Autumn has arrived, but the Sylius ecosystem is anything but slowing down. September was the busiest month of the quarter, with 144 merged pull requests, a complete rework of the PayPal Plugin, and Sylius 2.3 landing at the very end of the month. Add meetups from Warsaw to Aix-en-Provence and a PS Summit that is now just around the corner, and there is plenty to catch up on with a warm drink in hand. 🍵
Here’s what’s inside this edition:
September was the busiest month of the quarter, with 144 pull requests merged (96 internal, 48 external), dominated by a major PayPal overhaul and a coordinated security response across five supported branches.
Two security advisories were patched this month and backported all the way from 1.12 through 2.2: a new JwtAudienceListener now enforces JWT audience and principal validation, and a Host header injection in the admin password-reset e-mail link was fixed, so a maliciously crafted Host header can no longer be used to generate a reset link pointing at an attacker-controlled domain (#19203, #19204, #19205, #19207, #19209, #19213). On the 2.1 and 2.2 branches, Payment Request actions are now restricted to what the shop context should actually be allowed to do, and payment amounts can no longer be tampered with after a gateway transaction has started (#19210, #19212, #19214, #19216). Full details are published as GHSA-2rv4-pjmm-7fxf and GHSA-vv4h-q2x8-74g4; the Stripe Plugin bumped its minimum Sylius version to exclude the affected releases (#134).
The PayPal integration had its biggest month yet, migrating the entire shop-facing front end from PayPal’s old JS SDK v5 to the new Web SDK v6, with one SDK instance per page, PayPal web components instead of the old paypal.Buttons() API, and a unified create/capture-order contract across the cart, product, and checkout placements (#681). On top of that foundation, the plugin gained real Pay Later, Venmo, Google Pay, Apple Pay, and Trustly payment options, each with its own per-channel admin toggle (#689, #702, #703, #705, #710). Card payments moved to the v6 card-fields component inside the shop’s own checkout layout, with 3D Secure now genuinely deciding whether a charge goes through rather than running alongside it as a formality (#691, #692).
Express checkout was reworked end to end: approving in the wallet now captures payment and completes the order in a single step instead of requiring a second “Place order” click, real shipping options are priced and returned by a signature-verified server-side callback instead of a placeholder address, and the chosen variant, quantity, and address region are carried through the whole flow (#680, #682, #683, #694, #695). The order payload sent to PayPal was also enriched with line items, tax breakdowns, and a stable invoice ID to unlock risk scoring, dispute resolution, and package tracking, and package tracking information is now sent to PayPal directly from the admin shipping flow (#685, #699). A long tail of QA-driven fixes followed, covering cancelled and bank-refused redirect payments, refund labeling, locale handling for Pay Later messaging and the approval window, and ownership checks before allowing a ship action (#714, #717, #729, #730, #732).
Core work this month focused on maintenance and modernization: order item unit adjustments are now preloaded in a single query before order processing instead of lazily per unit, cutting a recurring N+1 pattern on checkout and coupon recalculation (#19195), the main admin menu builder was split with dedicated providers for easier extension (#19192), and the checkout address book now resolves the customer’s picked address consistently from a single source instead of two that could disagree (#19229). The unmaintained spotlight.js product gallery was replaced with viewerjs (#19149), and a 2.3 grid legacy-switch regression that ignored per-grid configuration was fixed (#19230).
On the dependency front, Sylius added support for API Platform 5, Symfony UX 3.0, and Webpack Encore 6, resolved a doctrine/orm 3.7 conflict breaking schema generation, and stopped shipping full copies of the Admin and Shop bundles’ PHP sources inside node_modules/@sylius-ui by publishing them as proper JS-only packages (#19248, #19189, #19006, #19251, #19250).
Following up on last month’s subscription deprecation work, recurring carts now only offer mollie_subscription payment methods instead of leaking through every other gateway, closing a gap where a customer could pay for a subscription cart without a subscription ever being created (#376). Mollie payment details are now scoped strictly to Mollie gateways in the payment form, a capture-retry bug after an abandoned checkout was fixed, and the plugin dropped its direct dependency on Gaufrette\Filesystem in favor of Sylius’s own FilesystemAdapterInterface (#370, #335, #371).
