Magento 2 Import Export Extension – STM Import Export Pro

Version 1.4.0 — 2026-11-10

• Google Drive with a Google account: setting "Sign in with" service account (key file) or Google account; for the Google account an OAuth client (web application) of the shop owner, "Connect Google account" in the profile, the refresh token is stored encrypted and renews the access by itself; files are read and written as that person, "My Drive" included. The redirect URI to register is shown in the profile. Clear hints for a wrong client, an expired or revoked connection (apps in the publishing status "Testing" lose it after 7 days) and a missing connection. Verified on 2026-11-10 with a real Google account: export into "My Drive", replace, import by name and pattern, move to done
• Google Drive: an upload refused for missing storage ("Service Accounts do not have storage quota") gets the right hint: use a shared drive (Google Workspace); "My Drive" folders take no files from a service account, reading works
• Dropbox: an error names the reason Dropbox gives instead of "other/..."; a missing permission is named with the way to fix it (tick it in the App Console, Submit, generate a new token)
• FTP: a failed upload or download names the reply of the server (e.g. "Operation not permitted" in the root of an ISPConfig account); missing directories are created level by level; relative paths keep their meaning after the directory check. Verified on 2026-11-10 against a real pure-ftpd account, plain FTP and FTPS: export uploaded, import (dry run) downloaded, 39 rows
• Profile list: tick boxes (one, several or all shown) and actions for the ticked profiles: duplicate, switch on, switch off, export as JSON, run in the background, delete
• Settings: a first row "Go to" with buttons to the overview, the profiles and the history
• Tree data for orders: template setting "Data for the template: tree" hands one record per order with every field of the order, billing.* / shipping.* (street1 … street4), payment.*, items (with options), tracks, invoices, shipments, creditmemos and comments. The row template knows sections {{#items}} … {{/items}}, {{^field}} … {{/field}} and dotted names; an XSLT stylesheet receives objects/object with the same structure as other Magento exporters use, and their <files><file> wrapper is unwrapped, so existing stylesheets run without changes (PHP functions excepted). Ready-made: orders as XML with their items, XSLT on tree data
• "Test with one record" in the profile (export): the saved profile writes one order number or SKU as in a run, shows the output and every field of the record with its value; nothing delivered, nothing recorded
• "Duplicate profile": a switched-off copy with every setting
• "Runs" in the profile: the last 15 runs with status, result, link and download
• Fix: a rollback of orders created through the cart deleted them without cancelling, so their MSI stock reservations stayed and the salable quantity was too low; such orders are now cancelled before they are deleted
• Export files: setting "Files" in the File step: one file, the file in a ZIP, or one file per record (an order with its item rows, named after the order number) in a ZIP
• PDF documents: order profiles can add the invoices, packing slips or credit memos of the exported orders, document profiles their own documents, as PDFs made by Magento ("Print" in the admin) in the folder pdf/ of the ZIP
• Mass action "Export with STM profile" in the grids of orders, invoices, shipments and credit memos: the selected records run through the chosen export profile at once (at most 5000), then the run opens with its download
• Feed templates for idealo (offer feed CSV) and billiger.de / solute (data superset CSV) after their published specifications; feed columns feed_shipping_cost (with free shipping from an amount), feed_delivery_time and feed_availability_text; CSV escaping of the template format also quotes commas
• Template format: setting "File extension" (xml, csv …) for the written file; the ready-made templates set it
• Google categories: search in Google's product taxonomy (in the shop's language, cached for 30 days) below the category table of a feed profile; a click writes the category
• Order import: setting "Customer accounts" creates accounts for unknown e-mail addresses (name, group, billing and shipping address, no password, no welcome e-mail); in cart mode a variant that is not visible on its own goes into the cart as its configurable product with the variant's options
• Stock import: setting "Open orders" subtracts what orders not shipped yet still need from the file's quantity (for warehouse counts; not with MSI reservations)
• Product feeds: columns feed_url, feed_image_url, feed_additional_image_urls, feed_price, feed_sale_price, feed_final_price (special prices and catalog price rules from the price index), feed_currency, feed_availability, feed_stock_qty, feed_brand, feed_gtin, feed_parent_sku, feed_category and feed_google_category, computed only when the mapping, a filter or the template names them; profile settings for prices with or without tax, GTIN and brand attribute, URL parameters and a category table for Google categories. Ready-made templates: Google Shopping XML (also read by Meta, Microsoft Advertising, Pinterest, TikTok), price comparison CSV, fixed-length text
