RepoJournal
Shopify Shopify
74 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-01
stories 12
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Validate git author args, stop leaking GitHub credentials

By RepoJournal · Filed · About Shopify

Gonzalo Riestra tyler-eon
2 people shipped this
Gonzalo Riestra @gonzaloriestra 2 cited tyler-eon @tyler-eon 2 cited

Shopify CLI shipped a security fix that validates git commit author arguments and stops printing GitHub credentials to terminal output.

A security patch [1] now validates the git commit author argument, closing a potential injection or spoofing vector. Separately, the CLI no longer prints GitHub authentication tokens or signed LFS download URLs [2]; `dev github print-auth` output is captured without being echoed, and credential sources are logged without their values. This is a breaking change for any workflow that relied on that output appearing in command output. For partners migrating billing plans, four new hidden commands were added [3], and NONE migration notifications were removed [4]. The hidden commands won't appear in help, README, or Shopify.dev docs, so they are intended for scripted use only.

$ ls shopify/reviews/ # the step-back reads

the week in review CLI adds subscription migration commands the month in review CLI 4.6/4.7 hardens auth, trims startup, rewrites E2E ergonomics
Topics: JavaScript Full archive →

Quick answers

What shipped in Shopify on September 1, 2026?
Shopify CLI shipped a security fix that validates git commit author arguments and stops printing GitHub credentials to terminal output. In total, 9 commits and 3 pull requests landed.
Who contributed to Shopify on September 1, 2026?
2 developers shipped this update, including Gonzalo Riestra and tyler-eon.
What were the notable Shopify updates?
Add app subscription migration commands, Prevent GitHub credentials from being logged locally, and Merge pull request #8435 from Shopify/security-validate-git-author-7844826945563519319.
♥

$ log Shopify --recent

shopify store list gains server-side type filtering 5 shipped Filter store list by type, server-side 3 shipped Shopify CLI adds subscription migration list command 14 shipped Two Shopify CLI prompts make their unexpected appearances visible 13 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.