EverShop bundles storefront and administration in TypeScript
EverShop combines a React storefront, admin interface, GraphQL API, PostgreSQL data model, themes, and extensions. Version 2.2.1 adds a visual page builder, blog, custom fields, multiple storefront languages, translated administration, shipping providers, multiple shipments, cloud file storage, and product recommendations. That is enough surface to build a serious shop without assembling every catalog and content screen separately.
A broad platform also creates coupling. The latest release moves the whole framework to React 19, changes shipping tables and APIs, converts fulfillment from one shipment to many, replaces widget storage, and moves several configuration values into admin settings. Its upgrade notes call for 31 automatic database migrations across 10 modules. Extension authors must read the full migration document before treating a minor-looking tag change as routine.
The Docker quick start hides a broken source sequence
The README's installation section is 2 commands: download docker-compose.yml, then run docker compose up -d. That file starts the latest EverShop image alongside PostgreSQL 16, exposes the application on port 3000, publishes PostgreSQL on port 5432, and persists database data in a named volume. It is a reasonable demo route, though the sample database password is postgres and must not survive into an exposed deployment.
Source setup is less clear. The root package has separate compile, build, and test scripts, while build directly executes a file under packages/evershop/dist. The README does not explain their required order because it points developers to the external installation guide. Our measured sequence installed dependencies and then called the declared build command, which failed before application compilation could proceed.
What happened when we ran it
Our sandbox installed 1,406 npm packages in 95 seconds and used 606 MB. The checkout at commit 770c47b contained 2,890 files, about 217,604 lines of source, and occupied 27.9 MB. Installation succeeded, but the build stopped after 10 seconds with exit code 1 because Node could not find /work/repo/packages/evershop/dist/bin/build/index.js.
Tests also ended with exit code 1 after 12 seconds. Jest checked 143 files and found zero matches for **/dist/**/tests/**/unit/**/*.test.[jt]s. The log does not say why compiled test files were missing, so we cannot claim that running compile first fixes the suite. The repository did include a tests directory, a Dockerfile, a Compose file, 2 CI workflows, and npm workspaces.
Npm audit reported 30 known vulnerabilities: 0 critical, 11 high, 18 moderate, and 1 low. That count describes the installed dependency tree in our sandbox, not necessarily exploitable paths in a deployed shop. Ecommerce handles identities, addresses, orders, and payment handoffs, so every high-severity advisory needs an applicability decision before production rather than dismissal as development-only noise.
Version 2.2.1 requires an upgrade rehearsal
The August 12, 2026 release is the largest since 2.0 according to its notes. Thirty-one migrations run automatically on first start. React 17 extension code must move to React 19 APIs, legacy shipping tables are dropped after migration, shipment relationships change, and direct SQL against the former widget table breaks. A logo config key is removed completely, requiring an upload through administration after upgrade.
Those changes are manageable with a staging copy and a rollback plan. Test an export of the current database, time the 31 migrations on a production-sized copy, and exercise payment, tax, shipping, refunds, locale URLs, image storage, and every custom extension. Automatic migrations reduce typing; they do not replace a reversible release process for a store that accepts orders continuously.
Built-in commerce breadth reduces extension shopping
EverShop 2.2.1 includes a page builder with drafts and scheduled publishing, a blog, typed metafields, 17 translated admin locales, and cloud storage for S3, Azure Blob, and Google Cloud Storage. Shipping providers can quote rates, carriers can create labels, and one order can split into several packages. Recommendations cover related products, co-purchase suggestions, upsells, and cart cross-sells.
This is the project's best argument. A TypeScript team can change themes and modules while keeping catalog, content, and operations in one codebase. The counterweight is verification effort across those features. A shop may use only 4 of the 17 locales and one shipping provider, yet upgrades still touch shared framework code. Decide using a representative catalog and checkout flow, not the polished demo credentials in the README.
Open HEAD behavior can confuse monitors and caches
Open issue 935 reports that HEAD requests fall through to a 404 when the route declares only GET, even though a normal GET succeeds. The report reproduces this on storefront pages, product assets, APIs, and extension routes. It specifically calls out uptime monitors, link checkers, browser prefetch, and cache revalidation, all of which may probe with HEAD to avoid transferring a response body.
That is a deployment concern rather than a cosmetic protocol detail. Before selecting a monitor or CDN rule, send both GET and HEAD to storefront pages, images, sitemap files, and health endpoints. If the chosen EverShop version still behaves as reported, use an explicit health route or proxy handling and document it. Do not let a 404 from a HEAD-only probe wake operators for a healthy storefront.
Current release activity does not settle security readiness
GitHub reported 10,424 stars, 73 combined issues and pull requests, and a last push on August 24, 2026. Version 2.2.1 was released 12 days earlier and its notes describe security fixes and rate limiting. An open issue also tracks CVE-2025-12919 concerning order-data authorization. The open state alone does not prove the current release remains vulnerable, so deployment review should confirm the patched code and advisory status directly.
EverShop offers much more than a storefront starter, and its GPL-3.0 license gives developers source access with obligations they must understand. The measured source path is the current warning: 606 MB of dependencies led to missing build output, zero discovered tests, and 30 audit findings. Trial the Docker image, then require a clean, documented source build and a security review before making it the system that holds customer orders.