• New destination "Public feed URL": pub/media/stm_ie_feeds/<secret per profile>/<file>, stable URL, replaced at once
• Template format: filters |text (plain text without HTML), |cut:N, |pad:N, |lpad:N (fixed-length files) and |opt (the line goes when the value is empty)
• Stock import (product import settings): "Find products by" another attribute (EAN, supplier number), quantities as changes (+5 / -3), "Products missing in the file": leave, set out of stock or set to 0 (never after a run with errors or without rows, and never when it would hit more products than the file names; dry run and rollback included)
• Modifiers map (value table with default and *) and calc (formula over columns, e.g. {Lager A} + {Lager B})
• New export entities: invoices, shipments, credit memos (one row per item; shipments with tracking and MSI source); events "invoice / shipment / credit memo created" hand such profiles the document itself
• Order export: any column of sales_order as order_<column> and of sales_order_item as item_<column>, so columns of other extensions (order attributes, delivery dates) can be exported without code
• Order import: an order without increment_id is found by ext_order_id; region names and codes are resolved to Magento's region (US, CA, DE …)
• Order migration: profile setting "Create new orders" (order import) with "as a historical record". Amounts, taxes, payment method, status, dates, invoices, shipments and credit memos come from the file; nothing is recalculated, no stock moves, no e-mail is sent, no cart is involved. Products that no longer exist stay on the order as SKU and name. A payment method the shop does not know is kept on the new hidden method "Imported payment" with its original name (column payment_title). Documents in the export format (invoices number:state:total:date, shipments number:date, credit_memos number:state:total:date); the first invoice and shipment carry the items (item_qty_invoiced / item_qty_shipped), a credit memo item_qty_refunded plus an adjustment for the rest. New columns payment_title, ext_order_id, item_tax_percent. A rollback deletes orders taken over this way with their documents; any other order keeps the protection against deleting invoiced or shipped orders
• XSLT stylesheet from a sample file: in the profile form, "Write from a sample file" (XML or JSON) finds the records and a list inside them (one row per item), names the columns after the Magento fields it recognises and tries the stylesheet on the sample. The template format now reads JSON files through the stylesheet as well (JSON is turned into XML: one element per key, <item> per list entry)
• Database tables of other extensions as entities: Stores › Configuration › STM Import & Export › Database tables. Each unlocked table appears as "Table <name>" with its columns as fields; key from a unique index or the primary key (several columns: column _key), auto-increment ids assigned by the database; numbers, dates, lengths and required columns checked before writing; dry run, snapshot and rollback. Tables with Magento's own data are refused; profiles need the new right "Database tables of other extensions"
• Profiles store settings of their entity (entity_settings, new column; setup:upgrade)
• Order export: columns product_<attribute code> carry the catalog value of the ordered product (e.g. product_ean, product_manufacturer, product_weight) and item_categories its category paths. A configurable item takes the chosen variant and falls back to its parent; select attributes give their labels; values are today's catalog values in the store view of the order. They are read only when the mapping or a filter names them, page by page in one query per store view; an unknown attribute code is a warning and an empty column
• New entity: search terms (search_term, Marketing › SEO & Search › Search Terms): term and store view as key, redirect URL, suggested-terms flag, active flag and the counters; import, export, dry run, snapshot and rollback
• Admin redesigned: compact profile form in five steps with a step rail, help on every field, Back goes to the previous step, sticky bar with run and save
• Mapping filled per entity and direction with the usual fields and harmless modifiers, further fields offered as suggestions; a suggestion the user never touched is not saved
• Mapping: a mapped column that is missing in the file is no longer passed on as an empty value; its field stays as it is and the column is named once as a warning
• Run page: download of the file each run read or wrote (copy below var/stm_ie/runs, setting "Keep the file of every run", cleaned with the history), counters, the first 25 exported rows or the result per imported row; content and download need the Magento right of the entity