Both MCP server plugins were updated for symfony/mcp-bundle 0.13’s multi-server support, and the shop-facing McpServerPlugin renamed its endpoint from /_mcp to the clearer /mcp/shop (#38, #16, #17).
The AI dev tools kept pace with the fast-moving Symfony AI Mate releases (0.12 through 0.14), and the sylius-dev skill was substantially refactored: container and profiler introspection now delegates to the Symfony Mate bridge instead of duplicating it, the skill was split into a smaller family of files, and seven tools that silently returned nothing against a real compiled container (service decorators, resource listing, hooks) were fixed with a new integration suite that boots the actual Sylius test application rather than a hand-written fake container (#11, #12, #13).
Sylius/Stack gained expression-based conditions for enabling or disabling Twig hookables, including is_granted() and authenticated-user checks, plus a reusable copy-to-clipboard component for BootstrapAdminUi (#385, #387, #380). SyliusRector shipped a critical fix after Rector 2.6.5 silently broke every Sylius rule set, replacing the old set-provider mechanism with composer version-bound rule configurations, alongside new rules for the Live One Page Checkout Plugin and a B2B Kit 4.0 index requirement (#65, #62, #66). SyliusRecipes added a Flex recipe for B2B Kit 4.0 and fixed a long-broken permission error blocking the Flex endpoint from updating since May (#51, #52). RefundPlugin was prepared for Sylius 2.3 and Symfony 8 (#504), and SyliusMailerBundle fixed a Twig 3.29 signature change that broke rendering of templated emails (#292).
Together, September closed out real security exposure across five supported branches and turned the PayPal Plugin into a genuinely modern, SDK v6-based payment experience with Pay Later, Venmo, Google Pay, Apple Pay, and Trustly all available out of the box.
With PayPal, Mollie, and Stripe all featured in this month’s updates, it’s a good moment to remind you why our official payment partnerships matter. Stripe, PayPal, Adyen and Mollie partnerships let the ecosystem help fund the work itself: we reinvest 100% of the revenue generated through PSP affiliate and revenue-share partnerships into the development of Sylius Community Edition. Choosing an official integration therefore supports the long-term sustainability of open source too. Support Sylius’ development with an official integration.
Recently, we released Sylius 2.3, and it is the first release with Symfony 8 support, alongside Symfony 6.4 and 7.4, and with PHP 8.3 as the minimum requirement. It also supports API Platform 5, and you can move to it on your own schedule, since API Platform 4 still works too. Beyond the foundation, the admin panel now has a dark mode (contributed by our Professional Solution Partner ACSEO), around 35 core grids are configurable in PHP instead of YAML, and Payment Request has officially left experimental status.
Merchants running multiple channels get the most from the promotions work: rules and actions can now be configured per channel, promotions can skip usage tracking, and Cart Quantity and Item Total rules support comparison operators. Add to that new post-flush cart events, a reusable CartItemAdder service, a resend verification email option, and separate administration and API access levels for admin users. Many of these came from the community, so big thanks to mamazu, Loïc Frémont, Francis Hilaire, Simon Krull, Camille Islasse, Dmitri Perunov, and everyone else who contributed. ♥️
📖 Read the full release article
Few weeks lets until first PS Summit event! On November 4-5, the PrestaShop and Sylius communities meet in Lyon at the Centre de Congrès for the first event the two ecosystems organize together, with more than 500 professionals expected. The number of free tickets is limited, so if you want to be there, now is the time to get yours.
November 4 is a technical Workshop & Hackathon day for experienced developers who want to learn the other framework and build real features together – while Sylius workshops are already full, there are 4 spots lets for PrestaShop workshop. November 5 is open to everyone, with talks on two stages (most of them in English), an expo floor with partners and sponsors, and plenty of networking, ending with the Community Awards. A Community Party on November 4 and an After Party on November 5 are both open to all attendees.
