Changes from 1.6.1 to 1.6.2

Aggregated from releases across the o3-shop GitHub organisation since shop-ce v1.6.1 (2026-06-04). Last updated: 2026-07-02 08:50 UTC.

shop-ce (v1.6.2)

• bin/release: print a click-and-finish checklist at end of a live run by @ralftrapp in shop-ce#169

• Wire tinymce-editor module as a dev satellite (#194) by @nlo-tronet in shop-ce#172

• feat: Add bootstrap.custom.php support for local/environment-specific initialization by @nlo-tronet in shop-ce#170

• fix: guard image-decode failures in resize helpers (PHP 8 TypeError → HTTP 500) by @nlo-tronet in shop-ce#173

• fix: add missing admin help translations, fix wrong ones, sort language files by @nlo-tronet in shop-ce#174

• Setup mod_rewrite check false-negatives behind reverse proxy / DDEV (blocks install) by @nlo-tronet in shop-ce#175

• setup xdebug in shop-app container for step debugging with IDE by @nlo-tronet in shop-ce#178

• fix(#171): resolve revocation templates through theme inheritance by @nlo-tronet in shop-ce#177

• fix(#190): bin/release pre-flight gate — enforce delete_branch_on_merge=false on final releases by @nlo-tronet in shop-ce#176

• feat(#213): pluggable core CAPTCHA layer + Google reCAPTCHA module by @nlo-tronet in shop-ce#180

• Add oe:theme:activate CLI; consolidate theme defaults to theme.php by @nlo-tronet in shop-ce#181

• feat(#213): fail closed when CAPTCHA consent is required but not granted by @nlo-tronet in shop-ce#183

• feat(#213): config-driven cookie-consent mode for core CAPTCHA by @nlo-tronet in shop-ce#184

• fix: add missing oxconfigdisplay entries for blShowSubcatTiles and sEnable3xl by @egate-media-Frank in shop-ce#185

• fix: seed contactFormRequiredFields in initial_data.sql by @egate-media-Frank in shop-ce#186

• Run database migrations automatically on composer update (with no-DB guard) (#192) by @nlo-tronet in shop-ce#171

• docs+feat(#140): close §17/§18, archive change, auto-detect nested working trees by @ralftrapp in shop-ce#131

• chore(#148): drop unused symfony/expression-language dep by @ralftrapp in shop-ce#135

• feat(#145): auto-bump theme.php version line at release time by @ralftrapp in shop-ce#132

• feat(#137): fail quality gate when coverage drops below 90% by @ralftrapp in shop-ce#133

• perf(#112): speed up admin order overview (SQL index-friendliness + skip stats on detail view) by @ralftrapp in shop-ce#138

• fix(#125): Config::reinitialize must clear in-memory params before re-init by @ralftrapp in shop-ce#139

• feat(#143): bin/oe-console oe:user:change-password + oe:user:create –role={admin|customer} by @ralftrapp in shop-ce#134

• fix(#140): bump CI composer pin 2.2.21 → 2.2.28 (GHSA-f9f8-rm49-7jv2) by @ralftrapp in shop-ce#141

• Delete .github/workflows/tests.yml by @nlo-tronet in shop-ce#142

• test(#127): regression guard for docker.sh exit-code propagation by @ralftrapp in shop-ce#137

• 124 make unit tests theme agnostic flip test fixture default to o3 theme by @nlo-tronet in shop-ce#147

• feat: multi-worktree Docker — shared MariaDB, per-worktree shop instances with isolated ports and databases by @nlo-tronet in shop-ce#148

• B 1.6 claude and scripts by @nlo-tronet in shop-ce#151

• Configurable log level for unknown-controller requests (bot probe noise) by @nlo-tronet in shop-ce#150

• feat: add oe:module:rebuild-configuration command (#132) by @nlo-tronet in shop-ce#146

• fix(#157): silence Composer autoload warning on --no-dev install by @nlo-tronet in shop-ce#149

• 109 test suite detects exceptions by scraping shared oxideshoplog error only substring exception fragile order dependent destructive by @nlo-tronet in shop-ce#105

• sec: symfony/dom-crawler and symfony/yaml CVEs investigated — not exploitable in O3-Shop, see report-cve-2026-05-26.md by @nlo-tronet in shop-ce#152

