OXID eShop 7.4.3

Release date: September 28, 2026

The patch release OXID eShop 7.4.3 is a pure maintenance release and contains no functional changes. It ensures that the installation runs without complaints from the security audit (composer audit) when using current Composer versions.

For a short and more technical overview of the changes, see the Release Notes.

Composer 2.10.3 Compatibility

Already with Compilation 7.4.2, composer/composer was updated to 2.10.2 to establish compatibility with the automatic security audit. The security advisory CVE-2026-84361 affects all composer/composer versions below 2.10.3, which would otherwise cause composer audit to report an issue.

In Compilation 7.4.3, composer/composer in the CE metapackage is therefore updated further:

  • composer/composer from 2.10.2 to 2.10.3

At the time of this release, 2.10.3 is the highest available Composer version and the only one not affected by CVE-2026-84361, so composer audit runs without warnings.

Since the compilation version is exposed via the eShop core component, the CE package was newly tagged as v7.4.5 to provide the 7.4.3 compilation. The PE and EE packages were tagged v7.4.5 as well, so that all three editions stay in sync. These components contain no functional changes; the update of composer/composer is part of this release.

Impact on existing projects

  • Update recommendation: The patch release is compatible with OXID eShop 7.4.0, 7.4.1, and 7.4.2 and can be installed without functional changes to the shop.

  • Packages: Compared to Compilation 7.4.2, the package versions are unchanged — except for the eShop core (CE/PE/EE), newly tagged as v7.4.5, and the updated composer/composer package (2.10.2 → 2.10.3).

  • PHP version: No change — the PHP versions supported for 7.4.0 remain valid.

  • Compatible OXID extensions: Identical to 7.4.0, 7.4.1, and 7.4.2.

Update

For more information about updating from OXID eShop 7.4.2 to 7.4.3, see the Release Notes.