RepoJournal
Shopify Shopify
127 wires and counting

$ follow Shopify

Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-11-07
stories 10
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Hydrogen moves CSP into the core package, and a Vite build fix stops 500s on Oxygen

By RepoJournal · Filed · About Shopify · Composed from the cited sources · methodology

Fran Dios isaacroldan andguy95
3 people shipped this
Fran Dios @frandiox 2 cited isaacroldan @isaacroldan 1 cited andguy95 @andguy95 1 cited

Hydrogen shipped framework-independent Content Security Policy utilities with stable Shopify bootstrap hashes, while a mini-oxygen fix stops React Router 8 storefronts from deploying without oxygen.json and returning 500 on every page.

fix(mini-oxygen): write oxygen.json in Vite Environment API builds Shopify/hydrogen

by andguy95

Apps built with React Router 8, or React Router 7 with future.v8_viteEnvironmentApi, deployed to Oxygen without dist/server/oxygen.json and fell back to the 2022-10-31 compatibility date, where Headers.getSetCookie() does not exist: every Storefront API request failed and every page returned 500. The oxygen() Vite plugin now writes that file in those builds.

Add framework-independent Content Security Policy utilities Shopify/hydrogen

by frandiox

The non-React path gets the same CSP story as classic Hydrogen: createContentSecurityPolicy({shop}) returns a policy with shared Shopify directives and a per-document nonce, and csp.applyResponseHeaders(response) writes them out, so React Router templates and the other supported frameworks no longer carry an app-local implementation. This is flagged as breaking, so check any hand-rolled CSP mid...

feat(hydrogen): add static Shopify script hashes for CSP (#4299) Shopify/hydrogen

by Fran Dios

Shopify's inline bootstraps used to embed shop, locale, and analytics configuration directly in executable JavaScript, so each combination produced a different hash and could not be pre-authorized. Configuration now lives in escaped data attributes and the bootstraps are byte-stable, with hashes collected from asInlineScript calls at build time and exported for Astro's and SvelteKit's native CS...

Treat HTTP 520 to 524 from the Admin API as gateway errors Shopify/cli

by isaacroldan

Theme Admin API reads run with handleErrors: false, so a raw ClientError from graphql-request reached shouldReportErrorAsUnexpected, and isExpectedApiError only accepted 401, 429, 502, 503, and 504. Cloudflare 520 to 524 responses now classify as gateway errors instead of being reported as an unexpected CLI bug.

$ ls shopify/reviews/ # the step-back reads

the week in review Shopify CLI goes machine-readable for agent tooling the month in review Shopify CLI 5.0 ships standardized JSON output
Full archive → Weekly reviews →

Quick answers

What shipped in Shopify on November 7, 2026?
Hydrogen shipped framework-independent Content Security Policy utilities with stable Shopify bootstrap hashes, while a mini-oxygen fix stops React Router 8 storefronts from deploying without oxygen.json and returning 500 on every page. In total, 5 commits and 5 pull requests landed.
Who contributed to Shopify on November 7, 2026?
3 developers shipped this update, including isaacroldan, Fran Dios, and andguy95.
What were the notable Shopify updates?
fix(mini-oxygen): write oxygen.json in Vite Environment API builds, Add framework-independent Content Security Policy utilities, and feat(hydrogen): add static Shopify script hashes for CSP (#4299).
♥

$ log Shopify --recent

Hydrogen stops leaking client IPs, app dev stops crashing on bad frames 21 shipped Theme tooling goes machine-readable, docs drift breaks CI 45 shipped Theme dev server stops forcing the exit page, and GraphiQL learns JSON 12 shipped MiniOxygen moves to Miniflare 4, Hydrogen stops replaying analytics events 17 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.