$ cat shopify/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Hydrogen drops Storefront API redirects after token leak risk
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Shopify CLI spends the same week putting typed JSON output on theme and app security commands, and shipping patch 2026.10.2 for Hydrogen carts.
Don't follow Storefront API redirects Shopify/hydrogen
Previously a redirect from Shopify's API was followed and the request replayed, with the store's secret API token, to wherever it pointed. Hydrogen now refuses and stops with an error, so any storefront that silently survived a redirect will surface it as a failure instead.
Add hydrogen-branches skill mapping the new vs classic Hydrogen branches Shopify/hydrogen
New Hydrogen replaced classic Hydrogen on main on 2026-10-09, with classic content moved to the 2026-04 back-fix branch, and nothing in the repo documented it. The new skill maps the branches so humans and agents pick the right base before branching.
@shopify/hydrogen@2026.10.2 Shopify/hydrogen
Patch 2026.10.2 stops a cart change made during an in-flight cart load from hiding the shopper's other lines or leaving loading stuck at true. The store revalidates the cart once the change settles, including when it was destroyed and reconnected in between.
Add typed JSON output to theme metafields pull Shopify/cli
Part of a sweep that gives theme commands a strict, discoverable JSON contract for metafields pull, joining package, init, check, and profile. Scripting theme pipelines no longer means parsing human-formatted output.
Use exponential backoff for throttled API requests Shopify/cli
Fixed one-second retries could exhaust before shared API quota recovered; throttled requests now back off exponentially, and retries are no longer synchronized across concurrent operations.
Bump MiniOxygen's undici from 7.24.0 to 7.30.1 Shopify/hydrogen
@shopify/mini-oxygen moves its exact undici pin from 7.24.0 to 7.30.1, past a batch of upstream advisories fixed between 7.28.0 and 7.30.1. Dev-server exposure only, but the pin stays exact, so no action on your side beyond upgrading.
Drop Oxygen-Cache-Control from private responses (#4174) Shopify/hydrogen
Oxygen's full-page cache reads only Oxygen-Cache-Control, so Hydrogen now deletes every vendor *-Cache-Control header when it marks a response private. A private response that carried the vendor header could get cached at the edge.
Exempt inert schema-typed Liquid settings from LIQUID_UNSAFE_RENDER Shopify/cli
LIQUID_UNSAFE_RENDER no longer flags block.settings.* and section.settings.* outputs whose values the extension schema fixes, such as select and checkbox settings, so schema-typed output stops generating false findings.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.