Skip to content

26.3.0

Latest
Latest

Choose a tag to compare

View all tags
@fballiano fballiano released this 06 Mar 23:19
· 95 commits to main since this release
26.3.0
c58032c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🎉🎉 Welcome to Maho 26.3.0 "Time Warp" 🎉🎉

We're barely two months into 2026 and Maho keeps accelerating. After the landmark multi-database and gift card release in 26.1.0, we've packed so many features into this release it feels like we're bending time.

Highlights include a one-step checkout, a product feed manager, content versioning, email logging, deferred image generation, bento grid layouts for our page builder WYSIWYG, blog categories, and even a new shipping method!

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!
become a sponsor

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

🚀 New features and major improvements

One-Step Checkout

Checkout is the most critical conversion point in any online store, and multi-step checkouts are a proven source of cart abandonment. Maho now ships with a built-in one-step checkout that displays all checkout steps simultaneously in a clean, responsive 2-column layout.

This also provides a new unified discount/giftcard code input for both cart and checkout, a unique and simple way for users to input their coupons.

  • All steps visible at once - billing, shipping, payment, and order review on a single page
  • Auto-loading shipping methods - rates appear as soon as an address is entered
  • Smart auto-selection - when only one shipping or payment method is available, it's pre-selected
  • Fully configurable via admin toggle - switch between classic multi-step and one-step with a single setting
  • 100% backward compatible with existing checkout customizations

FeedManager: Product Feed Export

Selling on Google Shopping, Facebook/Meta, Bing, Pinterest, or any marketplace? Nowadays it's a mandatory activity for every store and the platform should provide the best and most complete way to accomplish it. The new FeedManager module gives you a complete product feed export system built right into Maho - no third-party extensions needed.

  • Visual feed builder - drag-and-drop field configuration for XML, CSV, and JSON formats
  • Pre-built templates for Google Shopping, Meta Commerce, Bing, and Pinterest
  • Dynamic attribute rules - transform, concatenate, and conditionally map product data
  • Product filtering and category mapping - control exactly what goes into each feed
  • Automated delivery - schedule exports via cron with SFTP/FTP upload destinations
  • Batch processing - handles large catalogs without timeouts

Content Versioning

Ever accidentally overwritten a CMS page and wished you could go back? The new Maho_ContentVersion module automatically snapshots CMS pages, CMS blocks, and blog posts on every save.

  • Versions tab in every edit form with preview and one-click restore
  • Configurable retention - set maximum versions per entity and maximum age

Email Logging

Every outgoing email is now logged to a dedicated database table via a Symfony Mailer transport decorator - completely transparent, no configuration needed. Perfect for debugging delivery issues, auditing transactional emails, and compliance.

  • Admin grid at System > Tools > Email Log with filtering, search, and detail view
  • Configurable auto-cleanup via daily cron job

ShippingBridge: External Shipping Rate APIs

The new Maho_ShippingBridge module lets you connect to any external shipping rate API with zero custom code. Configure a REST endpoint, and Maho will POST cart data (items, quantities, product attributes) and map the JSON response back to standard shipping rates. This is especially important for medium/big companies with their internal CRM/PIM and custom shipping calculation rules. Simply deploy your API endpoint and manage precise shipping costs and possibilities to your customers.

  • Three auth modes - API key, Bearer token, or no auth
  • Configurable product attribute inclusion - send weight, dimensions, or any custom attribute
  • Debug logging for troubleshooting
  • Method logos - add a graphic logo for every shipping option
  • Handles all product types: simple, configurable, bundle, and grouped

Blog Categories

The Blog module now has a full hierarchical category system, bringing it on par with dedicated blogging platforms.

  • Nested tree structure - unlimited parent/child nesting with drag-and-drop reordering in admin
  • Admin interface - category grid, edit form, and AJAX post associations
  • Frontend sidebar styled as layered navigation for intuitive browsing
  • SEO-friendly URLs - full-path slugs like /blog/category/parent/child/
  • Breadcrumbs - proper navigation context on category and post pages

Bento Grid for TipTap WYSIWYG

Maho is always on the path of building a modern and complete page building experience and today marks another step forward, our WYSIWYG editor gains a powerful new layout tool: bento-style CSS Grid layouts. Think Pinterest boards or Apple's product pages - asymmetric, visually striking grid compositions right inside your CMS editor.

  • 12 layout presets across 2, 3, and 4-column configurations
  • Drag-to-resize column handles (also retrofitted to the existing Columns extension)
  • Bubble menu controls for quick layout adjustments
  • Style options - padding, gap, background, borders
  • Responsive collapse - gracefully stacks on mobile
  • Shared grid infrastructure between Bento and Columns extensions

Deferred Image Thumbnail Generation

Product image thumbnails are no longer generated synchronously during page render. On a cache miss, instead of blocking the entire page for 10-15 seconds while thumbnails are created, Maho now returns a signed URL that lets the browser fetch and generate each thumbnail in parallel via a dedicated controller.

  • HMAC-SHA256 signed tokens prevent abuse
  • Parallel generation - the browser requests all missing thumbnails concurrently
  • Zero overhead for cached images - they continue serving as direct static URLs
  • Dramatically improves first-load performance after cache flushes or new product imports

Complete Serialize-to-JSON Migration

This is one of those changes that doesn't sound flashy but is massive for security and cross-database compatibility. PHP's serialize()/unserialize() has been a perennial source of object injection vulnerabilities, and it's completely incompatible with PostgreSQL and SQLite.

We've migrated every single serialize call across the entire codebase to JSON - over 72 callsites across 41 files, covering rule conditions, product options, EAV attributes, widgets, quote addresses, order shipments, and more. The infrastructure changes to _serializeField()/_unserializeField() auto-propagate dual-read (JSON-first with unserialize fallback) to all consumers, including third-party modules. Batch migration scripts are included for existing databases.

Alongside this, we added cross-database JSON query helpers (getJsonExtractExpr, getJsonSearchExpr, getJsonContainsExpr) to the DB abstraction layer, replacing fragile LIKE patterns with native JSON operations across MySQL, PostgreSQL, and SQLite.

Important, but not major

Less important changes and fixes

Code quality & modernization

Security improvements

Dependencies & infrastructure

Assets 2
Loading