Skip to content

Magento 2 Module Changelog

Release history for the Loxa Magento 2 Insurance module (loxa/magento2-insurance).

Each entry describes what changed and why it matters for your store. Where a release touches module internals, the technical detail is available in the expandable Technical detail section under that release.

To upgrade to the latest version, run:

composer update loxa/magento2-insurance
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush

Current version

The latest release is v1.1.4 (9 September 2026). We recommend keeping the module up to date — releases regularly include security hardening, theme-compatibility fixes, and new appearance options.

v1.1.4 — Add protection from the cart

Released 9 September 2026

Protection can now be added to something already in the basket, from the cart page and the mini-cart. A single row appears under each uninsured line reading "Add Protection from £x.xx", which opens the usual sidebar on the cheapest plan.

Off by default. Turn on Offer Protection in the Cart under Behavior. Note that with it on, the module's assets load on every page rather than only the product and cart pages, because the mini-cart can be opened from anywhere.

See Offering Protection in the Cart.

v1.1.3 — Insurance priced from customisable options

Released 2 September 2026

  • New: Insurance can now be re-priced as a shopper changes customisable options, so a configured product is insured for what they are actually paying. Turn on Track Customisable Option Prices under Behavior.
  • New: Options that are not part of the goods — delivery, removal of an old item, samples — can be listed in Customisable Options to Ignore, so they neither re-price the cover nor count towards the insured value.
  • New: Product Price Selector under Product Page Settings, for themes that show the configured price somewhere the module does not look by default.
  • Fix: Regenerating the insurance product no longer leaves the store without one if the old product cannot be removed.

See Insurance on Customisable Options.

v1.1.2 — Sidebar FAQ copy

Released 24 August 2026

  • Fix: Corrected the frequently-asked-questions copy in the V3 sidebar.

v1.1.1 — New badge and sidebar design

Released 24 August 2026

  • New: A new design for the product page badge and the sidebar, covering all four integration types. Off by default — turn on UI v3 under Appearance to opt in, per store.
  • New: Two settings that go with it, both V3 only: Show Sidebar on Add, which makes the badge button open the sidebar rather than act in place, and Show FAQ in Sidebar.
  • New: On mobile the V3 sidebar opens as a bottom sheet rather than a side panel.
  • Fix: A badge anchor selector you set in admin is now respected on themes that already render an anchor of their own — previously it was ignored.
  • Fix: Product groups can now require or suppress the second-chance sidebar for their members, overriding the store setting.

v1.0.16 — Insurance quantity follows the product

Released 23 July 2026

  • Fix: Changing the quantity of an insured product in the cart now updates its insurance line to match, so cover cannot fall out of step with what is being bought.

v1.0.15 — Styling resilience

Released 10 June 2026

  • Fix: The module's own styling now survives themes with aggressive global CSS resets, which could previously strip the badges and sidebar back to unstyled text.

v1.0.14 — Appearance system V2 & CSS layering

Released 3 June 2026

The biggest appearance update since launch. Brings the Magento module in line with the Loxa Shopify app so retailers and the support team share one vocabulary for badge and sidebar styling across both storefronts.

What's new:

  • "V2 badge" master toggle under Stores → Configuration → Loxa Insurance → Appearance. Off (the default) means badges render exactly as before. Switching it on unlocks the new appearance fields below. This is a per-store rollout switch and will be removed once all merchants are migrated.
  • Five new appearance fields for fine-grained control of badge and sidebar styling — style (branded / plain / inherit), icon (logo / shield / none), and four add-on layouts (checkbox, checkbox-simple, button-default, button-simple).
  • New Sidebar Style field alongside Theme Mode, with the same branded / plain / inherit triad. The inherit option lets you skin the sidebar and badges entirely from your theme CSS via documented --loxa-sidebar-* and --loxa-badge-* custom properties.
  • Cleaner secondary action — the sidebar's secondary button is now always visible beneath the primary call-to-action, with its label adapting between "No Thanks" and "Remove Protection". In second-chance mode this replaces the previous duplicate decline buttons.

Fixes:

  • Module CSS now lives in its own cascade layer, so style overrides you set in admin reliably take precedence over the module's base styles. !important rules were removed from the base CSS to make this work correctly.

See the Appearance reference for full details on all the new fields, plus the Sidebar Style: Inherit and Badge Style: Inherit CSS-variable contracts.

Technical detail
  • All V2 state is stamped as data-* attributes on the relevant root element (data-loxa-badge-style|layout|icon on the add-on card, data-loxa-sidebar-style on #loxa-magento-sidebar). New CSS is keyed entirely off those attributes, so pre-V2 selectors are untouched — zero regression risk for installs that don't enable the V2 flag.
  • The temporary page_style field added during development was superseded by the V2 axis; Model/Config/Source/PageStyle.php was removed.
  • Module CSS is now wrapped in a named @layer, ensuring admin-configured overrides win over base styles regardless of source order.
  • Corresponding PRs: #13 (LT-465 UI updates), #14 (CSS layer), #15 (remove !important from base CSS).

v1.0.13 — Validation order & minification fix

Released 22 May 2026

  • Fix: Corrected the order of validation that runs before the insurance sidebar opens, preventing the sidebar from opening in an inconsistent state.
  • Fix: Resolved a JavaScript minification issue that could affect the bundled frontend assets in production.

v1.0.12 — Cost-to-retailer on the order

Released 28 April 2026

  • New: The module now exposes the cost to the retailer as an extension attribute on order items and renders it on the order page in the admin. This gives you visibility of the wholesale cost of each insurance policy directly against the order.
Technical detail

Added a new extension attribute on sales_order_item alongside loxa_insurance_data, surfaced in the admin order view. Corresponding PR: #11.

v1.0.11 — Breeze theme compatibility

Released 17 April 2026

  • Fix: The Generate Insurance Product step now works on Breeze-themed stores where the Catalog Inventory (MSI) module is disabled. Previously the product generation could fail on these configurations.

v1.0.10 — Independent anchor positioning

Released 8 April 2026

  • New: You can now position the add-on and inclusive badge anchors independently. This gives you finer control over where each badge type appears on the product page, which is useful for themes that need the two badge styles in different locations.

