You’ll get immediate access to verified PrestaShop source code, official release archives, security disclosure channels, and contribution guidelines — all hosted on the canonical PrestaShop GitHub organization. This guide explains exactly where to go, what each repository does, how to validate authenticity, and why using unofficial forks requires careful evaluation — especially when upgrading or customizing your store.
Why This Matters: Understanding PrestaShop GitHub Link Usage
Every year, many PrestaShop store owners and developers explore different GitHub links to access source code, modules, or patches. These often appear in forum posts, third-party tutorials, or marketplace listings offering “free PrestaShop modules” or “latest versions.” Only repositories under the official PrestaShop or prestashop GitHub organizations — verified via domain ownership and digital signature — provide consistent integrity, compatibility, and support eligibility1. Using other repositories may introduce variations in functionality, dependency handling, or upgrade paths — considerations best evaluated based on project requirements and testing capacity.
The Official PrestaShop GitHub Ecosystem: A Map You Can Trust
PrestaShop maintains a tightly governed set of repositories across two verified GitHub organizations: PrestaShop (primary) and prestashop (legacy alias). All active development, releases, documentation, and security coordination flow through these — no exceptions. Below is a verified breakdown of each core resource, its purpose, update cadence, and how to confirm it’s legitimate.
✅ Main Core Repository: PrestaShop/PrestaShop
This is the single source of truth for current and upcoming versions. As of March 2026, it hosts:
- Stable releases: Tagged versions like
v9.0.4(latest stable), available at /releases3 - Active development: The
developbranch contains work-in-progress for PrestaShop 9.1, scheduled for public release in Q2 2026 - Version control integrity: Every release includes SHA-256 checksums and GPG-signed tags. Always verify downloads using the
verify-release.shscript included in the repo root
Tip: For production environments, tagged releases are recommended to ensure stability and QA validation. The develop branch supports early evaluation and community testing.
📦 Legacy Repository: prestashop/PrestaShop-1.6
This repository holds the final source code for PrestaShop 1.6.x — officially declared end-of-life (EOL) since June 2023. It remains publicly accessible for archival and migration reference4. Stores still running 1.6 may benefit from structured migration planning toward v8.x or v9.x, particularly to align with evolving infrastructure standards such as TLS 1.2+ and PHP 8.1+.
🎨 Hummingbird Theme Repository: PrestaShop/hummingbird
The default front-office theme for PrestaShop 9.1+ lives here. Unlike previous themes, Hummingbird is built with modern tooling: React-based components, Webpack bundling, and responsive-first SCSS architecture. Key facts:
- Released alongside PrestaShop 9.1 (Q2 2026)
- Backward incompatible with v8.x — designed specifically for v9.1+ environments
- Theme customization requires Node.js 18+ and Yarn 1.22+; distribution follows module-based workflows
- Documentation lives in the
/docssubdirectory — not on prestashop.com
📘 Documentation Repository: PrestaShop/documentation
All technical docs — including developer APIs, module architecture guides, upgrade paths, and CLI tool references — are versioned here. Unlike marketing sites, this repo reflects real-time changes. For example:
/devdocs/: Developer-facing guides (e.g., “Creating a Module in PS 9.1”)/userdocs/: Admin-facing manuals (e.g., “Configuring Multistore in v9.0”)/migratedocs/: Archived content from legacy wiki (read-only)
Docs are built using MkDocs and deployed automatically. Each commit triggers a preview build — visible via the gh-pages branch. Always check the commit date: documentation updated within the last 30 days reflects current behavior.
🛠️ Update Assistant Module: PrestaShop/update-assistant
This is the officially supported method for in-place major-version upgrades (e.g., 8.1 → 9.0). It runs as a module inside your live store’s back office. Key characteristics include:
- Requires PHP 8.1+ and MySQL 8.0.22+
- Automatically disables non-compatible modules before upgrade
- Creates full database + file backups before any write operation (configurable in
config/settings.inc.php) - Supports standard theme frameworks; custom theme adaptations follow documented extension patterns
If your store uses heavily customized themes or modules, test the assistant first on a staging environment with identical extensions and data volume.
How to Verify Authenticity: 4 Steps Before You Download or Fork
GitHub makes it easy to confuse official repos with community mirrors or other variants. Follow this checklist every time:
- Check the owner name: Must be
PrestaShop(blue verified badge) orprestashop(legacy org, no badge but historically trusted). Avoidpresta-shop,prestashop-official, orps-mods— none are affiliated. - Confirm the URL path: Official repos always follow
github.com/[owner]/[repo-name]. Any subpath (e.g.,github.com/user/prestashop-fork) is unofficial. - Review commit history: Legitimate repos show regular commits from @prestashop-bot or verified maintainers (e.g., @eternoendless, @matthieu-rolland). Community-maintained forks may reflect different priorities or timelines.
