Shopware released version 6.7.15.0 on 1 October 2026. What’s new: redesigned admin navigation, an experimental dark mode, the Admin API with OAuth 2.0 (authorisation code and PKCE), Copilot Agentic as a stable version and product bundles with more flexible variant and quantity options. Here you can read what this means for operations, integrations and testing.
What exactly is in Shopware 6.7.15.0?
Shopware 6.7.15.0 brings together several small and medium-sized changes: the admin navigation has been redesigned, an experimental dark mode has been added, the Admin API supports OAuth 2.0 with authorisation code and PKCE, Copilot Agentic has moved from beta to stable, and product bundles allow more flexible variant and quantity options. The manufacturer provides details in its release announcement for Shopware 6.7.15.0.
The changes mainly affect how the Administration is used, secure machine-to-machine authentication and product configuration. This is relevant for integrations, automation tools, developer scripts and editors who spend a lot of time in the Administration. The move to OAuth 2.0 with PKCE matters most for CLI tools and native apps, because it changes the existing authentication and makes the set-up more secure.
The official source contains the full list of all fixes and changes. Review it before updating to rule out breaking changes.
How does the new admin navigation change day-to-day work?
The redesigned navigation is meant to make orientation faster with fewer clicks. For editors and shop owners, this usually means shorter paths to products, orders and settings, and possibly less onboarding for new users. The changes affect the interface; the APIs remain unchanged.
Technically, menu items and visibility in the Administration are restructured. For existing integrations, this means you should check back-end plugins that address admin routes or menu entries after the update. If you develop your own plugins or use third-party plugins, check compatibility and adjust menu IDs if necessary.
After the update, it is worth walking users through the new menus and setting up frequently used areas as bookmarks or dashlets. If your team spends a lot of time in the Administration, the time saved usually becomes noticeable quickly in our experience. Exactly how much depends on the individual workflow.
Is the experimental dark mode worth it?
The dark mode is experimental and aimed at administrators with long sessions or workplaces with little light. It offers an alternative display, reduces glare and can change how controls are perceived. Test it before using it in production.
“Experimental” means the feature may still change, and not every plugin or custom UI element is guaranteed to be compatible. Test the dark mode on desktop and with your most important plugins. Pay particular attention to contrast in form elements and to custom CSS adjustments that may look different in the dark theme.
If your team often works in the evening, an optional dark mode can be easier on the eyes. In productive support workflows, however, you shouldn’t use it without a test phase.
What does OAuth 2.0 with authorisation code and PKCE change for the Admin API, CLI tools and native apps?
OAuth 2.0 with authorisation code and PKCE improves security when authenticating clients that don’t run in a browser. For CLI tools, native applications and automation scripts, this means more secure token exchange and less reason to store credentials unprotected.
In detail, authorisation code with PKCE protects against code injection and interception attacks, because the client uses a one-time code challenge. If you develop integrations that rely on basic auth or insecure token flows, you should migrate them. Check your libraries for PKCE support and implement a secure token refresh. For headless integrations, the API structure stays the same; only the authentication layer changes.
Practical steps:
- Check which tools use OAuth.
- Update the client libraries.
- Run through the token cycle as a test.
- Update documentation and deploy runners.
In many cases, the switch is a one-off effort that permanently improves security.
What do the stable Copilot Agentic and the extended product bundles mean?
Copilot Agentic has left beta and is now stable. Shop owners can use the feature in production and expect APIs and workflows to behave more consistently. Product bundles allow more flexible variant and quantity options, which makes complex product combinations easier to represent.
Copilot Agentic is an AI-powered assistant that can automate or support tasks in the Administration. A version marked as stable behaves more reliably, and its API changes less often. Even so, check the data protection settings and review which data is sent to the AI components. This matters for regulatory requirements and data protection reviews.
The extended bundle options make it easier to create sets with variable quantities or different variants, for example sets of different colours or sizes in fixed combinations. This saves workarounds such as separate bundle products or manual stock management. Check the pricing and stock rules for bundles, as they can affect revenue calculation and stock logic.
Frequently asked questions
Is Shopware 6.7.15.0 a mandatory update?
No. It brings improvements in security and usability, but you should run compatibility tests for plugins and your own customisations before updating.
How do I test plugins for compatibility after the update?
Set up a staging instance, apply the update there and check critical workflows such as checkout, payment providers and admin plugins. Document errors and prioritise fixes.
How do I enable the experimental dark mode?
The dark mode is available in the Administration. You enable it in the display or user settings. Because the feature is experimental, test it with a few users first.
Where can I find the official release notes?
The manufacturer publishes the full release notes on its website: Shopware release notes (1 October 2026).
Update recommendation
Plan the update after a short test phase on a staging environment. Above all, check plugins and integrations that use admin routes or authentication. OAuth 2.0 with PKCE and the stable Copilot Agentic affect security and automation, so a targeted test run is worthwhile here.
Get in touch if you need support with the switch or with integrations.
Planning something similar?
Tell us briefly about your system and your goal. We will get back to you with questions or a proposal.
Request a project