Added

Joomla 5 native API

• Full Joomla 5 namespace compliance across all template files, overrides, and helper utilities — every Joomla\CMS\* class accessed through its namespaced form.
• templateDetails.xml rewritten to the J5 manifest schema with method="upgrade" declared so existing customers can update in place without uninstall-first. Extension-version declaration bumped to 5.4.0. Build date set to 2026-06-26. Copyright updated to Cybersalt Consulting Ltd / VirtueMartTemplates.net.
• VirtueMart 4 helper integration refactored end-to-end for J5 namespace resolution.

VirtueMart core upgrade — 4.2.12 → 4.6.8 Pro (build 11258)

• VirtueMart upgraded four minor releases from 4.2.12 (March 2024 build) to 4.6.8 Pro build 11258 (March 2026 build) on the donor before quickstart export. Customers installing the 5.4.0 quickstart get the current VirtueMart catalog engine, payment gateways, shipping plugins, and security fixes out of the box rather than a 22-month-old VM core to update first.
• Schema migrations applied to all virtuemart_* tables during the donor-side upgrade pass — the quickstart bundle exports the post-migration schema state, so the customer's fresh install boots into a fully-current VM database with no upgrade-in-progress flags.

Bootstrap 5.3.8 native rendering

• Template now renders directly against J5's bundled /media/vendor/bootstrap/css/bootstrap.min.css — no separate Bootstrap copy, no compatibility shim CSS in the final shipped tree.
• Phase 3a bs2-bs5-bridge.css layer installed to preserve backward compatibility for any third-party content posted by site editors using legacy BS2 markup (.row-fluid, .spanN, etc.). The bridge layer means existing customer-authored content that pre-dates the modernization continues to render correctly without manual rework.
• BS5 modal markup migration applied throughout the template — every data-toggle → data-bs-toggle, data-dismiss → data-bs-dismiss. The login modal, currency-selector dropdown, and any custom-content modal triggers all now fire under BS5's vanilla-JS modal handler.

Modern slideshow — Swiper 11

• Custom legacy camera.js plugin replaced with Swiper 11, J5's bundled slideshow library — touch-friendly, accessible, and actively maintained.
• Per-slide CTA button styling, caption positioning, and overlay darkness now controllable from the module-edit UI rather than requiring code edits.
• Fade-gradient overlay preserved from the previous camera.js implementation; visual look and feel matched 1:1 between old and new engine.

Vanilla JavaScript menu

• New js/menu-vanilla.js — a self-contained IIFE replacement for the legacy superfish.js + supersubs.js + inline jQuery menu handlers. WeakMap-backed 500 ms mouse-out delay preserves the original menu-hover feel without any jQuery dependency.

Mobile menu — Expression-pattern accordion

• New js/mobile-accordion.js replacing the legacy selectnav side-panel mobile menu with a hamburger toggle that reveals a single-branch-open accordion below the header.
• Hamburger button auto-injected into #top-handler on DOMContentLoaded; aria-expanded + aria-label attributes carry the accessibility metadata.
• JS-injected + / − indicators on parent items; tapping a parent expands children inline (no fly-out side panel); tapping a leaf navigates and closes the menu.
• Light-theme menu (white background, dark text) with WCAG-AA contrast on every indicator; comfortable 44px+ tap targets on every row.
• Top-right quick-nav (FAQ / HELP / SUPPORT / MY ACCOUNT / REGISTER) on mobile lays out as a wrapping flex-row centered — legible at every viewport width instead of stacked vertically against the edge.

Modern social-network support (Phase 3f — 13-network parity)

• Added Instagram, Threads, Bluesky, Mastodon, YouTube, TikTok, Pinterest, Discord via FontAwesome 6.5.2 brand glyphs.
• X (the Twitter rebrand) replaces the legacy Twitter icon with the current fa-x-twitter logo.
• Per-network icon glyphs delivered via the fa-brands set, retiring the legacy iconfont references entirely.

