Who contributed to Shopify on May 16, 2026?

1 developer shipped this update, including isaacroldan.

What were the notable Shopify updates?

Guard CLI bundle upload against oversized and out-of-app paths, Fix Windows auto-upgrade for local CLI installs, and Use bun for autoupgrade when CLI installed via bun add -g.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SHOPIFY CLI TIGHTENS BUNDLE GUARDS AND FIXES UPGRADE CHAOS ON WINDOWS

By RepoJournal · Filed 06:03 UTC on May 16, 2026 · About Shopify

1 person shipped this

isaacroldan @isaacroldan 1 cited

The CLI now prevents silent uploads of oversized and out-of-app assets that were silently ballooning bundles to gigabytes, while fixing a critical path normalization bug breaking Windows auto-upgrades.

Shopify CLI shipped a critical guardrail today [1] that stops the bundle upload pipeline from accepting asset paths pointing outside your app folder or exceeding reasonable size limits. Until now, a developer could accidentally point to their entire home directory with source = "../../" and watch a 2GB bundle silently upload to GCS without warning. This follows a Slack thread in #app-management where the scope of the problem became clear: there were zero safeguards on what got zipped and shipped.

On the Windows front, the CLI's auto-upgrade detection broke because path comparisons were failing silently [2]. The project root was normalized to forward slashes by the path library, but process.argv[1] arrives as OS-native backslash paths on Windows, so the startsWith check always missed. This meant users were stuck on old versions and couldn't upgrade automatically.

The CLI also fixed package manager detection for bun users [3]. When bun installs a global binary as a symlink out of ~/.bun, the path detection fell through to npm and tried to upgrade via npm instead of bun, breaking the flow for an entire installation method. The fix now inspects both the resolved real path and the unresolved symlink to catch bun correctly.

Two changesets landed to clean up the analytics override surface area [4] [5], removing analyticsNameOverride from the app generate extension command as part of broader API cleanup.

Action items

→ Upgrade @shopify/cli immediately if you manage extensions or large assets Shopify/cli [immediate]
→ Windows users: re-run CLI auto-upgrade to get the path fix Shopify/cli [immediate]
→ Audit existing extension bundles if you've used relative paths above your app root Shopify/cli [plan]

References

[1] Guard CLI bundle upload against oversized and out-of-app paths ↗ Shopify/cli
[2] Fix Windows auto-upgrade for local CLI installs Shopify/cli
[3] Use bun for autoupgrade when CLI installed via bun add -g Shopify/cli
[4] Drop changeset Shopify/cli
[5] Merge pull request #7536 from Shopify/fonso/drop-generate-extension-analytics-override Shopify/cli

Quick answers

What shipped in Shopify on May 16, 2026?: The CLI now prevents silent uploads of oversized and out-of-app assets that were silently ballooning bundles to gigabytes, while fixing a critical path normalization bug breaking Windows auto-upgrades. In total, 13 commits and 7 pull requests landed.
Who contributed to Shopify on May 16, 2026?: 1 developer shipped this update, including isaacroldan.
What were the notable Shopify updates?: Guard CLI bundle upload against oversized and out-of-app paths, Fix Windows auto-upgrade for local CLI installs, and Use bun for autoupgrade when CLI installed via bun add -g.

SHOPIFY CLI ADDS THEME UTILITY TEST COVERAGE

Shopify's CLI tooling now has comprehensive unit tests covering core theme utility functions, closing a coverage gap in the theme management layer.

javascript 2 shipped 1-min read

Shopify 4 days ago

SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD

Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.

javascript 6 shipped 1-min read

Shopify 7 days ago

SHOPIFY CLI TIGHTENS TEST COVERAGE ACROSS AUTH AND WARNING SYSTEMS

Shopify/cli shipped comprehensive unit tests for critical warning and storage systems, closing gaps that could hide regressions in production auth flows.

javascript 15 shipped 1-min read

Shopify 9 days ago

CLI AUTOMATION SWEEP KILLS INTERACTIVE PROMPTS ACROSS SHOPIFY TOOLS

Shopify's interactivity audit is shipping widespread fixes to eliminate blocking prompts in non-interactive workflows, from app dev to hydrogen deployments.

javascript 27 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.