Release (2026-11-13)

Module Highlights

• github.com/shopware/sdk-go: v1.0.1
  • Bug Fix: Action button responses are always sent with a payload object. Notifications put status and message inside payload, and ReloadResponse() sends an empty payload, so notifications and reloads now work in the Administration.
  • Bug Fix: Payment and refund statuses now use Shopware transition names: authorize, fail and cancel for payments, complete, process and fail for refunds. PaymentRedirect() and PaymentOpen() no longer send a status, so redirect payments work. PaymentStatusOpen is deprecated: leave the status empty to keep a payment open.
  • Dependencies: Updated AWS SDK for Go v2 (DynamoDB store), modernc.org/sqlite and golang.org/x/sync.
  • Documentation: We recommend Go 1.26.11+ (or 1.27.4+) for the latest standard library security fixes.
• github.com/shopware/sdk-go/integrations/gin: integrations/gin/v1.0.1
  • Dependencies: Requires github.com/shopware/sdk-go v1.0.1, so updating the Gin integration also brings the response fixes.
  • Dependencies: Updated github.com/gabriel-vasile/mimetype to v1.4.16; v1.4.15 was retracted by its author.

clients/adminapi is unchanged and stays at v1.0.0.

Contributors

Thanks to everyone who contributed to this release:

• Viktor Buzyka (@buzyka)

Release (2026-11-06)

Module Highlights

• github.com/shopware/sdk-go/clients/adminapi: clients/adminapi/v1.0.0
  • Release: First release of the Admin API client, a separate Go module. It depends only on the standard library and golang.org/x/sync and can be used without the rest of the SDK, for example in CLI tools, workers or integrations.
  • Feature: adminapi.NewClient with IntegrationCredentials, PasswordCredentials and RefreshTokenCredentials, or your own Credentials. The client logs in on the first request, refreshes the token before it expires, retries once on 401, and lets concurrent requests share one token request.
  • Feature: Get, Post, Put, Patch, Delete, Request and RequestRaw (non-JSON bodies such as uploads), with WithHeader and WithQuery options. adminapi.Path escapes path segments.
  • Feature: Typed errors: *APIError (status, Shopware error details, body), *TokenError, and IsNotFound, IsUnauthorized, IsConflict. Redirects are not followed (ErrUnexpectedRedirect), and responses are limited to 32 MiB by default (ErrResponseTooLarge).
  • Feature: Package tokenstorage: NewInMemory (default), NewNoOp, NewKV for Redis, Valkey, Memcached or any key-value store (WithKeyPrefix, WithRefreshTokenTTL, WithCipher), NewScoped for several apps on one backend, and a Locker interface for one token fetch across instances.
• github.com/shopware/sdk-go: v1.0.0
  • Release: First release of the core SDK. It is framework-agnostic, does not log, and adds no retries or caching unless you opt in.
  • Feature: app.New wires registration, webhook verification, shop resolution and the Admin API client from one app.Config. App.NewClient(ctx, shopID) and App.NewClientForShop(shop) return an *adminapi.Client; all clients of a shop share one token, kept in memory by default or in the TokenStorage you configure (Locker, HTTPClient and UserAgent are optional). App.ClearShopToken deletes the stored token of a shop.
  • Feature: App registration and confirmation (package registration) with HMAC-SHA256 verification. A re-registration of a confirmed shop must be signed with its current shop secret, and the previous secret is still accepted for a short window after a rotation (InflightAllowance, 1 minute by default).
  • Feature: Signed webhooks, signed GET requests (admin iframes) and signed JSON POST requests (action buttons, payments) are verified by webhook.Middleware and resolver.Resolver, with replay protection. QueryPolicy, PostPolicy, WebhookPolicy and LifecyclePolicy set the timestamp mode, the maximum age (5 minutes by default) and the clock skew, and request bodies are limited to 5 MiB by default (MaxBodyBytes).
  • Feature: Shop storage behind one store.ShopStore interface: NewInMemoryStore, NewSQLiteStore (pure Go, no CGo) and NewDynamoDBStore(ctx, cfg). store/middleware.NewRetryMiddleware adds retries with exponential backoff to any store.
  • Feature: Response builders in package response for action buttons (notification, reload, open new tab, open modal), payments and refunds, and structured errors in package sdkerrors with error types and HTTP status codes. store.ErrShopNotFound and sdkerrors.ErrShopNotFound are the same value, so errors.Is matches either name.
  • Documentation: Getting started, guide, token storage (Redis and Valkey, distributed locking, encryption), deployment, testing, architecture decisions, and three runnable examples (examples/vanilla-service, examples/gin-service, examples/admin-extension) that are tested in CI.
• github.com/shopware/sdk-go/integrations/gin: integrations/gin/v1.0.0
  • Release: First release of the Gin integration. Requires github.com/shopware/sdk-go v1.0.0 and clients/adminapi v1.0.0.
  • Feature: ginintegration.Configure registers all app endpoints with one call: registration (/app/register, /app/register/confirm) and the app.activated, app.deactivated and app.deleted lifecycle webhooks. Base paths are configurable (BasePath, RegistrationBasePath), and CORS is opt-in with an origin allowlist.
  • Feature: Responses on app routes are signed with the shop secret. WebhookMiddleware, GetRequestVerifier and GetRequestVerifierWithPolicy verify your own routes; GetShop and GetVerifiedEvent read the verified shop and event in handlers.
  • Feature: The app.deleted handler deletes the shop's Admin API token. Optional logging through a standard *slog.Logger (no logging by default).

Contributors

Thanks to everyone who contributed to this release:

• Jose Rodriguez (@j-rodriguezmartinez)
• Viktor Buzyka (@buzyka)
• Simon (@SimonVorgers)
• Soner (@shyim)
• D.Francos (@dfrancos-hub)
• Albert Scherman (@Bird87ZA)