The full lineup and program are already on the website. Among the sessions to look out for are “What 2.0 taught us about Sylius 3.0” by Magdalena Sadowska, a B2B ecommerce roundtable with Krystian Podemski, Przemysław Połeć, Łukasz Janik, and Radosław Żurawski, Michał Pysiak asking whether your AI knows your Sylius project, and a case study on building a B2B project with Elesto, alongside sessions on agentic commerce from Stripe and PayPal.
🎟️ Get your free ticket and check the full program.
Three stores, three countries, three very different businesses, all built on Sylius.
Gorilla Software built Plantoris, the new online store of Ogrody Drama, a garden business with 40 years of experience. The project runs on Sylius and is adapted to the specifics of selling plants, with a fully editable CMS, a loyalty program, courier integrations, and a React/Next.js frontend. The team was led by Tech Lead Rafał Pawlukiewicz, with Adrian Martynowicz coordinating, Artur Szulc handling the loyalty program and courier integrations, and Bartosz Sowiński building the frontend. Congratulations guys!
Innelec Multimédia, a French distributor of video games and pop culture products, needed a B2B platform able to handle complex pricing rules, a catalog of more than 7,000 product references, and seasonal traffic peaks. Together with our Professional Solution Partner Cyllene, Innelec migrated from Magento 2.3 to Sylius and built a platform tailored to its sales processes and connected to its existing business systems. The results include faster page loads, smoother navigation, more responsive search and filtering, stable performance during seasonal peaks, and at least 50% lower server load with comparable traffic and equivalent infrastructure. Innelec’s team will also share the story live at the Sylius Meetup in Paris on October 14.
Peiraias Home is an online store for home textiles based in Piraeus, Greece, and it runs on Sylius. The catalog spans bedroom, living room, dining and kitchen, bath, baby and kids collections, plus bridal, football team, and seasonal ranges, with brands such as Palamaiki home, Teoran, and LinoHome. Shopping stays simple, with guest checkout, payment by card, Apple Pay, Google Pay, PayPal, or IRIS, and free shipping across Greece.
Let’s take a quick look back at the recent events.
The first Sylius x PrestaShop Meetup in Poland took place in Warsaw on September 10, organized by our Global Solution Partner BitBag. Karolina Salet-Woźniak talked about why agencies should actively contribute to open source; there was a look at where AI stands today and how it really affects software development; and a closing panel led by Radosław Żurawski, Krystian Podemski, and Przemysław Połeć concluded that the question isn’t which technology is better, but which one best fits the business requirements. Thanks to BitBag and all the speakers for a day full of substance and great networking. 💪
Our Premium Solution Partner Antadis brought its ecosystem together in Lausanne on September 16 for its Partners Day, with Sylius among the participants. The goal was to strengthen synergies and better meet the challenges of Swiss e-merchants, with talks about the roadmap, the growth of the French-speaking market, and the launch of the Tables Romandes for eCommerce decision-makers. Two weeks later, on September 30 and October 1, the Antadis team took the conversation to the Swiss IT Forum(s) at Palexpo Geneva, where they talked about redesign, replatforming, architecture, and sustainable AI.
Sylius Premium Solution Partner WEEBY, Combustibles Gruchy, and Sylius presented the story of a PrestaShop to Sylius migration in a French-language webinar on September 24. Adrien Gruchy, Hugues Leproux (WEEBY), and Marc Laszczynski (Sylius) shared the merchant, agency, and platform perspectives on the migration. For latecomers, the recording is already available.
PHP Developer Day celebrated its 10th anniversary on September 25 at Gewandhaus Dresden, with eight talks on architecture, testing, security, and AI, plus live coding and plenty of time for conversations between sessions. Our friend Stephan Hochdörfer represented Sylius on the lineup with a live coding session on developing faster with Sylius Stack. Thanks to the PHP Usergroup Dresden for organizing it.
Our Professional Solution Partner ACSEO brought the French Sylius community together at thecamp on September 28, with a hackathon and a Sylius introduction in the afternoon and two talks in the evening, followed by a giveaway sponsored by our team and a cocktail. In the first talk, Nicolas Potier (ACSEO) covered how AI already fits into an ecommerce back office, from product pages and translations to support automation, and how the MCP protocol opens a platform to AI agents. He also noted that 40% of French consumers already use generative AI to prepare a purchase, yet 99% go back to Google to decide, so GEO has to work alongside SEO. His advice for agentic commerce: keep the platform open, own your data, and invest in product data quality.
