Who contributed to Shopify on July 29, 2026?

3 developers shipped this update, including isaacroldan, majd-shopify, and frandiox.

What were the notable Shopify updates?

Remove vestigial account-info and Partners codegen plumbing, Shrink PartnersClient and remove the GraphQL it exclusively used, and Merge pull request #8116 from Shopify/partners-cleanup/07-prune-stale-graphql-allowlist.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

CLI COMPLETES PARTNERS MIGRATION CLEANUP, HYDROGEN HARDENS DEBUGGER SECURITY

By RepoJournal · Filed 06:59 UTC on July 29, 2026 · About Shopify

3 people shipped this

isaacroldan @isaacroldan 5 cited

majd-shopify @majd-shopify 2 cited

frandiox @frandiox 2 cited

Shopify CLI finishes gutting vestigial Partners infrastructure with the final sweep of a three-part refactor, while Hydrogen locks down local debugger access to prevent network-level attacks.

Isaac Roldán completed the Partners client migration cleanup across three coordinated merges in CLI [1] [2] [5]. The keystone pull request shrank PartnersClient to a migration-only surface and deleted the exclusive GraphQL it consumed, followed by removal of the vestigial account-info interface and stale allowlist entries [3] [4]. No behavior change on the live migration path, but the code surface that only PartnersClient used is now gone. In Hydrogen, debugger reliability improved with an inspector connector overhaul that binds the public inspector to loopback and validates Host and Origin headers so network peers and untrusted browser pages cannot attach to workerd [9]. The same push also removed the Shopify Dev Docs Sync workflow after runners were blocked [6] [8]. Hydrogen's test coverage for local debugger flows is now in place [7].

Action items

→ Review and test CLI migrations after Partners cleanup lands in your branch Shopify/cli [plan]
→ Update Hydrogen dev setup to use new inspector connector if you run local debugging Shopify/hydrogen [plan]

References

[1] Remove vestigial account-info and Partners codegen plumbing ↗ Shopify/cli
[2] Shrink PartnersClient and remove the GraphQL it exclusively used ↗ Shopify/cli
[3] Merge pull request #8116 from Shopify/partners-cleanup/07-prune-stale-graphql-allowlist Shopify/cli
[4] Merge pull request #8115 from Shopify/partners-cleanup/06-drop-vestigial-account-info Shopify/cli
[5] Merge pull request #8111 from Shopify/partners-cleanup/03-shrink-partners-client Shopify/cli
[6] Remove Shopify Dev Docs Sync workflow (main) ↗ Shopify/hydrogen
[7] Improve MiniOxygen debugger connections ↗ Shopify/hydrogen
[8] Remove Shopify Dev Docs Sync workflow (#3873) Shopify/hydrogen
[9] Improve MiniOxygen debugger connections (#3883) Shopify/hydrogen

Quick answers

What shipped in Shopify on July 29, 2026?: Shopify CLI finishes gutting vestigial Partners infrastructure with the final sweep of a three-part refactor, while Hydrogen locks down local debugger access to prevent network-level attacks. In total, 10 commits and 9 pull requests landed.
Who contributed to Shopify on July 29, 2026?: 3 developers shipped this update, including isaacroldan, majd-shopify, and frandiox.
What were the notable Shopify updates?: Remove vestigial account-info and Partners codegen plumbing, Shrink PartnersClient and remove the GraphQL it exclusively used, and Merge pull request #8116 from Shopify/partners-cleanup/07-prune-stale-graphql-allowlist.

SHOPIFY CLI GAINS COUNTRY FLAG FOR STORE CREATION

The CLI now lets developers specify store country at creation time, unifying a flag across dev and preview environments.

javascript 5 shipped 1-min read

Shopify 5 days ago

SHOPIFY CLI ADDS THEME UTILITY TEST COVERAGE

Shopify's CLI tooling now has comprehensive unit tests covering core theme utility functions, closing a coverage gap in the theme management layer.

javascript 2 shipped 1-min read

Shopify 8 days ago

SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD

Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.

javascript 6 shipped 1-min read

Shopify 11 days ago

SHOPIFY CLI TIGHTENS TEST COVERAGE ACROSS AUTH AND WARNING SYSTEMS

Shopify/cli shipped comprehensive unit tests for critical warning and storage systems, closing gaps that could hide regressions in production auth flows.

javascript 15 shipped 1-min read

Elsewhere on the wire

AI Agents about 4 hours ago

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

ai-agents 119 shipped 1-min read

Local LLMs about 4 hours ago

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

+11

llms 239 shipped 2-min read

@CachyOS about 4 hours ago

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

infra 83 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.