RepoJournal
Shopify

Shopify

Hydrogen, Polaris, and the CLI — the dev platform behind millions of stores

Pick a date

  1. Tue 5 may
  2. Wed 6 may
  3. Thu 7 may
  4. Fri 8 may
  5. Sat 9 may
  6. Mon 11 may
  7. Tue 12 may
  8. Wed 13 may
  9. Thu 14 may
  10. Fri 15 may
  11. Sat 16 may
  12. Tue 19 may
  13. Thu 21 may
  14. Sat 23 may
  15. Wed 27 may
  16. Thu 28 may
  17. Fri 29 may
  18. Sat 30 may
  19. Mon 8 jun
  20. Tue 9 jun
  21. Today 10 jun

The Wire · Showcase

CLI PATCHES MEMORY DOS AND FIXES PHANTOM BREAKING CHANGES

By RepoJournal · Filed · About Shopify

Shopify/cli shipped a critical security fix for stdin memory exhaustion and eliminated false-positive breaking change detection that was blocking legitimate PRs.

The `readStdinString` function in Shopify/cli was vulnerable to Denial of Service through unbounded memory consumption—attackers could exhaust heap by piping unlimited data to stdin [1]. This release introduces a hard 10MB limit, closing the attack surface immediately [2]. In parallel, the breaking-change detection pipeline was reporting phantom removals whenever main diverged from a PR's branch point [3]. PR #7466 shows the exact failure: the check flagged a field removal that never happened in the PR itself—main had added the field after branching [3]. That's now fixed by comparing against merge-base and scoping diffs to actual PR changes [3]. On the test side, replay.test.ts was replaced with real temporary directories instead of mocked filesystem calls, making the log discovery and sorting logic actually testable rather than testing the mocks themselves [4].

Action items

References

  1. [1] [Security] Limit stdin read size in readStdinString Shopify/cli
  2. [2] Merge pull request #7482 from Shopify/sentinel-limit-stdin-read-10535475246681127260 Shopify/cli
  3. [3] Fix breaking-change check: compare against merge-base, scope to PR diff ↗ Shopify/cli
  4. [4] [Tests] Replace filesystem mocks with real temp dir in replay.test.ts ↗ Shopify/cli

FAQ

What changed in Shopify on May 8, 2026?
Shopify/cli shipped a critical security fix for stdin memory exhaustion and eliminated false-positive breaking change detection that was blocking legitimate PRs.
What should Shopify teams do about it?
Upgrade Shopify/cli immediately — stdin DoS fix is mandatory • Re-run breaking-change checks on any blocked PRs — false positives are now cleared
Which Shopify repositories shipped on May 8, 2026?
Shopify/cli

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • •14 famous open source orgs
  • •One wire per day
  • •Public, generic
  • •Read on the web, when you remember

Your wire

  • →Up to 1,500 of your repos - orgs, deps, vendors
  • →Morning and evening briefs
  • →Action items routed to your team
  • →Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.