I'm a software developer located in Staffordshire, United Kingdom specialising in PHP, Laravel and APIs. I love open source, data and sharing the things I learn.
If you’ve ever pulled a Magento 2 project and found bin/magento , lib/ , dev/ or setup/ simply aren’t there, you’re not going crazy - those directories are deployed out of the magento/magento2-base package by Composer rather than living in the repo. When that deploy step doesn’t run, or runs partially, the files never land and you’re left staring at a project that looks half-installed. The fix In…
If you do any local development against HTTPS you’ll eventually hit Chrome’s NET::ERR_CERT_AUTHORITY_INVALID interstitial - the full-page “Your connection is not private” warning. Usually there’s an “Advanced” link that lets you proceed anyway, but on certain certificate errors (HSTS, some ERR_CERT_* variants) that link is missing entirely, leaving you with no obvious way through. The well-known…
If you’re running Klevu alongside Magento’s Multi-Source Inventory (MSI) and products are showing the wrong stock status in your Klevu index, the cause turned out to be fairly subtle - and the fix is a single config setting. The problem Products that were genuinely in stock were being indexed as out of stock (or the reverse) in Klevu. The Magento storefront showed the correct status, but Klevu…
Adobe Commerce Cloud manages your infrastructure services for you, but knowing exactly which versions of Valkey, MariaDB and RabbitMQ are running on your environments isn’t always obvious. The .magento/services.yaml file defines what you’ve requested, but that doesn’t always reflect what’s actually deployed - especially after platform upgrades or environment redeployments. Here’s how to check the…
If you’ve been keeping an eye on the Magento security space recently, you’ll have seen the research from Sansec around SessionReaper exploitation and the more recent PolyShell - both of which use the media/custom_options/ directory as a vector for uploading and executing malicious PHP files. The SessionReaper attack targets session data to extract customer and admin credentials, and the PolyShell…
Magento’s built-in telephone validation for customer accounts is fairly strict - it only allows digits, spaces, parentheses, plus signs and hyphens. That works for a lot of western formats but breaks for plenty of valid international phone numbers. French phone numbers are commonly written with dots as separators (e.g. 06.76.40.32.22 ), and Austrian numbers often use a forward slash (e.g.…
If you’ve ever updated a product’s URL key via the Magento 2 REST API and then wondered why the old URL is now returning a 404, you’ve probably missed the url_key_create_redirect custom attribute. In the admin UI there’s a handy “Create Permanent Redirect for old URL” checkbox that appears when you change a product’s URL key. Behind the scenes, this sets url_key_create_redirect on the product -…
I recently ran into a fairly puzzling issue on an Adobe Commerce site where some products were behaving oddly on the frontend. After some digging, it turned out the catalog_product_relation and catalog_product_super_link tables had invalid entries - simple products were listed as parents with child relationships, which should never happen. In Magento/Adobe Commerce, only configurable, bundle and…
If you want to disable the AI mode button that appears in Chrome’s omnibox/address bar then you can do so via Chrome flags. Navigate to: chrome://flags/#ai-mode-omnibox-entry-point Set the flag to Disabled and relaunch Chrome.
If you want to go back to Opus 4.5, start hashtag#claude with: claude --model claude-opus-4-5-20251101 You can also edit your config file to set this as the default if you want to use it by default rather than 4.6.
