[Soner (shyim)]

Summary

Corrects outdated and overly broad Store guidance and adds concrete verification steps for extension developers. For example, the dependency guidance now uses valid Composer JSON and tested version ranges instead of a wildcard shopware/frontend dependency; packaging guidance distinguishes required source/build manifests from development-only artifacts.

• Add a security and permissions page covering route and DAL authorization, customer/channel ownership, input validation, credentials, callbacks, and HTTP methods.
• Expand lifecycle cleanup, restricted-role testing, channel inheritance, cache isolation, batching, queue retries, and consent behavior.
• Distinguish requirements and defects from recommendations, and test the oldest declared version as well as the newest supported stable version.
• Clarify intentional HTTP error responses, dynamic styling, indexing boundaries, and logging destinations.

Related links

• Current Store review documentation
• Composer version constraints

Checklist

• I reviewed affected links, code samples, and cross-references, including PageRef references where relevant.
• I added or updated redirects in .gitbook.yaml if pages were moved, renamed, or deleted. (Not applicable: existing page paths are preserved; the replaced heading retains its anchor.)
• I updated .wordlist.txt (and sorted it) if spellcheck flags new legitimate terms.
• I listed every dependent pull request that is not merged yet under Dependent PRs below. (None.)
• Dependent changes that must be released, not only merged, before this documentation goes live have been published. (No release dependency.)
• This pull request is ready for review.

Dependent PRs

Notes

Validation passed:

• Repository-wide Markdown lint (pnpm run check:markdown).
• Repository PageRef validation.
• Store-section spellcheck using the configured CI image and dictionary.
• 55 local Markdown links and the Composer JSON example.
• git diff --check.

Draft for review of the clarified requirement wording, particularly packaging exceptions, supported SQL use, and the distinction between recommendations and submission requirements. No private review discussions or partner extension source are included.

[shopware-dev-docs-connector]

Developer Docs healthcheck

Status: Completed with success.
Repository: shopware/docs
Commit: 20054d1
Preview: https://developer-documentation-q3xsmg1kd-shopware-frontends.vercel.app
Workflow run: #5908

[Copilot]

🟡 Changes recommended

The removal list still includes webpack.config.js, which is required to resolve Storefront npm dependencies, so following it can leave merchants unable to rebuild.

1 open issue

• Preserve webpack.config.js needed to rebuild Storefront npm dependencies · New

What changed in this PR

This PR clarifies Shopware Store submission guidance and adds practical verification steps for extension developers.

Changes:

• Add security guidance for authorization, resource ownership, validation, credentials, callbacks, and HTTP methods.
• Expand submission checks for lifecycle behavior, compatibility, sales channels, caching, batching, retries, and consent.
• Correct dependency examples and clarify packaging, logging, styling, indexing, and expected HTTP errors.

File	Description
guides/​development/​testing/​store/​storefront-performance-and-errors.md	Clarify dynamic styling, performance checks, and expected error responses
guides/​development/​testing/​store/​store-review-errors.md	Correct Composer guidance and refine packaging and compatibility checks
guides/​development/​testing/​store/​seo-and-structured-data.md	Distinguish indexable content from private and utility endpoints
guides/​development/​testing/​store/​security-and-permissions.md	Add security requirements and verification scenarios
guides/​development/​testing/​store/​quality-guidelines.md	Add submission checks and guidance for responding to findings
guides/​development/​testing/​store/​not-allowed-store-behaviors.md	Clarify supported database and filesystem boundaries
guides/​development/​testing/​store/​installation-and-cleanup.md	Expand cleanup, ownership, update, and lifecycle checks
guides/​development/​testing/​store/​index.md	Link the new security guidance
guides/​development/​testing/​store/​functionality-integration.md	Expand integration, channel, cache, batching, and queue guidance
guides/​development/​testing/​store/​cookies-and-privacy.md	Add consent enforcement and withdrawal checks
guides/​development/​testing/​store/​code-quality.md	Clarify logging destinations and release contents
.wordlist.txt	Add terminology used by the updated documentation

_{Review effort: Balanced}