If you sell to consumers in the EU, a new rule lands in eight days. From 19 June 2026, EU Directive 2023/2673 requires online shops to give customers a clearly labelled revocation button: a way to withdraw from a contract in a few clicks, always reachable, no hoops. In Germany it's written into law as §356a BGB.
Maho ships that button, built in. It lands in core with 26.7 in July, but the deadline comes first, so you can add it to your store today.
Maho isn't one repository. It's the core platform, dozens of payment and feature modules, developer tools, language packs, our websites, all open source, and all growing. Every new repo is one more place where code quality and security have to stay in line, and "keep an eye on it by hand" stops working pretty fast.
So we did what we always do at Maho: we solved it with open, auditable code. Say hello to our new infrastructure repository.
We're excited to share that Fabrizio Balliano will be speaking at DevConf 2026, the Italian conference dedicated to developers and the open source community.
Back in 2024 we shared our 15-year-long quest for perfect language packs. That first system did the job, but it leaned on a lot of moving parts behind the scenes, and the old translations it was built on were never the highest quality to begin with.
So we rebuilt the whole thing from scratch around a much simpler idea, started the translations over from a clean, higher-quality base, and while we were at it, added three brand-new languages.
Following the sprint of 26.3.0, this release goes deeper into the engine room: new flagship modules (PayPal, AI, Intelligence), a wave of core modernizations (typed routing, PHP attributes for observers and cron, rewritten date APIs), and the usual long tail of improvements, fixes and polish.
26.5.0 is one of the most ambitious modernization releases Maho has ever shipped.
Highlights
Brand-new Maho_Paypal module: Rebuilt from scratch on the PayPal JS SDK v6 and the official PayPal Server SDK.
Real-time EU VAT validation: VIES checks directly in checkout and address forms, with caching and offline fallback.
Symfony Routing with #[Route] attributes: Static, introspectable, ~7× faster matching on average.
Observers and Cron Jobs as PHP attributes: Native, compiled at build time, with the entire core migrated.
New Maho_Ai module: First-class multi-provider LLM platform on top of symfony/ai.
New Maho_Intelligence module: LSP and MCP server exposing the merged runtime config to editors and AI agents.
Official editor plugins: First-party Maho extensions for PhpStorm, VS Code, and Zed.
Vanilla JS image editor: Custom Canvas-based editor with on-device AI background removal.
Refactored date management APIs: Clear UTC/store semantics encoded into method names, ~130 files migrated.
Admin Health Check page: Configuration drift and misconfigurations surfaced at a glance.
We're barely two months into 2026 and Maho keeps accelerating. After the landmark multi-database and gift card release in 26.1.0, we've packed so many features into this release it feels like we're bending time.
26.3.0 is codenamed "Time Warp" for a reason.
Highlights
One-Step Checkout: All checkout steps visible at once in a responsive 2-column layout.
FeedManager: Complete product feed export for Google Shopping, Meta, Bing, Pinterest and more.
Content Versioning: Automatic snapshots of CMS pages, blocks, and blog posts with one-click restore.
Email Logging: Every outgoing email logged and browsable from the admin panel.
ShippingBridge: Connect to any external shipping rate API with zero custom code.
Blog Categories: Full hierarchical category system with drag-and-drop reordering.
Bento Grid layouts: Stunning CSS Grid compositions in the TipTap WYSIWYG editor.
Deferred Image Thumbnails: Async generation that dramatically improves first-load performance.
We're kicking off 2026 with yet another monumental milestone: multi-database support. For the first time ever, Maho can run on PostgreSQL and SQLite alongside MySQL!
But that's just the beginning. This release also brings passwordless authentication, a complete gift card module, automated product linking rules, dozens of frontend improvements, and full PHP 8.5 compatibility.
26.1.0 is our most feature-rich release yet.
Highlights
Multi-database support: Run Maho on MySQL, PostgreSQL, or SQLite via Doctrine DBAL 4.4.
Magic Link authentication: Passwordless login via secure email links with hybrid or full passwordless modes.
Complete Gift Card module: Fixed or custom amounts, partial payments, PDF export with QR codes, and recipient notifications.
CatalogLinkRule module: Automate product relationships through condition-based rules.
USPS REST API migration: OAuth 2.0 support with ~90% reduction in API requests.
Enhanced Dashboard Analytics: Server-side visitor insights without third-party data collection.
AJAX add-to-cart: Offcanvas minicart for smoother shopping experience.
New CLI commands: Database migrations, maintenance mode, theme scaffolding, and layout debugging.
