Who contributed to Shopify on May 21, 2026?

1 developer shipped this update, including MitchLillie.

What were the notable Shopify updates?

[Security] Redact cookies from debug logs, Merge pull request #7531 from Shopify/sentinel/redact-cookies-3070110335838284999, and Revert hosted app project changes.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SHOPIFY CLI PATCHES SESSION DATA LEAK IN DEBUG LOGS

By RepoJournal · Filed 06:03 UTC on May 21, 2026 · About Shopify

1 person shipped this

MitchLillie @MitchLillie 1 cited

Shopify CLI just plugged a security hole that was exposing session cookies in debug output, and you need to pull this immediately.

The vulnerability [1] [2] was straightforward but critical: cookies weren't being redacted from debug logs, meaning anyone tailing logs in development could see session data. The fix adds 'cookie' to the sanitized keywords list and updates tests to verify it sticks. This is the kind of silent leak that works its way into production logs if you're not careful.

In parallel cleanup, the team reverted the entire hosted app project [3] after deciding to shelf that feature work. They preserved the asset upload infrastructure so other extension types keep working, but this was a full strategic step back on the admin extensibility roadmap. Worth noting if you were tracking that initiative.

Two smaller refinements landed: filesystem mocks got cleaned up in copy-by-pattern tests [4], and git tag retrieval logic shed some duplication [5]. Both reduce maintenance burden, neither blocks your deploys.

Action items

→ Upgrade Shopify CLI and redeploy any local dev environments using it Shopify/cli [immediate]
→ Audit your debug logs if you've been running pre-patch CLI versions in shared environments Shopify/cli [plan]
→ Watch the hosted app revert rollout if you have downstream dependencies on that feature Shopify/cli [monitor]

References

[1] [Security] Redact cookies from debug logs Shopify/cli
[2] Merge pull request #7531 from Shopify/sentinel/redact-cookies-3070110335838284999 Shopify/cli
[3] Revert hosted app project changes ↗ Shopify/cli
[4] Merge pull request #7538 from Shopify/tester/remove-fs-mocks-copy-by-pattern-220001070802494390 Shopify/cli
[5] Merge pull request #7546 from Shopify/jules-refactor-git-tag-duplication-12497117072717296991 Shopify/cli

Quick answers

What shipped in Shopify on May 21, 2026?: Shopify CLI just plugged a security hole that was exposing session cookies in debug output, and you need to pull this immediately. In total, 19 commits and 13 pull requests landed.
Who contributed to Shopify on May 21, 2026?: 1 developer shipped this update, including MitchLillie.
What were the notable Shopify updates?: [Security] Redact cookies from debug logs, Merge pull request #7531 from Shopify/sentinel/redact-cookies-3070110335838284999, and Revert hosted app project changes.

SHOPIFY CLI ADDS THEME UTILITY TEST COVERAGE

Shopify's CLI tooling now has comprehensive unit tests covering core theme utility functions, closing a coverage gap in the theme management layer.

javascript 2 shipped 1-min read

Shopify 4 days ago

SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD

Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.

javascript 6 shipped 1-min read

Shopify 7 days ago

SHOPIFY CLI TIGHTENS TEST COVERAGE ACROSS AUTH AND WARNING SYSTEMS

Shopify/cli shipped comprehensive unit tests for critical warning and storage systems, closing gaps that could hide regressions in production auth flows.

javascript 15 shipped 1-min read

Shopify 9 days ago

CLI AUTOMATION SWEEP KILLS INTERACTIVE PROMPTS ACROSS SHOPIFY TOOLS

Shopify's interactivity audit is shipping widespread fixes to eliminate blocking prompts in non-interactive workflows, from app dev to hydrogen deployments.

javascript 27 shipped 1-min read

Elsewhere on the wire

AI Agents about 8 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 8 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.