$ cat shopify/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
Shopify CLI goes machine-readable for agent tooling
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Theme dev, theme console, GraphiQL and the language server gain JSON output while Hydrogen ships a runtime bump and several proxy fixes.
Remove network_access allowed_sources from theme app extensions Shopify/cli
The capability shipped in 5.0.0 but the platform never enabled it, so no app could use it; the declaration is now gone from theme app extensions. Anyone who added allowed_sources on the strength of the 5.0.0 notes should remove it.
Add JSONL output to theme dev Shopify/cli
`--json` (`-j`) streams the same JSONL bytes to stdout and the Dev Instance log using the shared log schema. This is the piece that lets a script follow a running dev session without scraping terminal output.
Support JSON flags for the theme language server Shopify/cli
The language server was already emitting JSON over LSP but declared no output schema, and CLI errors could corrupt its stdout when JSON was on globally. Both gaps close here.
Add finite JSON execution to theme console Shopify/cli
Repeatable `--script` flags and a mutually exclusive `--script-file` let a caller evaluate Liquid commands and stop, with no interactive terminal in the loop.
Upgrade MiniOxygen to Miniflare 4 Shopify/hydrogen
MiniOxygen was pinned to Miniflare 3.20250310.1, so local Hydrogen development ran on a March 2025 Workers runtime. It moves to runtime 2026-07-30, and the one behaviour change that would otherwise crash `vite dev` is handled.
fix(hydrogen): clean up forwarding headers from Shopify proxies Shopify/hydrogen
The `/__shopify`, `.well-known`, and UCP MCP proxies now strip client IP and forwarding headers before calling the store, matching what the Storefront API, MCP, and AJAX proxies already did.
fix(analytics): re-added destinations no longer replay retained events Shopify/hydrogen
Re-adding a destination under a name that had been removed handed it every retained event again, up to 500. The follow-up to #4068 closes that replay path.
ci: fail when generated shopify.dev docs are out of date Shopify/hydrogen
Nothing compared the committed generated docs data against source, so it drifted; the file is regenerated and a CI step now fails when it goes stale. Alongside: the Windows Cloudflare tunnel crash on `app dev` stop and auto-upgrade pulling a new major from `@latest` (4.8.4 to 5.0.0) both got fixes.
$ ls shopify/week/ # the briefings behind this review
Keep up with Shopify in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.