Upgrade Notes
These notes cover upgrades between Magewire V3 releases. Minor releases are backward compatible for documented APIs, but they can change default presentation, layout structure, and companion package requirements. For a move from V1, see Upgrade.
3.7.1 to 3.7.2
Security release
3.7.2 fixes GHSA-64j9-rg74-hqc7 (High), which affects Magewire 3.0.0 through 3.7.1. Upgrade every environment, including production, staging, development, local, demo, and test installations.
Update the package
For a project whose root constraints already permit 3.7.2:
composer update magewirephp/magewire:3.7.2 --with-all-dependencies
composer show magewirephp/magewire
Review the lockfile, test the application, and deploy with your normal Magento process. If a root-level constraint
pins an older release, raise it, for example to ^3.7.2. Coming from 3.6 or earlier, also apply
3.6 to 3.7.
The current companion packages accept 3.7.2 without a new release: magewirephp/magewire-hyva-theme 3.1.2
requires >=3.7, magewirephp/magewire-hyva-checkout 3.1.1 requires ~3.7.1, and magewirephp/magewire-admin
3.0.0 requires ^3.0.
Inherited methods are no longer browser actions
Every public method defined on your component class is callable from the browser, even when no template refers to
it. That is unchanged. Before 3.7.2, the browser could also call public methods inherited from Magewire's
Component and Component\Form classes and their traits. These are now rejected with MethodNotFoundException,
for example:
reset,fill,only,except, andpull;redirectandskipRender;validateandvalidateOnly;tapand accessors such asgetName.
A method whose name starts with __ is not callable, wherever it is declared. Magewire handles its own __dispatch
and __lazyLoad calls separately.
A template that calls one of these directly, such as wire:click="reset" or $wire.reset(), stops working. Add a
public action that checks the request and calls the helper:
class CheckoutForm extends \Magewirephp\Magewire\Component\Form
{
public string $email = '';
public function clearEmail(): void
{
$this->reset('email');
}
}
Then call wire:click="clearEmail". Re-declaring an inherited method, such as public function reset(...$properties),
makes it browser-callable again, so only do that deliberately.
Public methods on your own base classes and traits stay callable unless their name is reserved.
Event listener targets are checked
A listener that points at a method inherited from Component or Component\Form, such as reset, or at a lifecycle
hook, such as mount or boot, now throws MethodNotFoundException when its event is dispatched. This applies to
$listeners, #[On], and the magewire:listeners layout argument.
Point the listener at a public action instead. A listener whose method is not declared on the component, and
$refresh, still re-render without calling anything.
Reserved method names
These names belong to the framework. The browser cannot call them, and they cannot be listener targets:
boot,booted,mount,exception,rendering,rendered, andplaceholder;- any name starting with
hydrate,dehydrate,updating, orupdated; - a trait hook name: one of
boot,initialize,mount,hydrate,updating,updated,rendering,rendered,dehydrate,exception,call, orbooted, followed by the basename of a trait the component uses, such ascallRequestorinitializeView.
Names are matched case-sensitively, so declare lifecycle hooks in the casing shown. Rename an application action that
collides with one of these names, for example a public placeholder() action on a non-lazy component.
Lazy loading
The internal __lazyLoad call is only accepted while a lazy placeholder loads its
component. Lazy components need no change.
What to check
- Search templates and scripts for
wire:directives and$wirecalls that name an inherited helper. - Check every
$listenersentry,#[On]method, andmagewire:listenersitem for an inherited helper or a reserved name. - Check that public actions do not use a reserved name.
See Magewire's compatibility guide and Security.
3.6 to 3.7
Update the packages together
| Package | Release for Magewire 3.7 |
|---|---|
magewirephp/magewire |
3.7.2 (security release) |
magewirephp/magewire-hyva-theme |
3.1.2 (requires >=3.7) |
magewirephp/magewire-hyva-checkout |
3.1.1 (requires ~3.7.1) |
The Hyvä Checkout package accepts any Hyvä theme package version, so require the theme package explicitly. See Companion package compatibility.
composer require magewirephp/magewire:^3.7.2 magewirephp/magewire-hyva-theme:^3.1.2
bin/magento setup:upgrade
In production mode, also compile DI and deploy static content, which now includes Magewire's stylesheet.
Core styles
- The inline
magewire.cssblock is replaced by theMagewirephp_Magewire::css/magewire.csshead asset. Layout instructions that reference the old block have no effect. - Core templates no longer contain Tailwind classes. Theme CSS that targeted
relative,animate-bounce,sr-only,animate-spin, or the old exception utilities must use the newmagewire-*classes. - The notifier's
activity-stateblocks were removed and a close button was added. Core no longer draws a spinner inside notifications. - On wide screens, the notifier sits at the bottom start edge (3.7.1).
See Core styles for the class mapping and tokens.
Hyvä
- Run
bin/magento setup:upgradeso Hyvä regeneratesapp/etc/hyva-themes.jsonwithout the core entry, then rebuild the theme withnpm run build. - Move overrides of the package's
--offset,--index, and--gapproperties to the core--magewire-notifier-offset,--magewire-notifier-z-index, and--magewire-notifier-gaptokens.
See Tailwind.
Hyvä Checkout
- Since
magewirephp/magewire-hyva-checkout3.1.0, components without an attribute receive backwards compatibility when they render insidehyva-checkout-main. Add#[HandleBackwardsCompatibility(enabled: false)]to V3-native checkout components. See Hyvä Checkout BC. - Consecutive identical checkout flash messages are grouped with a count badge by default. Rebuild the Hyvä theme so the badge is styled, or turn the grouping off. See Hyvä Checkout flash messages.
Loading indicator
Components that handle dispatched events now show a spinner when a request is slow. Review it on pages with event listeners, and adjust or remove it as described in Loading Indicator.
Service type sequences
sequence entries on Features, Mechanisms, and Containers are now enforced by item name. An existing entry can
reorder items, and setup fails with a LogicException on a cycle or when a PERSISTENT or ALWAYS item sequences
after a LAZY one. See Ordering items.
Behavior fixes to check
- A loader message that starts with
..., such as... Saved, now shows nothing during the request instead of a "Message Unknown" notification. - Dispatching an event that a component does not listen to now fails with
EventHandlerDoesNotExistinstead of a class-not-found error.
New, optional
- Layout overrides: adjust listeners, loader messages, and component setup per layout block.
- The UI workbench at
/magewire/playwright/uirenders the core UI outside production mode for styling work.
3.6.0 to 3.6.1
The Alpine runtime providers were renamed to magewireRuntime and magewireRuntimeBindings. The previous names still
work as deprecated aliases; update custom templates that reference them. See
CSP Script Bootstrap.