-email-field.
• Profiler: CLI now supports --profile.
• Performance: improvements to snippet authoring, hydration, and error messages.
• Entity rules: checks for invalid UUIDs, empty ID filters, and ManyToOne errors.
• Data & migrations: missing transaction associations; migration tests & SalesChannel fixes.

Stability & Security

• Improved API error messages (ManyToOne), clearer guidance for incorrect usage, consistent handling of invalid UUIDs.
• Media: removed non-printable ASCII characters from paths; integrated 3D scene editor entities; synced user avatars.

CMS & Experience Worlds

• Fixed Image Slider (admin preview works again).
• Sanitise warnings in the CMS element configuration.
• Wrapper components for numerous UI elements (e.g. sw-button, sw-card, sw-icon, sw-text-field, sw-switch-field, sw-number-field, sw-loader, sw-checkbox-field).
• Fix for missing document settings: fallback for custom docs.

Flow Builder & Automation

• Improved error handling for transition/flow exceptions in the order process.
• Smart Bar & Main Menu can be toggled via app module.
• Configurable delay for PseudoModals.

Products & Orders

• Fixed price sorting in the ProductDetailRoute.
• Improved display of long child item names in orders.
• OffCanvas cart: shipping method switcher as a button.
• Promotion codes now accept umlauts; title length validated for reviews.
• Improvements to language & inheritance for more consistent loading processes.

Storefront

• Accessibility & SEO: added headings for the login page.
• Fixed missing backdrops in checkout address modals.
• GallerySlider plugin is now correctly detected.
• Storefront Webpack overhauled (performance, watch mode, Twig integration).
• Varnish: fixed the ban all command; wishlist: removed superfluous CSS icons.

Developers & Technology

• Webpack: support for ts & cts configs.
• Meteor Component Library as an admin dependency.
• Improved hydrate performance; fixed profiler tables & icons.
• Redis: removed prefixes from keys; optimised incrementer.
• Pipeline/import/export fixes.
• App integration: feature flags now return an active status; payment status optional for app payment handlers.

Communication & Customers

• Customer account: display of VAT information.
• Emails & snippets: faster snippet author queries; search fix for very long snippets; fixed default mail footer; defaults set for header/footer.
• Forms & captchas: validation errors are correctly taken into account again.

Security & Stability

• Extended flow validations (language, query exceptions, order processing).
• Maintenance mode: IPv6 CIDR support for allow lists.
• SQL injection protection: faulty queries are now handled cleanly.
• Blocked Twig update 3.9 to ensure compatibility.

CMS & Experience Worlds

• New HTML CMS element; video support for products.
• Improved image/slider integration; snippet cache invalidation.
• Pseudo-modal Twig blocks; sanitise function for CMS text fields.
• Assigned pages column in CMS lists.

Flow Builder & Automation

• Routing for creating flows from templates.
• Improved error handling for nested transactions & dispatcher events.
• New options: recalculate order, scope extensions; broader support for domain exceptions.

Products & Orders

• New API route for updating order addresses.
• Individual promotions: improved duplicate detection & validation.
• Fixes for order status, currencies, variant names (bulk edit).
• New rule condition: "Order with sent document".
• New mesh/DRACO support for 3D files; faster PDP.

Storefront

• SEO/sitemap improvements (URL validation, OG tags, trailing slashes, redirect fixes).
• Theme: webpack.config.cjs support; --sync flag; optimised static compilation.
• Consent management: Google Consent V2.
• Accessibility & usability: login improvements, RememberMe, more accessible navigation.

Developers & Technology

• OpenAPI significantly expanded (products, orders, SEO, media, wishlist, and more).
• Admin SDK 5.0.1; Vue 3 migration advanced.
• New CLI commands (e.g. user:list, ludtwig composer, system:update:finish extended).
• Profiler & debugging: improved tracing/logging (e.g. repository tracer).
• Symfony 7 & Composer upgrade.

Communication & Emails

• Newsletter module Vue 3 compatible.
• Improved validation (recipients, unsubscribe flows, regex, umlauts).
• Separate document titles per page.

Search & Elasticsearch

• More precise rules (numeric terms, fewer typos).
• Optimised ES integration (cross-selling, indexing, admin search).

Storefront & Themes

• Theme cache per sales channel Channel-specific caching of themes provides greater stability and prevents display errors across multiple sales channels.

Tracking & Sessions

• Affiliate tracking Fixed an error in session access within the AffiliateTrackingListener → more reliable affiliate programmes and tracking functions.

CMS & Shopping Experiences

• Supplementary migration Changed the sorting key in CMS slots to use the ID, so that the sort order is managed in a stable and consistent manner.

System & Updates

• Blue-green deployments system:update:finish now takes blue-green-safe destructive migrations into account → more stable, safer zero-downtime deployments.

