RepoJournal
Shopify Shopify
85 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-15
stories 10
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

App doctor drops the lax Shopify API key check

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

Donald Merand Francis Beaudoin
2 people shipped this
Donald Merand @dmerand 2 cited Francis Beaudoin @francisbeaudoin 2 cited

Shopify/cli narrowed two of app doctor's noisiest heuristics in one sitting: the API key scan no longer flags any 32-character hex string, and static theme asset script URLs are allowed through.

Remove lax Shopify API key secret check Shopify/cli

by francisbeaudoin

The check used to treat any api_key, client_id, or SHOPIFY_API_KEY assignment containing 32 hex characters as a hardcoded Shopify API key; that pattern was broad enough to flag public identifiers such as public client IDs in application code. Removing it means app doctor stops reporting those as secrets, so expect fewer false positives on the next run.

Merge pull request #8503 from francisbeaudoin/remove-lax-shopify-api-key-secret-check Shopify/cli

by Donald Merand

The change lands on main through the merge of the remove-lax-shopify-api-key-secret-check branch. Anyone on the default branch picks up the narrower check without further action.

Merge pull request #8502 from francisbeaudoin/fix-static-asset-script-src Shopify/cli

by Donald Merand

App doctor now accepts static theme asset script URLs rather than rejecting them in the script-src check. Projects referencing static assets that way should pass cleanly.

Merge branch 'Shopify:main' into remove-lax-shopify-api-key-secret-check Shopify/cli

by Francis Beaudoin

The branch was synced with Shopify:main before landing, along with the same sync for the static asset fix, so both changes sit on top of current main.

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI 4.8.0 ships store create and delete the month in review CLI 4.6/4.7 hardens auth, trims startup, rewrites E2E ergonomics
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on September 15, 2026?
Shopify/cli narrowed two of app doctor's noisiest heuristics in one sitting: the API key scan no longer flags any 32-character hex string, and static theme asset script URLs are allowed through. In total, 6 commits and 4 pull requests landed.
Who contributed to Shopify on September 15, 2026?
2 developers shipped this update, including Donald Merand and Francis Beaudoin.
What were the notable Shopify updates?
Remove lax Shopify API key secret check, Merge pull request #8503 from francisbeaudoin/remove-lax-shopify-api-key-secret-check, and Merge pull request #8502 from francisbeaudoin/fix-static-asset-script-src.
♥

$ log Shopify --recent

Per-target function input variables, optional owner_type for UI extension metafields 15 shipped App Doctor gains a dependency automation check, organization list gets a JSON schema 9 shipped Shopify CLI drops CVE audit from app doctor, adds typed command events 47 shipped Shopify CLI starts detecting AI agents in analytics 3 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.