The second talk told the story of Aéroport Marseille Provence, presented by Christophe Combalat together with ACSEO’s Sabrine Ferchichi, Alexandre Haroutunian, and Bruno Acquaviva. The airport moved from a Magento store dating back to 2011, handling close to 1,000 orders a day, to Sylius 1 and recently Sylius 2, with Sylius serving as a single back office for B2C, B2B, and partners. Instead of just changing tools, the team cleaned up the model, for example, merging 50 separate bus ticket products into one product with variants, and moved from siloed services to a unified marketplace with a single cart covering parking, fast track, shuttles, VIP lounges, and subscriptions.
The conversation continued online on October 8, when ACSEO hosted a live webinar with Nicolas Potier’s talk, “Ecommerce performance and how to adapt to the AI revolution”. Following requests from people who had missed the in-person sessions, the team revisited the topic for a wider audience.
Our Professional Solution Partner Cyllene is hosting a Sylius Meetup in Paris on October 14 at 6:30 p.m., an intimate evening limited to 40 participants for CIOs, tech leads, and eCommerce managers to talk about the future of ecommerce and Sylius. Marc Laszczynski will share the latest Sylius news, Innelec will present its B2B story, Piotr Szymański will talk about AI agents in ecommerce, and the Cyllene team will demo sovereign AI connected to Sylius via RAG, followed by networking. 🍺
We’re joining Tech for Retail as one of this year’s new exhibitors, on November 30 and December 1 at Paris Expo Porte de Versailles, Hall 7.2. The European retail tech show brings together over 420 exhibitors and more than 200 conferences, covering everything from ecommerce and payments to AI, so it’s a good chance to meet the Sylius team and talk about your next project.
Two new partners joined the Sylius Partner Network this month, one from Germany and one from France. 🤝
BatteryIncluded, our new Professional Technology Partner, develops an AI Data Discovery Framework for B2B and complex B2C eCommerce. Its platform combines Hybrid LLM Search, AI-powered product recommendations, and merchandising tools that help customers find and navigate large catalogs, covering search suggestions, semantic search, filters, sorting, category listings, and recommendations. It takes a cookieless approach with data hosted in Germany, while giving commerce teams control over product relevance and merchandising. A strong example is the OFFICE Partner GmbH case study: around 120,000 SKUs, two B2B and B2C storefronts, and roughly half a million monthly visits. Welcome aboard!
👉 sylius.com/partner/batteryincluded 🇩🇪
Human’s Connexion (HUCO) is an open-source integrator based in Toulouse, delivering custom IT projects across web, eCommerce, ERP/CRM, infrastructure, and managed services. Their focus on open-source technologies, tailor-made development, and interoperability between business systems fits the Sylius ecosystem well. They already have Sylius experience, including Normadoc, a multilingual, multi-currency platform migrated from Magento 1 and connected to external business tools, and a B2B project for Osport. We’re glad to welcome HUCO and keep strengthening the Sylius community in France.
👉 sylius.com/partner/humans-connexion-huco 🇫🇷
First of all, here are the highlighted posts about PS Summit from September: Julien Mutzenhardt I Arina Drucioc I Maxime Bénard I Profileo I Nicolas Dabène I Hugues Leproux I Synolia I Loic Ferrier.
This month, Adeliom shared a detailed PrestaShop to Sylius migration, and our friend Stephan Hochdörfer (bitExpert) shared how he built the Wishlist Concierge, a Sylius plugin for the OpenAI WebMCP Challenge that lets AI agents build budget-aware wishlists.
From a new payment gateway to a CMS that keeps getting better, here are the plugins and projects that caught our eye this month.
That’s September in the books: a reworked PayPal Plugin, Sylius 2.3 out the door, and a calendar full of meetups and webinars behind us. Next up is PS Summit in Lyon on November 4-5, where the PrestaShop and Sylius communities meet for the first time at one event, so grab your free ticket while they’re still available. See you in Lyon! 🦢🍂
Sylius Plus 
