Supported versions
What 1.4.0 was actually tested on, what its metadata declares, and what has not been tested yet. Plan §17 and §20 item 2. Rule from §17: a version is not "supported" merely because Composer can install the package on it.
Status 2026-09-26: version matrix (release gates R1 / R2) on branch feat/magento-matrix, owner's scope of 2026-09-25 — install-tested 2.4.4-p13, 2.4.7-p4 and 2.4.9 (+ Hyvä on 2.4.9); 2.4.6-p15 and 2.4.8-p5 statically verified only.
1.5.0 (unreleased) — what has and has not been run
Status 2026-09-27 (late), branch feat/magento-1.5.0-customer-hub, commit 9bab13f. Nothing below is published or deployed. Measured on a throwaway test stack with synthetic data; it is evidence for 1.5.0 on the versions named here only. Everything in the 1.4.0 tables further down stays as measured for 1.4.0.
| Target | What ran for 1.5.0 | Result |
|---|---|---|
| Magento 2.4.7-p4 (PHP 8.3, MariaDB 10.6, OpenSearch 2.5, MSI), Luma | fresh install of the module, setup:upgrade, setup:di:compile; upgrade from the released 1.4.1 module; every identity / My orders / guest code / admin card / admin permissions / diagnostics E2E script; the 1.4.x regression scripts with the new switches off | passed (0 failures) |
| 2.4.7-p4 with the built-in full-page cache and with Varnish 7.5 (Magento's generated VCL) | two customers in one cache context, the identity bootstrap, the page config | passed: no customer data in cached HTML, the bootstrap never cached |
| The real Conviro API against this store in a real browser (Chromium) | register, identity, My orders for two customers, sign-out revocation, Reset identity, another workspace untouched | passed (42 checks) |
| Sign-out in one browser tab while another tab shows orders | real browser, two tabs | passed: the other tab's order cards disappear without a reload and its old identity is refused |
| Magento 2.4.7-p9 (PHP 8.3, MSI, Redis for cache and sessions), Luma — upgraded in place from 2.4.7-p4 | the same scripts: module check, upgrade from 1.4.1, identity, My orders, cache privacy, admin, diagnostics, the real Conviro API in a browser | passed (0 failures) |
| Magento 2.4.8-p5 (PHP 8.3, MSI, Redis), Luma | module check, upgrade from 1.4.1, My orders, admin card, admin permissions, diagnostics, regression scripts, and the real Conviro API in a browser on an https store | passed (0 failures); cache privacy behind Varnish passed |
| 2.4.8-p5 storefront browser scripts on a plain http test store | identity, widget, storefront and built-in page cache scripts | inconclusive: on this http test store Magento's own customer data never loaded in the browser and signed-in pages were never cached — both also with the Conviro module disabled; the same checks passed over https |
| Magento 2.4.4-p13 (PHP 8.1), 2.4.6, 2.4.9 (PHP 8.4) | nothing for 1.5.0 yet | not run |
| Module unit tests (PHPUnit 9.6) | PHP 7.4, 8.3 and 8.4 | 836 tests, 0 failures on each |
| PHP 7.4 | php -l on every PHP / PHTML file (332) and the module unit tests (PHPUnit 9.6) under PHP 7.4.33; no Magento install on PHP 7.4 | lint and unit tests pass (836 tests); a Magento runtime on 7.4 not run |
| Magento 2.4.7-p9 + Hyvä default theme 1.5.2 (open source; theme-module 1.5.2, base-layout-reset 2.0.5), MSI, Redis — the first production store's combination without Hyvä Checkout | fresh install, upgrade from the released 1.4.1, the storefront walk (every page detected as Hyvä), identity, My orders, cross-tab sign-out, cache privacy with the built-in cache and behind Varnish 7.5, admin, diagnostics, and the real Conviro API in a browser | passed (0 failures). The checkout page ran on the Hyvä theme without hyva-themes/magento2-luma-checkout |
| Hyvä Checkout, a CDN in front of the store, headless frontends | nothing | not tested (Hyvä Checkout is a licensed product); signed identity does not work on token-based headless frontends (Headless) |
| Guest one-time code with real e-mail delivery | module and Conviro logic tested without a real mail server | not run |
Declared for 1.5.0: composer.json adds "ext-sodium": "*" (Composer refuses the install without PHP's sodium extension); the PHP range (~7.4.0||~8.1.0||~8.2.0||~8.3.0||~8.4.0), magento/framework ^103.0.4 (Magento 2.4.4+) and the module.xml sequence are unchanged. The Conviro backend enables signed identity only for a module that reports 1.5.0 or later and announces it; 1.3.x / 1.4.x modules keep working unchanged against a 1.5.0 backend (by design and unit tests, not measured end to end).
