RepoJournal
Shopify Shopify
127 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-26
stories 4
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Theme app extensions can declare network origins, server support pending

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

Josh Larson jplhomer
2 people shipped this
Josh Larson @isaacroldan 2 cited jplhomer @jplhomer 1 cited

Shopify/cli now lets theme app extensions declare the external origins they contact through a new capabilities.network_access.allowed_sources key, but the platform does not accept it yet, so the change is inert until the server catches up.

Let theme app extensions declare the network origins they contact Shopify/cli

by jplhomer

The CLI accepts a new `[extensions.capabilities.network_access]` block in a theme app extension's deploy config, so extensions can declare which origins their storefront scripts reach. The PR carries its own warning: the platform still rejects unknown deploy-config keys, so deploying an extension that declares it fails until the server accepts `capabilities.network_access.allowed_sources`; exte...

Separate theme capabilities from the shared schema Shopify/cli

by Isaac Roldán

Theme capabilities move out of the shared schema into their own module, which is what gives the new network access block a shape separate from the rest of the extension surface.

Reject hexadecimal IP addresses in theme network sources Shopify/cli

by Isaac Roldán

The validator now rejects hexadecimal IP addresses in theme network sources, closing the obvious gap where a source list could name an origin in a form that skips normalization.

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI goes machine-readable for agent tooling the month in review Shopify CLI 5.0 ships standardized JSON output
Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on October 26, 2026?
Shopify/cli now lets theme app extensions declare the external origins they contact through a new capabilities.network_access.allowed_sources key, but the platform does not accept it yet, so the change is inert until the server catches up. In total, 3 commits and 1 pull requests landed.
Who contributed to Shopify on October 26, 2026?
2 developers shipped this update, including jplhomer and Josh Larson.
What were the notable Shopify updates?
Let theme app extensions declare the network origins they contact, Separate theme capabilities from the shared schema, and Reject hexadecimal IP addresses in theme network sources.
♥

$ log Shopify --recent

Hydrogen moves CSP into the core package, and a Vite build fix stops 500s on Oxygen 10 shipped Hydrogen stops leaking client IPs, app dev stops crashing on bad frames 21 shipped Theme tooling goes machine-readable, docs drift breaks CI 45 shipped Theme dev server stops forcing the exit page, and GraphiQL learns JSON 12 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.