Tools

The Shopmon integration role now includes additional default ACL permissions required for language and locale reads and log-entry creation.

Fixed

• Added the missing default permissions to the Shopmon integration role. #516 (@M-arcus)

Shopmon setup credentials are now shown only when an integration is created, and the product health check no longer flags a main product that uses a variant’s cover.

Fixed

• The invalid product-cover check now accepts a main product cover that references media assigned to one of its variants. #513 (@M-arcus)

Changed

• Shopmon credentials and the quick setup code are returned and displayed only once, immediately after creating an integration. Existing integrations remain valid, but their credentials are not recoverable from FroshTools; to get a new setup code, remove and recreate the integration, then reconnect Shopmon. The update also deletes previously stored credential copies from FroshTools and FroshShopmon configuration. #514 (@shyim)

Data integrity checks now report actionable duplicate-customer details and identify products without a usable visible category, while avoiding several false positives. The Administration also improves accessibility across FroshTools pages, controls, dialogs, and task actions.

Added

• Added a data integrity check for active products visible in a sales channel but lacking an active, visible category in that channel. It reports the issue on the product holding the category assignments; categories surfaced only through dynamic product groups are not considered. #510 (@M-arcus)
• Duplicate customer email results now list the other affected customer accounts, making it easier to identify which records share an address. #510 (@M-arcus)

Fixed

• Improved data integrity results: guest accounts are excluded from invalid default-address checks, inactive duplicate-option variants are ignored, and covers pointing to another product's media are not flagged when that same image is among the product's own media. Number-range checks now distinguish core-resolved types from extension types that are not assigned per sales channel. #510 (@M-arcus)
• Improved Administration accessibility with labeled native selectors, named dialogs and actions, corrected heading and landmark semantics, and focus restoration after task menus close. Controls also fit narrow panels, and clearing security activity filters resets actor search. #506 (@shyim)

Breaking Changes

• ft-button now defaults to type="button" to avoid unintended form submissions. Set type="submit" explicitly for buttons intended to submit forms. #506 (@shyim)

New Contributors

• @M-arcus made their first contribution in #510.

Shopmon integrations can now retrieve queue statistics, and recommendation code in the Administration no longer includes unwanted surrounding whitespace.

Fixed

• Added message_queue_stats:read to the Shopmon integration role, fixing authorization failures when Shopmon requests queue statistics. Existing integrations receive the permission when the role is refreshed on plugin update. #508 (@mbortkiewicz-crehler)
• Removed unwanted whitespace around recommendation code displayed in the Administration. #507 (@lacknere)

No user-facing changes in this release.

Shopware Tools 3.17.0 makes data integrity findings easier to investigate by listing affected records in the Administration, and adds an API inventory of accounts and roles that can access the Admin API. It also improves Administration text readability by using the module’s base font size and Shopware’s font family.

Added

• Data integrity check Info dialogs now show affected records in paginated lists with links to their Administration pages. Checks can supply these records through the new AffectedEntitiesProviderInterface; entities without a known Administration page are listed by ID, and the corresponding {entity}:read privilege is required to query records. The release also adds a duplicate-rules check and corrects payment and shipping method checks to exclude product-comparison sales channels. #501 (@M-arcus)
• GET /api/_action/frosh-tools/security/accounts returns a snapshot of admin users, integrations, and ACL roles for external monitoring. It includes security-relevant metadata and hashed role privileges, but excludes usernames, names, and credentials; email addresses are masked. The endpoint requires frosh_tools_security:read. #495 (@pumpi)

Fixed

• Administration text that was rendered too small now inherits the module’s base font size; the module also uses the Administration’s font family. #502 (@tinect)

Shopware Tools 3.16.0 adds a persistent Security activity timeline, refreshes the Administration navigation and task pages, and improves queue health checks and Shopmon integration setup.