• chore: metapackage update resolves composer/composer advisories — re-baseline audit reports by @nlo-tronet in shop-ce#154

• bc: Basket::getPaymentId() is now a required basket contract in OrderController::getPayment() by @nlo-tronet in shop-ce#153

• fix: ensure consistent log directory path handling in Config by @nlo-tronet in shop-ce#155

• 166 sourcebootstrapphp rewrite hard references exithandler breaks composer install for any 13x 16x upgrade with a non empty vendor by @nlo-tronet in shop-ce#156

• Adjust bin/release for the metapackage fold-out by @ralftrapp in shop-ce#157

• fix(#166): guard ExitHandler registration with interface_exists() by @ralftrapp in shop-ce#158

• refactor(#169): tag shop-metapackage-ce at –to verbatim (drop the –bump workaround) by @ralftrapp in shop-ce#159

• German language inactive by default — should ship active by @ralftrapp in shop-ce#160

• fix: export SHOP_CONTAINER for playwright suite after #148 rename by @ralftrapp in shop-ce#161

• Security review: symfony/yaml & symfony/polyfill-intl-idn CVEs (Low) — not exploitable in O3-Shop; yaml fix deferred to Symfony stack migration by @nlo-tronet in shop-ce#162

• fix: update initial_data.sql for o3-Theme v1.4.0 color settings by @egate-media-Frank in shop-ce#165

New Contributors

• @egate-media-Frank made their first contribution in shop-ce#165

• fix: use INSERT IGNORE for o3-theme oxconfigdisplay block in initial_… by @egate-media-Frank in shop-ce#166

• issue #185 by @egate-media-Frank in shop-ce#167

shop-metapackage-ce (v1.6.2)

• Update README.md by @swinde in shop-metapackage-ce#2

o3-shop (v1.6.2)

o3-shop/shop-facts

o3-shop/shop-doctrine-migration-wrapper

o3-shop/shop-db-views-generator

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-db-views-generator#1

New Contributors

• @ralftrapp made their first contribution in shop-db-views-generator#1

o3-shop/shop-demodata-installer

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-demodata-installer#1

• @ralftrapp made their first contribution in shop-demodata-installer#1

o3-shop/shop-composer-plugin

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-composer-plugin#4

• fix: upgrade bootstrap.php overwrite notification to warning by @nlo-tronet in shop-composer-plugin#5

• @ralftrapp made their first contribution in shop-composer-plugin#4

• @nlo-tronet made their first contribution in shop-composer-plugin#5

o3-shop/mink-selenium-driver

• feat: exclude .next-bump from dist archives by @ralftrapp in MinkSeleniumDriver#1

• @ralftrapp made their first contribution in MinkSeleniumDriver#1

o3-shop/codeception-page-objects

• feat: exclude .next-bump from dist archives by @ralftrapp in codeception-page-objects#1

• @ralftrapp made their first contribution in codeception-page-objects#1

o3-shop/shop-ce

• bin/release: print a click-and-finish checklist at end of a live run by @ralftrapp in shop-ce#169

• Wire tinymce-editor module as a dev satellite (#194) by @nlo-tronet in shop-ce#172

• feat: Add bootstrap.custom.php support for local/environment-specific initialization by @nlo-tronet in shop-ce#170

• fix: guard image-decode failures in resize helpers (PHP 8 TypeError → HTTP 500) by @nlo-tronet in shop-ce#173

• fix: add missing admin help translations, fix wrong ones, sort language files by @nlo-tronet in shop-ce#174

• Setup mod_rewrite check false-negatives behind reverse proxy / DDEV (blocks install) by @nlo-tronet in shop-ce#175

• setup xdebug in shop-app container for step debugging with IDE by @nlo-tronet in shop-ce#178

• fix(#171): resolve revocation templates through theme inheritance by @nlo-tronet in shop-ce#177

• fix(#190): bin/release pre-flight gate — enforce delete_branch_on_merge=false on final releases by @nlo-tronet in shop-ce#176

• feat(#213): pluggable core CAPTCHA layer + Google reCAPTCHA module by @nlo-tronet in shop-ce#180

• Add oe:theme:activate CLI; consolidate theme defaults to theme.php by @nlo-tronet in shop-ce#181

