Who contributed to Shopify on July 30, 2026?

1 developer shipped this update, including alfonso-noriega.

What were the notable Shopify updates?

Make store auth session reuse opt-in per theme command, Skip expired store auth sessions in theme commands, and Log store auth session decisions in theme commands under --verbose.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SHOPIFY CLI CLOSES STORE DELETE REGRESSION, ADDS CONFIRMATION GATES

By RepoJournal · Filed 06:59 UTC on July 30, 2026 · About Shopify

1 person shipped this

alfonso-noriega @alfonso-noriega 5 cited

Alfonso Noriega shipped three connected fixes for the store-auth session reuse regression that broke theme commands for OAuth users, then added irreversible deletion safeguards to prevent accidental store wipes.

The regression from CLI 4.4.0 hit Enterprise Support hard: store-auth sessions were being reused automatically across all theme commands without checking scopes, silencing OAuth users [1]. Noriega stacked three layers to fix it. First, he made session reuse opt-in per theme command [1], blocking the silent adoption that triggered the regression. Second, he added expiry checking [2] because theme commands were reading cached store-auth tokens but never validating their freshness, handing 401s to the Admin API with no refresh handler. Third, he wired verbose logging [3] so support can see exactly why a stored session was adopted, skipped, or rejected without tracing code. In parallel, Noriega shipped the `shopify store delete` command [4] that Business Platform now requests but CLI never had, then immediately wrapped it with confirmation UX [5]: store name required in interactive mode, `--force` required for CI, because deleting a development store is permanent. Ten commits, six PRs, one engineer closing a production hole and hardening a dangerous operation.

Action items

→ Test theme dev and store delete commands against your dev stores before shipping Shopify/cli [plan]
→ Document the new --force flag for store delete in automation docs Shopify/cli [plan]
→ Monitor Enterprise Support Slack for OAuth user regressions in next 48 hours Shopify/cli [monitor]

References

[1] Make store auth session reuse opt-in per theme command ↗ Shopify/cli
[2] Skip expired store auth sessions in theme commands ↗ Shopify/cli
[3] Log store auth session decisions in theme commands under --verbose Shopify/cli
[4] Add store delete command ↗ Shopify/cli
[5] Require confirmation or --force for store delete ↗ Shopify/cli

Quick answers

What shipped in Shopify on July 30, 2026?: Alfonso Noriega shipped three connected fixes for the store-auth session reuse regression that broke theme commands for OAuth users, then added irreversible deletion safeguards to prevent accidental store wipes. In total, 10 commits and 6 pull requests landed.
Who contributed to Shopify on July 30, 2026?: 1 developer shipped this update, including alfonso-noriega.
What were the notable Shopify updates?: Make store auth session reuse opt-in per theme command, Skip expired store auth sessions in theme commands, and Log store auth session decisions in theme commands under --verbose.

CLI TOKEN DEBUGGING GETS TEETH, HYDROGEN STOPS NUKING SESSIONS ON BLIPS

Shopify CLI now exposes the actual reason token exchanges fail instead of dead-end error messages, while Hydrogen stops logging out customers when OAuth endpoints hiccup.

javascript 41 shipped

Shopify Aug 5

CLI TIGHTENS FUNCTION TYPES, LOCKS DOWN NON-INTERACTIVE FLAGS

Shopify Function GraphQL scalars now ship with proper TypeScript mappings instead of unsafe `any` types, while CLI commands gain infrastructure to enforce required flags in automation flows.

javascript 45 shipped

Shopify Aug 4

SHOPIFY CLI WARNS DEVELOPERS ABOUT SENSITIVE DATA IN VERBOSE LOGS

The Shopify CLI now explicitly flags that --verbose output may leak sensitive information, closing a gap in the redaction pipeline.

javascript 7 shipped

Shopify Aug 1

SHOPIFY CLI 4.6.0 SHIPS WITH FUNCTION PROFILING AND SOURCE MAP FIXES

The Shopify CLI gains WebAssembly performance profiling for app functions while fixing a critical bug that broke UI extension source maps in local development.

javascript 22 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.