# angeo/module-ucp 2.1.0

> Version 2.1.0 of angeo/module-ucp, released 2026-09-01.

`composer require angeo/module-ucp:2.1.0`

Canonical URL: https://packagento.com/angeo/module-ucp/2.1.0

## At a glance

- **Released**: 2026-09-01
- **Magento**: >=103.0.0
- **PHP**: >=8.2
- **QA**: failing

## What it does

Spec-compliant Universal Commerce Protocol (UCP) profile generator for Magento 2. Serves /.well-known/ucp at protocol version 2026-08-25 with the canonical keys[] JWK Set (ES256/ES384/Ed25519), authority-bound capability schemas, and correct hosting/CORS headers.

## Dependencies

### Require

| Package | Constraint |
|---|---|
| ext-curl | * |
| ext-json | * |
| ext-openssl | * |
| magento/framework | >=103.0.0 |
| magento/module-backend | >=102.0.0 |
| magento/module-config | >=101.0.0 |
| magento/module-store | >=101.0.0 |
| php | >=8.2 |

### Require (dev)

| Package | Constraint |
|---|---|
| magento/magento-coding-standard | * |
| phpstan/phpstan | ^1.10 |
| phpunit/phpunit | ^10.0 |

### Suggest

| Package | Constraint |
|---|---|
| angeo/module-ucp-catalog | Serves the catalog.search / catalog.lookup / get_product endpoints this profile advertises |
| ext-sodium | Required only for Ed25519 (EdDSA) signing keys, which the UCP spec recommends for Web Bot Auth interop. ES256 works without it. |

## Quality

Version 2.1.0 fails the Packagento QA pipeline. Verdicts below are per-cell (Magento line × PHP version) for the matrixed tools, and run-once for the static / security tiers.


### Compatibility

Each Magento line is installed on its supported PHP versions, then the module is built (DI compile + static-content deploy). Cells show passed / failed / untested; staircase gaps render as `–`.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | Pass | Pass | – | – |
| 2.4.8 | – | Pass | Pass | – |
| 2.4.9 | – | – | Pass | Pass |


### Code Quality

Advisory checks against the module's source. Never affect the Compatibility verdict — a phpcs finding can't make a module incompatible.

#### Static Analysis

Coding standards (phpcs), mess detection (phpmd), copy-pasted code (cpd), PHP cross-version compatibility, composer.json validity. Each runs once for the whole module.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| PHPCS | Fail | 128 | 11 errors, 117 warnings (ruleset: Magento2), 1 auto-fixable with phpcbf |
| PHPMD | Warning | 2 | 2 rule violations (UnusedPrivateField:2) |
| Cpd | Pass | 0 |  |
| Composer validate | Info | 5 | valid; 5 advisory notes (composer validate --strict) |

#### PHPStan

Type-checks the module against a real Magento install. Re-runs per Magento + PHP version because resolvable symbols differ between releases.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | 13 | 13 | – | – |
| 2.4.8 | – | 13 | 13 | – |
| 2.4.9 | – | – | 13 | 13 |


### Tests

Unit and integration suites run per Magento + PHP cell. Test failures speak to the module's behaviour, not its compatibility with a line, so they're reported here separately.

#### Unit Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | Pass | Pass | – | – |
| 2.4.8 | – | 4 | not tested | – |
| 2.4.9 | – | – | 4 | 4 |

#### Integration Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | – | – |
| 2.4.8 | – | N/A | N/A | – |
| 2.4.9 | – | – | N/A | N/A |


### Security

Dependency-advisory audit (composer audit) plus a source malware scan. A malware detection fails the version outright.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| Composer audit | Pass | 0 |  |
| Malware scan | Pass | 0 |  |

## Parent package

[angeo/module-ucp](https://packagento.com/angeo/module-ucp.md) — full catalogue, pricing, install steps, and vendor info.