See Theme Compatibility for how anchors are placed.

v1.0.9 — Product generation, MSI & cache fixes

Released 31 March 2026

A consolidation release rolling up several reliability fixes for the insurance product setup flow.

  • New: Insurance product creation now supports manual creation in addition to autogeneration, and autogenerates the required product attributes.
  • Fix: Multi-Source Inventory (MSI) handling corrected so product generation works across more store configurations.
  • Fix: Restored cart item total persistence that had been lost in an earlier merge.
  • Fix: Configuration changes now correctly invalidate the relevant cache.
Technical detail

Corresponding PRs: #5 (manual + autogenerated product attributes), #6 (revert lost cart-total save), #7 (MSI fix), #8 (cache invalidation on config update).

v1.0.8 — Cart totals fix & locally bundled logos

Released 26 March 2026

  • Fix: Resolved a cart totals bug on Hyva themes where insurance could result in stale or zero persisted totals at checkout.
  • Improvement: Loxa logos are now served from locally bundled assets rather than an external S3 URL. This prevents broken badge and sidebar logos on stores whose CSP or firewall rules block the Loxa asset CDN.
  • Housekeeping: composer.json updated with the correct documentation links, support email, and website.
Technical detail
  • The Hyva totals bug was caused by InsuranceCartManager::addInsuranceForItem() leaving TotalsCollectedFlag set to true after its own collectTotals()->save(), causing Magento's later Cart::save() to skip totals collection. Fixed by resetting the flag ($quote->setTotalsCollectedFlag(false)) immediately after the save.
  • Badge logos (loxa-logo-stacked.svg) are now swapped to the local asset immediately after DOM injection; the sidebar header logo in sidebar.phtml uses getViewFileUrl() against the bundled loxa-logo-landscape.svg.
  • Corresponding PRs: #3 (composer.json), #4 (cart totals + local logos).

Security hardening & rename

Released 3 March 2026 (v1.0.6 – v1.0.7)

A focused hardening pass following an internal security review, plus an internal rename of all DOM identifiers.

  • Security: Added form-key validation and rate limiting (30 requests/minute/IP) to the price and analytics proxy endpoints, and removed a CSRF bypass on the analytics endpoint.
  • Security: Hardened admin CSS sanitisation against expression(), javascript: URLs, @import, and similar injection vectors.
  • Improvement: Removed runtime use of Magento's ObjectManager in favour of proper dependency injection, and switched cart persistence to the repository pattern.
  • Improvement: Fonts now load as external WOFF2 files instead of a 256 KB base64-embedded stylesheet, and all DOM identifiers were renamed from the legacy loxa-shopify-* prefix to loxa-magento-*.
  • Improvement: Added internationalisation (i18n) support so all customer-facing strings — call-to-action labels, disclaimers, term labels — can be translated.
  • New: Added a proper uninstall routine that removes the loxa_insurance_data column and the module's configuration entries on uninstall.

Two tags, one release

v1.0.6 and v1.0.7 ship the same changes — v1.0.7 was re-cut to clean up the release metadata. Install v1.0.7 (or later).

Technical detail
  • ObjectManager::getInstance() in Controller/Adminhtml/Product/Generate.php replaced with nullable constructor-injected MSI dependencies.
  • Analytics and Price controllers now validate the form key via FormKeyValidator (header / query param) and apply cache-based rate limiting; date('c') corrected to gmdate('c').
  • Admin CSS sanitisation rewritten from a naive str_ireplace to strip_tags() plus regex removal of dangerous constructs.
  • InsuranceCartManager now uses CartRepositoryInterface->save() instead of direct $item->save() / $quote->save().
  • ~190 loxa-shopify-* occurrences across 14 source files renamed to loxa-magento-*.
  • Translatable strings exposed via Block/Insurance.php::getTranslatableStrings() and consumed by _str() / _sprintf() helpers in loxa-magento.js.
  • New Setup/Uninstall.php implementing UninstallInterface.
  • Corresponding PRs: #1 (review recommendations), #2 (form-key fix on product page).

v1.0.0 — Initial release

Released 23 February 2026 (v1.0.0 – v1.0.5)

First release of the Loxa Magento 2 module, supporting both Luma and Hyva themes. Versions v1.0.1 through v1.0.5 were rapid internal iterations stabilising the initial launch; v1.0.5 is the first broadly deployable build.

Core capabilities at launch:

  • All four insurance integration types — Add-on, Inclusive, Hybrid Extension, and Hybrid Warranty
  • Automatic badge rendering and the insurance sidebar with plan selection and legal disclaimers
  • Server-side price proxy with HMAC signature verification to prevent price tampering
  • Cart line-item management, including variant re-pricing and automatic removal of insurance when the insured product is removed
  • Quote-to-order persistence, with insurance data exposed via the Magento REST API for Loxa to pull orders
  • Built-in opt-out flows for inclusive insurance per the Compliance Rules

See the Magento 2 Integration Guide for full installation and configuration instructions.