I recently ran into a “No signature” error when trying to get my git commits verified and it sent me down a bit of a rabbit hole. If you’ve ever tried to set up GPG signing for git commits, you’ll know it can be a fairly painful experience. As you can now sign git commits with SSH keys rather than GPG and given that pretty much everyone already has an SSH key (and pretty much no one has a GPG key…
Adobe have changed the way they usually release security patch updates for 2026, but sadly their communcations around the release leaves quite a bit to be desired. I’ll collate the release information here through the year and document what has/hasn’t been released as per the official release schedule . 13/01/2026: No patches released, confirmed by Nathan Smith via Slack . 10/02/2026: There was a…
If you’re running into this issue with Adobe Commerce deployments, it’s due to the older versions of composer now being marked as having a few security issues (“PKSA-1gck-s111-yq7g”, “PKSA-b8f7-zn44-r4gz”, “PKSA-s25b-vbmp-jvhh”): Installing build dependencies .. . Installing php build dependencies: composer/composer W: Changed current directory to /app/.global/composer/composer W: No composer.lock…
One of the more interesting things I’ve had to debug this year was why Magento was apparently returning 400 responses to builder.io for certain webhook payloads. A few of the team had looked into this but drawn a bit of a blank so I offered to take a look and it ended up being a fairly puzzling one to debug. The same payload POST direct to a local running version of the application would give the…
If you’re running multiple import processes simultaneously in Adobe Commerce or Magento 2, you might encounter a frustrating bug where the imports interfere with each other, causing data corruption or import failures. This issue, documented in GitHub issue #37593 , has been confirmed in Magento 2.4.6 but is present in other versions too namely 2.4.7. If two import processes run concurrently in…
There are times when you need to either list or activate an old version of your Fastly configuration but you may not be able to access your Magento/Adobe Commerce control panel to do so. If you need to list versions of your service, you can do so using the Fastly CLI tool using: fastly service-version list -t API_KEY -s SERVICE_ID This will return you a list of service versions and their…
If you ever need the ability to flush Fastly but can’t acess an Adobe Commerce admin panel to do so, you can run the following curl request: curl -H "Fastly-Key: API_KEY” -X POST " https://api.fastly.com/service/SERVICE_ID/purge_all" You can fetch both your API_KEY key and SERVICE_ID from the file mounted at: /mnt/shared/fastly_tokens.txt in your Commerce Cloud cluster.
If you’ve recently deployed one of the latest release lines of Magento on Commerce Cloud and have: REDIS_BACKEND : '\Magento\Framework\Cache\Backend\RemoteSynchronizedCache' [ 2025 -04-08T10:29:29.486342+00:00 ] ERROR: Magento version '2.4.7.0-patch5' does not support Valkey backend model '\Magento\Framework\Cache\Backend\RemoteSynchronizedCache' There is a Github issue for this problem . That…
If you’re using Adobe’s B2B extension and recently tried upgrading then you likely hit this issue: W: Unable to apply data patch Magento \ Company \ Setup \ Patch \ Data \ SetComp W: anyForStructure for module Magento_Company. Original exception message: SQL W: STATE [ 42000 ] : Syntax error or access violation: 1305 FUNCTION abcdefghijk W: .REGEXP_LIKE does not exist, query was: UPDATE `…
If you use Laravel’s Request object and had previously used the $request->getContentType() method then in Laravel 12, it’s been changed to $request->getContentTypeFormat() : Old: /** * */ class ApiRequestHandler { /** * @param Illuminate\Http\Request $request */ public function __invoke ( \ Illuminate \ Http \ Request $request ) { if ( $request - > getContentType ( ) === 'form' ) { // Do something…
If you need to update the website a product is assigned to in Magento via the REST API, you can do this fairly easily. You can get the current websites assigned by running this query: curl "https://www.mystore.co.uk/rest/all/V1/products/MY-PRODUCT-SKU" \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer [token]' This will return a JSON payload. Within the payload you’ll find: "id" :…
This week I needed to debug an issue when Paypal Express was being used and it was throwing a “We can’t place the order”. If you’ve ever looked into the Paypal Express controller within Magento then you’ll see that it’s effectively a catch all when something in the process fails. If you take a look at vendor/magento/module-paypal/Controller/Express/AbstractExpress/PlaceOrder.php : 141 } catch (…
