$ cat shopify/week/2026-09-28.log
the week in review · Sep 28 – Oct 4, 2026
Hydrogen moves consent to CTA async API
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Hydrogen's consent init now fetches and caches Customer Privacy data before analytics starts, replacing its own consentManagement request.
Use CTA async consent for classic Hydrogen Shopify/hydrogen
Consent and visitor tokens now have a single owner: initialization moves to CTA async, and Hydrogen stops issuing its own consentManagement request or coordinating the response with the Customer Privacy API. The PR notes this removes tracking-value Server-Timing from classic Hydrogen.
@shopify/hydrogen-react@2026.4.4 Shopify/hydrogen
Shopify's consent API now returns visitor tracking values in the consentManagement response, so the Customer Privacy API fetches and caches them before analytics starts. If you read consent state directly, the values now arrive asynchronously rather than from Hydrogen's separate request.
@shopify/hydrogen@2026.4.7 Shopify/hydrogen
Fixed the React hydration interruption caused by Analytics.Provider state updates. Deferred cart, shop, and consent updates are wrapped in startTransition, so React no longer abandons server-rendered HTML while Suspense boundaries are still dehydrating.
@shopify/cli-hydrogen@13.0.6 Shopify/hydrogen
`h2 env pull` no longer corrupts values containing backslashes, double quotes, or tabs. Values are single-quoted where possible so dotenv reads them back exactly, and `$` and backticks stay unexpanded if the .env file is sourced by a shell.
@shopify/create-hydrogen@5.0.40 Shopify/hydrogen
`h2 init --template skeleton` now behaves the same as leaving the flag out instead of pulling GitHub's latest release. New projects get dependency install, .env and name setup, and every other flag honored.
Add --ignore to app security check and instructions Shopify/cli
Each `--ignore` value is one .gitignore line relative to the app directory. Patterns take precedence over the default and gitignore exclusions, and a leading `!` re-includes files; later patterns win over earlier ones.
Merge pull request #8697 from lopez-mar/fix/shopify-only-secret-prefixes Shopify/cli
App security secret findings are now limited to Shopify tokens, so unrelated credentials in your repo stop surfacing in the report.
Prioritize recent flaky tests in the automated testing task Shopify/cli
The automated testing task now reviews every Main tests workflow run from the last seven days and puts flaky-test fixes ahead of coverage gaps. Alongside: theme-tools bumped to @shopify/theme-check-node 3.29.1, and the App Doctor and App Security changesets were pulled from public release notes until that feature ships.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.