$ the-wire · showcase
Theme extensions can declare network origins, but the server isn't ready
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
3 people shipped this
Shopify/cli now accepts a capabilities.network_access.allowed_sources block in theme app extension deploy config, but the platform still rejects it, so anyone who adopts it ships a failing deploy.
Let theme app extensions declare the network origins they contact Shopify/cli
Theme app extensions that contact third-party origins can now declare them under [extensions.capabilities.network_access] instead of leaving storefront requests undocumented. The PR marks this as needing server support before release: the platform still rejects unknown keys in a theme app extension's deploy config, so deploying an extension with the block fails until it accepts capabilities.net...
Let cart Remove buttons skip form validation Shopify/hydrogen
In the Nuxt example, React Router template, SolidStart and SvelteKit, a cart line's Remove button shares a form with its quantity input, so invalid text like abc made the browser show "Please match the requested format" and clicking Remove did nothing. Remove now reads only the line ID, so the button works regardless of what the quantity field holds.
Let cart Remove buttons skip form validation (#4259) Shopify/hydrogen
The mechanism is register("remove"), which now returns formNoValidate: true, letting the Remove submit skip validation of the interactive quantity input's digits-only pattern. One Playwright test for invalid-text Remove was dropped because input[type=number] cannot hold letters to begin with.
Reject hexadecimal IP addresses in theme network sources Shopify/cli
The same effort tightens validation of what an extension may declare: hexadecimal IP addresses are now rejected in theme network sources, which closes a notation that could slip past the origin check. Theme capabilities were also split out of the shared schema.
Action items