Update : Hyva are now recommending Adobe Commerce Cloud customers commit their app/etc/hyva-themes.json file into the repo. The app/etc/hyva-themes.json file The file needs to be generated after Magento is installed, so it can’t be run during the build phase. This means, for Adobe Commerce Cloud projects, the app/etc/ hyva-themes.json file needs to be commited to the repository. Otherwise the file…
If you’re using the Klarna Checkout package (klarna/m2-checkout) then when you upgrade to Magento 2.4.4 it won’t install due to a conflict with Monolog versions. As per a merchant email a short while ago, you need to change over to the new klarna/m2-checkout package. You can switch over using: composer remove klarna/m2-checkout composer require klarna/m2-klarna
You can re-run a composer script by using this syntax: composer run-script post-create-project-cmd
If you hit a redirect loop in the admin panel after upgrading to 2.4.4 then you like had the configuration option system/security/max_session_size_admin set to 0 to fix an issue with 2.4.3 and session size. Setting it to 0 in 2.4.4 doesn’t work and causes the session to not get written. If you set it to an actual upper limit then it’ll work: bin/magento config:set…
I think Google Calendar is brilliant however one type of repeating event it does not support is the last working day of the month. There is the option to import a custom ICS file though and within the specification of that file format you can get pretty much close to last working day (there may be some exceptions where this doesn’t work, such a bank holidays but it is close enough). Create a new…
I think Google Calendar is brilliant however one type of repeating event it does not support is the last specific day of the month. There is the option to import a custom ICS file though and within the specification of that file format you can do it. Create a new file, ie last-wed-of-month.ics and put this inside it: BEGIN:VCALENDAR VERSION:2.0 BEGIN:VEVENT RRULE:FREQ = MONTHLY ; INTERVAL = 1 ;…
I think Google Calendar is brilliant however one type of repeating event it does not support is the last day of the month. There is the option to import a custom ICS file though and within the specification of that file format you can do it. Create a new file, ie last-day-of-month.ics and put this inside it: BEGIN:VCALENDAR VERSION:2.0 BEGIN:VEVENT RRULE:FREQ = MONTHLY ; INTERVAL = 1 ; BYSETPOS =…
There may be situations when you need to use logrotate without having root access to the server that you’re dealing with. In these situations you can point logrotate at a state file in your home directory. First, create your logrotate configuration file with something like: /var/log/messages { rotate 5 weekly } and then save to ~/logrotate.conf . Next, touch your state file: touch…
As PHP older versions have now been deprecated upstream you will encounter errors when trying to to install via Homebrew. For example, attempting to install PHP 7.2 will give the following: Error: php@7.2 has been disabled because it is deprecated upstream ! There’s a tap you can use at shivammathur/php which has all of the older versions that are still installable. First, tap the repo: brew tap…
If you ever need to create a bootable USB installer, the most reliable way that I’ve found to do so on a Windows machine is using Rufus . It works every single time and I’ve yet to encounter any issues with a drive created using the tool. I last used it to create a Windows 10 bootable drive after their own instructions didn’t work whereas Rufus worked flawlessly.
To set max_upload_size and post_max_size to set in the official docker image, open a bash session and run: root@f125876a0568:/var/www/html # echo “php_value upload_max_filesize 256M” >> .htaccess root@f125876a0568:/var/www/html # cat .htaccess # snipped php_value post_max_size 256M php_value upload_max_filesize 256M Using >> in the echo command will append the line to the existing content present.
If you’re lucky to have a newer Mac with a T2 chip in it, at some point you’re likely going to reinstall the OS to freshen things up. If “Allow booting from external media” is disabled (see image below) in Startup Security and you use Internet Recovery which then fails at any point (past the point of changing disk partitions) - when hen you then reboot your Mac, it’ll be bricked. Internet Recovery…
If you ever need to remove all special/sale prices from a Magento 2 installation, you can use the following SQL to do so. First step, back up your databases if you haven’t already. Specifically the catalog_product_entity_decimal table. Then run the following SQL: DELETE FROM catalog_product_entity_decimal WHERE attribute_id IN ( SELECT attribute_id FROM eav_attribute WHERE attribute_code =…
The new version of macOS doesn’t appear to have pip installed by default, you can install it by running this command in a Terminal window: sudo easy_install install pip Note: Make sure that you have version 12.2 of Xcode installed and that in Xcode -> Preferences -> Locations -> Command Line Tools is set to Xcode 12.2 too.
