Updating to Venta Theme 1.7.4 (Hyvä 1.5.3 and Hyvä Checkout 1.3.15) ​

1.7.4 is a regular release. Magento is unchanged and there is no build-stack migration. The Hyvä packages do move: Hyvä Default Theme and Hyvä Theme Module go from 1.5.2 to 1.5.3, and Hyvä Checkout from 1.3.14 to 1.3.15. The theme package pins all three exactly, so the update does not resolve until your Hyvä Packagist tenant serves them.

Most of the work is in the child theme, where several changes break 1.7.3 overrides or subclasses. The Hyvä 1.5.3 upgrade also uninstalls two GraphQL packages that custom code may still use. A data patch moves the checkout address-field settings to the per-field config of Hyvä Checkout 1.3.15. A few defaults change as well, most visibly Advanced Search, which is now off.

The rest of the release is storefront fixes and page-weight work. See what changed for the list and Features for the feature-level view.

Recommended reading:

• Updating to 1.7.3, if you are not on it yet
• Hyvä: Upgrading to 1.5.3
• Hyvä Checkout: Upgrading to 1.3.15
• Hyvä security changelog, for the MSRP template fix
• File Review, for the override reconciliation routine

Breaking changes for child themes ​

The list view product card template is removed ​

Magento_Catalog/templates/product/list/item-list.phtml is deleted, together with its product_list_item_list block and the four child blocks declared under it in Magento_Catalog/layout/catalog_list_item.xml. List mode has used item-grid.phtml with mode-list: utilities since 1.7.1, so the removed card was no longer rendered.

Magento_Catalog/templates/product/list/item.phtml now renders product_list_item_grid for every view mode except vertical:

default => 'product_list_item_grid',

grep -rn "getItemHtml\|'list'" app/design/frontend/<Vendor>/<ProjectTheme>/Magento_Catalog/templates/product/list.phtml

Attributes takes a new constructor argument ​

Magebit\VentaTheme\Block\Product\View\Attributes::__construct() takes Magebit\VentaTheme\Model\Eav\StoreShortDescriptions in place of ShortDescriptionRepositoryInterface. Short descriptions now load once per store instead of once per attribute. The full signature:

public function __construct(
    Context $context,
    Registry $registry,
    PriceCurrencyInterface $priceCurrency,
    private readonly StoreShortDescriptions $storeShortDescriptions,
    array $data = []
)

A subclass that overrides the constructor has to pass the new type. getShortDescription() keeps its signature.

Two classes in the User Type Switcher also gain required constructor arguments: Model\Form\EntityFormModifier\WithUserTypeModifier and Plugin\Checkout\PersistUserTypePlugin. If a project module extends either one, compare its constructor against the vendor class.

Hyvä 1.5.3 uninstalls the GraphQL view model and tokens ​

Hyvä Default Theme 1.5.3 no longer requires hyva-themes/magento2-graphql-view-model or hyva-themes/magento2-graphql-tokens, so Composer removes both during the update unless something else requires them. Venta 1.7.4 no longer uses either. Code that still does breaks:

• a template or module that calls $viewModels->require(GraphqlViewModel::class)
• anything reading signin_token from the customer section or cartId from the cart section

Four Venta 1.7.3 templates required the GraphQL view model. A child copy of any of them fails once the package is gone, and the fix is to rebase it on 1.7.4 in §2, not to reinstall the package:

• Magento_Review/templates/form.phtml
• Magento_Catalog/templates/product/widget/viewed/js/fetch-recently-viewed-products.phtml
• Magento_Catalog/templates/product/widget/viewed/js/recently-viewed-products.phtml
• Magento_Theme/templates/mini-cart/slider/recently-viewed/recently-renderer.phtml

For your own code, adding the package to the require of whichever module uses it. For project code that is the root composer.json:

composer require hyva-themes/magento2-graphql-view-model hyva-themes/magento2-graphql-tokens

Require only the ones your code uses. Pre-flight check 2 finds them.

The guest shipping estimate on the cart page was one of the cartId readers. Venta's Magento_Checkout/templates/php-cart/shipping.phtml now builds both guest URLs from the masked quote ID in window.checkoutConfig.quoteData.entity_id. A child override of that template needs the same change, or guests get no shipping rates on the cart page:

: '/V1/guest-carts/' + window.checkoutConfig.quoteData.entity_id + '/estimate-shipping-methods';

: '/V1/guest-carts/' + window.checkoutConfig.quoteData.entity_id + '/totals-information';

MSRP template escaping fix ​

Hyvä 1.5.3 fixes a cross-site scripting issue in Magento_Msrp/templates/popup.phtml and Magento_Msrp/templates/product/price/msrp.phtml. Hyvä rates it low severity, since exploiting it needs write access to product data. Venta does not override these files, so stores get the fix from the parent theme. A child theme that overrides either file has to take the new version of both: the new msrp.phtml depends on the initMsrpPrice component that the new popup.phtml registers.