Administration & UX

• Vue 3 & SDK New/adapted Admin SDK blocks (including CMS counterparts, help sidebar, settings, iFrame full screen, Stoplight Elements).
• Usability Back button in SDK settings, improved reactivity for order status, optimised pagination/list templates, more consistent field events.
• Permissions & Validation Fixes for permissions, e-mail validation, ISO checks; clearer error messages & domain exceptions.
• Convenience Public media selection with pagination, title attributes/blocks in lists, more stable Ajax modals, many UI fixes.

Storefront, SEO & Content

• SEO & Routing No SEO URLs for headless channels; live updates; sitemap improvements (home slash, mandatory fields, error messages).
• A11y & HTML5 Improved accessibility, modern HTML5 tags; OG tags on error pages; AVIF support; new Twig blocks.
• Theme & Assets Static/atomic compilation, fixes for remote scripts, CDN/Fastly, asynchronous JS, removal of all.js.
• Consent & Cookies Google Consent v2, cookie clearing on 404, revised labelling.

Search & Elasticsearch

• Inheritance & Precision New ES inheritance model, more precise numeric search, search information via date aggregation.
• Performance Fewer resources in listings, faster variant listings, more robust keyword cleanup tasks.

Flow Builder & Automation

• More stable flow storage, deprecations removed, clearer warning/error messages, rule-aware flows in more areas.

Apps, Admin SDK & Extensibility

• More SDK capabilities (translations, routing, CMS block counterparts, new hooks/blocks), local apps folders, one-time script inclusion.
• Security/stability: longer paths, media proxy/URL rules, manifest/proxy error handling; shipping methods via apps no longer 'experimental'.

Media & Files

• Service Hardening Cleanup of temp files, central media validation (name/ASCII/type/size), no individual fetches per item.
• Uploads & Formats AVIF, spatial upload/zoom, only required node_modules for (app/)plugin assets; thumbnail edge cases fixed.

Orders, Customers & Checkout

• Correct languages after login, robust address editor validation, redirects for legacy passwords; correct currency/tax dialogues.
• Order handling: no overwriting of 'staged changes', new transactions in status history, cancellation documents reference the correct order version.

Performance, Stability & Operations

• Core Upgrades Symfony 7, Composer/runtime, PHPUnit 10+; cleanup of old deprecations.
• Caching & HTTP ESI tags, unified HTTP cache, bulk invalidations via Redis, fewer boot requests.
• Indexer & Jobs Synchronous post-update indexers now possible, fault-tolerant reschedules, new health check events.
• Error Transparency Broad domain exceptions, more sensible log levels, clear notices for invalid configurations.

Security & Validation

• Stricter file/URL/form handling, e-mail/newsletter validations, ReCaptcha v3 refresh, secure download links; no HTML sanitising in mail header/footer.

Breaking Changes / Deprecations (Excerpt)

• Removed/replaced Storefront Twig/JS/CSS APIs & flags (6.6 cut), ES multilingual flag removed.
• Flow/framework deprecations cleaned up; new default events in components; legacy files in PDP/cart removed.
• New system requirements (Node/build chain updated: Webpack 5, SWC minify).

Technical Adjustments

• Reverted the update of NPM packages to avoid compatibility issues.

Bugfixes

• Fixed a redirect loop that could occur in certain scenarios.

Administration & UI

• Improved error handling for invalid manifest files and long media filenames.
• CMS & Search New after block element in search settings; improved logic for default sorting.
• Fixes when rendering CMS element configurations in the Admin SDK.
• Usability Added a “Remember Me” checkbox to the login.
• Fixed an admin search error; optimised content in searchable fields.

Products & Variants

• Performance optimisation when loading product and variant lists.
• Fix: loading of the default currency during bulk editing.
• Fixed an issue with cross-selling sorting when using Elasticsearch.
• Reduced resource consumption for large product lists.

Flow Builder, Rules & States

• Fix: customer custom field rule with multiple selection.
• Improved privileges in state machine handling.
• New domain exceptions for snippets & Symfony Messenger errors.

Media & Uploads

• Support for spatial objects as media.
• Revised upload size logic.
• Indexer now automatically triggered after MediaPath updates.

Technology & Performance

• Updated to Symfony 6.4.
• Improved performance for the Webpack build.
• Removal of all.js, asynchronous JS.
• New admin request tracing.
• Optimisation of price serialisation.
• Updated dompdf/dompdf to 2.0.4.
• Fixes for PHP type hints, OpenAPI and the address_format column.

Miscellaneous

• Consent banner: “Deny” button renamed to “Only technically required”.
• Updated regex for Belgian VAT IDs.
• Consistent parameter conversion in data bags.
• Improved support for special characters in filenames.
• New abstract tax detector.
• Extended documentation on sitemap updates.

Technology & Database

• Adjustment of the column type address_format for improved consistency & stability.

Technology & Framework

• Added and correctly exposed the belated inject feature flag.

Technology & Maintenance

• Cleanup of the service configuration: removed test classes from services.xml.