Version 1.3.1 — 2026-11-07

• Fix: bin/magento config:set rejected every path ("path doesn't exist") on a store with the module installed. The configuration entity received MagentoConfigModelConfigStructure directly; Magento builds the CLI command list in the global area, the structure read system.xml there and stayed empty for the whole process. The importer now gets the structure through a proxy (built on first use)
• Actions after an order export need the matching Magento rights (invoice, ship, cancel, comment, send e-mails) when an admin saves, imports or runs the profile; they are not applied with an XSLT stylesheet; every order is locked while its actions run; a journal per profile remembers the orders already handled, so a repeated or delta export neither comments nor mails twice; a status with "notify" sends the comment e-mail and marks the history entry as notified only when Magento really sent it
• Delta exports: the change list is read with a ten-minute look-back (a change noted before the mark can be committed after it); with more than 50,000 noted keys the run exports everything instead of dropping keys; prepared key sets instead of a list scan per row; filters with an alternative that the product query cannot express as a whole stay with the row filter; the change list is noted after the commit (*_save_commit_after), never inside the checkout transaction; with "keep history" = 0 the change list is kept too
• XSLT: xsl:include and xsl:import are refused by namespace (any prefix) and no external resource can be loaded while the stylesheet is compiled; document() and the like are checked on the parsed attributes
• XML reader clears libxml's error buffer before it starts; XML and JSON writers and the core import work file stop the run on write errors; category, attribute and order imports flush their snapshot when a reader fails half way; category store values use the link field value (row_id on Adobe Commerce with staging)
• WebP / AVIF: at most 25 megapixels are decoded; transparency is checked on every pixel up to 4 megapixels, larger images become PNG
• Shared catalogs: type values as Adobe defines them (0 custom, 1 public); categories are synced before the product list is read again and completed; read errors stop the row; companies are listed with | (names may contain commas); a company moved from another catalog is a documented rollback limit
• Reviews: product_url is Magento's own product URL in the default store view; the Google product reviews template writes version 2.4 and recommends a rating filter
• Default export file names carry the run id ({run}), so two exports in the same second never collide; event triggers de-duplicate within five seconds only
• PHP 8.4 deprecations raised inside Magento's own importer (e.g. DateTime with null in ImportExport's report helper) no longer fail a run or a rollback started in the admin, where Magento's error handler turns them into exceptions

Version 1.3.0 — 2026-11-07

• Actions after an order export: invoice, shipment, cancellation, status with comment and optional customer e-mails, applied to every exported order once the file was delivered (profile field "actions", also in profile JSON and over the REST API); nothing happens on a dry run, after a failed row or a refused delivery
• Delta exports see changes that do not move updated_at: a change list (stm_ie_change) notes products whose stock item was saved, products of placed orders and credit memos, and customers whose address was saved or deleted; the delta filter takes them in addition to updated_at (product query with OR, other entities by key)
• Template format with XSLT 1.0: an export writes <records><record><column>…</column></record></records> and the stylesheet turns it into the final file; an import runs the stylesheet first and reads the result, so the template format now reads files too; document(), PHP functions, files and the network are disabled; ready-made templates in the form (Google product reviews feed, simple XML list, XSLT example) and the placeholders {{column|iso}}, {{column|round}}, {{column|int}}, {{shop}}, {{base_url}}
• Reviews export rating_average, product_name and product_url for feeds
• Product images in WebP or AVIF are converted to JPG (photos) or PNG (transparency) before Magento's importer sees them, which accepts jpg, png and gif only (before: the row failed on a .webp file)
• Entity shared catalogs for Adobe Commerce B2B (name, description, type, tax class, store, products, categories, companies; through the B2B service contracts, resolved at run time, so Magento Open Source compiles and runs without the B2B modules and a run there says the entity needs them); not verified on a B2B shop yet
• Entity rights: shared catalogs need Magento_SharedCatalog::manage