A child bundle entry needs the card hover import ​

web/tailwind/venta-bundle.js in the vendor theme gains ./js/bundle/product-card-hover.js after bfcache.js. The product card hover now locks the card height through window.magebit.lockCardHeight(), which this file defines. If your theme keeps its own venta-bundle.js with a hardcoded import list, add the import after the bfcache.js line:

import '../../../../../../../vendor/magebitcom/magento2-venta-theme/web/tailwind/js/bundle/product-card-hover.js';

Without it, hovering a product card throws lockCardHeight is not a function.

Prerequisites ​

• Venta Theme 1.7.3. If you are further back, work through Updating to 1.7.3 first.
• hyva-themes/magento2-default-theme 1.5.3, hyva-themes/magento2-theme-module 1.5.3 and hyva-themes/magento2-hyva-checkout 1.3.15 reachable in your Hyvä Packagist tenant.
• magento/module-media-gallery-synchronization-api installable. It ships with Magento and Venta's theme module (magebitcom/magento2-venta-theme-module) now requires it. A project that lists it under replace in the root composer.json to trim Media Gallery packages has to drop that line. The module itself can stay disabled.
• Node 20 or newer for the theme build, unchanged since 1.7.0.
• Magento and the PHP requirements are unchanged.

Pre-flight checklist ​

Run this while the project is still on 1.7.3.

1. Check your root Composer pins ​

grep -n "magento2-default-theme\|magento2-theme-module\|magento2-hyva-checkout\|media-gallery-synchronization-api" composer.json

The Hyvä packages arrive through the theme. A root pin at 1.5.2 or 1.3.14 conflicts with what the theme requires, and Composer refuses to resolve. A replace entry for the Media Gallery synchronization API blocks Venta's theme module. §1 has what to change.

2. Find code that uses the uninstalled GraphQL packages ​

grep -rn "GraphqlViewModel\|signin_token" app/design/frontend/<Vendor> app/code
grep -rn "\.cartId" app/design/frontend/<Vendor> app/code --include='*.phtml' --include='*.js'

A hit in a copy of one of the Venta templates listed in the GraphQL section, or in php-cart/shipping.phtml, goes on the §2 list. Anything else needs the package it uses required at the root, or a rewrite.

3. Find PHP code that extends the changed classes ​

grep -rn "View\\\\Attributes\|WithUserTypeModifier\|PersistUserTypePlugin" app/code

A subclass that overrides the constructor needs the new arguments described above.

4. Check your bundle entry ​

grep -n "bundle/" app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind/venta-bundle.js 2>/dev/null

If this prints an import list without product-card-hover.js, the card hover import applies. No output means there is nothing to do.

5. Inventory your template overrides ​

git -C app/design/frontend/<Vendor>/<ProjectTheme> ls-files \
  'Magento_Catalog/layout/catalog_list_item.xml' \
  'Magento_Catalog/templates/product/list/**' \
  'Magento_Catalog/templates/product/widget/viewed/**' \
  'Magento_Checkout/templates/php-cart/shipping.phtml' \
  'Magento_Msrp/templates/**' \
  'Magento_Review/layout/catalog_product_view.xml' \
  'Magento_Review/templates/**' \
  'Magento_Theme/templates/html/cart/cart-drawer.phtml' \
  'Magento_Theme/templates/mini-cart/**' \
  'Magento_Theme/templates/messages.phtml' \
  'Magento_Swatches/templates/**' \
  'Hyva_Checkout/layout/hyva_checkout_venta.xml' \
  'Hyva_Checkout/templates/**' \
  'Magebit_VentaTheme/templates/sticky-bar/**' \
  'Magebit_VentaSmileElasticSuite/templates/catalog/**'

§2 lists what each group needs. More templates changed than this list covers; the File Review comparison catches the rest.

