RepoJournal
Shopify

Shopify

Hydrogen, Polaris, and the CLI — the dev platform behind millions of stores

What actually shipped in Shopify, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 23 may
  2. Wed 27 may
  3. Thu 28 may
  4. Fri 29 may
  5. Sat 30 may
  6. Mon 8 jun
  7. Tue 9 jun
  8. Wed 10 jun
  9. Thu 11 jun
  10. Fri 12 jun
  11. Sat 13 jun
  12. Tue 16 jun
  13. Wed 17 jun
  14. Thu 18 jun
  15. Sat 27 jun
  16. Tue 30 jun
  17. Wed 1 jul
  18. Thu 2 jul
  19. Fri 3 jul
  20. Sat 4 jul
  21. Tue 7 jul
  22. Wed 8 jul
  23. Thu 9 jul
  24. Fri 10 jul
  25. Sat 11 jul
  26. Tue 14 jul
  27. Wed 15 jul
  28. Thu 16 jul
  29. Sat 18 jul
  30. Today 21 jul
Topics: JavaScript Full archive →

The Wire · Showcase

SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD

By RepoJournal · Filed · About Shopify

gonzaloriestra dependabot
2 people shipped this
gonzaloriestra @gonzaloriestra 2 cited dependabot @dependabot 1 cited

Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.

The move addresses a real vulnerability in rapid-fire dependency chains: new versions published to npm can ship undetected bugs or malicious code before the broader ecosystem catches problems [1]. Security patches bypass the cooldown entirely, so critical fixes land immediately [1]. In the same window, the team merged 17 development dependency bumps including Nx, Vitest, and ESLint [2], keeping the test and lint stack current ahead of the new slowdown policy [3]. This is smart supply-chain hygiene without sacrificing security velocity.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Delay Dependabot updates by seven days ↗ Shopify/cli
  2. [2] Bump the development_dependencies group across 1 directory with 17 updates ↗ Shopify/cli
  3. [3] Merge pull request #8117 from Shopify/dependabot-npm_and_yarn-development_dependencies-4a18ee4e4f Shopify/cli

Quick answers

What shipped in Shopify on July 21, 2026?
Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them. In total, 4 commits and 2 pull requests landed.
Who contributed to Shopify on July 21, 2026?
2 developers shipped this update, including dependabot and gonzaloriestra.
What were the notable Shopify updates?
Delay Dependabot updates by seven days, Bump the development_dependencies group across 1 directory with 17 updates, and Merge pull request #8117 from Shopify/dependabot-npm_and_yarn-development_dependencies-4a18ee4e4f.

More from Shopify

Shopify Shopify

SHOPIFY CLI TIGHTENS TEST COVERAGE ACROSS AUTH AND WARNING SYSTEMS

Shopify/cli shipped comprehensive unit tests for critical warning and storage systems, closing gaps that could hide regressions in production auth flows.

gonzaloriestra Alfonso Noriega
javascript 15 shipped 1-min read
Shopify Shopify

CLI AUTOMATION SWEEP KILLS INTERACTIVE PROMPTS ACROSS SHOPIFY TOOLS

Shopify's interactivity audit is shipping widespread fixes to eliminate blocking prompts in non-interactive workflows, from app dev to hydrogen deployments.

gonzaloriestra shopify-github-actions-access[bot]
javascript 27 shipped 1-min read
Shopify Shopify

CLI 4.5.1 SHIPS WITH HYDROGEN BUMP AND CHANGESET FIX

Shopify CLI stabilized overnight, merging critical fixes for broken Changesets validation and upgrading hydrogen to 13.0.1.

amcaplan Gonzalo Riestra github-actions[bot] alfonso-noriega
javascript 7 shipped 1-min read
Shopify Shopify

CLI COMMANDS UNHIDDEN, HYDROGEN FIXES IMPORT RESOLUTION ACROSS FRAMEWORKS

Shopify CLI 4.5.0 ships store commands for public use while Hydrogen patches JavaScript project imports that broke after the Vite 8 upgrade.

github-actions[bot] gonzaloriestra Alfonso Noriega shopify-github-actions-access[bot] +2
javascript 26 shipped 1-min read

Daily updates, in your inbox

Follow Shopify

What actually shipped in Shopify, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

NORWAY MIRROR DOWN, KERNEL STACK SHIPS MAINTENANCE RELEASES

CachyOS infrastructure is reporting a downed Norway mirror while the kernel and toolchain stacks push routine version bumps across the board.

Piotr Gorski Matias miwakasa ptr1337 +2
infra 55 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO GAINS FRAGMENT COLUMN NAMING, PHOENIX PLUGS GET SMARTER

Ecto's new with_columns/2 lets you assign names to SQL fragments, while Phoenix now handles module plugs with options in pipe_through declarations.

José Valim AlexGx preciz Flo0807 +3
elixir 14 shipped 1-min read
Mobile platforms Mobile platforms

KOTLIN RIPS OUT INTERPRETER GUTS, FLUTTER PATCHES RENDERING PIPELINE

Kotlin is systematically removing its IR interpreter in a multi-commit cleanup that signals a major shift in how the compiler handles intermediate representation, while Flutter ships critical Vulkan safety fixes and expands autofill support.

Mohellebi Abdessalem jason-simmons Valentin Vignal jameskrupnik +7
mobile 115 shipped 2-min read
.NET @dotnet

MAUI 11 PREVIEW 6 SHIPS WITH 190 COMMITS, MACIOS FIXES GENERATOR FLAKINESS

.NET MAUI 11.0.0-preview.6 landed with significant platform improvements while dotnet/macios tackles a critical test parallelization bug that was silently dropping thread-safety calls from generated code.

kubaflo Shane Neuville rolfbjarne VincentBu +6
dotnet 59 shipped 2-min read
Want every project, not just this one?