PrestaShop
PrestaShop patches 33 vulnerabilities across 9.2.1 and 8.2.9 on the same day.
A side-by-side editorial comparison of Sendcloud and Sylius — release velocity, themes, recent moves, and the top alternatives to consider.
Sendcloud spends November removing manual steps from customs and pickup points.
Sendcloud's November entries target the chores around a label. Customs PDFs can now be uploaded through API v3, Shipping Rules can fill Importer of Record details automatically, and DPD and DHL Benelux contract rates load from a dragged-in PDF. Shopify Plus checkout now forces a specific pickup point, the Atlas Pickup Points app links its selection to Sendcloud orders, and dimensional surcharges show up in the total price column.
Sylius hits another Host header injection, this time in the shop reset email
v1.14.21 is a security release fixing a disabled API reachable through percent-encoded paths, Host header injection in shop password reset emails when a channel has no hostname, and unpublished reviews exposed by the Shop API. It follows the September patches across 1.12, 1.13 and 1.14 for JWT audience confusion and an admin reset Host header flaw. v2.3.0-ALPHA.1, with Symfony 8, dark mode and per-channel promotions, is the latest development release in view.
Sendcloud's November entries target the chores around a label. Customs PDFs can now be uploaded through API v3, Shipping Rules can fill Importer of Record details automatically, and DPD and DHL Benelux contract rates load from a dragged-in PDF. Shopify Plus checkout now forces a specific pickup point, the Atlas Pickup Points app links its selection to Sendcloud orders, and dimensional surcharges show up in the total price column.
After a summer of new carriers and routes, the product is tightening data quality: real carrier pickup statuses, sub-user attribution, enforced pickup selection, and price surprises surfaced earlier. Cross-border paperwork is getting the most automation, with both API and rules-based paths.
Expect the new IOR Shipping Rules actions to reach the v3 'shipments with rules & defaults' endpoint, since the entry flags that gap, and more carriers added to PDF contract-rate upload.
v1.14.21 is a security release fixing a disabled API reachable through percent-encoded paths, Host header injection in shop password reset emails when a channel has no hostname, and unpublished reviews exposed by the Shop API. It follows the September patches across 1.12, 1.13 and 1.14 for JWT audience confusion and an admin reset Host header flaw. v2.3.0-ALPHA.1, with Symfony 8, dark mode and per-channel promotions, is the latest development release in view.
Security patching dominates the visible 1.x stream, and the recurrence matters: the same Host header class has now surfaced in both admin and shop reset flows. The 2.x line carries the platform modernization and new commerce capability. The entries show nothing further on it since August, so the pace of the path to a 2.3 beta is unclear.
Expect further 1.14 security patches while the branch is supported. The next 2.3 pre-release is the signal to watch for commerce features.
Other E-comm products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Sendcloud or Sylius.
PrestaShop patches 33 vulnerabilities across 9.2.1 and 8.2.9 on the same day.
Spryker builds an MCP server into its Storefront API so AI agents can shop.
CartFlows Pro 3.3.1 adds a single page layout to Instant Checkout.
Virto Commerce lets admins register AI agent clients as OAuth apps in the back office.
Shopify's November POS batch adds QR wallets, French debit cards and fewer taps per sale.
Antavo's feed is loyalty-industry commentary; the product rarely appears in it.
See all Sendcloud alternatives → · See all Sylius alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
Both compete on the same themes — api — within E-comm. Sendcloud is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Sendcloud is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other E-comm products to evaluate alongside.
Top Sendcloud alternatives in E-comm are ranked by recent ship velocity. Browse the "Sendcloud alternatives" section above for the current picks, or visit /alternatives/sendcloud for the full list with editorial commentary on each.
Top Sylius alternatives in E-comm are ranked by recent ship velocity. Browse the "Sylius alternatives" section above for the current picks, or visit /alternatives/sylius for the full list with editorial commentary on each.