6. Find x-html in your own templates ​

grep -rn 'x-html=' app/design/frontend/<Vendor> app/code --include='*.phtml'

Venta 1.7.4 has no x-html binding left, in line with the Hyvä 1.5.3 default theme. The Alpine build that Hyvä 1.5.3 ships still supports x-html, so your templates keep working after this update. Hyvä's documentation says Alpine CSP 3.15 drops x-html and recommends migrating now: x-text for plain text, and the new x-html-safe directive for values that carry markup. x-html-safe renders through an allowlist that strips img, picture, id, name, style and Alpine directives, so check the output of anything you migrate. Hyvä also adds Stores > Configuration > Hyvä Themes > Developer > HTML Safe > Map x-html-safe to x-html (Disabled by default), which applies the same allowlist to existing x-html bindings on CSP pages or on all pages.

What changed ​

1. Update Composer dependencies ​

Put the store into maintenance mode first and leave it there until §3 takes it out:

bin/magento maintenance:enable

The Composer run removes the GraphQL packages from vendor/ while your old overrides are still deployed. A copied template that requires GraphqlViewModel fails until §2 lands.

Pin the versions in your root composer.json. Add the four smaller packages only if your project already requires them:

{
  "require": {
    "magebitcom/magento2-venta-theme": "1.7.4",
    "magebitcom/magento2-venta-theme-module": "1.7.4",
    "magebitcom/magento2-venta-theme-smile-elasticsuite-module": "1.7.4",
    "magebitcom/magento2-venta-theme-style-guide": "1.0.4",
    "magebitcom/magento2-venta-theme-back-in-stock-module": "1.1.3",
    "magebitcom/magento2-venta-theme-paypal": "1.0.4",
    "magebitcom/magento2-venta-theme-user-type-switcher": "1.0.2"
  }
}

If your root composer.json also pins hyva-themes/magento2-default-theme, hyva-themes/magento2-theme-module or hyva-themes/magento2-hyva-checkout, raise those lines to 1.5.3, 1.5.3 and 1.3.15 before running the update, or drop them and let the theme's requirement carry the packages.

composer update \
  magebitcom/magento2-venta-theme \
  magebitcom/magento2-venta-theme-module \
  magebitcom/magento2-venta-theme-smile-elasticsuite-module \
  --with-all-dependencies
composer show hyva-themes/magento2-default-theme   # must report 1.5.3
composer show hyva-themes/magento2-theme-module    # must report 1.5.3
composer show hyva-themes/magento2-hyva-checkout   # must report 1.3.15

Add every smaller Venta package your project requires to the composer update line. The User Type Switcher in particular has to reach 1.0.2: 1.0.1 accepted any Hyvä Checkout version, so Composer does not move it on its own, and 1.0.1 has the old checkout field layout. --with-all-dependencies is what lets the locked Hyvä packages move to satisfy the theme.

If pre-flight check 2 found code using the GraphQL packages, run the composer require from the GraphQL section now.

2. Reconcile your template overrides ​

Work through the list the pre-flight inventory produced, following the File Review routine. What each group needs:

• Magento_Catalog/templates/product/list/item.phtml and layout/catalog_list_item.xml - take the vendor item.phtml and drop any product_list_item_list declarations. Delete your copy of item-list.phtml; nothing renders it. See above.
• Magento_Catalog/templates/product/list/item-grid.phtml, js/product-card-actions.phtml, js/wishlist.phtml and js/compare.phtml - the card's root x-data object becomes the named initProductCard component, the list-view regions start their Alpine components only in list view, and the wishlist and compare buttons read section data through magebit.subscribePrivateContent() instead of their own private-content-loaded listeners. Reconcile these four together.
• Magento_Checkout/templates/php-cart/shipping.phtml - the masked quote ID change from the GraphQL section.
• Magento_Msrp/templates/popup.phtml and product/price/msrp.phtml - take both from Hyvä Default Theme 1.5.3. This is the security fix from above.
• Magento_Theme/templates/html/cart/cart-drawer.phtml, mini-cart/slider/slider-wrapper.phtml and messages.phtml - these templates work together with cart-drawer.js and messages.js in the JS bundle, which is built from the vendor theme. The mini cart writes express checkout buttons into an x-ref container, and flash message icons are rendered in PHP and switched with x-show. An override that keeps the 1.7.3 markup no longer matches what the bundle expects.
• Magento_Catalog/templates/product/widget/viewed/js/* and Magento_Theme/templates/mini-cart/slider/recently-viewed/recently-renderer.phtml - recently viewed products come from browser storage only. A 1.7.3 copy requires GraphqlViewModel and fails once the package is gone. See Known limitations.
• Magento_Review/templates/form.phtml - the form posts natively to review/product/post with the form key, renders the rating stars server-side and loads the ratings collection once. A 1.7.3 copy requires GraphqlViewModel and fails once the package is gone.
• Magento_Review/layout/catalog_product_view.xml - product.review.summary uses Magebit\VentaTheme\Block\Product\Review\Chart, which is block-cached. A child layout that sets its own class on this block loses the cache.
• Magento_Review/templates/helper/summary.phtml and summary_short.phtml - the aria labels come from data attributes, and the partial star is a clipped sprite star pair instead of an inline gradient SVG.
• Hyva_Checkout/layout/hyva_checkout_venta.xml and the Hyva_Checkout/templates/ overrides - see Hyvä Checkout 1.3.15 below.
• Magento_Swatches/templates/** - swatch and swatch-group class attributes are escaped with escapeHtml, and configurable and listing swatches offer only options with an enabled child.
• Templates with x-html - every Venta template that used it now binds with x-text or x-html-safe, including the sticky add-to-cart bar (Magebit_VentaTheme::sticky-bar/*) and the ElasticSuite autocomplete and layered navigation templates. Where you override one of them, take the new binding along with the rest of the rebase.

