$ the-wire · showcase
Hydrogen stops following Storefront API redirects
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
Hydrogen now refuses API redirects rather than re-sending the store's secret token to wherever they point, and Shopify's CLI narrows app security verification to static analysis only.
Don't follow Storefront API redirects Shopify/hydrogen
Previously a redirect from Shopify's API made Hydrogen follow it and replay the request, secret API token included, at the new destination; it now stops with an error. The maintainers note the API should never redirect, so treat a redirect here as a signal something upstream is wrong, and this lands as the first of four stacked hardening fixes.
Make app security checks static only Shopify/cli
App security checks in the CLI run static analysis only, with a patch changeset shipped alongside. Scans that previously inspected running app behavior no longer do, so findings based on dynamic checks will not surface.
Drop Oxygen-Cache-Control from private responses (#4174) Shopify/hydrogen
Oxygen's full-page cache reads only Oxygen-Cache-Control, so Hydrogen now deletes every vendor *-Cache-Control header when it makes a response private. Private responses that previously carried a stray vendor cache header will no longer leak a cacheable directive to Oxygen.
@shopify/hydrogen@2026.10.2 Shopify/hydrogen
In @shopify/hydrogen 2026.10.2, a cart change made while a cart load is in flight no longer hides the shopper's other lines or leaves `loading` stuck on `true`, and the cart store now applies `updateCart` calls that touch several lines at once, settling each from the response with per-line rollback.
Merge pull request #8927 from Shopify/jplhomer/app-security-instructions-test-nudge Shopify/cli
The CLI now nudges agents to add a regression test when fixing a verified app security finding, and Hydrogen drops the shopify.dev preview label workflow because the docs preview tooling finds relevant pull requests by their changed files; @shopify/create-hydrogen 5.1.0 also adds typed JSON project and account results, partial setup failures exiting with code 1 and `--no-input` to disable promp...