Added

• Security → Timeline records sign-ins, account and role changes, integration and API-key changes, password recovery, and available extension lifecycle events. Filter by actor, action, client IP, and UTC date; inspect event details and export all matching entries as JSON. Retention defaults to 90 days and is configurable from 1–3650 days with frosh_tools.security_activity.retention_days. Access uses the existing frosh_tools_security:read privilege. Existing logs are not imported. #477, #496, #497
• Shopmon integration setup can be automated by setting both SHOPMON_ACCESS_KEY and SHOPMON_ACCESS_SECRET before installing or updating FroshTools; APP_URL supplies the shop URL. Existing FroshShopmon integrations and credentials are adopted without rotation. When uninstalling FroshShopmon, keep its user data to avoid deleting the adopted integration. #494

Changed

• The Administration has a refreshed design and reorganized tools navigation, with focused subpages for Statistics, Apps, Search, and Fastly. Section URLs support deep links and browser history; restricted actions remain permission-aware. #487
• Queue health checks now inspect configured transports rather than unrelated database rows. Empty queues no longer trigger stale-message warnings; known overdue messages still warn, and transports that cannot report message age show an informational result. #491

Fixed

• SBOM generation strips URL credentials and query parameters from source references and omits distribution URLs, preventing credentials embedded in package URLs from appearing in the exported SBOM. Distribution hashes remain available. #500
• Removed a redundant type check in the backward line reader. #493

Breaking Changes

• The Security timeline creates a new activity table through the plugin migration. Uninstalling FroshTools without choosing keep user data drops that table. To retain activity history, keep user data when uninstalling.

• chore: prepare release 3.15.3
• feat: update minimum PHP Versions
• feat(health): add data integrity checks (#483)

• Bump version from 3.15.1 to 3.15.2
• Warn about PDO parser security before PHP 8.4 (#489)
• feat(security): warn when HTML sanitizer is disabled (#488)
• feat: add option to disable administration user password recovery (#486)

• Fixed a Security issue: https://github.com/FriendsOfShopware/FroshTools/security/advisories/GHSA-9rvg-6f23-985w
• Bump version from 3.15.0 to 3.15.1
• Block all environment files from file access and restore
• Merge commit from fork
• fix(admin): show green health dot in the 6.7.15 sidebar again (#484)
• fix(admin): restore webpack build on Shopware 6.6 (#480)
• fix(health): resolve SYSTEM time_zone and skip check on 6.7 (#479)
• docs(apps): clarify that visualization covers Shopware Services (#476)

• fix: remove comment
• chore: increase version
• fix(security): show bundled dependency origins in Composer audit (#475)
• feat: add Apps section with shop reachability, store login and shop id reset (#467)
• Fix health indicator layout on Shopware 6.7.15 sidebar (#465)
• feat: backport system activity logging (#474)

• Bump version from 3.14.0 to 3.14.1
• fix: use fully specified imports in administration for strict ESM builds (#471)
• feat: add security checks for leftovers of cleanup scheduled tasks (#470)

• Bump version from 3.13.0 to 3.14.0
• fix: replace deprecated ShopwareStyle with SymfonyStyle (#463)
• feat: downgrade neverConsumed check from warning to info
• Add error when shopware-installer.phar.php remains in public (#462)
• Add Vitest Shopware admin tests for 6.6 and 6.7 (#460)
• Add per-area ACL privileges for Frosh Tools (#459)

• chore: prepare release 3.13.0
• chore: change structs to public properties
• feat: show symfony scheduler
• Delete .github/workflows/pullfrog.yml
• Add Pullfrog workflow for agent execution
• Remove unnecessary comment in README.md (#454)
• Add ionCube Loader performance warning (#453)
• fix: no longer report actively supported releases as end of active support (#451) (#452)
• fix: clarify EOL findings track official support only (#445) (#450)

• chore: prepare release
• feat: configurable queue monitoring for QueueChecker (#269) (#448)
• fix: clarify Redis TagAware check targets HTTP cache only (#245) (#447)
• docs: professional README with full feature set and fresh screenshots (#446)
• test: add kernel-based integration tests (#444)
• feat(security): add CycloneDX SBOM export (#442)
• feat(administration): improve UI and UX of the Tools module (#441)
• feat(administration): add inline webhook search (#440)

• fix: symfony var-dumper version pinning

• chore: upgrade version
• feat: queue abstraction (#437)

• Bump version from 3.10.1 to 3.10.2
• Delete src/Components/Health/Checker/PerformanceChecker/CompressionMethodChecker.php

