What's Changed

App

• Fix Cloudflare tunnel shutdown errors on Windows
• Prevent intermittent app deploy failures when UI extensions in the same folder build concurrently.
• Remove [extensions.capabilities.network_access] allowed_sources from theme app extensions; declare network origins with [network_access] allowed_sources in shopify.app.toml instead.

Store

• store create dev no longer fails with "Unable to determine store creation status."

Theme

• Fix shopify theme check --json failing when Theme Check reports an offense without a known position
• Fix links to other sites in theme dev and theme app extension previews

CLI

• Better error description for revoked or expired service account tokens.

Shopify CLI 5.0.0

What's Changed

CLI

• Upgrade cloudflared to 2026.10.3 #9019

Full Changelog: 4.9.4...4.9.5

What's Changed

App

• Require Git 2.38 or later when shopify app security check uses Git, because its protections against untrusted repositories depend on safe.bareRepository. Scans that don't use Git, such as --no-git-ignore with no Git-dependent secret candidate, still run without it by @jek in #8856
• Stop shopify app security check from running a command that a scanned repository names through an empty Git remote helper by @jek in #8856
• Add --print-instructions to shopify app security check to print coding-agent instructions. --yes still works but is deprecated, because it only selected printed instructions by @nickwesselman in #8878
• Add usage examples to shopify app security check --help for common scan layouts, such as an external backend, a configuration in a subdirectory, exclusions, Git-ignored files, and listing the scan scope by @nickwesselman in #8875
• State in the shopify app security check, record, and review help that each command reports the number of findings, but not finding details, to Shopify as usage telemetry by @nickwesselman in #8882

CLI

• Fix the check that stops the CLI from running a program found in the working directory on Windows, which covered only the CLI's own current directory by @jek in #8856

Full Changelog: 4.9.3...4.9.4

What's Changed

App

• Skip lockfiles in every shopify app security check scan directory, including --include-dir paths, so large repository-root lockfiles no longer leave the secret check unresolved by @jplhomer in #8825
• Check Dependabot and Renovate configuration at the app's Git repository root when the app is nested below it by @jplhomer in #8826
• Detect React Router code in additional directories, such as servers added with --include-dir and web/ directories, so the relevant source checks can run by @jplhomer in #8827
• Clarify agent-check instructions for React Router authentication, metafield writes, and frame-ancestors CSP policies, including when to report completed checks versus unresolved investigations by @jplhomer in #8830
• Clarify the --blocking levels and its none default, and when to use --skip-instructions, in shopify app security help by @jplhomer in #8853

Full Changelog: 4.9.2...4.9.3

What's Changed

CLI

• hydrogen/Bump cli-hydrogen to 13.0.6 by @andguy95 in #8840

Full Changelog: 4.9.1...4.9.2

What's Changed

CLI

• Fix event subscription handle validation in stable/4.9 by @isaacroldan in #8849

Full Changelog: 4.9.0...4.9.1

What's Changed

App

• Add shopify app security commands to check an app's source code for Shopify-specific security issues:
  • check runs deterministic rules and generates checks for your coding agent to investigate
  • record saves the agent's findings
  • review shows the combined results
  • instructions prints the workflow for a coding agent
  • clean removes local results

• Add app subscription-migrations commands by @tyler-eon in #8660
• Add shopify app import channel-config for partner channel spec import by @suzkiee in #8360
• Move import commands under a new app import topic by @nickwesselman in #8569
• Support target-level input query variables on functions by @saga-dasgupta in #8471
• Support optional owner_type in UI extension metafields by @kumar303 in #8534
• [Feature] Relative url patching on contract app extensions by @EliasJRH in #8362
• Stop reporting developer project errors as CLI crashes in build steps by @Suleimanlatrsh in #8627
• Fix repeated event config diffs when API versions are inherited by @cdarne in #8690
• Add --unsafe-validation to app dev by @dmerand in #8258
• Allow --config with --client-id on app deploy and dev by @isaacroldan in #8735
• Improve help for app config link flags by @gonzaloriestra in #8787

CLI

• Add --no-input to all commands by @gonzaloriestra in #8407
• Add --json-schema flag to commands by @gonzaloriestra in #8413
• Define JSON output schema for some commands (store commands, app versions list, organization list, version, config, auth)
• Print errors and events as JSON when using --json
• Fix text prompt underlines in Windows consoles by @amcaplan in #8489
• Recover gracefully when pnpm blocks build scripts during extension generation by @amcaplan in #8491
• Fix startup crash when the OS can't look up the current user's shell by @craigmichaelmartin in #8496
• Fix false success message when CLI self-upgrade installs the wrong version by @craigmichaelmartin in #8473
• [Feature] Add --language to doc fetch by @jplhomer in #8517
• Fix loading bar cleanup when tasks log messages by @gonzaloriestra in #8531
• Fix local storage initialization permission errors by @gonzaloriestra in #8572
• Retry gateway failures during device authorization by @gonzaloriestra in #8573
• Report unavailable shops and Admin API server errors instead of unknown CLI bugs by @Suleimanlatrsh in #8612
• Resolve store list --organization-id without listing every organization by @amcaplan in #8577
• hydrogen/Bump cli-hydrogen to 13.0.5 by @fredericoo in #8656
• Bump Shopify/theme-tools packages by @karreiro in #8668
• Write interactive prompts to stderr by default by @isaacroldan in #8812
• Remove lax Shopify API key secret check by @francisbeaudoin in #8503

Full Changelog: 4.8.0...4.9.0

What's Changed

Theme

• [4.8] Make theme init default to stable Skeleton releases by @karreiro in #8785

Full Changelog: 4.8.4...4.8.5

What's Changed

Theme

• [4.8] Bump Shopify/theme-tools packages by @karreiro in #8719
• [4.8] Restore theme documentation sync by @karreiro in #8723

Full Changelog: 4.8.3...4.8.4