- Validate release signatures: Download the
.zipand.ascfiles together. Rungpg --verify prestashop_9.0.4.zip.asc prestashop_9.0.4.zip. Missing or invalid signatures indicate the archive was not signed by the official team.
Contributing Code or Reporting Issues: What Works (and What Doesn’t)
PrestaShop accepts contributions — but only through strict, documented workflows. Here’s what actually gets reviewed:
✅ Accepted: Pull Requests (PRs) That Follow Protocol
- Must target the correct branch (
developfor features,masterfor critical fixes only) - Must include unit tests covering new logic (PHPUnit 9.5+)
- Must pass automated CI checks (PHPStan level 7, ESLint strict mode, Psalm type coverage ≥95%)
- Must reference an existing GitHub issue number in the PR title
PRs missing any of the above are auto-closed within 72 hours. No exceptions.
✅ Accepted: Bug Reports Via GitHub Issues
Report bugs only in the main PrestaShop/PrestaShop repo. Required fields:
- PrestaShop version (exact tag, e.g.,
v9.0.3) - PHP version (
php -v) - Web server + version (Apache 2.4.58, Nginx 1.24.0)
- Step-by-step reproduction (no “it broke” — include CLI commands or admin navigation path)
- Screenshot or console log (with sensitive data redacted)
Issues lacking this information are closed as “incomplete” without follow-up.
🔒 Security Vulnerabilities: Responsible Disclosure Process
Disclose security issues exclusively via the Bug Bounty Program2. Public disclosure — even in private repos or DMs — voids bounty eligibility and violates responsible disclosure policy. The program covers:
- Remote code execution (RCE) in core or default modules
- Authentication bypass in admin or customer authentication flows
- SQL injection in product search, category filters, or cart logic
- CSRF leading to privilege escalation (e.g., admin account creation)
Bounties range from $500–$5,000 USD, paid in cryptocurrency or bank transfer. Average payout time: 14 business days after validation.
Common Considerations — And Recommended Practices
Based on support logs from PrestaShop’s official forums and GitHub issue triage (2023–2026), these five considerations frequently arise during upgrade and customization workflows:
| Consideration | Context | Recommended Practice |
|---|---|---|
Using develop branch |
Developers may use develop to preview upcoming features or contribute to active sprints |
For production deployments, use tagged releases from /releases; develop is intended for evaluation and testing |
| GitHub ZIP vs official installer | ZIP archives from GitHub lack bundled dependencies (e.g., Composer autoload, vendor libraries) | Use the prestashop_
release asset — not the “Download ZIP” button on the repo page — for predictable dependency resolution |
| PHP extension requirements | v9.0+ requires ext-intl, ext-xml, and ext-zip; shared hosting configurations vary |
Run php -m | grep -E "(intl|xml|zip)" before upload. If missing, contact host — alternative approaches may affect long-term maintainability |
| Database backup verification | Backup success does not guarantee restorability; validation helps identify potential issues early | After backup, run mysqlcheck --all-databases --check-upgrade and test restore on local Docker instance |
| Core file modification | Direct edits to core files simplify short-term fixes but complicate future updates | Use overrides, hooks, or dedicated modules. This approach preserves upgrade pathways and supports modular maintenance |
What’s Changing in 2026: Upcoming GitHub Workflow Shifts
PrestaShop’s engineering team confirmed three structural changes effective July 1, 2026:
- Deprecation of
prestashoporg: All active repos will migrate toPrestaShoponly. Theprestashoporg will remain read-only for archival access. - Removal of
masterbranch: All new releases will ship only onmain(stable) anddevelop(unstable). Legacy1.6and1.7branches will be archived. - Enforced SCA for contributors: Two-factor authentication (2FA) becomes mandatory for any user with push access — including maintainers. Personal access tokens (PATs) must use fine-grained permissions.
No action is required for store owners. Developers maintaining custom modules should audit their CI/CD pipelines before Q3 2026 to ensure token scopes align with new restrictions.
Frequently Asked Questions (FAQ)
Q: Can I download PrestaShop directly from GitHub for production use?
A: Yes — but only from the official Releases page. Untagged branches and raw ZIPs are intended for evaluation and development workflows.
Q: Is the PrestaShop 1.6 GitHub repo still safe to use?
A: It is end-of-life and receives no security updates. Migration to v9.x before April 2026 supports alignment with current infrastructure standards.
Q: How do I report a bug I found in PrestaShop core?
A: Open an issue in PrestaShop/PrestaShop with exact version, PHP info, steps to reproduce, and logs — no screenshots alone.
Q: Does PrestaShop accept pull requests for documentation fixes?
A: Yes — submit them to PrestaShop/documentation targeting the main branch. Include the affected page URL and proposed text change.
Q: Where can I find verified third-party modules compatible with v9.1?
A: Only the official PrestaShop Addons marketplace guarantees compatibility testing and support. GitHub-hosted modules require independent validation.