Package + Update Manager registration

• New pkg_eshop.xml package manifest. Installing the pkg_eshop-5.4.0.zip package registers the eShop template AND its update-server URL (https://virtuemarttemplates.net/updates/pkg_eshop.xml) with Joomla's native Update Manager so customers get update notifications in-admin when future releases ship.

Security hardening (XSS)

• New escape and validation helpers added to index.php:
  • phEsc() — HTML attribute escaping for href, src, alt, title, and Swiper caption output.
  • phHexColor() — color parameter validation with fallback to #000000 on bad input.
  • phCssDim() — dimension parameter validation accepting px / em / rem / % / vh / vw / pt / ex / ch / cm / mm / in.
• 126 phEsc() / phHexColor() / phCssDim() wraps applied across index.php template parameter echoes — every admin-controlled string that the template echoes into the rendered HTML is now escape-validated at the boundary.
• $type fallback added to mod_login override — Joomla 5 split mod_login into separate login / logout templates; fallback silences the Undefined variable $type warning while preserving the legacy logout branch.
• $moduleclass_sfx fallback added to mod_breadcrumbs override.
• All 73 template overrides reviewed for malicious patterns (eval, base64_decode, system, exec, raw $_GET / $_POST echoes, obfuscation) via the Cybersalt override-security checklist — clean. Override Manager dashboard widget orphan-row sweep also applied so the admin Templates panel no longer shows a permanent "Override(s) to check" badge from removed-in-J5 core layouts.
• 39 legacy admin form switches in templateDetails.xml converted to J5-native type="radio" layout="joomla.form.field.radio.switcher" markup — the old BS2-era type="checkbox" class="switch" inputs are gone. Editing the Template Style in the admin now uses the modern J5 switcher UI consistently.

Changed

J3 to J5 API migration

• Every deprecated J* static class call migrated to its namespaced equivalent: JFactory, JText, JHtml, JUri, JRoute, JComponentHelper, etc.

Web fonts

• WebFontConfig + ajax.googleapis webfont.js loader replaced with direct <link> to Google Fonts (Open+Sans) with &display=swap + preconnect hints to fonts.googleapis.com + fonts.gstatic.com — one fewer external JS dependency, no flash-of-invisible-text.

Modernization swaps (Phase 5)

• Phase 5b: jQuery.dropkick currency selector replaced with native <select> and CSS-only chrome.
• Phase 5c: Superfish menu replaced with vanilla menu-vanilla.js (no jQuery dependency).
• Phase 5d: jQuery.backstretch replaced with CSS background-size: cover.
• Phase 5e: Removed jQuery 3 compatibility shim (BS5 bundles its own modern jQuery).
• Camera slideshow hand-ported to Swiper 11.
• Login modal toggle rewritten from jQuery(...).toggle() to vanilla addEventListener + style.display; modal close handled by BS5 vanilla-JS modal API.

Fixed (layout + rendering regressions caught at walkaround)

• Header full-width — the dark top bar now extends the full template width on every viewport. Fix: header.span12 { width: 100% !important; max-width: 100% !important } + .container.main-bg { position: relative } so the absolute-positioned header sizes to its container, not the viewport.
• Product category page — 4-in-row grid restored. Before the fix the BS2 standalone .span3 { margin-left: 20px } rule was leaking into .row-fluid contexts and pushing the fourth card onto a second row. Fix: bridge-CSS rule .row-fluid > [class*="span"] { margin-left: 0 !important } with !important to win the cascade against the standalone rule.
• Product card heights normalized. .spacer-handler { height: 100% } from the legacy template was clipping product titles, prices, and "Product Details" buttons below the card boundary. Fix: bridge-CSS override .spacer-handler { height: auto } so cards size to their content.
• MY ACCOUNT / REGISTER quick-nav centering. On medium viewports where the two items wrapped onto a second row, the legacy flex layout left them left-aligned against the menu's left edge. Fix: display: contents on the wrapper to flatten the sibling-UL out of the flex flow + text-align: center — wrapped items now center across the available width.
• Bootstrap 2 grid × Bootstrap 5 grid coexistence. The bridge CSS now provides explicit .row > .spanN rules so legacy customer content using BS2 grid markup renders correctly inside a J5-native page that uses the modern .row wrapper. No more half-broken hybrid layouts when an editor pastes legacy markup into a new content area.
• Mobile menu fly-out side panels eliminated. The legacy selectnav implementation rendered the mobile menu as off-canvas side panels that were broken under modern viewport widths. Replaced wholesale with the in-flow accordion above (see "Mobile menu" in Added).
• Hamburger button positioning sits cleanly inside the dark top bar instead of overflowing the right edge.
• Slideshow fade gradient retained through the camera.js → Swiper migration so the visual transition character is unchanged.