• chore: prepare release
• fix: add handling of deprecated cache compression options (#433)

• Update version from 3.9.0 to 3.10.0
• Add health checker for Shopware conflicts repository configuration (#430)
• Move health check documentation inline with modal recommendations (#426)
• fix: total cache in opcache statistics (#428)
• Filter templates to include only those containing 'storefront/' (#429)
• Refactor PHP settings checker to use dedicated boolean ini helper (#427)

• Bump version from 3.8.2 to 3.9.0
• Add support for Sentry traceable cache adapters in CacheAdapter (#425)
• feat: mobile-responsive module shell and Shopmon tab (#424)

• chore: prepare release
• Revert "feat: add extension services xml convert command" (#423)
• fix: use parameterized i18n for elasticsearch/opensearch titles (#422)
• fix: restore Elasticsearch cluster status display and detect OpenSearch (#421)

• chore: prepare release
• feat: add config option to show all elasticsearch indices

• chore: prepare release
• fix(elasticsearch): Cleanup-Feedback + neuer "Verwaiste Indizes löschen"-Button (#398)
• feat: make tables sortable (#419)
• feat: add extension services xml convert command (#418)
• feat: add statistics tab with cache and database metrics (#397)

• chore: prepare release
• feat: track composer dependencies across all autoloaders (#417)
• Delete .github/workflows/pullfrog.yml
• Add pullfrog.yml workflow

• bump: increase version
• fix: wrap long log messages in detail modal (#415)

• chore: bump version for release
• feat: add unified Security Center (#413)

• chore: bump version
• fix: skip root package in Composer audit collection (#412)

• chore: prepare release
• Redesign admin module with custom design system (#409)
• [WIP] Fix wrong link in recommendations (#408)

• chore: prepare release
• feat: add logsEnabled flag based on log folder existence (#407)
• fix: validate errors (#406)

• chore: prepare release
• feat: add webhook module (#394)

• chore: increase version
• fix: formatting issues
• fix: remove TwigCacheKernelWarmer due to Shopware Core bug
• feat: add time zone data checker
• fix: do not recommand zstd after 6.7.1
• fix: switch to php cfg

• chore: increase version
• Update admin index prefix matching to use '-' instead of '_' (#391)

• chore: increase version
• fix: add env for warmup
• fix: code style issue
• fix: remove dependency config for twig warmer, enable it by default

• chore: increase version
• fix: not loading cache page

• chore: bump version from 3.3.0 to 3.4.0
• feat: render local mermaid for state machine, fixes #327 (#390)
• fix: show only relevant indices, fixes #329 (#389)
• feat: add twig cache warmer (#388)

• chore: increase version
• fix: make ci happy
• fix: some style issues
• Normalize extension version checks for checksum validation (#387)
• feat: Feature Flags (#375)
• feat: Add clear OPcache button (#383)
• Add frosh-tools:health-check-json command (#312)
• Correctly reset the page on the log viewer page (#366)
• fix: Refactor namespace handling in Redis commands: (#367)
• feat: add fastly tab (#379)

• fix: escape html in log viewer

• fix: handle non existing cache dirs
• fix: determine recent security plugin version from unofficial shopware api (#374)

• fix: broken v-model in elasticsearch console
• chore: fix linting errors
• Add explanation for file types usually changed during deployments (#373)

• chore: prepare release
• Remove lazy autowiring from HttpClientInterface
• Remove lazy autowire from HttpClientInterface (#371)
• Add missing plugin activation steps to Composer installation instructions (#369)

• feat: degrade check for max listen queue to an info instead warning
• feat: degrade check for max children reached to an info instead warning

• chore: prepare release 3.2.0
• feat: allow skipping checks (#362)
• add: missing commands (#363)
• chore: fix codestyle
• Skip fix cache ID performance check from 6.7.0.0 (#361)
• fix: Skip sql_set_default_session_variables for Shopware >= 6.7
• Skip fine-grained-caching check for >= 6.7 (#357)
• style: fix issues reported by linter
• feat: add frosh:es:delete-unused-indices

• fix: handle admin state access correctly
• fix: consider all pools as active namespaces

