$ cat shopify/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
Shopify CLI ships typed JSON output across app commands
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Deploy, execute, webhook trigger, and custom-data import now return machine-readable results, and Hydrogen 2026.10 breaks silent cart caching in direct ports.
Add typed JSON output to app deploy Shopify/cli
The deploy command now emits --json for the app, the created version, and the release state, so CI can branch on the outcome instead of scraping stdout. A declined confirmation returns a cancelled result rather than a prompt that hangs a script, as reported in the change description. The same treatment covers app execute, webhook trigger, and the custom-data-definitions import.
Add typed JSON output to app execute Shopify/cli
app execute returns native {data, extensions?} results under --json and shares fatal error shapes with GraphQL details, which means a script can read the GraphQL response directly. Webhook trigger follows with topic, API version, delivery method, address, and delivery status. The stated goal in both: let scripts read results rather than parse human output.
Tell migrating agents to add a cache to every formerly uncached query Shopify/hydrogen
The migration skill now tells agents to add a cache to every query that previously relied on CacheDefault(). The 2026-10 client caches only when a query passes a cache option, so a straight port keeps running with no caching at all and no error. If you migrate by hand rather than through the skill, audit your query definitions yourself.
docs(skill): warn that CSP/nonce is app-owned in 2026-10 Shopify/hydrogen
2026-10 removes createContentSecurityPolicy, NonceProvider, and useNonce, and leaves CSP entirely to the app. A migrator that keeps a strict CSP without porting the nonce threading into the router and Scripts components will not get a warning from the framework: the docs skill now flags it explicitly. This is the sharpest edge in the Hydrogen migration, not the caching change.
Fix the opaque error when a 2026.4 storefront installs @shopify/hydrogen 2026.10 Shopify/hydrogen
Storefronts on 2026.4 with Dependabot or ^ ranges pick up @shopify/hydrogen 2026.10 and fail with "does not provide an export named 'hydrogen'". The fix does not change that; it replaces the opaque error with a message explaining what happened and how to pin back, which is the difference between a five-minute fix and an afternoon. Pin the version if your install ranges float.
Handle multi-line cart changes and changes during the first cart load Shopify/hydrogen
Multi-line updates and removals through Shopify.actions.updateCart({ lines: [a, b] }) get no optimistic state, no pending entries, and no rollback, so the UI keeps showing lines the server already removed. Changes made during the first cart load had a related race. Both now handled.
Only require sessionManager when a handler needs it Shopify/hydrogen
handleShopifyRoutes now infers whether a sessionManager is needed from the registered handlers instead of requiring one unconditionally. Cart-only apps can drop the placeholder manager they were forced to construct just to make the call go through.
Merge pull request #8888 from Shopify/security-graphql-cache-principal Shopify/cli
Alongside: GraphQL response caching is now partitioned by endpoint and token, GraphiQL configuration is serialized safely in inline scripts, security command help discloses telemetry, and the CLI stopped permitting a resolved-findings count in app metadata because findings lack stable identities.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.