Skip to content

Blog

Maho 26.11.0 is out today!

26.11.0 is another huge one: an AI assistant on every admin page, a drag-and-drop page builder, a filesystem abstraction with S3, Google Cloud Storage and Azure for all media, a redesigned admin, product gallery layouts and SLSA Build Level 3 signed release packages. And under all of it, the foundation moves one major version up: PHP 8.5, Symfony 8.1 and API Platform 5.0.

It is also the first release for Maho Admin, our native app to run your store from your phone or tablet, now on Google Play and coming soon to the App Store!

Is that enough? Good, because we packed about 150 more changes into this release!

With 26.11.0, you can run your store by asking for what you need, from your desk or from your pocket.

Highlights

  • Admin assistant: ask in plain language on every admin page, approve each write with the value before and after, undo it if needed.
  • Maho Admin: the official app for iPhone, iPad and Android, talking straight to your own store.
  • Page builder: a fullscreen drag-and-drop editor for CMS pages, CMS blocks and blog posts, with a live storefront preview.
  • Cloud storage: media, uploads, downloads, sitemaps and feeds on S3, Google Cloud Storage or Azure, for several web nodes with no shared disk.
  • Redesigned admin: daisyUI 5 components everywhere, light and dark, and a new login page that fits a phone.
  • Product gallery layouts: thumbnails below, left or right, a grid, and a swipe carousel on phones.
  • A full reindex three to five times faster, on MySQL, PostgreSQL and SQLite.
  • PHP 8.5, Symfony 8.1, API Platform 5.0 and SLSA Build Level 3 signed release packages.

Maho 26.9.0 is out today!

Every release so far rebuilt something inside Maho. This one changes the first thing a shopper sees: 26.9.0 ships a brand-new storefront built on Tailwind CSS 4 and daisyUI 5, with eleven ready-made themes and a live theme editor in the admin. Around it, the pieces a modern store is expected to have: social login, a WCAG accessibility scanner, an MCP server for AI agents, an AI-agent-ready storefront, a native job queue and OpenTelemetry observability.

With 26.9.0, Maho gets a brand-new face, and it is ready for the agents.

Highlights

  • New storefront: compiled Tailwind CSS 4 + daisyUI 5 skin, eleven themes in light and dark, no build step to use them.
  • Live theme editor: colors, fonts, radii and more from an admin form, with a live preview pane.
  • Social login: Google, Apple and Facebook, with account linking and the Magic Link flow.
  • WCAG accessibility scanner: axe-core audits from the admin, violations outlined on a screenshot and mapped to the template.
  • MCP server: 201 tools on a default install, OAuth 2.1 browser login, same permissions as REST.
  • AI-agent-ready storefront: robots.txt, llms.txt and a markdown version of every page.
  • Async job queue: Symfony Messenger on your database and cron, with worker pools and an admin grid.
  • OpenTelemetry: traces, metrics and logs over OTLP to any backend you already run.

Maho 26.7.0 is out today!

Maho keeps accelerating: 26.7.0 lands with a completely rewritten API (REST v2, GraphQL, JWT auth, OpenAPI docs), a brand-new admin design with light and dark mode, and a declarative database schema system that replaces two decades of imperative upgrade scripts.

With 26.7.0, Maho gets a brand-new API and a brand-new face.

Highlights

  • The new API on API Platform: ~140 REST endpoints, GraphQL, JWT auth, granular permissions, OpenAPI docs. Ships as beta.
  • New backend design: complete admin redesign with light and dark mode, CSS-first, zero new dependencies.
  • Declarative DB schema: modules describe their target schema, Maho converges the database automatically.
  • Frontend 2FA: optional (or mandatory) TOTP two-factor authentication for customers.
  • Maho_Revocation: the EU-mandatory revocation button (Directive 2023/2673), built in.
  • Schema.org structured data: JSON-LD for products, breadcrumbs, organization, site search and blog posts.
  • Layered navigation SEO: noindex for filtered/paginated pages, canonical defaults, nofollow filter links.
  • PDF attachments for invoice, shipment, and credit memo emails.
  • Maho_MediaCleaner: find and clean orphan media files from the admin.
  • Bestsellers and On Sale widgets: merchandising blocks powered by data Maho already collects.

Bugfix releases are coming, starting with 26.7

Maho moves fast, and every new YY.m release proves it: new features, performance improvements, and a platform that keeps getting more modern. Until now, if you needed a fix between releases, you picked up the whole next release with it.

Starting with 26.7, that trade-off is gone. The current Maho series can now receive proper bugfix releases, 26.7.1, 26.7.2, and so on, carrying important fixes back to the exact version your store is already running.

A brand-new admin panel, in light and dark

Your customers see the storefront. You see the admin, every single day. It's where you add products, chase orders, tweak config, and spend hours that nobody outside your team ever notices. And while Maho has spent its whole life modernizing this platform from the inside, PHP 8.3+, a rebuilt checkout, modern tooling, one piece at a time, the admin was the one big surface still wearing the look it was born with.

So we rebuilt it. Maho's admin panel has been completely redesigned: a modern, calm, consistent interface with first-class dark mode. It lands in core with 26.7 in July, but you don't have to wait, you can click around the real thing on our live demo right now.

The EU revocation button is mandatory on June 19. Maho has you covered.

If you sell to consumers in the EU, a new rule lands in eight days. From 19 June 2026, EU Directive 2023/2673 requires online shops to give customers a clearly labelled revocation button: a way to withdraw from a contract in a few clicks, always reachable, no hoops. In Germany it's written into law as ยง356a BGB.

Maho ships that button, built in. It lands in core with 26.7 in July, but the deadline comes first, so you can add it to your store today.

Raising the bar on quality and security

Maho isn't one repository. It's the core platform, dozens of payment and feature modules, developer tools, language packs, our websites, all open source, and all growing. Every new repo is one more place where code quality and security have to stay in line, and "keep an eye on it by hand" stops working pretty fast.

So we did what we always do at Maho: we solved it with open, auditable code. Say hello to our new infrastructure repository.

  • in Events
  • 1 min read

Maho at DevConf 2026!

DevConf 2026

We're excited to share that Fabrizio Balliano will be speaking at DevConf 2026, the Italian conference dedicated to developers and the open source community.

Language packs, rebuilt, and three new languages

Back in 2024 we shared our 15-year-long quest for perfect language packs. That first system did the job, but it leaned on a lot of moving parts behind the scenes, and the old translations it was built on were never the highest quality to begin with.

So we rebuilt the whole thing from scratch around a much simpler idea, started the translations over from a clean, higher-quality base, and while we were at it, added three brand-new languages.