Skip to content

Magento 2 Module Changelog

Release history for the Loxa Magento 2 Insurance module (loxa/magento2-insurance).

Each entry describes what changed and why it matters for your store. Where a release touches module internals, the technical detail is available in the expandable Technical detail section under that release.

To upgrade to the latest version, run:

composer update loxa/magento2-insurance
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:flush

Current version

The latest release is v1.0.14 (3 June 2026). We recommend keeping the module up to date — releases regularly include security hardening, theme-compatibility fixes, and new appearance options.

v1.0.14 — Appearance system V2 & CSS layering

Released 3 June 2026

The biggest appearance update since launch. Brings the Magento module in line with the Loxa Shopify app so retailers and the support team share one vocabulary for badge and sidebar styling across both storefronts.

What's new:

  • "V2 badge" master toggle under Stores → Configuration → Loxa Insurance → Appearance. Off (the default) means badges render exactly as before. Switching it on unlocks the new appearance fields below. This is a per-store rollout switch and will be removed once all merchants are migrated.
  • Five new appearance fields for fine-grained control of badge and sidebar styling — style (branded / plain / inherit), icon (logo / shield / none), and four add-on layouts (checkbox, checkbox-simple, button-default, button-simple).
  • New Sidebar Style field alongside Theme Mode, with the same branded / plain / inherit triad. The inherit option lets you skin the sidebar and badges entirely from your theme CSS via documented --loxa-sidebar-* and --loxa-badge-* custom properties.
  • Cleaner secondary action — the sidebar's secondary button is now always visible beneath the primary call-to-action, with its label adapting between "No Thanks" and "Remove Protection". In second-chance mode this replaces the previous duplicate decline buttons.

Fixes:

  • Module CSS now lives in its own cascade layer, so style overrides you set in admin reliably take precedence over the module's base styles. !important rules were removed from the base CSS to make this work correctly.

See the Appearance reference for full details on all the new fields, plus the Sidebar Style: Inherit and Badge Style: Inherit CSS-variable contracts.

Technical detail
  • All V2 state is stamped as data-* attributes on the relevant root element (data-loxa-badge-style|layout|icon on the add-on card, data-loxa-sidebar-style on #loxa-magento-sidebar). New CSS is keyed entirely off those attributes, so pre-V2 selectors are untouched — zero regression risk for installs that don't enable the V2 flag.
  • The temporary page_style field added during development was superseded by the V2 axis; Model/Config/Source/PageStyle.php was removed.
  • Module CSS is now wrapped in a named @layer, ensuring admin-configured overrides win over base styles regardless of source order.
  • Corresponding PRs: #13 (LT-465 UI updates), #14 (CSS layer), #15 (remove !important from base CSS).

v1.0.13 — Validation order & minification fix

Released 22 May 2026

  • Fix: Corrected the order of validation that runs before the insurance sidebar opens, preventing the sidebar from opening in an inconsistent state.
  • Fix: Resolved a JavaScript minification issue that could affect the bundled frontend assets in production.

v1.0.12 — Cost-to-retailer on the order

Released 28 April 2026

  • New: The module now exposes the cost to the retailer as an extension attribute on order items and renders it on the order page in the admin. This gives you visibility of the wholesale cost of each insurance policy directly against the order.
Technical detail

Added a new extension attribute on sales_order_item alongside loxa_insurance_data, surfaced in the admin order view. Corresponding PR: #11.

v1.0.11 — Breeze theme compatibility

Released 17 April 2026

  • Fix: The Generate Insurance Product step now works on Breeze-themed stores where the Catalog Inventory (MSI) module is disabled. Previously the product generation could fail on these configurations.

v1.0.10 — Independent anchor positioning

Released 8 April 2026

  • New: You can now position the add-on and inclusive badge anchors independently. This gives you finer control over where each badge type appears on the product page, which is useful for themes that need the two badge styles in different locations.

See Theme Compatibility for how anchors are placed.

v1.0.9 — Product generation, MSI & cache fixes

Released 31 March 2026

A consolidation release rolling up several reliability fixes for the insurance product setup flow.

