Nebula — Modern Admin Theme for Magento 2 / Mage-OS

Replace Magento's legacy admin theme — bring it into the 21st century.

Nebula modernizes the Magento Admin with a faster interface, cleaner workflows,
dark mode, and developer-friendly customization — without forcing you to
replace Magento itself. It runs alongside your existing store on
Magento 2.4.7+ (or Mage-OS 2.0+) and PHP 8.1+.

Why Nebula

Who it's for

• Store owners & admin teams — faster daily order, catalog, and content
  workflows, with dark mode and pinned navigation. Modernize the back office
  without changing your commerce platform.
• Developers — a cleaner admin architecture with JSON definitions instead
  of XML UI patterns, and straightforward extension points.
• Agencies — quicker admin improvements, client branding via skins, and
  lower back-office customization costs.

Highlights

• JSON-driven UI — admin forms and grids defined as JSON, with a library of
  reusable composable snippets.
• Modern frontend — Alpine.js 3, Tailwind CSS 4, native ES modules, no
  RequireJS/KnockoutJS/jQuery.
• Dark mode + skins — multiple built-in themes; brand per client.
• Focused modules — a clean, modular package (see below) you can adopt
  incrementally.
• Well tested — extensive PHPUnit and Vitest coverage, plus bridge tests for
  third-party compatibility.

Installation

composer require qoliber/nebula-admin-theme
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

Then activate the Nebula theme under
Stores → Configuration → Design (adminhtml), or assign it as the admin
theme for your environment.

Requirements

• Magento 2.4.7+ or Mage-OS 2.0+
• PHP 8.1+

Modules

This package ships the following focused modules:

License

Nebula is released under the Nebula Community License (NCL) — a
source-available license. See LICENSE.md for the full terms.

Brought to you by

qoliber and Siteation

Changelog — Qoliber Nebula

All notable changes to the Nebula admin theme are recorded here.
The format follows Keep a Changelog;
the project aims to follow Semantic Versioning.

[0.9.0]

Added

• Five modules promoted to the public package: Qoliber_NebulaCurrency,
  Qoliber_NebulaDirective, Qoliber_NebulaReports, Qoliber_NebulaSystem,
  and Qoliber_NebulaUser. The package now ships 16 modules plus the theme.

Changed

• registration.php updated to list the published modules.
• Version bumped to 0.9.0.

Security

• Grid request hardening — whitelist filter and sort columns against the
  grid definition and clamp pageSize (MAX_PAGE_SIZE = 200) across all data
  providers (CollectionProvider, ProductProvider, CustomerGridProvider,
  SalesRuleCouponsGridProvider, AgreementGridProvider, AttributeSetProvider).
• Media browser — MediaPicker rejects path-traversal segments and asserts
  the resolved file stays under the media root before deletion.
• Toast notifications — render admin messages as text (textContent),
  closing a DOM-XSS vector.
• DefinitionAccessControl treats an empty acl string as unset and falls back
  to Magento_Backend::admin (default-deny).

Internal

• Snippet templates no longer use ObjectManager::getInstance(); ViewModels are
  injected via SnippetViewModelRegistry (or layout XML), throwing if a
  view_model is missing instead of silently service-locating.
• Complete PHPDoc coverage on changed PHP (FQDN @param/@return).

[0.8.0]

Added

• Initial public release.