This page describes how we test, update and fix the integration plugins, the Integration Module and the DTC Starter for Medusa.

---

We develop the plugins, the module and the starter in the open gorgojs/medusa-integrations and gorgojs/medusa-dtc-starter repositories under the MIT license. You can use the code in commercial projects, adapt it to your store and fork it.

The code isn't the only thing in the open. The tests and their GitHub Actions runs, the issues and the changelogs are public too, so you can check nearly everything below for yourself.

---

Every night GitHub Actions runs the unit, integration and contract tests of every plugin and the module, and on a pull request it tests the packages the change touches. The contract tests call the providers' test APIs, such as Stripe's and PayPal's, and catch changes on the provider's side, even when our code hasn't changed. How We Test Our Medusa Plugins has the details.

---

Every day the plugins' workflow updates Medusa in the example projects and runs the tests, and the starter's workflow builds the backend and the storefront on the new version. Whatever passes goes into a pull request with the update.

The plugins and the module declare Medusa in peerDependencies as a version range, so they install next to a new minor version without --legacy-peer-deps.

---

A Gorgo developer reads every change before it is released. Plugin and module versions follow semantic versioning, and every plugin has a changelog in the documentation. Before we remove anything, we mark it as deprecated and keep it working until the next major version.

You copy the starter into your own project, so you bring its updates over yourself from the repository's commit history.

---

The Support page lists where to report bugs and ask questions. We usually reply within one business day.

We fix vulnerabilities first, along with bugs that stop a store from taking payments or creating shipments, or that lose or duplicate orders. Such a fix ships as its own patch release.

Don't report a vulnerability in a public issue. Report it privately on the repository's Security tab, as SECURITY.md describes.

---

• Outages and changes on the provider's side. We help you find the cause, but we can't fix someone else's service.
• Plugin or starter code you changed in your project, and forks.
• Medusa versions outside the range in peerDependencies.
• Store-specific customizations and questions about Medusa itself. Bring the latter to the Medusa developer chat @medusajs_chat.