$ the-wire · showcase
CLI drops --app-security-check-yes, Hydrogen migration skill names its silent failures
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
Shopify's CLI replaces a boolean security-check flag with --print-instructions and removes resolved security findings from app command metadata, while Hydrogen's migration skill now documents the 2026-10 changes that leave apps rendering fine but hydrating dead.
Add print-instructions flag and deprecate app security check yes flag Shopify/cli
The app security check gains --print-instructions and the existing --app-security-check-yes flag is deprecated, with flag-conflict coverage strengthened alongside it. Scripts and CI that pass the old flag keep working today but should move to the new one.
docs(skill): warn that CSP/nonce is app-owned in 2026-10 Shopify/hydrogen
Hydrogen 2026-10 drops classic's createContentSecurityPolicy, NonceProvider and useNonce, leaving CSP to the app; the skill warns that a strict CSP carried over without the nonce wiring produces pages that render while hydration of the cart, variant picker and analytics is silently dead. All three agents in a three-model migration test on the same classic store flagged it.
Tell migrating agents to add a cache to every formerly uncached query Shopify/hydrogen
Classic applied CacheDefault() to every query lacking an explicit cache option, but the 2026-10 client caches only when a query passes one, so a straight port quietly stops caching; the skill also retracts its claim that passing $country in variables is a type error, which it is not.
Remove resolved security findings from CLI metadata Shopify/cli
App command metadata will no longer permit a resolved security finding count, because findings lack stable identities for the CLI to compute one against; the field stays in the server-side Monorail schema definition.
Restore the shopify.dev preview label workflow Shopify/hydrogen
The shopify.dev preview label workflow returns, labeling same-repo PRs that touch Hydrogen generated docs, package.json or screenshots, skipping fork PRs that get a read-only token, scoping permissions to the job and dropping the hydrogen-react paths that are no longer on main.
