$ cat shopify/month/2026-10-01.log
the month in review · October 2026
Shopify CLI 5.0 ships standardized JSON output
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The release makes nearly all commands machine-readable for agentic workflows and breaks existing output formats, alongside Hydrogen 2026.10.
5.0.0 Shopify/cli
Nearly every CLI command now emits a standardized JSON format, and `app dev` is tuned for agent-driven loops. Anything parsing CLI stdout in CI needs the migration guide before the bump; the release also drops `--app-security-check-yes` and `check --clean` in favor of an `app security clean` command.
Align unreleased JSON outputs Shopify/cli
The JSON shape was locked ahead of release specifically to avoid a second breaking change: the team aligned unreleased flags on shared conventions and fixed a serialization issue in GraphiQL rendering. The format that shipped in 5.0 is the one you migrate to, not an interim one.
@shopify/hydrogen@2026.10.0 Shopify/hydrogen
Product pages now accept Liquid-style `?variant=<numeric id>` links, and `handleShopifyRoutes({routeTemplates})` 302-redirects those URLs to the canonical option-params form: `/products/x?variant=123` becomes `/products/x?Color=Red&Size=M`. Storefronts that relied on the raw query param surviving into their own routing need to account for the redirect.
@shopify/hydrogen@2026.10.2 Shopify/hydrogen
A cart edit made while a cart load is still in flight no longer blanks other lines or leaves `loading` stuck at `true`, and the store revalidates once the change settles, including after a disconnect and reconnect. Hydrogen 2026.4.7 separately wraps Analytics.Provider updates in `startTransition` so deferred cart, shop, and consent state stops abandoning server-rendered HTML mid-hydration.
@shopify/cli-hydrogen@13.0.6 Shopify/hydrogen
`h2 env pull` was backslash-escaping `\`, `"`, and tabs inside double quotes, but dotenv has no general escape syntax, so values did not round-trip through `h2 dev`, `h2 env push`, or `h2 deploy`. Values are now single-quoted where possible, and `$` and backticks no longer expand if the file is sourced by a shell.
Add `--no-input` to all commands Shopify/cli
`--no-input` sets prompts, browser launches, and other interactive behavior off independently of the output format, which is the split scripts and agents need. Pairing it with the JSON flags gives non-interactive runs a supported path instead of piping stdin closed.
Add --ignore to app security check and instructions Shopify/cli
`app security check` takes `--ignore` values that are each one .gitignore line relative to the app directory, and those patterns take precedence over the default and gitignore exclusions, with a leading `!` re-including ignored files. Later patterns win.
@shopify/create-hydrogen@5.0.40 Shopify/hydrogen
`h2 init --template skeleton` and the equivalent `npm create @shopify/hydrogen` invocation now behave like omitting the flag: dependencies install, `.env` and the project name are set up, and other flags are honored, rather than pulling GitHub's latest release.
$ ls shopify/month/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.