A week of new ways to build content in Maho

This is the week the way you write content changes: a page builder lands in the editor of CMS pages, blocks and blog posts, and the product page learns to show its images the way the store manager prefers. Underneath, as always, there are fixes too: gift cards, wishlist, newsletter and a maintenance patch that touches the REST API.

Highlights

• A page builder inside the content
• The editor keeps the HTML of a save
• The product page gallery picks its layout
• Gift cards and lookups that ignore letter case
• The wishlist no longer loses API items
• Saving a customer no longer unsubscribes it
• The 26.9.2 patch and the prices seen by the API
• Signed releases and a narrower Actions token
• A faster reindex and a consistent sitemap

A page builder inside the content

The Content tab of CMS pages, static blocks and blog posts has one more button, “Fullscreen Page Builder”. You compose the content by dragging columns, bento grids, accordions, tabs, images, slideshows, widgets and buttons, with the storefront preview beside the editor (#1594, by fballiano).

The preview is not a simulation in the browser: the server renders a draft of the unsaved content, in the theme of the store view. In the same line of work, the plain editor stopped showing placeholders and now presents widgets, blocks and {{icon}} directives as a visitor sees them (#1595).

The draft lives in the application cache for thirty minutes, so a store with more than one web node needs a shared cache, for example Redis. The page builder comes from the Design Mode of empiricompany/maho-design-mode, the open source module MageMEGA contributed to the core.

The editor keeps the HTML of a save

Whoever writes HTML by hand knows the annoyance: one label, one section, one video or one aria- attribute on a heading was enough to close the editor and land on the raw HTML. The fix in #1610 by fballiano makes the editor keep everything a save keeps.

The product page gallery picks its layout

A new group in System > Configuration > Design > Product Page Gallery: thumbnails below, left or right of the image, or a grid of all images in one, two or three columns. On a phone the default becomes a swipe carousel with a counter (#1601, by fballiano).

Two useful details: the thumbnails are larger, 99 px instead of 68 px in a 1280 px window, and the one of the visible image has a dark outline. To get the previous phone layout back, set “Phone Layout” to “Thumbnails Below the Image”.

Gift cards and lookups that ignore letter case

The fix in #1606 by fballiano solves three defects in the gift card module and one in the lookups of codes, emails and postcodes. On MySQL and MariaDB a gift card was marked as used when the amount was at least half of the balance, and the customer lost the rest. The wrong balance also showed in the history row when another request used the card first.

Partial invoices now share the gift card amount instead of subtracting the total every time, and the same fix closes the cases where logins, coupons and postcode rates failed on PostgreSQL and SQLite when the letter case changed. The 26.9 version ships with #1609.

The wishlist no longer loses API items

#1602 by hirale fixes a wishlist save that deleted the items added through REST, for example with POST /api/rest/v2/customers/me/wishlist/sync. The cause was a list of product ids built with array_keys() over a list that already held ids, so the filter received 0, 1, 2 instead of the real ids. The same pull request puts the extensions of api_wishlist_item_dto_build back in the API responses. The 26.9 backport is #1603.

Saving a customer no longer unsubscribes it

When an admin saved a subscribed customer, for example to add an address, the customer was unsubscribed from the newsletter and got the “Newsletter unsubscription success” email. It happened when the output of MageNewsletter is disabled, because the Newsletter tab is then not shown. A save now changes the subscription only when the tab is visible (#1612, backported in #1613).

The 26.9.2 patch and the prices seen by the API

The 26.9.2 release is pure maintenance, but some fixes change what the REST API returns. The delicate one is #1563: catalog price rules and the customer group now apply to API product reads and API carts too. A customer cart saved as NOT LOGGED IN takes the correct group on its next write, so its prices change.

With #1532 the exact quantity is no longer visible to everyone: anonymous callers and customers get stockQty only below the Only X left Threshold, null otherwise. With #1574 the price of configurable variants is no longer 0, and refused guest orders answer 403 instead of 401 (#1573).

Signed releases and a narrower Actions token

The project publishes a downloadable release package with a signed build provenance and an SBOM (#1592), and the signing moved to a separate workflow to reach SLSA Build Level 3 (#1593). In the same line, #1600 limits the token of every GitHub Actions workflow to read access, with write permissions only where they are really needed.

A faster reindex and a consistent sitemap

#1582 makes a full reindex three to five times faster and fixes tier prices that a mass product update dropped from the price index. #1586 writes the canonical URL of each page in the sitemap, following Trailing Slash Behavior, so search engines stop flagging those URLs as “Page with redirect”.

Changelog

• #1610 content editor keeps the HTML of a save, by fballiano.
• #1613 backport of the newsletter unsubscribe fix to 26.9, by github-actions[bot].
• #1612 customer save unsubscribing from the newsletter, by fballiano.
• #1609 backport of the gift card fixes to 26.9, by github-actions[bot].
• #1606 gift card balances and letter case lookups on PostgreSQL and SQLite, by fballiano.
• #1604 order review table layout in the one-step checkout, by fballiano.
• #1602 wishlist items deleted by a save and API responses without the extensions, by hirale.
• #1603 backport of the wishlist fix to 26.9, by github-actions[bot].
• #1601 product page gallery layouts, by fballiano.
• #1594 page builder in the content of CMS pages, blocks and posts, by fballiano.
• #1600 read-only GitHub Actions tokens, by fballiano.
• #1598 daisyui and playwright update, by dependabot[bot].
• #1599 setup-php, CodeQL and create-github-app-token update, by dependabot[bot].
• #1597 fourteen dependency updates, by dependabot[bot].
• #1595 widgets, blocks and icons in the editor as on the storefront, by fballiano.
• #1593 release package signing in a separate workflow, for SLSA Build Level 3, by fballiano.
• #1592 downloadable release package with signed provenance and SBOM, by fballiano.
• #1590 warning on the OAuth approval screen for MCP connections, by fballiano.
• #1589 backport of the sitemap URLs to 26.9, by github-actions[bot].
• #1587 cart shipping estimate for a country without regions, by fballiano.
• #1586 product, category and CMS page URLs in the sitemap that the storefront redirects with a 301, by fballiano.
• #1588 backport of the OAuth admin path fix to 26.9, by github-actions[bot].
• #1584 admin path visible on the OAuth authorization page, by fballiano.
• #1582 full reindex three to five times faster and tier prices in the index, by fballiano.
• #1579 request trace of actions that call exit(), by hirale.
• #1578 storage:image:resize, storage:image:clean and storage:migrate missing in a Composer project, by hirale.
• #1580 backport of the request trace to 26.9, by github-actions[bot].
• 26.9.2 maintenance release for the 26.9 line, by fballiano.