Quickstart database hardening (Phase 5)

• Phase 5f: Update Sites Manager cache flushed; enabled / disabled update sites surveyed.
• Phase 5f.2: Pending extension updates applied. Weblinks Extension Package upgraded to 5.1.0 via Joomla CLI on the donor before quickstart export. Customers installing the 5.4.0 quickstart get current third-party extensions out of the box rather than pending updates as their first action.
• Phase 5g.1: Global check-in across J5 tables (stale check-outs cleared).
• Phase 5g.2: Condition-based postinstall messages hidden (customer-actionable kept); robots.txt synced to robots.txt.dist; all user groups set to text-filter NH (No HTML, XSS hardening).
• Phase 5j: Article hits counter reset. All #__content.hits values reset to 0 in the donor database before quickstart export. Rationale: the hits counter accumulates during development on the donor site and ships as preloaded view-counts inside the customer's freshly-installed quickstart, which is misleading at best and indistinguishable from third-party tampering at worst.
• Phase 5i: Footer year bumped to 2026 and centered.
• Phase 5k: All 73 template overrides reviewed (Cybersalt override-security checklist) and marked as checked-in. Orphan-of-removed-core override sweep applied to silence the admin Templates panel's permanent "Override(s) to check" badge from layouts that were removed in Joomla 5.
• StageIt 5 + MCP for Joomla preinstalled in the quickstart bundle so the customer's fresh install includes the staging-clone workflow and the Claude API endpoint out of the box — new in 5.4.0 per the Cybersalt VMT quickstart-shipped-extensions standard.

Removed

Legacy Bootstrap purge (Phase 3b.6)

• Deleted top-level css/bootstrap.css — BS2-era full stylesheet, no longer referenced by index.php.
• Deleted css/bootstrap/ subdirectory (BS2 split-files).
• Deleted js/bootstrap.min.js — BS2-era jQuery-dependent JS bundle.

Extinct-framework dead code

• MooTools dead-code purge across the override tree: removed $$(), window.addEvent, Fx.Slide, and other MooTools-isms left over from the J3-era codebase. The framework hasn't loaded since J4 but the calls remained harmlessly dead in chrome and module overrides. Now removed for code-cleanliness.
• IE conditional comments (7 blocks) removed.
• selectivizr.js IE polyfill removed.
• Removed dead social networks: Google+, StumbleUpon, Digg, Blogger, MySpace.

Cassiopeia vestigial overrides

• Deleted the orphaned templates/cassiopeia/html/ override tree shipped from the J4-era donor. Cassiopeia is Joomla's default fallback template, not eShop's active template — these overrides targeted core layouts that were removed in J5 and caused a spurious "Changes found" notice in the admin Templates panel.

Notes

Package format

• Template package: pkg_eshop-5.4.0.zip — Joomla package wrapper that installs the tpl_eshop template extension AND registers the update-server URL under the package manager for in-admin update notifications.
• Quickstart bundle: eshop-quickstart-J5.4.6-27.06.2026.zip — complete Joomla 5.4.6 install with VirtueMart 4.6.8 Pro and eShop pre-loaded as the active template, plus StageIt 5 and MCP for Joomla preinstalled.