• chore: prepare release
• chore: change icon to have higher resolution
• ci: update store info
• feat: add functionality for plugin checksums (#344)
• feat: add redis cleanup commands (#349)

• feat: make 6.7 compatible (#331)
• fix: update scripts to use shopware-cli for formatting and validation
• fix: disable product indexing checker hint for versions <6.6.10.5 (#347)
• feat: sort health collection by state (#348)
• fix: formatting issues
• fix: check to preg_match having one result
• fix: check for message in LogController

• chore: release 3.0.0
• chore: update store information
• feat: remove sales channel attribute from monitor command (#337)
• feat: add checks for PHP FPM when not in cluster mode (#336)
• chore: format source files (#335)
• feat!: remove system config override feature
• feat!: remove environment component
• feat!: remove env and plugin update commands
• fix: formatting issues
• feat: Unify snippets (#325)

• chore: prepare release
• Fix mysql timezone check (#324)
• PHPStan: Don't report unmatched ignored errors (#323)
• Update code-style.yml (#322)

• chore: prepare release
• feat: MySQL settings checker: Add time_zone check (#321)
• ci: use extension verifier (#315)
• feature: allow deactivating of scheduled tasks (#316)
• chore: remove non-existing feature task logging (#318)
• feat: add system time checker (#314) (#317)

• chore: prepare release 2.6.0
• fix: code-style
• feat: add cache for health ping

• chore: prepare release 2.5.0
• feat: add check for active webProfiler and kernelDebug state
• fix: correctly interpret ini values in PhpSettingsChecker (#303)
• fix: code style errors

• fix: symfony secrets shows correct state

• fix: plugin activation error when secrets disabled

• chore: prepare release 2.4.5 (#302)
• Add "Messenger auto_setup" checker (#300)
• Add "Disable Product Stream Indexer" checker (#299)
• Add "Disable Symfony Secrets" checker (#298)

• chore: prepare release 2.4.4
• feat: remove recommendation to activate compressions
• fix: correct reported overdue for scheduled task (#297)

• chore: prepare release
• Fix editing nextExecutionTime of scheduled tasks (#293)

• chore: prepare erlease
• feature: allow scheduling of scheduled tasks (#290)
• Cart & Cache compression: Set SettingsResult severity to info for deactivated or gzip

• chore: prepare release
• Update .devcontainer.json (#289)
• Add "Disable fine-grained caching" checker (#282)
• Replace deprecated TaggedIterator with new AutowireIterator (#288)
• Update .devcontainer.json (#287)

• chore: prepare release
• fix broken back button in module (#285)
• ci: fix store release
• Feat/ignore unknown queue counts (#284)
• Update frosh-tools-schema.json (#283)
• Use Symfony HttpClient (#281)
• Add compression checker for cart and cache (#277)
• Adjust composer cs-fix script to CI cs check (#278)
• Add "App URL external check" checker (#276)

• chore: release 2.3.0
• fix: update min maria db to 10.11 (#274)
• feat: allow handling of log files within subfolders (#273)

• chore: release 2.2.0
• fix: correct check for set SQL_Mode
• fix: correct for minimum LoggerLevel
• MySQL Settings: Check performance settings (#268)

• chore: release
• remove mysql 8 check (#265)
• Create .devcontainer.json
• feat: Use health checks for monitor command (#258)
• Update en-GB.json (#257)

• chore: release 2.1.2
• feat: support sync and any other unknown as queue adapter for reporting status

• chore: release 2.1.1
• feat: add info about Security updates for installed version (#247)

• feat: rename objectCache to cacheObject to have better autowire without attribute
• feat: update status just every 60 seconds
• feat: add warning for outdated shopware
• feat: remove ChangeUserPasswordCommand (#243)
• style: Remove unused imports (#239)
• Delete .github/workflows/qodana.yml
• Update qodana.yaml
• Update qodana.yaml

• feat: shopware 6.6 compatibility (#237)
• Fix message queue monitoring (#236)
• fix code styling
• fix: phpstan errors
• chore: cleanup files
• Update phpstan.neon.dist
• Create phpstan.neon.dist
• ci: use workflows from shopware
• ci: remove check snippets