Release: QUIQQER 2.27
Executive summary
QUIQQER 2.27 strengthens the platform where current CMS projects increasingly meet connected services: authentication, machine-readable interfaces, multilingual routing, and reliable day-to-day administration. The most substantial work is concentrated in Core, OAuth Server, and AI MCP. Together, these releases make authorization flows more explicit, improve support for project languages and virtual hosts, and give integrations clearer contracts.
Several application modules add practical improvements alongside that foundation work. Calendar handles external and recurring data more defensively, REST broadens its OpenAPI support, Order adds bulk administration, and Template Presentation introduces more flexible navigation and spacing options. This report is based on the available release notes and is intended as orientation; the packages installed in a project and its integration landscape remain decisive for any rollout.
What changed
OAuth flows become more complete and easier to integrate
OAuth Server 3.8.1 concludes a concentrated sequence of releases around consent, scopes, discovery, and refresh tokens. Consent now respects the project language and can be presented through an extensible interface. Discovery endpoints emit absolute URLs, while protected-scope settings give administrators more direct control over what connected clients may request.
Refresh-token handling is also more resilient. Rotation has been hardened, and dynamic clients can use shared refresh tokens where that model is appropriate. These changes reduce ambiguity at the boundary between QUIQQER and external applications, but existing clients should be tested against their expected consent and token lifecycle.
Core improves multilingual routing and administrative reliability
Core 2.27.1 adds path-language routing for virtual hosts and improves MCP handling for project languages and virtual-host configuration. This is relevant for installations that serve several languages from one domain or expose project administration to trusted automation. When pages are copied, their target order is now preserved, making content restructuring more predictable.
A number of smaller corrections address routine administration: deleted pages can no longer be edited, package menus are loaded before settings windows open, expected permission denials no longer produce unnecessary warnings, and session handling avoids shared transaction conflicts. None of these changes redesigns the CMS, but together they remove failure modes that can be disruptive in live editorial work.
AI MCP defines clearer access boundaries
AI MCP 1.10.0 enforces capability-scoped OAuth for MCP access and adds user-session handling. Its catalog is visible during OAuth consent, so users can better understand which capabilities a connected MCP client is requesting. The result is a more explicit authorization model for agent and automation scenarios rather than a broad, implicit connection.
The first release of AI Agentic complements this direction with interactive account onboarding and typed provider-access contracts. This is an early foundation, not a finished end-user workflow, but it establishes clearer decisions around provider access and account setup.
Application modules receive focused operational improvements
Calendar 5.1.0 continues its move to DBAL and treats malformed external calendar data more carefully. Recurring information is now limited to recurring events, invalid dates are handled defensively, and missing configuration or unavailable URL results no longer cause avoidable failures. Projects that import third-party calendars should benefit most from the stricter edge-case handling.
REST 3.3.0 adds support for YAML OpenAPI definitions and the current Guzzle PSR-7 line. Order 2.12.0 allows multiple orders to be deleted together and guards against unavailable shipping integrations. Template Presentation 6.10.0 adds an auto-hide navigation mode, layout-gap tokens, corrected spacing variables, and additional overline styling. These are targeted changes, but they improve documentation workflows, administration, and presentation consistency.
Payment Stripe 3.4.0 scopes recurring Stripe data to the relevant account, hides Stripe below the minimum charge amount, and refines its administration. Productsearch 2.2.3 ensures that product setup completes before search setup. Both changes address ordering and scope assumptions that matter more in production than they do in an isolated module view.
What this means for projects
- Multilingual installations should verify path-language routing and virtual-host behavior across root and path languages.
- OAuth and MCP consumers should test consent screens, protected scopes, discovery URLs, refresh-token rotation, and user-session behavior together.
- Projects importing calendar data should include malformed dates, non-recurring events, and temporarily unavailable sources in staging tests.
- Order, Stripe, REST, and presentation updates are incremental, but custom shipping, payment, API, or template integrations should still be checked against the revised behavior.
Operational notes
Review the package versions actually installed before updating and take a current backup. For connected applications, use a staging environment with representative OAuth clients and token lifecycles rather than validating only the login step. Multilingual projects should test every configured host and path language, while calendar and commerce projects should include external-service failures in their checks.
The available release notes vary in detail. Package-level changelogs and project-specific tests therefore remain the authoritative basis for deployment decisions.
Looking ahead
QUIQQER 2.27 continues the move toward a platform with clearer operational and authorization boundaries. Language-aware routing, capability-scoped access, explicit consent, and more defensive module behavior all point in the same direction: integrations should be easier to understand and live CMS projects should fail in more predictable ways.