A short-hand method of truncating files is by using this syntax: : > /path/to/filename.txt Once it has ran then the files content will be removed and the file itself left in place.
On most standard Linux operating systems you can view the current users’ group membership with: id -nG or if you’re currently logged in as root then you can just tag the user that you want to view on the end of the command. For example, if I’m logged in as root and want to see the groups that john is a member of: id -nG john which will then output: root@mimas:~ # id -nG john john docker
Clever little iOS app for businesses/teams called Mustr. It can broadcast critical/urgent messages to your team and take roll calls to make sure everyone’s healthy, safe and secure. 🔗 https://t.co/HdOah1fKHa #ios #app #teams #remotework #remote #safety — Scott (@ssxio) July 30, 2020
This post is part of a series called “Keeping Your Privacy” . There are a hundred and one reasons to run your own VPN - the biggest and most commonly referenced is privacy. You can control your own privacy when using public networks or public wifi for example. If you’re connecting via your own VPN service then you’re a lot more hidden. In the current climate of protests you would be able to…
This post is part of a series called “Keeping Your Privacy” . It has been truly remarkable to see the protests around the world in the last two weeks. A message seems to be spreading and getting through to politicians and those in power at least seem to acknowledge that something has to change going forward. The liability in the White House hasn’t exactly helped matters state side but with a white…
Everyone is aware that privacy online is an important topic. It becomes even more important when you apply the context of the current protests and people needing to protect their identity. I’m lucky that I’ve worked as a professional software developer for a long time and know how to configure, run and operate lots of different services. When the protests broke out worldwide I felt like I should…
Create a non-root user to run your docker containers under: adduser steve Next, update the apt sources and install Docker: apt install docker.io systemctl enable —now docker Now, add our new user to the docker user group so they can interact with the service: usermod -aG docker steve and finally, we’ll switch over to that user using su and confirm we can run a simple container: su steve docker run…
Due to recent updates to OpenSSH there is now a much simpler and easier way to use hardware tokens for SSH access. Start by inserting your Yubikey into your Mac. Create a new key ecdsa-sk which will reside on your machine but require your hardware token: ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk -C “user@site.co” It’ll ask you to enter a password to protect your key, then if touch compatible…
If you’ve got a growing Lumen application or perhaps you just want clear separation of configuration - it can be beneficial to add more configuration files to the config/ directory. These files are pretty simple in nature, if I was creating one to configure settings for users, I could create a file called config/user.php containing: return [ 'prefix' = > 'user_' , 'table' = > 'users' ,…
A lot of the software developers I’ve interacted with hold a basic working knowledge of git which I’ve always found surprising as a lot of pieces sound a lot scarier to hear than they are to use. An example of this would be git rebasing - people immediately seem to worry about this even though at the end of the day its a relatively simple concept - you have a stack of commits and you want to trim…
If you use S3 to store files then the chances are at some point you’ll be letting users download these files themselves. If you don’t want to fetch the file yourself and you want to send the user directly to S3 to download it - you can do this securely using pre-signed URLs. In short, a temporary URL is generated to allow the user access to the file and it has a timed expiry. If you’re normalising…
I’d recently seen a few people recommending app store apps to handle zipping and encrypting files/directories on a Mac. Open up a Terminal session and locate the directory you need and run: zip -er secret-files.zip directory-of-files/things.txt You’ll then be prompted to enter the password and confirm it.
Later this year on September 14th a new European payment law will come into use. For consumers its a brilliant step forward. Essentially the new law requires two-factor auth when checking out which should cut down on card fraud. If you’re a Stripe user, all you’ll need to do is implement 3D Secure 2. This will cover your requirements for the new law. I asked Stripe on Twitter to confirm this…
I’ve never one to say there shouldn’t be any legacy projects. I’m sure plenty of developers who would like to change the definition of a legacy project to suit this weeks best practices but in all honestly there are legacy applications out there generating hundreds and thousands of pounds for many companies. That in itself should be respected. Legacy has become a dirty word somehow. It shouldn’t…