Tested
Everything was run on disposable local Docker stacks (integrations/magento2/dev/ and dev/matrix/), against a mock Conviro or the backend code run locally — not on a merchant store and not against the deployed backend. "E2E" is the dev acceptance suite of Development and testing: 19 scripts, among them three real-browser walks.
| Magento | PHP | Database / search | What ran | Result |
|---|---|---|---|---|
2.4.9 (Open Source, magento/framework 103.0.9) | 8.4 | MariaDB 11.8 / OpenSearch 3.8 | upgrade 1.3.5 → 1.4.0 and fresh install: setup:upgrade, setup:di:compile, setup:static-content:deploy -f, production mode; E2E on both | all 19 scripts pass on both paths (2026-09-26) |
| 2.4.9 + Hyvä default theme 1.5.2 (open source) with the Luma checkout fallback | 8.4 | as above | storefront walk in production mode, FPC privacy, consent / attribution with Hyvä's cookie banner, widget identity | all pass (2026-09-26) |
| 2.4.7-p4 (Mage-OS 1.0.6) | 8.3 | MariaDB 10.6 / OpenSearch 2.5 | the original development stack: every acceptance script, module-verify.sh | pass (2026-09-24 and earlier) |
2.4.4-p13 (magento/framework 103.0.4-p13) | 8.1 | MariaDB 10.6 / OpenSearch 1.3 | upgrade 1.3.5 → 1.4.0 and fresh install as for 2.4.9; E2E on both | all 19 scripts pass on both paths (2026-09-26) |
| — | 7.4 and 8.2 | — | php -l on every PHP / PHTML file (180), PHPUnit (204 tests, 1460 assertions) | pass (2026-09-26); no Magento install ran on these PHP versions |
| 2.4.6-p15, 2.4.8-p5 | — | — | static only (2026-09-24): Magento classes, signatures, events, XSDs, PHPStan against those framework versions | pass; not install-tested |
| Component | Tested |
|---|---|
| Deploy mode | production (compile + static deploy) for the install steps and the storefront walks; the rest of the suite in developer mode (the FPC privacy test reads a developer-mode header) |
| Theme | Luma (2.4.4-p13, 2.4.7-p4, 2.4.9); Hyvä default theme 1.5.2 (2.4.9); checkout on Hyvä is hyva-themes/magento2-luma-checkout 1.1.7 |
| Full-page cache | Magento's built-in cache |
| Inventory | MSI enabled; default stock only |
| Store setup | one website, default store view plus a second store view |
| Product types | simple, configurable |
| Runtime deprecations | none from 1.4.0 code on PHP 8.1 or 8.4 (var/log and the PHP error log of every run) |
Found and fixed by the matrix (2026-09-26): the lead-form CMS widget never rendered on any version; on 2.4.9 the configuration page left a full administrator without the setup actions; OAuth requests with ten or more list entries were refused by 2.4.8+ (backend). See the Changelog.
Declared
| Where | Says |
|---|---|
AiChat/composer.json | php ~7.4.0||~8.1.0||~8.2.0||~8.3.0||~8.4.0, magento/framework ^103.0.4 (Magento 2.4.4 and later in the 2.4 line). A store on 2.4.0–2.4.3, or on another PHP version, keeps 1.3.5 on composer update. |
AiChat/etc/module.xml | depends on Magento_Backend, Magento_Integration, Magento_Store, Magento_Catalog, Magento_Sales, Magento_Customer |
Module health checks (HealthCheck::MIN_MAGENTO, MIN_PHP) | Magento ≥ 2.4.4, PHP ≥ 7.4.0 — below that the wizard and the health card show Action required |
Conviro backend GET /api/magento/module-version | minMagento: '2.4.4', minimumSecure: '1.3.5' |
| Code notes | MSI optional (reached through a lazy shim); the CSP nonce helper (admin cards only since the storefront loader became a static file) is resolved lazily because its class exists only from 2.4.7 |
Not yet tested
| Area | Status |
|---|---|
| Magento Open Source 2.4.5, 2.4.6, 2.4.8 installed | not install-tested (2.4.6-p15 and 2.4.8-p5 statically verified) |
| Adobe Commerce (any version), incl. RMA returns and B2B quotes used by AI actions | not yet tested |
| A Magento install on PHP 7.4 or 8.2 | not yet tested (lint + unit tests only) |
| PHP 8.5 | not declared, not tested |
| MySQL (any version) | not yet tested |
| Varnish, Redis cache / session | not yet tested |
| Hyvä Checkout | not tested — a licensed product (private repository); a Hyvä Checkout layout handle ships |
| Adobe PWA Studio, custom headless frontends | not yet tested (Headless / PWA) |
| Multi-website installations; a website on a non-default MSI stock | not yet tested |
| Bundle, grouped, virtual, downloadable products; customer-group / tier prices; catalog price rules | not yet tested |
| RabbitMQ / message queue consumers | not used (delivery is cron only) |
| A real merchant store with the deployed Conviro backend | not yet done — nothing is deployed |
Where this list must stay consistent
Plan §17 asks for one support definition behind: this page, composer.json, the backend's module-version endpoint (minMagento), the marketing and install pages, and the CI matrix. As of 2026-09-26 composer.json, the module health checks and the backend agree on Magento 2.4.4+ and PHP 7.4+; CI runs no Magento install. Marketing (2026-09-26, branch feat/magento-extension-landing, not merged): the landing page useconviro.com/integrations/magento2 and the install page state this page's matrix — the tested rows as rows, 2.4.6-p15 / 2.4.8-p5 as static only, Adobe Commerce, Hyvä Checkout and PHP 7.4 / 8.2 installs as not tested (apps/web/src/app/[locale]/(marketing)/integrations/magento2/_content.ts, COMPAT_ROWS); _content.test.ts pins the module version to composer.json. The rows themselves are copied by hand, so a change here needs the same change there.