RepoJournal
Shopify Shopify
95 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-29
stories 19
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CLI COMPLETES PARTNERS MIGRATION CLEANUP, HYDROGEN HARDENS DEBUGGER SECURITY

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

isaacroldan majd-shopify frandiox
3 people shipped this
isaacroldan @isaacroldan 5 cited majd-shopify @majd-shopify 2 cited frandiox @frandiox 2 cited

Shopify CLI finishes gutting vestigial Partners infrastructure with the final sweep of a three-part refactor, while Hydrogen locks down local debugger access to prevent network-level attacks.

Isaac Roldán completed the Partners client migration cleanup across three coordinated merges in CLI [1] [2] [5]. The keystone pull request shrank PartnersClient to a migration-only surface and deleted the exclusive GraphQL it consumed, followed by removal of the vestigial account-info interface and stale allowlist entries [3] [4]. No behavior change on the live migration path, but the code surface that only PartnersClient used is now gone. In Hydrogen, debugger reliability improved with an inspector connector overhaul that binds the public inspector to loopback and validates Host and Origin headers so network peers and untrusted browser pages cannot attach to workerd [9]. The same push also removed the Shopify Dev Docs Sync workflow after runners were blocked [6] [8]. Hydrogen's test coverage for local debugger flows is now in place [7].

Action items

References

  1. [1] Remove vestigial account-info and Partners codegen plumbing ↗ Shopify/cli
  2. [2] Shrink PartnersClient and remove the GraphQL it exclusively used ↗ Shopify/cli
  3. [3] Merge pull request #8116 from Shopify/partners-cleanup/07-prune-stale-graphql-allowlist ↗ Shopify/cli
  4. [4] Merge pull request #8115 from Shopify/partners-cleanup/06-drop-vestigial-account-info ↗ Shopify/cli
  5. [5] Merge pull request #8111 from Shopify/partners-cleanup/03-shrink-partners-client ↗ Shopify/cli
  6. [6] Remove Shopify Dev Docs Sync workflow (main) ↗ Shopify/hydrogen
  7. [7] Improve MiniOxygen debugger connections ↗ Shopify/hydrogen
  8. [8] Remove Shopify Dev Docs Sync workflow (#3873) ↗ Shopify/hydrogen
  9. [9] Improve MiniOxygen debugger connections (#3883) ↗ Shopify/hydrogen

$ ls shopify/reviews/ # the step-back reads

the week in review App Doctor becomes App Security, scoring removed the month in review Shopify CLI closes credential leaks, ships 4.8.0
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on July 29, 2026?
Shopify CLI finishes gutting vestigial Partners infrastructure with the final sweep of a three-part refactor, while Hydrogen locks down local debugger access to prevent network-level attacks. In total, 10 commits and 9 pull requests landed.
Who contributed to Shopify on July 29, 2026?
3 developers shipped this update, including isaacroldan, majd-shopify, and frandiox.
What were the notable Shopify updates?
Remove vestigial account-info and Partners codegen plumbing, Shrink PartnersClient and remove the GraphQL it exclusively used, and Merge pull request #8116 from Shopify/partners-cleanup/07-prune-stale-graphql-allowlist.
♥

$ log Shopify --recent

App Security renames its artifacts, Hydrogen stops interrupting hydration 33 shipped Shopify CLI adds --ignore to app security check, Hydrogen fixes env pull quoting 24 shipped App Security checks arrive in Shopify CLI, injection checks changeset pulled 32 shipped Hydrogen moves consent to CTA async, dropping Server-Timing and legacy cookies 10 shipped

$ log --all # elsewhere on the wire

@openclaw Access audit trails on delete, subagent wake-up fix Agentic Coding Goose exports sessions to HTML, Codex gets model-listing auth recovery

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.