$ cat shopify/week/2026-09-14.log
the week in review · Sep 14 – Sep 20, 2026
App doctor drops CVE audit and lax key check
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Shopify CLI reshaped App Doctor's checks and began reporting which AI agent ran a command.
Merge pull request #8555 from Shopify/joshlarson/remove-app-doctor-cve-audit Shopify/cli
App Doctor no longer audits dependencies for CVEs, so the security findings that used to surface during a doctor run are gone from that command entirely. Pair it with a dedicated scanner or you lose the coverage silently. The follow-up work then adds a dependency-automation check that flags missing configuration without interpreting CI workflows or shell commands.
Remove lax Shopify API key secret check Shopify/cli
App Doctor had treated any api_key, client_id, or SHOPIFY_API_KEY assignment containing 32 hex characters as a hardcoded secret, which flagged legitimate public identifiers such as public client IDs in application code. The pattern is gone, so those false positives stop blocking a run.
Add AI agent detection to CLI analytics Shopify/cli
The CLI now uses @vercel/detect-agent to identify which agent is running it and reports the name as n:<name> inside SHOPIFY_CLI_AGENT_INFO, the same packed field the Shopify AI toolkit uses for agents that declare themselves. Detection only feeds analytics, so nothing in your build output changes.
Support target-level input query variables on functions Shopify/cli
Input queries were always per-target, one input_query per [[targeting]] entry, but their variables were per-function, with a single extension-level input.variables applied to every target. Variables now follow the targeting entry they belong to, which matters if you have one extension shipping different inputs per target.
Add JSON schema to organization list Shopify/cli
shopify organization list --json is now a typed, discoverable contract, and the command returns public organization data consumers can use without a second API request.
Fix loading bar cleanup when tasks log messages Shopify/cli
Calling outputInfo() or outputWarn() during an Ink task wrote straight to stderr and left the loading bar stranded when the task finished. stderr logs now go through Ink's existing console interception, so long-running task output no longer corrupts the progress display.
Check for dependency automation configuration files in App Doctor Shopify/cli
With package-manager CVE audits removed, App Doctor instead checks for the presence of dependency-automation configuration files and flags when they are missing, without attempting to parse your CI workflows or shell commands.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.