RepoJournal
Shopify Shopify
74 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-02
stories 14
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Redact store signup JWTs from analytics and terminal output

By RepoJournal · Filed · About Shopify

craigmichaelmartin dengjeffrey fredericoo
3 people shipped this
craigmichaelmartin @craigmichaelmartin 2 cited dengjeffrey @dengjeffrey 2 cited fredericoo @fredericoo 1 cited

Shopify CLI stopped printing and reporting store signup JWTs, aligning with a security finding that classifies them as never-to-be-printed server secrets.

The merge of redaction in the Stripe auth flow now aligns CLI reporting with the security finding (Vault 69736): the signup JWT passed to `shopify store stripe-auth --signup` is a bearer credential for the target store, and analytics payloads no longer include it [1]. Related changes reduce local exposure: `--signup` is now optional and reads the JWT from stdin when omitted, and the CLI opens a non-sensitive loopback handoff URL instead of printing the JWT-bearing OAuth URL to the terminal [2]. This follows the earlier fix that stopped the manual-authorization fallback from printing URLs marked sensitive, which could have exposed the signup JWT in shell history [3]. Separately, `cli-hydrogen` was bumped from 13.0.3 to 13.0.4, adding `--javascript-origin` to `hydrogen customer-account-push`, fixing local CLI discovery for that command, and recommending the Shopify AI Toolkit in new storefronts [4]. Also, gateway errors are no longer reported as CLI crashes [5].

$ ls shopify/reviews/ # the step-back reads

the week in review CLI adds subscription migration commands the month in review CLI 4.6/4.7 hardens auth, trims startup, rewrites E2E ergonomics
Topics: JavaScript Full archive →

Quick answers

What shipped in Shopify on September 2, 2026?
Shopify CLI stopped printing and reporting store signup JWTs, aligning with a security finding that classifies them as never-to-be-printed server secrets. In total, 8 commits, 5 pull requests, and 1 releases landed.
Who contributed to Shopify on September 2, 2026?
3 developers shipped this update, including craigmichaelmartin, dengjeffrey, and fredericoo.
What were the notable Shopify updates?
Redact store signup JWTs from analytics payloads, Read store signup JWT from stdin, and Avoid printing sensitive store auth URLs.
♥

$ log Shopify --recent

shopify store list gains server-side type filtering 5 shipped Filter store list by type, server-side 3 shipped Shopify CLI adds subscription migration list command 14 shipped Two Shopify CLI prompts make their unexpected appearances visible 13 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.