RepoJournal
Shopify Shopify
127 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-15
stories 54
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Shopify CLI hardens GraphQL caching and GraphiQL rendering

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

Liz Kenyon Nick Wesselman andguy95 mdamjanic7
4 people shipped this
Liz Kenyon @lizkenyon 2 cited Nick Wesselman @nickwesselman 1 cited andguy95 @andguy95 1 cited mdamjanic7 @mdamjanic7 1 cited

A security cluster lands in Shopify/cli, partitioning cached GraphQL responses by endpoint and token and serializing GraphiQL inline configuration safely, while Hydrogen fixes the opaque failure a 2026.4 storefront hits when it auto-bumps to @shopify/hydrogen 2026.10.

Merge pull request #8888 from Shopify/security-graphql-cache-principal Shopify/cli

by Liz Kenyon

The CLI now partitions GraphQL response caching by endpoint and token, so cached responses can no longer be served across principals that share a cache. If your tooling relies on cache hits across endpoints or credentials, expect those to become misses.

Merge pull request #8887 from Shopify/security-graphiql-inline-json Shopify/cli

by Liz Kenyon

GraphiQL configuration is now serialized into inline scripts safely, closing off a path where configuration data was written into the page without escaping. Anyone embedding GraphiQL output should take the updated CLI rather than hand-rolling the script tag.

Fix the opaque error when a 2026.4 storefront installs @shopify/hydrogen 2026.10 Shopify/hydrogen

by andguy95

Storefronts on 2026.4 whose dependencies auto-bump to latest were hitting a cryptic "does not provide an export named 'hydrogen'" error after @shopify/hydrogen 2026.10 published under the same package name and the same 2026.x version prefix. The fix swaps that message for one that explains what happened and how to pin back.

Merge pull request #8882 from Shopify/nickwesselman/security-command-telemetry-disclosure Shopify/cli

by Nick Wesselman

The security command's help text now discloses telemetry, so a reader of `--help` learns what the command reports before running it. Two companion commits (id 4, id 5) add usage examples for `app security check` and use cross-platform glob quoting in those examples.

Point fresh `hydrogen setup` runs at the hydrogen-setup skill Shopify/hydrogen

by mdamjanic7

Fresh `hydrogen setup` runs now end with "Setup is ready. Next: ask your agent to use the hydrogen-setup skill." It only prints when Hydrogen was not already installed; update runs just resync skills as before, and the change ships as a patch.

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI goes machine-readable for agent tooling the month in review Shopify CLI 5.0 ships standardized JSON output
Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on October 15, 2026?
A security cluster lands in Shopify/cli, partitioning cached GraphQL responses by endpoint and token and serializing GraphiQL inline configuration safely, while Hydrogen fixes the opaque failure a 2026.4 storefront hits when it auto-bumps to @shopify/hydrogen 2026.10. In total, 39 commits, 14 pull requests, and 1 releases landed.
Who contributed to Shopify on October 15, 2026?
4 developers shipped this update, including Liz Kenyon, Nick Wesselman, andguy95, and mdamjanic7.
What were the notable Shopify updates?
Merge pull request #8888 from Shopify/security-graphql-cache-principal, Merge pull request #8887 from Shopify/security-graphiql-inline-json, and Fix the opaque error when a 2026.4 storefront installs @shopify/hydrogen 2026.10.
♥

$ log Shopify --recent

Hydrogen moves CSP into the core package, and a Vite build fix stops 500s on Oxygen 10 shipped Hydrogen stops leaking client IPs, app dev stops crashing on bad frames 21 shipped Theme tooling goes machine-readable, docs drift breaks CI 45 shipped Theme dev server stops forcing the exit page, and GraphiQL learns JSON 12 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.