  • New: Insurance product creation now supports manual creation in addition to autogeneration, and autogenerates the required product attributes.
  • Fix: Multi-Source Inventory (MSI) handling corrected so product generation works across more store configurations.
  • Fix: Restored cart item total persistence that had been lost in an earlier merge.
  • Fix: Configuration changes now correctly invalidate the relevant cache.
Technical detail

Corresponding PRs: #5 (manual + autogenerated product attributes), #6 (revert lost cart-total save), #7 (MSI fix), #8 (cache invalidation on config update).

v1.0.8 — Cart totals fix & locally bundled logos

Released 26 March 2026

  • Fix: Resolved a cart totals bug on Hyva themes where insurance could result in stale or zero persisted totals at checkout.
  • Improvement: Loxa logos are now served from locally bundled assets rather than an external S3 URL. This prevents broken badge and sidebar logos on stores whose CSP or firewall rules block the Loxa asset CDN.
  • Housekeeping: composer.json updated with the correct documentation links, support email, and website.
Technical detail
  • The Hyva totals bug was caused by InsuranceCartManager::addInsuranceForItem() leaving TotalsCollectedFlag set to true after its own collectTotals()->save(), causing Magento's later Cart::save() to skip totals collection. Fixed by resetting the flag ($quote->setTotalsCollectedFlag(false)) immediately after the save.
  • Badge logos (loxa-logo-stacked.svg) are now swapped to the local asset immediately after DOM injection; the sidebar header logo in sidebar.phtml uses getViewFileUrl() against the bundled loxa-logo-landscape.svg.
  • Corresponding PRs: #3 (composer.json), #4 (cart totals + local logos).

Security hardening & rename

Released 3 March 2026 (v1.0.6 – v1.0.7)

A focused hardening pass following an internal security review, plus an internal rename of all DOM identifiers.

  • Security: Added form-key validation and rate limiting (30 requests/minute/IP) to the price and analytics proxy endpoints, and removed a CSRF bypass on the analytics endpoint.
  • Security: Hardened admin CSS sanitisation against expression(), javascript: URLs, @import, and similar injection vectors.
  • Improvement: Removed runtime use of Magento's ObjectManager in favour of proper dependency injection, and switched cart persistence to the repository pattern.
  • Improvement: Fonts now load as external WOFF2 files instead of a 256 KB base64-embedded stylesheet, and all DOM identifiers were renamed from the legacy loxa-shopify-* prefix to loxa-magento-*.
  • Improvement: Added internationalisation (i18n) support so all customer-facing strings — call-to-action labels, disclaimers, term labels — can be translated.
  • New: Added a proper uninstall routine that removes the loxa_insurance_data column and the module's configuration entries on uninstall.

Two tags, one release

v1.0.6 and v1.0.7 ship the same changes — v1.0.7 was re-cut to clean up the release metadata. Install v1.0.7 (or later).

Technical detail
  • ObjectManager::getInstance() in Controller/Adminhtml/Product/Generate.php replaced with nullable constructor-injected MSI dependencies.
  • Analytics and Price controllers now validate the form key via FormKeyValidator (header / query param) and apply cache-based rate limiting; date('c') corrected to gmdate('c').
  • Admin CSS sanitisation rewritten from a naive str_ireplace to strip_tags() plus regex removal of dangerous constructs.
  • InsuranceCartManager now uses CartRepositoryInterface->save() instead of direct $item->save() / $quote->save().
  • ~190 loxa-shopify-* occurrences across 14 source files renamed to loxa-magento-*.
  • Translatable strings exposed via Block/Insurance.php::getTranslatableStrings() and consumed by _str() / _sprintf() helpers in loxa-magento.js.
  • New Setup/Uninstall.php implementing UninstallInterface.
  • Corresponding PRs: #1 (review recommendations), #2 (form-key fix on product page).

v1.0.0 — Initial release

Released 23 February 2026 (v1.0.0 – v1.0.5)

First release of the Loxa Magento 2 module, supporting both Luma and Hyva themes. Versions v1.0.1 through v1.0.5 were rapid internal iterations stabilising the initial launch; v1.0.5 is the first broadly deployable build.

Core capabilities at launch:

  • All four insurance integration types — Add-on, Inclusive, Hybrid Extension, and Hybrid Warranty
  • Automatic badge rendering and the insurance sidebar with plan selection and legal disclaimers
  • Server-side price proxy with HMAC signature verification to prevent price tampering
  • Cart line-item management, including variant re-pricing and automatic removal of insurance when the insured product is removed
  • Quote-to-order persistence, with insurance data exposed via the Magento REST API for Loxa to pull orders
  • Built-in opt-out flows for inclusive insurance per the Compliance Rules

See the Magento 2 Integration Guide for full installation and configuration instructions.