A week of practical fixes in Maho

This was a week of practical fixes: checkout validation became more accurate, export tooling grew a useful first set of commands, and several edge cases in payments and installation were closed. The database encoding change deserves particular attention before an upgrade.

Highlights

• Country-aware address validation reaches checkout and the admin
• CSV exports arrive in the CLI
• MySQL and MariaDB move to utf8mb4
• PayPal no longer reports an already-placed order
• The installer handles translated apostrophes
• The queue watchdog works on a fresh install

Country-aware address validation reaches checkout and the admin

PR #1481 by fballiano adds postcode and region validation based on the country. The address forms put the country first, show a country-specific postcode example and validate the format in the browser before submit. The same rule set is used in checkout, customer account and admin. A follow-up fix in PR #1506 by hirale keeps the customer and cart APIs from requiring a postcode in countries where it is optional.

CSV exports arrive in the CLI

PR #1503 by fballiano adds product, customer and category export commands, with CSV output, filters and a skip option. The default destination is var/export. This completes the CLI part of the related category import work and keeps the sample-data column names aligned.

MySQL and MariaDB move to utf8mb4

PR #1490 by fballiano changes the connection and existing tables from utf8mb3 to utf8mb4, allowing four-byte characters such as emoji to be stored. The first ./maho migrate rebuilds every table, so a large store needs a maintenance window. ./maho migrate --dry-run lists the conversions first.

PayPal no longer reports an already-placed order

PR #1501 by fballiano fixes the race between the PayPal approval webhook and the buyer-facing action. The action now loads the session quote correctly and takes the order lock before rejecting an inactive quote. The change was backported to 26.9 in PR #1502.

The installer handles translated apostrophes

PR #1488 by fballiano escapes translated PHP values before inserting them into JavaScript in the web installer. This fixes steps that stopped parsing when a translation contained an apostrophe, including the Italian language pack. The fix was backported to 26.9 in PR #1489.

The queue watchdog works on a fresh install

PR #1484 by fballiano gets the queue log path from Maho’s log-directory helper. That creates var/log when needed and honours a custom log directory, so the watchdog can start a worker on a fresh installation. The fix was backported to 26.9 in PR #1485.

Changelog

• #1506 optional postcodes in customer and cart address APIs, by hirale.
• #1483 DBAL 4.5 and typed schema editors, by fballiano.
• #1504 Symfony MCP bundle 0.14 and percent signs in store names, by fballiano.
• #1481 country-aware postcode and region validation, by fballiano.
• #1503 product, customer and category CSV exports, by fballiano.
• #1502 PayPal fix backport to 26.9, by github-actions[bot].
• #1501 PayPal webhook/order race fix, by fballiano.
• #1498 payment method instance cache fix, by fballiano.
• #1495 Altcha and DaisyUI dependency updates, by dependabot[bot].
• #1496 CI and Cloudflare action updates, by dependabot[bot].
• #1494 icons, Symfony Console and PHP-CS-Fixer updates, by dependabot[bot].
• #1493 search fix backport to 26.9, by github-actions[bot].
• #1490 utf8mb4 migration, by fballiano.
• #1489 installer fix backport to 26.9, by github-actions[bot].
• #1488 installer apostrophe fix, by fballiano.
• #1486 coupon usage report fix, by fballiano.
• #1485 queue watchdog backport to 26.9, by github-actions[bot].
• #1484 queue watchdog log path fix, by fballiano.