• feat(#213): fail closed when CAPTCHA consent is required but not granted by @nlo-tronet in shop-ce#183

• feat(#213): config-driven cookie-consent mode for core CAPTCHA by @nlo-tronet in shop-ce#184

• fix: add missing oxconfigdisplay entries for blShowSubcatTiles and sEnable3xl by @egate-media-Frank in shop-ce#185

• fix: seed contactFormRequiredFields in initial_data.sql by @egate-media-Frank in shop-ce#186

• Run database migrations automatically on composer update (with no-DB guard) (#192) by @nlo-tronet in shop-ce#171

o3-shop/o3-theme

• feat: exclude .next-bump from dist archives by @ralftrapp in o3-Theme#22

• docs(#131): rewrite README — audience, fix broken clone URL, drop obsolete steps by @ralftrapp in o3-Theme#25

• fix(#145): bump theme.php version to current tag (1.3.1) by @ralftrapp in o3-Theme#24

• fix: update brace-expansion to version 5.0.6 in package-lock.json by @nlo-tronet in o3-Theme#26

• feat: v1.4.0 — new color/layout settings and template improvements (f… by @egate-media-Frank in o3-Theme#28

• Feature/issue 27 new color settings by @egate-media-Frank in o3-Theme#29

• fix: uppercase sAccentColor default value (#FFFFFF) by @egate-media-Frank in o3-Theme#30

• fix: add missing English DD_FOOTER_O3ShopLink translation by @nlo-tronet in o3-Theme#31

• fix: contact map derives from shop address instead of placeholder by @nlo-tronet in o3-Theme#32

• v1.5.0 - 3xl-size, subcategory tiles, template fixes, CSS consolidation by @egate-media-Frank in o3-Theme#33

• fix: translate German comments to English in widget JS files by @egate-media-Frank in o3-Theme#34

• feat(#213): render CAPTCHA widget into the 7 form blocks by @nlo-tronet in o3-Theme#35

• Add 8 missing feature/footer/article toggles to theme.php by @nlo-tronet in o3-Theme#36

• fix: remove whitespace inside contact textarea that misplaces cursor by @egate-media-Frank in o3-Theme#37

• fix: show text pill for manufacturers without icon on manufacturer list by @egate-media-Frank in o3-Theme#38

• @nlo-tronet made their first contribution in o3-Theme#26

o3-shop/shop-demodata-ce

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-demodata-ce#9

• fix: update demodata.sql for o3-Theme v1.4.0 color setting renames by @egate-media-Frank in shop-demodata-ce#10

• fix: add s-prefix color settings to demodata.sql for o3-Theme v1.4.0 by @egate-media-Frank in shop-demodata-ce#11

• @egate-media-Frank made their first contribution in shop-demodata-ce#10

o3-shop/tinymce-editor

• Security: upgrade bundled TinyMCE 6.4.1 → 7.9.3 (3 HIGH XSS CVEs) by @nlo-tronet in tinymce-editor#3

• @nlo-tronet made their first contribution in tinymce-editor#3

o3-shop/wave-theme

• feat: exclude .next-bump from dist archives by @ralftrapp in wave-theme#4

• fix(#145): bump theme.php version to current tag (1.2.1) by @ralftrapp in wave-theme#5

• fix: contact map derives from shop address instead of placeholder by @nlo-tronet in wave-theme#6

• feat(#213): render CAPTCHA widget into the 7 form blocks by @nlo-tronet in wave-theme#7

• @nlo-tronet made their first contribution in wave-theme#6

o3-shop/shop-metapackage-ce

• Update README.md by @swinde in shop-metapackage-ce#2

Unchanged in this release

• o3-shop/gdpr-optin-module continues at v2.3.5

• o3-shop/smarty continues at ~2.6.34

• o3-shop/shop-unified-namespace-generator continues at ^1.0.0

• o3-shop/php-selenium continues at ~1.0.0

• o3-shop/codeception-modules continues at ^1.0.0

• o3-shop/developer-tools continues at ^1.0.0

• o3-shop/testing-library continues at ^1.2.0

• o3-shop/shop-ide-helper continues at ^1.0.0

• o3-shop/usercentrics continues at v1.2.2

• Update main to v1.0.4 (#140 §14) by @ralftrapp in shop-facts#2

• Delete .github/workflows/sync_action.yml by @ralftrapp in shop-doctrine-migration-wrapper#3

o3-shop/shop-unified-namespace-generator

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-unified-namespace-generator#1