CMS & Storefront

• New Async Theme Compilation option for improved performance on larger projects.
• Fixes for CMS elements (multiple instances of SDK elements, layout modal, filters in dynamic product listings).
• Improved display in the order history (closed missing div, added Twig blocks).
• New sparkles icons and Twig blocks for more flexible templates.
• Added consent banner for usage data collection.
• Fixed cookie banner styling ("Accept all" button).
• SEO URLs: validation & improved error messages; fix for category SEO URLs.
• Translation/snippet fixes (wishlist button, address formats, case changes for product properties).

Flow Builder & Automation

• Fixes for flow executions within transactions and for caching after order processes.
• New event: Remove from cart.
• Improved error logging for promotion, cart and document exceptions.

Products & Orders

• Vue 3 compatibility: order, category and customer modules updated.
• Performance boost for document creation (invoices).
• New technical names for payment & shipping methods.
• Fixes for faulty payment methods/price fields in the Administration.
• Soft Deletes introduced for custom entities.
• Improvements to cross-selling (sorting by price) and variant logic.
• Fixed edge case: orders disappeared when cancelling an Administration edit.

Search & Elasticsearch

• Improved debugging tools and logs.
• More precise results for numeric search queries.
• New Date Aggregation feature for product index information.
• More stable handling of large keyword dictionaries and token filters.

Technology & Infrastructure

• Integrated HTTP cache for routes.
• Improved Redis cache clearing & Predis support; optimised cluster/Redis handling.
• Extended CLI (scheduled task helpers); system:update:finish now shows a completion message.
• Optimised Webpack & Administration builds (flex templates, watch, dev server).
• New low_priority queue.
• Updated Admin SDK; additional Vue 3 Jest tests.
• Fixes for MariaDB, zip code columns, foreign keys.

Security & Validation

• Restrictions for snippet sanitising (only permitted attributes such as data-url).
• Upload validations (file name ASCII, mime type check).
• Domain exceptions in Customer, Media, Elasticsearch, Orders.
• Guest account login page can no longer be accessed directly.

Bugfix

• Fixed a rare bug where orders could disappear if an ongoing admin editing process was cancelled.

Administration & Interface

• Numerous Vue 3 compatibility fixes (Properties module, Promotions module, Privileges service, Jest tests).
• Datepicker fix: Vue refs are now set correctly on initial load.
• Indeterminate checkbox state introduced.
• Fixes for multilingual recovery emails and Administration search.
• Entity multi-select can be cleared again; custom fields correctly applied for new shipping methods.

Products, Categories & Checkout

• Fix: adding products by product number.
• Non-stackable cart items now produce clear error messages.
• New domain exceptions (categories, documents, cart, promotions).
• Store API: active billing address now available in the context.
• Request data is now reliably included in payment payloads.

Flows & Automation

• CSV import no longer triggers unnecessary flows.

Search & SEO

• SeoUrlUpdater internally refactored; resolver caching removed.
• Improved language handling for product search keywords; Administration search queuing optimised.

System & Performance

• Redis: batch invalidations; media:delete-unused now also works with offset 0.
• Cluster cache clearing fixed; backup now excludes cache folder; Predis support repaired.
• New CLI helpers (scheduled tasks); assets:install with --force.
• theme:compile can now be restricted to specific themes/sales channels.

Bug Fixes & Miscellaneous

• Fixed issues with file names containing forward slashes.
• Improved error handling for document previews/missing billing addresses.
• OpenAPI/schema improvements; missing JS semicolons added.
• Old consent modal variant removed; sitemap documentation extended with update intervals.
• Logging revised: exceptions now receive appropriate log levels.

Administration & Translations

• Fix: Translator randomly selected a snippet set – resolved.

CMS & Performance

• Reverted a previous performance fix for editing text in large CMS blocks (unexpected side effects).

Technology & Platform

• PHP 8.2: Fixed remaining deprecations – full compatibility ensured.

CMS & Storefront

• Horizontal image alignment: new option for the CMS element Image (left/centre/right).
• Introduced global Storefront defaults.
• Custom icons in possible again.
• Performance: improved text editing on CMS pages with many blocks.
• JS builds: automatic application of Storefront JS during Composer builds.
• Vue 3: made the customer module & Jest tests compatible.

Products & Orders

• Stock Management Comprehensively revised.
• Fixed editing of shipping costs in non-default currencies.
• Discounts: fix for products priced at €0.
• Reviews: improved synchronisation of the review count.
• Order creation: fixes for orders without a customer & empty addresses.
• Order API: reactivated extensions.

Flow Builder & Automation

• New Criteria events (transactions & finalisation).
• Error summaries in cards now optional/more flexible.
• Improved date handling in DateRangeRules.

Search & Database

• ListField filter Filtering of NULL values now possible.
• Elasticsearch: parser fixes & optimised definitions.
• DAL: improved ID/reference validation; enhanced MariaDB compatibility.
• UUIDs New generation switched to UUIDv7.

Technology & Platform

• Logging & Exceptions Reduced log level for template exceptions; extended DomainExceptions (refunds, customers, media).
• Scheduled Tasks Direct crontab operation now possible.
• Health Check URL New monitoring interface.
• Extended app server communication; Admin API with max limits.