RepoJournal
Shopify Shopify
127 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-21
stories 32
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SHOPIFY CLI PATCHES SESSION DATA LEAK IN DEBUG LOGS

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

MitchLillie
1 person shipped this
MitchLillie @MitchLillie 1 cited

Shopify CLI just plugged a security hole that was exposing session cookies in debug output, and you need to pull this immediately.

The vulnerability [1] [2] was straightforward but critical: cookies weren't being redacted from debug logs, meaning anyone tailing logs in development could see session data. The fix adds 'cookie' to the sanitized keywords list and updates tests to verify it sticks. This is the kind of silent leak that works its way into production logs if you're not careful.

In parallel cleanup, the team reverted the entire hosted app project [3] after deciding to shelf that feature work. They preserved the asset upload infrastructure so other extension types keep working, but this was a full strategic step back on the admin extensibility roadmap. Worth noting if you were tracking that initiative.

Two smaller refinements landed: filesystem mocks got cleaned up in copy-by-pattern tests [4], and git tag retrieval logic shed some duplication [5]. Both reduce maintenance burden, neither blocks your deploys.

Action items

References

  1. [1] [Security] Redact cookies from debug logs Shopify/cli ↗
  2. [2] Merge pull request #7531 from Shopify/sentinel/redact-cookies-3070110335838284999 ↗ Shopify/cli
  3. [3] Revert hosted app project changes ↗ Shopify/cli
  4. [4] Merge pull request #7538 from Shopify/tester/remove-fs-mocks-copy-by-pattern-220001070802494390 Shopify/cli ↗
  5. [5] Merge pull request #7546 from Shopify/jules-refactor-git-tag-duplication-12497117072717296991 Shopify/cli ↗

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI goes machine-readable for agent tooling the month in review Shopify CLI 5.0 ships standardized JSON output
Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on May 21, 2026?
Shopify CLI just plugged a security hole that was exposing session cookies in debug output, and you need to pull this immediately. In total, 19 commits and 13 pull requests landed.
Who contributed to Shopify on May 21, 2026?
1 developer shipped this update, including MitchLillie.
What were the notable Shopify updates?
[Security] Redact cookies from debug logs, Merge pull request #7531 from Shopify/sentinel/redact-cookies-3070110335838284999, and Revert hosted app project changes.
♥

$ log Shopify --recent

Hydrogen moves CSP into the core package, and a Vite build fix stops 500s on Oxygen 10 shipped Hydrogen stops leaking client IPs, app dev stops crashing on bad frames 21 shipped Theme tooling goes machine-readable, docs drift breaks CI 45 shipped Theme dev server stops forcing the exit page, and GraphiQL learns JSON 12 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.