Hyvä Checkout 1.3.15 ​

Venta's checkout templates now follow Hyvä Checkout 1.3.15:

• Billing details render through Hyvä Checkout's shared entity-details.phtml, with the same-address checkbox as its own same-address-toggle.phtml. Venta's Hyva_Checkout/templates/default/checkout/address-view/billing-details.phtml is removed and hyva_checkout_venta.xml no longer points checkout.billing-details at it. A child copy of that file is no longer rendered; port its changes to entity-details.phtml if you still need them.
• Address list (address-view/address-list*.phtml and the Alpine api/v1/alpinejs/address-view/address-list.phtml) selects addresses by Hyvä's string address IDs, so an address entered during checkout can be re-selected and edited. "New Address" is hidden while an address entered during checkout exists, and the shipping form button reads "Ship here".
• Discount code (coupon-code.phtml and the new coupon-code/*.phtml) is a Hyvä Checkout form, so the coupon reCAPTCHA can guard it. Hyvä deprecates applyCouponCode() and revokeCouponCode().
• Footer (page/footer.phtml and the new page/footer/recaptcha-notice.phtml) shows the reCAPTCHA disclosure when an invisible or v3 reCAPTCHA guards customer login, discount code or place order.
• Smaller fixes in price-summary/cart-items.phtml (quantity escaped), customer-comment.phtml (aria-label attribute-escaped) and page/js/api/v1/evaluation/redirect-dialog.phtml (no JavaScript error on open).

Hyvä's upgrade notes list the upstream template changes, including the switch from Heroicons to Lucide icons. A child theme that overrides Hyvä Checkout templates Venta does not touch needs that list too.

3. Upgrade and deploy ​

bin/magento setup:upgrade
bin/magento setup:di:compile

setup:upgrade runs Hyvä Checkout's address-config migration and then Venta's own MigrateCheckoutAddressFieldConfig data patch. §4 covers what to check afterwards.

The theme's package.json raises @hyva-themes/hyva-modules from ^1.4.0 to ^1.5.0. Version 1.5.0 adds base styles for form validation messages and <progress>, and the hyva-fonts command. Raise the same range in your theme. ^1.4.0 already allows 1.5.0, but the lockfile keeps 1.4.x until the range is raised, and npm ci refuses a package.json that disagrees with the lockfile. This updates both, so commit the two files afterwards:

cd app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind
npm install @hyva-themes/hyva-modules@^1.5.0

Then rebuild theme assets in your child theme. The build picks up the rebased templates, so it runs after §2:

cd app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind
npm ci
npm run build-prod

Deploy the rebuilt assets, then take the store out of maintenance mode:

bin/magento setup:static-content:deploy -f
bin/magento cache:flush
bin/magento maintenance:disable

4. Check the checkout address fields ​

Hyvä Checkout 1.3.15 drops the Enabled and Required columns from the address form field grid (Stores > Configuration > Hyvä Checkout > General > Components > Billing / Shipping Address Form > Form Fields). Field visibility and required state now come from the customer address attribute, with optional per-field overrides under hyva_themes_checkout/form/<form>/<field>/ that have no admin field.

Hyvä's migration only keeps flags that differ from Hyvä's shipped defaults, but fields now fall back to the customer address attribute, so Venta 1.7.4 adds MigrateCheckoutAddressFieldConfig. It reads the old field JSON at every scope that has a value, writes each field's enabled and required flags to the per-field paths at that same scope, and keeps the original JSON under <path>_legacy. Street line requirements move to Address Forms > Street Address Fields. User type and reference are set to disabled in the per-field config, because the User Type Switcher renders them.

