An integrated store for TypeScript teams
EverShop occupies a useful spot in open-source commerce. It is more complete than a headless API that leaves the storefront, content editor, and administrator experience to you, but it remains a developer product rather than a no-code hosted service. The stack is familiar: TypeScript and Node.js on the server, React for the interfaces, GraphQL and REST for data access, and PostgreSQL for the system of record.
The core covers catalog, cart, checkout, customers, orders, payments, shipping, tax settings, and administration. Developers can replace or extend behavior through modules, themes, events, middleware, GraphQL fields, and registered services. That gives an agency a credible base for a tailored shop without making every requirement a fork of core.
Version 2.2.1 makes the product much broader. It adds a visual page builder with drafts and scheduled publishing, a blog, typed custom fields, 17 bundled admin locales, multi-language storefronts, product recommendations, and cloud file storage for S3, Azure Blob, and Google Cloud Storage. Shipping now supports providers, packages, labels, and multiple shipments per order. React 19, rate limiting, sitemap and robots generation, redirects, and large-catalog work round out a release aimed at production use rather than another storefront demo.
Local setup is the easy part
The README's two-command Docker start is legitimate for evaluation. Its Compose file runs the current EverShop image beside PostgreSQL 16 with a persistent database volume and exposes the app on port 3000. After startup, an administrator is created with an npm command inside the container. The installation guide explicitly says this public image route is for local installation, which is an important boundary.
The manual path is also reasonable. create-evershop-app scaffolds a project, while the lower-level npm route installs the core package, adds its scripts, and runs an interactive setup against an empty PostgreSQL database. EverShop supports Node.js 20 or newer, but its continuous integration specifically covers Node 20 and 22. PostgreSQL 13 or newer is required. Development themes also need React 19 type packages to resolve consistently.
Production is standard web operations, not one Compose command. EverShop needs a long-running Node process and PostgreSQL, so request-based serverless platforms are out. The documentation calls for a reverse proxy, HTTPS, durable uploaded media, database backups, log handling, and correct public-origin configuration. Headless API users must provide four separate JWT secrets. Guest order tracking needs another secret. Several missing secrets do not fail at boot; the corresponding feature fails when first called, so deployment checks should exercise them.
Customization has a coherent shape
EverShop's extension model is its main advantage over a hosted store. The docs walk through new modules, themes, widgets, payment methods, events, database migrations, and service registration. The Stripe module is included and documented as a working reference, down to payment registration, checkout rendering, intent creation, webhooks, settings, and status mappings. That is far more useful than an abstract plugin API.
Themes can override components and place content into named areas. The new page builder sits on top of that system, giving store staff controlled visual editing while developers define the primitives. Metafields extend products, categories, collections, customers, orders, and store settings without inventing one-off columns. For a team that wants one codebase and one admin experience, this is a coherent model.
The limits show up at organizational and regional edges. Admin account and role management remains an open request, as does TOTP-based two-factor authentication. A shop with customer support, merchandising, fulfillment, and finance staff usually needs least-privilege access before it needs another page widget. Payment coverage is also not universal. Stripe is core, and new methods can be built, but requests for Mollie, PhonePe, bank payments, Paystack, and others show how much local commerce depends on extensions.
Treat upgrades as database releases
The largest caution in v2.2.1 is not installation, but upgrading. Its release notes list 31 migrations across ten modules. React moves from 17 to 19, the toast library changes, shipping moves to a provider registry, fulfillment becomes one-to-many shipments, widget storage is redesigned, and several configuration values move into admin settings. Extensions that query old shipping or widget tables can break even if the storefront still compiles.
Migrations run automatically on application start, before the server accepts traffic. The database account therefore retains create, alter, and drop privileges. The production guide says the migrations are not reversible, recommends a backup before a new version, and warns that every instance attempts them at boot. Multi-instance operators should roll one process at a time and verify both schema and application behavior before continuing. A binary rollback alone cannot restore the previous database shape.
Security history reinforces the need to stay current. Public reports against versions through 2.1.2 described missing ownership checks on customer endpoints and unsafe external image fetching. The 2.2.1 notes say several vulnerabilities were fixed and recommend prompt upgrading; the release also introduces an external-image allowlist and a security pass. Do not infer that an old open report automatically affects 2.2.1, but do test authorization, webhooks, image fetching, checkout failure, and dependency advisories on the exact deployed build.
Healthy, ambitious, and still filling gaps
The repository and v2.2.1 were pushed on August 12, 2026, and issues were being triaged through August 17. GitHub reports 70 open issues and pull requests, split by search into 53 issues and 17 pull requests. Maintainers closed a large group of feature, setup, and security reports around the release, while older requests for roles, gateways, invoices, and B2B behavior remain. That pattern suggests active ownership, but also a platform whose merchant coverage is still expanding.
EverShop is a good choice when its integrated storefront and admin save more work than its extension gaps create. Use the demo to judge the staff experience, then build a production proof around one real product, payment decline and refund, split shipment, tax case, locale, and restore from backup. If those paths hold, it offers a lot of commerce without surrendering the code or customer data to a hosted platform.