26.7.2

Maho 26.7.2 is a bugfix release for the 26.7 line: no new features, no breaking changes, just fixes backported from main.

Creating Maho is a massive effort that requires all the help possible, please join our sponsorship program.
It will make all the difference in the world!

Maho rocks! 🚀
https://mahocommerce.com
https://demo.mahocommerce.com

---

🐛 Fixes

• Fixed admin URLs being corrupted when they end in a query string: code that appends key/value/ segments to a _current admin URL wrote them into the last query param's value instead of the path, breaking navigation such as the report store switcher.
• Fixed empty API role permission tree and 405 when deleting an API role: the role editor rendered no permissions when the compiled permission registry was missing or empty, and deleting a role failed with Method Not Allowed.
• Fixed serialized grids losing their selection on sort and the broken cron dialog spinner: sorting, filtering or paginating the Related/Up-sell/Cross-sell/Grouped product grids (and similar serialized grids) emptied them and lost the checked rows.
• Fixed catalog rule price indexing on PostgreSQL and SQLite: the price index refresh relied on MySQL user variables, so applying catalog rules failed outright on the other supported databases.
• Prevented Symfony 8 from being installed alongside the 7.4 bundles: on PHP 8.4+ Composer resolved 22 transitive Symfony components to 8.x while the bundles stayed on 7.4, producing a fatal error at bootstrap.
• Fixed 405 Method Not Allowed after login when the stored redirect target was a POST-only route: logging in after being bounced off a POST-only action landed the customer on an error page instead of a sensible destination.
• Fixed Maho_Captcha rejecting repeated form submissions on the one-page checkout: re-submitting a step (e.g. fixing a typo in the billing address) replayed a spent captcha token and was silently rejected; second admin login attempts failed the same way.
• Fixed currency prices rendering ¤ instead of the currency symbol: getOutputFormat() left ICU's generic currency placeholder in the pattern, so labels like the admin inc-tax hint showed ¤63.82 instead of £63.82.
• Fixed email:config:show reporting cron schedules as not configured: the command read the legacy XML crontab tree and missed jobs declared with #[CronJob] attributes.
• Stopped marking the api_data cache type invalidated on every catalog save: the affected cache tags are now cleaned directly instead of nagging admins with a permanent "invalidated cache" notice after routine saves and orders.

Full changelog: 26.7.1...26.7.2