$ cat shopify/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Hydrogen 2026.10 redirects variant URLs, a breaking change
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The same week, Shopify CLI locked JSON conventions and moved prompts to stderr ahead of 4.9.0.
@shopify/hydrogen@2026.10.0 Shopify/hydrogen
Product pages now accept Liquid-style ?variant=<numeric id> links: handleShopifyRoutes({routeTemplates}) 302-redirects /products/x?variant=123 to /products/x?Color=Red&Size=M. Anything downstream that read the numeric id off the query string, including analytics and client-side variant pickers, needs to handle the redirected URL instead.
Align unreleased JSON outputs Shopify/cli
The merged-command portion of step 2 in the JSON conventions and migration plan lands here. The stated goal is to align the new JSON flags before any of them ship, avoiding a breaking change in the next release.
Write interactive prompts to stderr by default Shopify/cli
Interactive prompts default to stderr, keeping prompt text and terminal control codes out of stdout alongside command results. Explicit output stream overrides still work, but stdin and stderr are now required.
Add typed JSON output to concurrent process rendering Shopify/cli
Finite concurrent processes could write terminal text to stdout in JSON mode and corrupt the command result. Concurrent output now routes through typed JSON, stacked on the stderr prompt defaults.
Add typed JSON output to app bulk status Shopify/cli
app bulk status gains typed JSON so callers can read bulk-operation state without parsing terminal output; the command shares the common bulk-operation and context schemas.
Publish /snapit snapshots through release.yml with npm OIDC Shopify/hydrogen
/snapit had been broken since 2025-12-09, when npm revoked classic tokens and the NPM_TOKEN it relied on stopped working; every run since then failed. Snapshots now publish through release.yml with npm OIDC.
Validate --client-id in App Security check, record and review Shopify/cli
The --client-id value is now looked up in the user's account, as deploy does, before gathering, scanning, writing or reading results and before the no-app-configuration prompt. The TOML client_id and the picker's client ID are not looked up.
Merge pull request #8763 from Shopify/app-security/nested-app-configs Shopify/cli
App Security now warns when it scans another app's files, covering nested app configurations.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.