After setup:upgrade, place a test order as a guest and as a customer on each website or store view that had its own address-field settings, and check that the same fields show and are required as before. Hyvä's migration, and Venta's patch after it, also remove customer attributes such as date of birth, gender and tax/VAT number from the address form JSON.

5. Review the changed defaults ​

• Advanced Search - off by default. Stores > Configuration > Magebit > Theme > Search > Enable Advanced Search defaults to No, and while it is off catalogsearch/advanced and its results page return 404. Set it to Yes for each store view that links to Advanced Search.

• Last ordered items - the last-ordered-items customer section returns an empty array and the sale.reorder.sidebar block is removed, because nothing in Venta renders them. A project that shows a reorder sidebar has to restore both: remove="false" on the block in the child theme layout, and the core section source in the etc/frontend/di.xml of a project module that loads after Magebit_VentaTheme.

• HTML indentation - line indentation is stripped from rendered pages outside script, pre, textarea and elements whose classes or inline style keep whitespace (whitespace-pre*, whitespace-break-spaces). Checkout is skipped. An element that keeps whitespace through a stylesheet class of its own, or a <code> element, needs one of those classes. There is no admin setting. To turn the stripping off, disable the plugin in the etc/frontend/di.xml of a project module that loads after Magebit_VentaTheme:

  xml

  <type name="Magento\Framework\View\Result\Page">
      <plugin name="Magebit_VentaTheme::strip_indentation" disabled="true"/>
  </type>

• Express checkout shortcuts - the shortcut container is skipped when no express provider is active for the store view. Providers and their config flags are listed under providers of Magebit\VentaTheme\Model\Checkout\ExpressShortcutAvailability in the theme module's etc/di.xml. An express integration that is not on that list keeps the container rendering as before, so third-party providers need no change.

• Hyvä 1.5.3 defaults - Hyvä Theme Module 1.5.3 sets two defaults to Yes: "Show Newest Items First" (checkout/cart/show_newest_items_first), which the mini cart now follows, and "Enable Autocomplete on login/forgot password forms" (customer/password/autocomplete_on_storefront, No in Magento itself), which the register and account edit password fields now follow. A store with a saved value for either keeps it.

• Seeded content - setup:upgrade creates the venta-showcase CMS page, disabled, if no page with that identifier exists. The new privacy, return, shipping and cookies policy pages are only created together with the footer block that links them, so an upgraded store with the footer already in place does not get them. Existing pages and blocks are never overwritten. Missing seed images are copied to pub/media/wysiwyg/; files already there are left alone.

Known limitations ​

Since Hyvä 1.5.3, the Synchronize widget products with backend storage setting (catalog/recently_products/synchronize_with_backend, under Stores > Configuration > Catalog > Catalog > Recently Viewed/Compared Products) has no effect, because Hyvä removed the GraphQL fetch that refreshed recently viewed products. The admin field carries a note saying so. Recently viewed widgets show the price stored in the browser when the product was viewed, and items stored in another currency show without a price. This is reported upstream as magento2-theme-module#546.

Post-upgrade verification ​

1. List view renders. Switch a category to list view. Cards render with prices, swatches and the add to cart row, and the browser console has no errors.
2. Card hover works. Hover product cards on a category page and the wishlist. The card keeps its height and the console shows no lockCardHeight error.
3. Guests get shipping rates on the cart page. As a guest, add a product and open the cart page estimate. The request goes to /V1/guest-carts/<masked id>/estimate-shipping-methods, not /undefined/, and returns rates.
4. Checkout address forms match. Run the checks from §4: the same fields show and are required on each store view, the Private/Business switcher sits above the name fields, and a new address entered during checkout can be re-selected and edited.
5. The discount code applies. Apply and remove a coupon in checkout. If reCAPTCHA guards the coupon form, the footer shows the reCAPTCHA notice.
6. Reviews post. Submit a review on a product page. The page reloads with a flash message and the review shows up in admin.
7. The mini cart shows express buttons. With an express provider active, open the mini cart. The buttons render, and the PayPal shimmer matches the button count while it loads.
8. Advanced Search matches your setting. Open catalogsearch/advanced. It returns 404 unless you enabled it in §5.
9. Recently viewed products show. Open two products, then a category page and the mini cart. The recently viewed widget lists both with prices and the console has no errors.