Requirements¶
| Supported | |
|---|---|
| Magento Open Source | 2.4.9 |
| MageOS | 3.5.0 (the release tested with Nebula 1.0.0) |
| PHP | 8.3, 8.4 or 8.5, subject to the Magento/MageOS platform matrix |
| Node.js | not needed for an install; 22.12 or newer only to rebuild the theme's CSS and TypeScript |
| Browser | a current Chrome, Firefox, Safari or Edge; passkeys need a platform authenticator or a security key |
The package manifests declare php: ~8.3.0 || ~8.4.0 || ~8.5.0 and magento/framework: ~103.0.9. That constraint admits a later 2.4.9 patch release on the same framework line. Magento 2.4.7 and 2.4.8 are not claimed because nothing is tested against them. Adobe Commerce is not claimed either: its additional admin screens are UI Components Nebula does not replace, and nothing tests them.
Third-party PHP libraries¶
Composer installs the following third-party libraries alongside the Magento and Nebula packages:
| Library | Constraint | Required by | What it does |
|---|---|---|---|
justinrainbow/json-schema |
^6.12 |
nebula/module-component |
validates JSON definitions |
symfony/process |
^6.4 \|\| ^7.0 \|\| ^8.0 |
nebula/module-component |
runs build processes |
web-auth/webauthn-lib |
^5.3 |
nebula/module-passkey |
verifies the WebAuthn registration and authentication ceremonies |
endroid/qr-code |
^6.0 |
nebula/module-passkey |
generates authenticator enrollment QR codes |
spomky-labs/otphp |
^11.2 |
nebula/module-passkey |
generates and checks TOTP codes |
Both modules are part of the nebula/admin metapackage, so these libraries land in vendor/ on a normal Composer install. Use composer require nebula/admin:1.0.0 --with-all-dependencies so an older locked dependency can move to a compatible version. Magento_TwoFactorAuth requires spomky-labs/otphp on the same ^11.2 line, so the two constraints agree on a stock 2.4.9 install.
Restricted Composer sources
If you install through an allow-list, an internal mirror or a Satis repository, add these libraries and their own dependencies before running the install. Copying modules into app/code installs no libraries; use the Composer metapackage as described in Install.
Admin Content Security Policy¶
Nebula needs script-src 'unsafe-eval' on the admin. Alpine.js compiles the expression in every x- attribute at runtime, and that is a policy-level permission no nonce can grant. Magento ships its admin CSP in report-only mode, and Nebula targets that default. Under an enforced strict nonce or hash policy the admin will not function.
Most inline scripts and styles Nebula authors go through Magento's secure renderer and carry a nonce, but not all of them do. Four templates still print an inline <script> block of their own, among them the passkey button on the admin login screen. Enforcing the admin policy is supported, because Magento's shipped admin policy still allows inline scripts and eval. What those templates cannot survive is turning that allowance off: with csp/policies/admin/scripts/inline set to 0, passkey sign-in stops working. Leave that setting and csp/policies/admin/scripts/eval at their default of 1.
Optional core modules¶
Some report and menu screens reference optional core modules such as PayPal, Braintree and Reviews. On an install without them, those screens fall back rather than fail, but verify on your build.
Two-step verification¶
Magento's Magento_TwoFactorAuth module must be enabled, which it is on a stock install. Nebula registers a passkey as one of its providers and sets the forced provider list on install. Read First sign-in before you install on a store with existing administrators.