Version 1.2.1 — 2026-11-06

• Rights: a profile for admin roles, the configuration, customers, addresses or orders needs the matching Magento right of the admin user who saves, runs or takes it back, in the admin and over the REST API
• Rollback: customers are deleted by e-mail and website; snapshot rows are written every 200 records, so a run that was killed can still be taken back; a value that was empty before the import is cleared again (empty-value constant in the snapshot); rows of records the run created are not re-imported; a rollback with failed rows leaves the run open so that it can be repeated; rows are de-duplicated per scope
• Magento's importer (products, customers, addresses) runs under a lock: two profiles at once wait for each other
• URLs of sources, destinations, webhooks and product images must point to public hosts unless "Allow private network addresses" is switched on; only http(s) is followed on redirects; transfers are capped in size
• XML files: no entity substitution and no DTD (XXE), damaged files stop with the line number
• SFTP: optional host key fingerprint (SHA256) checked before any credential is sent
• Secrets in profile JSON (admin, command line) are stored encrypted; "Further headers" of URL sources are a secret
• Configuration import saves through Magento's config model, so backend models (encryption, validation) run
• Delta exports count from the start of the last successful run, not from the last run
• A file with failed rows stays where it is (not deleted or moved) and the run says so
• Parallel parts: rows of one record stay in one part; parts are streamed to disk
• Second review round: rights are checked against the backend session in the admin (Magento's composite user context carries no admin session there) and on JSON profile import; redirects are followed hop by hop with the URL guard, credentials and custom headers never leave the profile's host, the checked address is pinned for the connection (no DNS rebinding), IPv4-mapped IPv6 and the whole carrier-grade NAT range are refused, unresolvable hosts are refused; XML files with a DOCTYPE are refused; configuration import keeps ciphertext as it is, writes unknown paths plainly and fails the row when a backend model refuses a value, new settings in the default scope work, secret values are masked in the stored preview; "clear this value" cells pass the entities' date, JSON and name checks; the snapshot is flushed when a reader fails half way and a full disk stops the run; rollbacks and the source clean-up also count errors without a row number; created wish lists, subscribers and synonym groups are rolled back with their website or store; a failed run with a snapshot can be taken back from the history; ambiguous order numbers fail the row, not the run; delta marks come from successful exports of the same entity only; profile names on the command line must be unique; a Google Sheet is always read as CSV; partial profile updates encrypt new credentials; widget placements (page_groups) are converted to Magento's form structure on every save, so an update keeps them and the column is importable and rolled back (before, any widget update dropped the placements)
• Third review round: credentials are bound to scheme, host and port (no HTTPS downgrade, no other port); site-local and NAT64 IPv6 ranges refused; the download cap is enforced during the transfer, not only by libcurl; scope columns (store, website) are never cleared by the empty-value constant; a subscriber status cannot be cleared; snapshot metadata is replaced atomically; errors are counted independently of the message cap; part files and CSV exports stop the run when the disk is full; created URL rewrites are rolled back per store view; synonym groups are matched by the exact word set first; widget placements are validated before saving; configuration fields with an Encrypted backend or password type are masked in the preview; the closing work of record importers (cache clean, rule application) runs even after a reader error
• Events start export profiles only; CSV reads without backslash escaping (as written); modifier options may contain "|" inside quotes; ensure_option acts on imports only; order numbers shared by several store views are reported instead of guessed; tax rates and currency values must be numeric; review products, wish list customers and admin users are checked in a dry run; category exports carry created_at and updated_at; uploaded files are never overwritten

Version 1.2.0 — 2026-11-06

• Entities coupon codes, newsletter subscribers, product reviews (with ratings), tax rates, tax rules, search synonyms, configuration (core_config_data by path and scope), wish lists, admin roles and widget instances: import with dry run, snapshot and rollback, export; 21 entities in all
• Profiles as JSON: export and import in the admin (buttons above the profile list) and on the command line (stm:ie:profile:export, stm:ie:profile:save takes a list); profiles with a known name are updated
• Record importers: an entity whose key is also its content (synonym lists) compares the key; created records with shop-assigned ids (reviews) are rolled back by their real id

Version 1.1.0 — 2026-11-06

• Entities CMS blocks, CMS pages, URL rewrites, catalog price rules and cart price rules: import with dry run, snapshot and rollback, export; rules carry their conditions as JSON and are re-importable without changes
• Order export: shipments, invoices and credit memos per order (number, state, total, date)
• Modifiers: append, case, strip_html, template (value from other columns), date, currency (shop rates), product_id (SKU ↔ id), ensure_option (creates missing select options), anonymize (stable pseudonyms)
• Events: a profile runs when an order is placed, its status changes, an invoice, shipment or credit memo is created, a customer registers or is saved, a product is saved; the run is queued with a filter on that record
• REST API: GET /V1/stm-ie/profiles, POST /V1/stm-ie/profiles/:id/run, POST /V1/stm-ie/profiles/:id/import (deliver file content), GET /V1/stm-ie/runs/:id
• Formats: OpenDocument (ods); template format for own text structures (feeds, partner XML/JSON) with {{column}} placeholders
• Sources and destinations: Dropbox (access or refresh token), Google Drive (service account)
• Parallel parts: a queued import is split into N parts for N consumer processes, each with its own history and rollback
• Sample file per entity or profile from the form; step navigation in the profile form
• Product images: URLs are fetched by the extension with three tries, checked to be images, stored once per URL and content below pub/media/import/stm_ie; a dry run checks every URL; rows no longer fail on a slow image server
• Preview compares images (by file name), additional images, configurable variations and custom options
• Customer group names in exports keep their spelling