• @ralftrapp made their first contribution in shop-unified-namespace-generator#1

o3-shop/codeception-modules

• feat: exclude .next-bump from dist archives by @ralftrapp in codeception-modules#1

• @ralftrapp made their first contribution in codeception-modules#1

o3-shop/developer-tools

• feat: exclude .next-bump from dist archives by @ralftrapp in developer-tools#1

• @ralftrapp made their first contribution in developer-tools#1

o3-shop/testing-library

• feat: exclude .next-bump from dist archives by @ralftrapp in testing-library#4

• fix(#109): replace file-based exception detection with Monolog TestHandler by @nlo-tronet in testing-library#5

• fix(#193): relax symfony/polyfill-intl-idn pin to ^1.38.1 (CVE-2026-46644) by @nlo-tronet in testing-library#6

• B 1.6 by @nlo-tronet in testing-library#7

• @ralftrapp made their first contribution in testing-library#4

o3-shop/shop-ide-helper

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-ide-helper#1

• @ralftrapp made their first contribution in shop-ide-helper#1

• o3-shop/shop-facts continues at v1.0.5

• o3-shop/shop-doctrine-migration-wrapper continues at v1.0.3

o3-shop/gdpr-optin-module

• feat: exclude .next-bump from dist archives by @ralftrapp in gdpr-optin-module#1

• @ralftrapp made their first contribution in gdpr-optin-module#1

• feat: exclude .next-bump from dist archives by @ralftrapp in shop-facts#1

• b-1.5 => main by @nlo-tronet in shop-ce#99

• feat: exclude .next-bump from dist archives by @ralftrapp in tinymce-editor#1

• fix: editor-inserted images use root-relative URLs (o3-shop/o3-shop#151) by @ralftrapp in tinymce-editor#2

• @ralftrapp made their first contribution in tinymce-editor#1

o3-shop/usercentrics

• feat: exclude .next-bump from dist archives by @ralftrapp in usercentrics#1

• @ralftrapp made their first contribution in usercentrics#1

• feat(#140): bin/release CLI + metapackage fold-in prerequisites by @ralftrapp in shop-ce#121

• feat(#140): post-#121 fixes from 12.1 live dry-run + UX by @ralftrapp in shop-ce#123

• docs(#140): close §13 (wiki) and §14 (branch normalization) by @ralftrapp in shop-ce#124

• docs(#140): extend §14 to cover 5 missed release-eligible repos by @ralftrapp in shop-ce#125

• feat(#140): wire live execution in ReleaseCommand (§15) by @ralftrapp in shop-ce#126

• feat(#140): zero-config repo discovery + auto-clone + UpToDateGate (§16) by @ralftrapp in shop-ce#127

• feat(#140): ComposerInstallGate refinements + –no-audit CLI flag by @ralftrapp in shop-ce#128

• fix(#140): use bundled composer in ComposerInstallGate by @ralftrapp in shop-ce#129

• fix(#140): drop –no-audit; bundled composer 2.2.x predates audit feature by @ralftrapp in shop-ce#130

• docs+feat(#140): close §17/§18, archive change, auto-detect nested working trees by @ralftrapp in shop-ce#131

• chore(#148): drop unused symfony/expression-language dep by @ralftrapp in shop-ce#135

• feat(#145): auto-bump theme.php version line at release time by @ralftrapp in shop-ce#132

• feat(#137): fail quality gate when coverage drops below 90% by @ralftrapp in shop-ce#133

• perf(#112): speed up admin order overview (SQL index-friendliness + skip stats on detail view) by @ralftrapp in shop-ce#138

• fix(#125): Config::reinitialize must clear in-memory params before re-init by @ralftrapp in shop-ce#139

• feat(#143): bin/oe-console oe:user:change-password + oe:user:create –role={admin|customer} by @ralftrapp in shop-ce#134

• fix(#140): bump CI composer pin 2.2.21 → 2.2.28 (GHSA-f9f8-rm49-7jv2) by @ralftrapp in shop-ce#141

