RepoJournal
Shopify Shopify
127 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-09
stories 25
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

HYDROGEN PATCHES CART RECURSION BUG AS CLI BUMPS 41 DEPENDENCIES

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

dependabot[bot]
1 person shipped this
dependabot[bot] @dependabot[bot] 1 cited

Hydrogen's cart handler now recursively includes line item children, fixing a data structure bug that could break custom cart implementations across the entire platform ecosystem.

The Hydrogen team shipped coordinated patch releases across five packages [6][7][8][9][10] addressing cart rendering and React Router compatibility. The critical fix surfaces in @shopify/hydrogen@2026.4.3 [8], where cart.get() now respects the provided cartId before falling back to getCartId(), and the Image component stops generating incorrect density descriptors for fluid images capped at 3 srcset entries. All five Hydrogen packages [6][7][8][9][10] now widen React Router peer dependency ranges to accept 7.16 patch versions without npm conflicts. On the CLI side, Shopify/cli merged a massive 41-package dependency bump [1] including TypeScript-ESLint 8.60.1, GraphQL 16.14.1, and Zod updates, while strategically removing breaking minor updates [2] and OpenTelemetry exporters [3] from the grouped release. The CLI also fixed GitHub release creation for legacy workflows [4] and expanded E2E staging configs with sidekick summaries [5].

Action items

References

  1. [1] Bump the minor_versions group across 1 directory with 41 updates ↗ Shopify/cli
  2. [2] Remove breaking minor dependency updates ↗ Shopify/cli
  3. [3] Remove OpenTelemetry metrics exporter from grouped update ↗ Shopify/cli
  4. [4] Merge pull request #7651 from Shopify/donald/fix-release-gh-latest-legacy ↗ Shopify/cli
  5. [5] Merge pull request #7752 from Shopify/e2e-sidekick-staging-config ↗ Shopify/cli
  6. [6] skeleton@2026.4.3 ↗ Shopify/hydrogen
  7. [7] @shopify/cli-hydrogen@12.0.1 ↗ Shopify/hydrogen
  8. [8] @shopify/hydrogen@2026.4.3 ↗ Shopify/hydrogen
  9. [9] @shopify/remix-oxygen@3.0.4 ↗ Shopify/hydrogen
  10. [10] @shopify/create-hydrogen@5.0.37 ↗ Shopify/hydrogen

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI goes machine-readable for agent tooling the month in review Shopify CLI 5.0 ships standardized JSON output
Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on June 9, 2026?
Hydrogen's cart handler now recursively includes line item children, fixing a data structure bug that could break custom cart implementations across the entire platform ecosystem. In total, 12 commits, 7 pull requests, and 6 releases landed.
Who contributed to Shopify on June 9, 2026?
1 developer shipped this update, including dependabot[bot].
What were the notable Shopify updates?
Bump the minor_versions group across 1 directory with 41 updates, Remove breaking minor dependency updates, and Remove OpenTelemetry metrics exporter from grouped update.
♥

$ log Shopify --recent

Hydrogen moves CSP into the core package, and a Vite build fix stops 500s on Oxygen 10 shipped Hydrogen stops leaking client IPs, app dev stops crashing on bad frames 21 shipped Theme tooling goes machine-readable, docs drift breaks CI 45 shipped Theme dev server stops forcing the exit page, and GraphiQL learns JSON 12 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.