FriendsOfShopware/FroshTools 3.16.0

3.16.0: Security activity timeline and refreshed Administration

on GitHub

Shopware Tools 3.16.0 adds a persistent Security activity timeline, refreshes the Administration navigation and task pages, and improves queue health checks and Shopmon integration setup.

Added

• Security → Timeline records sign-ins, account and role changes, integration and API-key changes, password recovery, and available extension lifecycle events. Filter by actor, action, client IP, and UTC date; inspect event details and export all matching entries as JSON. Retention defaults to 90 days and is configurable from 1–3650 days with frosh_tools.security_activity.retention_days. Access uses the existing frosh_tools_security:read privilege. Existing logs are not imported. #477, #496, #497
• Shopmon integration setup can be automated by setting both SHOPMON_ACCESS_KEY and SHOPMON_ACCESS_SECRET before installing or updating FroshTools; APP_URL supplies the shop URL. Existing FroshShopmon integrations and credentials are adopted without rotation. When uninstalling FroshShopmon, keep its user data to avoid deleting the adopted integration. #494

Changed

• The Administration has a refreshed design and reorganized tools navigation, with focused subpages for Statistics, Apps, Search, and Fastly. Section URLs support deep links and browser history; restricted actions remain permission-aware. #487
• Queue health checks now inspect configured transports rather than unrelated database rows. Empty queues no longer trigger stale-message warnings; known overdue messages still warn, and transports that cannot report message age show an informational result. #491

Fixed

• SBOM generation strips URL credentials and query parameters from source references and omits distribution URLs, preventing credentials embedded in package URLs from appearing in the exported SBOM. Distribution hashes remain available. #500
• Removed a redundant type check in the backward line reader. #493

Breaking Changes

• The Security timeline creates a new activity table through the plugin migration. Uninstalling FroshTools without choosing keep user data drops that table. To retain activity history, keep user data when uninstalling.