• Delete .github/workflows/tests.yml by @nlo-tronet in shop-ce#142

• test(#127): regression guard for docker.sh exit-code propagation by @ralftrapp in shop-ce#137

• 124 make unit tests theme agnostic flip test fixture default to o3 theme by @nlo-tronet in shop-ce#147

• feat: multi-worktree Docker — shared MariaDB, per-worktree shop instances with isolated ports and databases by @nlo-tronet in shop-ce#148

• B 1.6 claude and scripts by @nlo-tronet in shop-ce#151

• Configurable log level for unknown-controller requests (bot probe noise) by @nlo-tronet in shop-ce#150

• feat: add oe:module:rebuild-configuration command (#132) by @nlo-tronet in shop-ce#146

• fix(#157): silence Composer autoload warning on --no-dev install by @nlo-tronet in shop-ce#149

• 109 test suite detects exceptions by scraping shared oxideshoplog error only substring exception fragile order dependent destructive by @nlo-tronet in shop-ce#105

• sec: symfony/dom-crawler and symfony/yaml CVEs investigated — not exploitable in O3-Shop, see report-cve-2026-05-26.md by @nlo-tronet in shop-ce#152

• chore: metapackage update resolves composer/composer advisories — re-baseline audit reports by @nlo-tronet in shop-ce#154

• bc: Basket::getPaymentId() is now a required basket contract in OrderController::getPayment() by @nlo-tronet in shop-ce#153

• fix: ensure consistent log directory path handling in Config by @nlo-tronet in shop-ce#155

• 166 sourcebootstrapphp rewrite hard references exithandler breaks composer install for any 13x 16x upgrade with a non empty vendor by @nlo-tronet in shop-ce#156

• Adjust bin/release for the metapackage fold-out by @ralftrapp in shop-ce#157

• fix(#166): guard ExitHandler registration with interface_exists() by @ralftrapp in shop-ce#158

• refactor(#169): tag shop-metapackage-ce at –to verbatim (drop the –bump workaround) by @ralftrapp in shop-ce#159

• German language inactive by default — should ship active by @ralftrapp in shop-ce#160

• fix: export SHOP_CONTAINER for playwright suite after #148 rename by @ralftrapp in shop-ce#161

• Security review: symfony/yaml & symfony/polyfill-intl-idn CVEs (Low) — not exploitable in O3-Shop; yaml fix deferred to Symfony stack migration by @nlo-tronet in shop-ce#162

• fix: update initial_data.sql for o3-Theme v1.4.0 color settings by @egate-media-Frank in shop-ce#165

• @egate-media-Frank made their first contribution in shop-ce#165

o3-Theme (v1.5.3)

What Changed

• Fixing a bug where old shops crashed because of the new Captcha System - @nlo-tronet

• fix: translate German comments to English in widget JS files by @egate-media-Frank in o3-Theme#34

• feat(#213): render CAPTCHA widget into the 7 form blocks by @nlo-tronet in o3-Theme#35

• Add 8 missing feature/footer/article toggles to theme.php by @nlo-tronet in o3-Theme#36

• fix: remove whitespace inside contact textarea that misplaces cursor by @egate-media-Frank in o3-Theme#37

• fix: show text pill for manufacturers without icon on manufacturer list by @egate-media-Frank in o3-Theme#38

• fix: add missing English DD_FOOTER_O3ShopLink translation by @nlo-tronet in o3-Theme#31

• fix: contact map derives from shop address instead of placeholder by @nlo-tronet in o3-Theme#32

• v1.5.0 - 3xl-size, subcategory tiles, template fixes, CSS consolidation by @egate-media-Frank in o3-Theme#33

wave-theme (v1.2.5)

What Changed

• Fixing a bug where old shops crashed because of the new Captcha System - @nlo-tronet

• feat(#213): render CAPTCHA widget into the 7 form blocks by @nlo-tronet in wave-theme#7

• fix: contact map derives from shop address instead of placeholder by @nlo-tronet in wave-theme#6

New Contributors

• @nlo-tronet made their first contribution in wave-theme#6

testing-library (v1.2.6)

• fix(#193): relax symfony/polyfill-intl-idn pin to ^1.38.1 (CVE-2026-46644) by @nlo-tronet in testing-library#6