$ the-wire · showcase
App security commands get typed JSON output
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
2 people shipped this
Shopify/cli's app security suite now emits typed JSON for coding agents and exits 0 when a scan is declined, while Hydrogen patches an undici pin carrying upstream advisories.
Have coding agents read app security results as JSON Shopify/cli
The coding-agent instructions now run `check`, `record`, `review` and `clean` with `--json --no-input`, naming the result fields to read. That matters because `review`'s terminal boxes wrap long paths and commands, so agents had to rejoin them; the JSON result carries every finding in full with absolute paths and one-based lines and columns, and a rejected `record` document surfaces as an error...
Merge pull request #8964 from Shopify/app-security/support-json-schema-record Shopify/cli
`app security record` gains typed JSON output, so its machine-readable result is now schema-backed rather than shaped ad hoc. Coding agents that parse the output get a stable structure to key off.
Bump MiniOxygen's undici from 7.24.0 to 7.30.1 Shopify/hydrogen
`@shopify/mini-oxygen` pinned `undici` to 7.24.0, which the changelog describes as "affected by a batch of upstream advisories fixed between 7.28.0 and 7.30.1"; the pin moves to 7.30.1 and stays an exact pin, with only the `undici` entries changing in `pnpm-lock.yaml`. MiniOxygen uses undici's `fetch` and `ProxyAgent` in the worker runtime and `request` in devtools, so the affected surface is t...
Exit 0 when app security check's no-configuration prompt is declined Shopify/cli
Answering No to "Scan it without app configuration?" used to abort with exit 1 in the terminal while `--json` returned a cancelled result with exit 0; both formats now show the same message and next step and exit 0. Without prompts a missing app configuration still aborts, since nothing was declined.
Split the shared app security JSON module into types and result Shopify/cli
The shared app security JSON schemas moved to app-security/types.ts and their projections to app-security/result.ts, matching how `dev-clean` and each `security-<command>` folder already split them. The JSON output and JSON Schema do not change.
Action items
- → Upgrade @shopify/mini-oxygen to the patch release that pins undici 7.30.1 Shopify/hydrogen [plan]