Version 1.0.0 — 2026-11-06

• License: STM Import Export Pro is checked through the STM license module (stm/module-license). Real imports, exports and rollbacks need an activated key; dry runs work without one. After the 12 months the extension keeps working, only updates and support end
• Orders: new orders can be created from a file (customer by e-mail or guest, items in one cell sku:qty:price|… or one row per item, addresses, shipping and payment method, optional order number and created_at), followed by status, comment, shipment and invoice in the same row
• Orders: delete only orders without invoice, shipment, credit memo or payment
• Order number no longer required on import; rows without it create a new order
• Manuals in German and English, example profiles in docs/examples

Version 0.5.0 — 2026-11-06

• Sources: URL / REST endpoint (GET or POST, basic, bearer or API-key header), FTP, SFTP (password or key, pattern takes the newest file, afterwards keep / move to done / delete), Google Sheet (shared by link)
• Destinations: FTP, SFTP, URL / REST endpoint (raw body or multipart), e-mail with attachment
• Passwords, tokens and keys of sources and destinations are stored encrypted in the profile
• Reports after a run by mail and webhook (Slack, Teams, Mattermost, Discord): never, on problems, always
• Message queue: run in the background from the admin, stm:ie:run --queue, consumer stm_ie_run; cron can queue scheduled profiles instead of running them inline
• Streaming product export: pages through the catalog, loads only the requested columns, pushes filters into the query; 2040 products with 60 columns in 8 seconds on the test shop
• Local source: after a successful import keep, move to a done folder or delete the file
• Profile form: source and destination with their own fields, "Run in the background"

Version 0.4.0 — 2026-11-06

• Formats JSON, XML and Excel (xlsx, through PhpSpreadsheet) for import and export
• Products: stock per MSI source in one cell (sources: default:100|berlin:5), written through Magento's stock sources importer
• Entity customers through Magento's customer importer with diff preview, snapshot and rollback; group by name, password hashed
• Entity customer addresses through Magento's address importer and export (no snapshot)
• Entity orders: export one row per item with header, addresses, totals and tracking; import updates status with history comment, creates shipments with tracking and invoices; snapshot keeps the status
• Delta export: filter "since_last_run" exports only records changed since the last run; timestamps now in UTC like Magento
• Delta filters compare dates as dates

Version 0.3.0 — 2026-11-06

• Entity categories: path of names as key, missing parents created, store view values, delete with subtree warning, dry run, snapshot and rollback (store view overrides that used the default go back to the default)
• Entity product attributes: create with options and attribute set / group assignment, add options, remove unused options (remove_options), flags and scope; rollback deletes created attributes and the options a run added
• Admin: profile list, profile form with upload and mapping proposed from the file header, modifier line syntax, filters, dry run / run buttons, history with details, preview and "take back"
• Preview rows are stored with the run; rollback restores the first snapshot row per key
• Command stm:ie:entities lists the new entities

Version 0.2.1 — 2026-11-06

• Products: rows Magento refuses are left out and the rest handed over again (Magento treats every error of a new product as fatal)
• Products: for existing products every empty cell keeps the current value (Magento would disable the product, zero the stock or fail required attributes)
• Products: new products with an empty product_online / is_in_stock cell are enabled and in stock when a quantity is given
• Tier prices: "All Websites [EUR]" with the base currency, as the advanced pricing importer expects it; tier price errors no longer count the row as failed
• Customer groups: customer tax classes are read with the right constant
• Failed rows are counted once, however many errors Magento reports for them

Version 0.2.0 — 2026-11-06

• Products: import of all types through Magento's importer, behaviors add/update, add, update, delete
• Dry run with diff preview per row and column (state loader + differ)
• Snapshot before writing, rollback command stm:ie:rollback
• Tier prices in one cell, written through the advanced pricing importer
• Product export through Magento's exporter with pushed-down filters
• Command stm:ie:profile:save for profiles from JSON
• Run recorder shared by runner and rollback; history column started_by

Version 0.1.0 — 2026-11-06

• Skeleton: profiles, history with messages, runner, pools for entities / sources / destinations / formats / modifiers
• CSV format with detection of delimiter, BOM and encoding
• Local directory as source and destination
• Modifiers: trim, replace, multiply, default
• Entity customer groups: import and export with dry-run preview
• Entity products: field declaration
• Commands stm:ie:run, stm:ie:list, stm:ie:entities
• Cron scheduler per profile, nightly cleanup
• Admin overview and settings