Maho 26.3.0 "Time Warp" is out today!

We're barely two months into 2026 and Maho keeps accelerating. After the landmark multi-database and gift card release in 26.1.0, we've packed so many features into this release it feels like we're bending time.

26.3.0 is codenamed "Time Warp" for a reason.

New features and major improvements

One-Step Checkout

Checkout is the most critical conversion point in any online store, and multi-step checkouts are a proven source of cart abandonment. Maho now ships with a built-in one-step checkout that displays all checkout steps simultaneously in a clean, responsive 2-column layout.

FeedManager: Product Feed Export

Selling on Google Shopping, Facebook/Meta, Bing, Pinterest, or any marketplace? The new FeedManager module gives you a complete product feed export system built right into Maho - no third-party extensions needed.

Content Versioning

Ever accidentally overwritten a CMS page and wished you could go back? The new Maho_ContentVersion module automatically snapshots CMS pages, CMS blocks, and blog posts on every save.

Email Logging

Every outgoing email is now logged to a dedicated database table via a Symfony Mailer transport decorator - completely transparent, no configuration needed. Perfect for debugging delivery issues, auditing transactional emails, and compliance.

• Admin grid at System > Tools > Email Log with filtering, search, and detail view
• Configurable auto-cleanup via daily cron job

ShippingBridge: External Shipping Rate APIs

The new Maho_ShippingBridge module lets you connect to any external shipping rate API with zero custom code. Configure a REST endpoint, and Maho will POST cart data (items, quantities, product attributes) and map the JSON response back to standard shipping rates. Especially important for medium/big companies with internal CRM/PIM and custom shipping calculation rules.

Blog Categories

The Blog module now has a full hierarchical category system, bringing it on par with dedicated blogging platforms.

• Nested tree structure - unlimited parent/child nesting with drag-and-drop reordering in admin
• Frontend sidebar styled as layered navigation for intuitive browsing
• SEO-friendly URLs - full-path slugs like /blog/category/parent/child/
• Breadcrumbs - proper navigation context on category and post pages

Bento Grid for TipTap WYSIWYG

Our WYSIWYG editor gains a powerful new layout tool: bento-style CSS Grid layouts. Think Pinterest boards or Apple's product pages - asymmetric, visually striking grid compositions right inside your CMS editor.

Deferred Image Thumbnail Generation

Product image thumbnails are no longer generated synchronously during page render. On a cache miss, instead of blocking the entire page for 10-15 seconds, Maho now returns a signed URL that lets the browser fetch and generate each thumbnail in parallel.

• HMAC-SHA256 signed tokens prevent abuse
• Parallel generation - the browser requests all missing thumbnails concurrently
• Zero overhead for cached images - they continue serving as direct static URLs

Complete Serialize-to-JSON Migration

PHP's serialize()/unserialize() has been a perennial source of object injection vulnerabilities, and it's completely incompatible with PostgreSQL and SQLite. We've migrated over 72 callsites across 41 files to JSON, covering rule conditions, product options, EAV attributes, widgets, quote addresses, order shipments, and more. The infrastructure includes dual-read (JSON-first with unserialize fallback) that auto-propagates to all consumers, including third-party modules. Batch migration scripts are included for existing databases.

And much more, be sure to check the full release announcement.