$ the-wire · showcase
Hydrogen stops leaking client IPs, app dev stops crashing on bad frames
By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology
Hydrogen closes a header-forwarding leak in three of its proxies and restores its Storefront User-Agent, while the CLI hardens app dev against hostile WebSocket clients and fixes an auto-upgrade that crossed a major version.
fix(hydrogen): clean up forwarding headers from Shopify proxies Shopify/hydrogen
The /__shopify, .well-known, and UCP MCP proxies built upstream headers in deny mode and only stripped hop-by-hop headers, host, content-length, and cf-connecting-ip, so X-Forwarded-For and Shopify-Storefront-Buyer-IP reached the store. They now remove client IP and forwarding headers before the upstream fetch, matching what the Storefront API, MCP, and AJAX proxies already did.
fix(hydrogen): restore the Hydrogen User-Agent on Storefront API requests (#4301) Shopify/hydrogen
Hydrogen 2026.4 sent User-Agent: Hydrogen <version> on every Storefront API request; the 2026.10 client stopped. Server-side requests now identify as Hydrogen again, the same way classic Hydrogen does, and tests pin the exact value so deduplicating the constant cannot quietly change it.
Fix auto-upgrade installing a new major version from @latest Shopify/cli
Auto-upgrade checked the cached latest version for a major bump but then installed @shopify/cli@latest, so a user on 4.8.4 was upgraded to 5.0.0 when the cache lagged the registry. The check and the install now agree on which version is being installed.
Fix app dev exiting on non-JSON extensions WebSocket messages Shopify/cli
getOnMessageHandler called JSON.parse on every /extensions WebSocket message without a try/catch, so a non-JSON text message threw a SyntaxError out of the message listener and killed shopify app dev. The SyntaxError is now caught, logged via outputDebug, and the message ignored, with a regression test in handlers.test.ts.
fix(hydrogen): trim trailing slashes from request paths in linear time Shopify/hydrogen
stripTrailingSlash and handleUrlRedirects both ran /\/+$/ on request paths, which goes quadratic on a long run of slashes followed by another character, so a crafted path could hold a worker for seconds. A plain loop replaces the regex.
Fix app dev crash on malformed /extensions WebSocket frames Shopify/cli
Separately, getConnectionDoneHandler registered no error listener on the /extensions sockets, so a protocol error such as a frame over maxPayload surfaced as an unhandled RangeError and took the local proxy down with app dev.
