The Aimeos 2026.04 release brings important support for the latest PHP versions and frameworks, a brand-new customer CSV import, security hardening, and static analysis for the codebase.
Laravel 13 and Symfony 8 Support
Aimeos stays current with the latest framework releases. The Laravel integration now supports Laravel 13, and both the Aimeos stand-alone shop and headless distributions are built on Laravel 13 out of the box. The Symfony integration adds support for Symfony 8 alongside the existing Symfony 7 support. This ensures that developers can use Aimeos with the newest versions of their preferred framework right from the beginning.
Customer CSV Import
Managing large customer databases just got a lot easier. Aimeos 2026.04 introduces a complete CSV import pipeline for customers, available both as a background job and directly from the admin backend via a new upload button in the customer list view.
The import supports address and property data, allows multiple configured values per CSV column, and includes regex validation for each field. For security, HTML content is disallowed by default in imported data. Administrators can also configure allowed and denied customer groups to control which records are processed.
This rounds out the existing CSV import capabilities for products, catalogs, and suppliers, making Aimeos a fully CSV-manageable e-commerce platform.
Security Hardening
This release puts a strong focus on security across multiple extensions. The CMS extension (ai-cms-grapesjs) now sanitizes all stored HTML content using HtmlPurifier to prevent XSS attacks. Allowed iframes for video platforms and local form actions are now configurable instead of being open by default.
The GraphQL admin API enforces query depth and complexity limits, preventing abuse through deeply nested or overly complex queries. Permission checks have also been tightened to ensure only authorized users can access sensitive operations.
Ready for PHP 9 and PHPStan
With PHP 9 on the horizon, this release lays the groundwork by raising the minimum version to PHP 8.1 and removing all deprecations and notices across the core and all 30+ extensions. The entire codebase has been fully tested against PHP 8.5, ensuring a smooth transition when PHP 9 arrives. PHPUnit 12 support has been added, which enforces stricter test isolation and deprecation handling, ensuring higher test quality across the board.
Code quality takes another step forward with the addition of PHPStan static analysis at level 4 to the core codebase. This catches type errors, undefined method calls, and other issues at build time rather than at runtime. The core now passes with zero errors, providing a solid foundation for contributors and extension developers alike.
