What were the notable Shopify updates?

Merge pull request #7572 from Shopify/jules-security-fix-locale-header-redaction-14224719727929470904, Merge pull request #7567 from Shopify/jules-tests-remove-fs-mocks-function-common-test-2974459126850071803, and Remove "3.0" version reference from README.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SHOPIFY CLI PATCHES LOCALE HEADER LEAK, CLEANS UP TEST INFRASTRUCTURE

By RepoJournal · Filed 06:03 UTC on May 23, 2026 · About Shopify

A security fix landed overnight that tightens locale-sensitive header redaction in Shopify CLI, while the team continues stripping out filesystem mocks from the test suite.

The CLI caught a locale header redaction bug [1] that could expose sensitive information in certain contexts. It's a narrow fix but important enough to land as breaking, so audit your deployments if you're running CLI in multi-locale environments. In parallel, the team is methodically removing filesystem mocks from the test layer [2] , replacing them with cleaner abstractions. This is defensive work that makes the test suite more reliable and faster to run. The README also shed its hardcoded "3.0" version reference [3] , a small move that keeps docs from aging into obsolescence. These aren't headline features, but they're the kind of housekeeping that keeps a CLI tool stable and maintainable.

Action items

→ Pull the latest CLI with the locale header fix before your next merchant deployment Shopify/cli [immediate]
→ Review your test mocks in function and build suites for compatibility with filesystem removal changes Shopify/cli [plan]

References

[1] Merge pull request #7572 from Shopify/jules-security-fix-locale-header-redaction-14224719727929470904 Shopify/cli
[2] Merge pull request #7567 from Shopify/jules-tests-remove-fs-mocks-function-common-test-2974459126850071803 Shopify/cli
[3] Remove "3.0" version reference from README Shopify/cli

Quick answers

What shipped in Shopify on May 23, 2026?: A security fix landed overnight that tightens locale-sensitive header redaction in Shopify CLI, while the team continues stripping out filesystem mocks from the test suite. In total, 21 commits and 16 pull requests landed.
What were the notable Shopify updates?: Merge pull request #7572 from Shopify/jules-security-fix-locale-header-redaction-14224719727929470904, Merge pull request #7567 from Shopify/jules-tests-remove-fs-mocks-function-common-test-2974459126850071803, and Remove "3.0" version reference from README.

SHOPIFY CLI ADDS THEME UTILITY TEST COVERAGE

Shopify's CLI tooling now has comprehensive unit tests covering core theme utility functions, closing a coverage gap in the theme management layer.

javascript 2 shipped 1-min read

Shopify 4 days ago

SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD

Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.

javascript 6 shipped 1-min read

Shopify 7 days ago

SHOPIFY CLI TIGHTENS TEST COVERAGE ACROSS AUTH AND WARNING SYSTEMS

Shopify/cli shipped comprehensive unit tests for critical warning and storage systems, closing gaps that could hide regressions in production auth flows.

javascript 15 shipped 1-min read

Shopify 9 days ago

CLI AUTOMATION SWEEP KILLS INTERACTIVE PROMPTS ACROSS SHOPIFY TOOLS

Shopify's interactivity audit is shipping widespread fixes to eliminate blocking prompts in non-interactive workflows, from app dev to hydrogen deployments.

javascript 27 shipped 1-min read

Elsewhere on the wire

AI Agents about 7 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 7 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.