Who contributed to Shopify on August 11, 2026?

3 developers shipped this update, including Gonzalo Riestra, Donald Merand, and isaacroldan.

What were the notable Shopify updates?

Merge pull request #8275 from Shopify/security-sanitize-git-branch-init-10018993654953565653, Merge pull request #8029 from Shopify/security-harden-notifications-url-18035364240484933283, and Remove obsolete polyfill dependencies from cli-kit.

Shopify

Hydrogen, Polaris, and the CLI - the dev platform behind millions of stores

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

CLI PATCHES TWO SECURITY HOLES IN GIT INITIALIZATION AND NOTIFICATION HANDLING

By RepoJournal · Filed 06:59 UTC on August 11, 2026 · About Shopify

3 people shipped this

Gonzalo Riestra @gonzaloriestra 2 cited

Donald Merand @dmerand 2 cited

isaacroldan @isaacroldan 1 cited

Shopify/cli shipped emergency fixes for argument injection in git repository setup and URL validation flaws that could expose merchant deployments.

Two breaking security patches landed overnight in the CLI. The first plugs an argument injection vulnerability in git repository initialization [1], while the second hardens notifications URL validation to block malicious input [2]. Both required immediate merge. In parallel, the team is cleaning house: polyfill dependencies are being stripped out now that the CLI requires Node >= 22.12 [3], including `node-abort-controller` and three other packages that no longer earn their weight. Test suite simplifications are also landing [4][5], reducing cognitive load without changing behavior. Across the repo, 31 commits and 16 PRs in 24 hours signal active hardening across the CLI stack.

Action items

→ Deploy CLI security patches immediately to all Shopify development environments Shopify/cli [immediate]
→ Audit existing git initialization calls in your CLI plugins for untrusted branch input Shopify/cli [immediate]
→ Review notification URL sources in your tooling for hardening compatibility Shopify/cli [plan]

References

[1] Merge pull request #8275 from Shopify/security-sanitize-git-branch-init-10018993654953565653 Shopify/cli
[2] Merge pull request #8029 from Shopify/security-harden-notifications-url-18035364240484933283 Shopify/cli
[3] Remove obsolete polyfill dependencies from cli-kit ↗ Shopify/cli
[4] Drop redundant fallback assertion Shopify/cli
[5] Simplify special-character encoding test and drop rationale comment Shopify/cli

Quick answers

What shipped in Shopify on August 11, 2026?: Shopify/cli shipped emergency fixes for argument injection in git repository setup and URL validation flaws that could expose merchant deployments. In total, 31 commits and 16 pull requests landed.
Who contributed to Shopify on August 11, 2026?: 3 developers shipped this update, including Gonzalo Riestra, Donald Merand, and isaacroldan.
What were the notable Shopify updates?: Merge pull request #8275 from Shopify/security-sanitize-git-branch-init-10018993654953565653, Merge pull request #8029 from Shopify/security-harden-notifications-url-18035364240484933283, and Remove obsolete polyfill dependencies from cli-kit.

CLI NOW OWNS E2E STORE LIFECYCLE, HYDROGEN FIXES HTTP/2 HANDSHAKE

The CLI commands for creating and deleting development stores are live in E2E tests, cutting out Playwright provisioning entirely, while Hydrogen's local development stack now handles HTTP/2 requests without choking on pseudo-headers.

javascript 8 shipped

Shopify Aug 8

CLI 4.6.1 PATCHES SOURCE MAPS, REVERTS TYPESCRIPT BUNDLING BREAKAGE

Shopify CLI shipped a hotfix for UI extension source maps, but immediately rolled back a production-breaking change that removed TypeScript from the bundle.

javascript 7 shipped

Shopify Aug 7

CLI STARTUP GETS 30% FASTER AS SHOPIFY DROPS REACT FROM BOOT PATH

Shopify's CLI now skips loading the entire terminal UI runtime on every invocation, cutting startup overhead before any command runs.

javascript 54 shipped

Shopify Aug 6

CLI TOKEN DEBUGGING GETS TEETH, HYDROGEN STOPS NUKING SESSIONS ON BLIPS

Shopify CLI now exposes the actual reason token exchanges fail instead of dead-end error messages, while Hydrogen stops logging out customers when OAuth endpoints hiccup.

javascript 41 shipped

Elsewhere on the wire

AI Agents Aug 12

LANGCHAIN SHIPS THREE CRITICAL RELEASES IN 12 HOURS, CLOSES SETUPTOOLS VULNERABILITY

LangChain pushed langchain-core 1.5.4, langchain 1.3.15, and langchain-anthropic 1.5.5 overnight while patching a setuptools supply-chain risk that gated the Hugging Face integration.

ai-agents 59 shipped

Local LLMs Aug 12

OLLAMA CUTS REPEAT PENALTY BLOAT, LLAMA.CPP SHIPS POCKET-TTS SUPPORT

Ollama kills a decade of default penalty cruft that was drowning every model, while llama.cpp gains multimodal audio chops and vLLM fixes ROCm speculative decoding corruption.