Known limitations

This is the list for 1.0.0. Each entry is verified against the code rather than against an earlier version of the list.

Deliberately parked or done differently

Area	State	Detail
Grid inline cell editing	Not implemented, by choice	Rows are edited in a quick-edit drawer. A cell has no room for a label or an error message.
Quick edit on every grid	Five grids	CMS blocks, CMS pages, search terms, email templates, cart price rules. The product grid declares the same editable fields, but it sets rowClick to edit, so a row there opens the full product page and the drawer is never shown. Reports, sales documents and record-manager pages do not get one.
tax/rate/add, Magento's own route	Renders empty chrome	Nebula's tax rate form lives at nebula/taxrate/new and every link in the admin points there. The core route is reachable only by a typed URL.
Merchandiser: dragging across pages	Within a page only	Page size goes to 100 and Renumber compacts positions. A cross-page move is a follow-on feature.
Merchandiser: metrics and automation	Manual ordering in the free package	Automatic strategies register through the strategy pool from Nebula Pro.
CMS page and block preview	Not implemented	Core ships no admin preview route for CMS.
Newsletter "Convert to Plain Text"	Not provided, by choice	The stock button is destructive server-side and has no route back. Create the template as text instead.
Shipping label packaging dialog	Loads RequireJS	The one core dialog still on RequireJS, loaded only when the carrier can print labels.
Sidebar footer links	Placeholders in 1.0	With Menu Position set to Sidebar, the menu ends with three items that are not wired up. What's new carries a fixed badge of 3 and its link goes nowhere. Help & Support opens Adobe's Commerce admin workspace documentation in a new tab, not Nebula's. The small line beneath them reads a fixed Qoliber Nebula v1.0 and does not track the installed version. The Top and Magento rail positions have no sidebar footer, so none of the three appear there.
Quill loads twice on the email template editor	Accepted	That screen requests the Quill bundle itself, because its Visual tab needs Quill whichever editor the store has selected. The global request fires when the WYSIWYG editor is both enabled and set to the Nebula Quill adapter, which is what a fresh install configures, so on most stores both requests fire. The browser fetches each file once and parses and executes it twice on that one screen, roughly 229 KB of JavaScript and 27 KB of CSS. The console stays clean and nothing else is affected. Removing the editor's own request would break the Visual tab silently for every store that selected a different editor.

The version you are actually running is printed on the footer line at the bottom of every admin page, beside the distribution name. It appears again under Nebula Admin in the ShopInfo popover that the button in that same footer opens, next to the Magento version and the deploy mode.

Security posture

• Grid filter and sort are whitelisted against declared columns; page size is bounded at 200 interactive, 100,000 export, 100 for the picker search endpoints.
• The media browser rejects path traversal and asserts the resolved path stays under the media root.
• Admin messages render through textContent, never innerHTML.
• CSRF is enforced, definition ACL is default-deny, the generic form save whitelists fields, CSV export guards against formula injection, and exception messages shown to users are generic.
• Nine controllers sit on Magento_Backend::admin rather than a narrower resource, on purpose: the three saved-grid-view endpoints, the three menu-pin endpoints, the configuration-section pin and the two-step challenge pair. Each is scoped to the signed-in administrator's own data, or guards itself.
• Every Nebula form is validated server-side by the controller it posts to, which for all but a few screens is core's own controller. See Saving and validation.
• A strict admin CSP is a non-goal. Nebula requires script-src 'unsafe-eval' because Alpine compiles its expressions at runtime. Most inline scripts and styles Nebula authors carry a nonce, but four templates still ship un-nonced inline scripts, including the passkey button on the admin login screen. The admin inline script policy therefore cannot be turned off safely, and passkey sign-in stops working when it is.

Compatibility

• Magento 2.4.9 and the equivalent Mage-OS release, on PHP 8.3, 8.4 or 8.5, subject to the platform requirements. Older versions are not claimed because nothing tests them.
• The admin ships in English only. Nineteen i18n/en_US.csv dictionaries carry about 1,380 phrases and no other locale is supplied, so an administrator whose Interface Locale is not English sees Magento's own strings translated and Nebula's own in English until a dictionary for that locale is added. bin/magento i18n:collect-phrases reaches every one of them, including the strings the compiled JavaScript shows, because those are declared as __() calls in Nebula\Component\ViewModel\Translations and handed to the bundles as window.NebulaI18n. A string added to your own TypeScript needs an entry there too, or it stays English.
• Nebula replaces a broad set of core admin blocks and suppresses core UI Components where it ships a replacement. It is spot-checked against common extensions, not validated against every third-party admin module.
• A third-party module that styles its admin with LESS under view/adminhtml/web/css/source/_module.less arrives unstyled; Nebula has no parent theme and compiles nobody's LESS. See CSS and JavaScript in your module.
• A third-party UI Component grid or form that Nebula does not replace renders its container without its Knockout runtime. See UI Bridge.
• Optional core modules that Nebula's code imports — Paypal, Review, CheckoutAgreements, AsynchronousOperations, Newsletter, and the Inventory (MSI) API modules InventoryApi, InventoryCatalogApi, InventorySalesApi and InventoryAdminUi — may be disabled but must stay installed: the manifests require them, so Composer refuses their removal, and setup:di:compile would fail without their classes. The report and menu entries that borrow their screens declare dependsOnModule and hide cleanly when the module is disabled.
• A third-party module's UI Component page that Nebula does not replace renders Nebula's chrome with an empty body and a clean console. The two answers are the UI Bridge and nebula:ui:transform into a definition of your own. The bridge's generated output carries keys the engine ignores (dataType, visible, prefer, valueMap, _warning) that fail nebula:lint; strip them when adopting a definition.
• Two-factor providers: Google Authenticator and Nebula's own passkey and TOTP are exercised by the test suite; Duo, Authy and U2F were verified by hand for 1.0.0 and are not covered by an automated test.

Reporting

Include the Magento or Mage-OS version, PHP version, deploy mode, browser, the enabled module list, and the output of bin/magento nebula:doctor.