Securing your app, together
Act now to secure your app: We're asking every app dev to act this week. We have new tools to help, including AI security scans, expiring tokens, and better log filtering. Read on to learn how.
October 2026
Surface- GraphQL Admin APIMetaobject analytics queryable capability available in the Admin API
- UCPCheckout MCP and Cart MCP now support UCP buyer consent
- Build with confidence: Shopify AI Toolkit's security check
Check your app for security vulnerabilities with `shopify app security check`. Run it before you submit an app, and on every release, to catch problems in your own code and get remediation guidance.
AI Toolkit

- Hydrogen 2026-10 is now available
The new Hydrogen is now GA: A framework-agnostic JavaScript library to add Shopify commerce to your existing stack, plus skills for coding agents and starters for React Router and Next.js.
Hydrogen

- ToolsAdd shopping and Shop Pay checkout to any agent with Shop MCP
- Ajax APICart updates that result in no changes to the cart no longer trigger carts/update webhooks
- POS ExtensionsDetect when a POS extension screen finishes navigating
- POS ExtensionsIdentify the published version running in a POS extension
- DeprecatedCatalogGlobal Catalog REST API stops serving traffic on November 2, 2026
- CatalogCatalog API now returns compare-at prices as
list_price - HydrogenHydrogen developer preview update: October 8, 2026
- Action requiredCheckout UINew
owner_typefield for metafield declarations in Checkout and Customer Account UI extensions, required in 2027-01 - ToolsShopify Flow: Flow Trigger Lifecycle Callback extensions now support relative url paths
- Breaking changesPOS ExtensionsCart mutations reject unconfirmed writes in POS UI extensions 2026-10
- Breaking changesPOS ExtensionsPOS UI extensions now return percentage values for percentage discounts
- Customer Account APIPer-customer request limit for the Customer Account API
- GraphQL Admin APIDowngrade app access scopes from write to read
- HydrogenHydrogen developer preview update: October 2, 2026
- PolarisWhat's new in Polaris 2.0.0-rc.1
- More control over commerce updates with Next Gen Events
Fewer deliveries, richer payloads, no follow-up queries: Events is a declarative replacement for classic webhooks, now generally available across 18 topics.
Events & webhooks

- ShopifyQLNew Shop Campaigns metrics and dimensions in ShopifyQL API version 2026-10
- GraphQL Admin APIRollouts queries and webhooks in the Admin GraphQL API
- Action requiredGraphQL Admin APIDiscounts can now be included in Rollouts
- Events & webhooksOrders webhooks now include selling_plan_id on line items
- GraphQL Admin APINew fiscalDeviceIdentifier field on PointOfSaleDevice
- Breaking changesGraphQL Admin API
metafieldIntegercollection condition removed in API version 2027-01 - GraphQL Admin APIAdded parseWarnings to ShopifyqlQueryResponse
- GraphQL Admin APIThe
orderCancelmutation now returns a structuredjobResult - Action requiredGraphQL Admin APISMS marketing consent now available on the CustomerPhoneNumber object
- Breaking changesGraphQL Admin APITax webhook summary and calculation requests now use Global IDs
- Action requiredGraphQL Admin APINew SubscriptionContractCalculation API for subscription management
- Events & webhooksInventory shipment webhooks include inventory transfer IDs
- Breaking changesGraphQL Admin APIUpdated function syntax on the segment query language
- GraphQL Admin APIReturn policy profiles are now available in the GraphQL Admin API
- GraphQL Admin APINew APIs for buyer-requested order edits
- GraphQL Admin APINew tax fields for return shipping fees in the GraphQL Admin API
2026-10: Release notes
Covers order tax recalculation, metafield filter errors, and removed checkout fields.
September 2026
Surface- FunctionsUse app intents for your discount app
- GraphQL Admin APIMore resilient token exchanges when migrating tokens without a user session
- GraphQL Admin APIManage packed product dimensions with the GraphQL Admin API
- App storeMove existing subscriptions to Shopify App Pricing
- PlatformSidekick can now invoke app intents without tools
- PlatformWebMCP support for checkout
- Action requiredAI ToolkitAI Toolkit skills have been consolidated to
shopify - The new Dev Dashboard: your command center for building
One home for your apps and the stores you work in: Designed to make your everyday easier.
Dev Dashboard

- GraphQL Admin APIShopify Payments Balance Transaction GraphQL type supports currency conversion type
- PolarisPolaris 2.0 release candidate
- Breaking changesEvents & webhooksEvents subscription query complexity limit is changing to 100 points
- PolarisPolaris CDN 1.1 is now stable
- Breaking changesGraphQL Admin APIRemoving marketCurrencySettingsUpdate mutation
- App storeUnlimited private plans and target stores in Shopify App Pricing
- GraphQL Admin APINew translatable boolean field for Metafield GraphQL Object
- Breaking changesGraphQL Admin APIThe
automaticDiscountsquery is removed in API version 2027-01 - Admin ExtensionsRequest a bundle size exception for existing UI extensions
- GraphQL Admin APIAdding a canceled receive action to the inventory shipments API
- Breaking changesPOS ExtensionsRemoved session.currentSession.staffMemberId from POS UI Extensions (2026-10)
- GraphQL Admin APIPurchase Order Read API
- GraphQL Admin APIQuery market hierarchies with the GraphQL Admin API
- GraphQL Admin APINew Pricing audit trail for contextual product variant prices
- Action requiredEvents & webhooksUpdates to Events payloads and subscription configuration
- CatalogFilter Catalog search results by media type
- GraphQL Admin APIDynamic complexity cost for
metafieldsSetmutation - PolarisPrepare your app for the Shopify admin's new look
- Payments Apps APIfamily_name is optional for B2B orders in Payments Apps API requests
- FunctionsDelivery options in Shopify Functions input now expose their metafields
- HydrogenHydrogen developer preview update: September 11, 2026
- Action requiredGraphQL Admin APIDiscounts Allocator Function API developer preview has ended
- Shopify CLICreate and delete dev stores in Shopify CLI
- Action requiredGraphQL Admin APIVariants now support multiple barcodes
- DeprecatedCheckout UICustomer Address APIs now support countryCode
- UCPShopify storefronts now support UCP 2026-08-25
- HydrogenHydrogen developer preview update: September 2, 2026
- GraphQL Admin APINew paymentInstrumentSendAddEmail mutation emails customers a link to add a payment method for a subscription, order, or draft order
August 2026
Surface- PolarisPolaris CDN 1.1 release candidate
- PolarisThe Polaris CDN is adopting semantic versioning
- GraphQL Admin APIMore resilient refreshes for expiring offline access tokens
- Action requiredThemesPassword Protected Shop Dev flows on Shopify Theme CLI v3.83.x and older to be deprecated
- Events & webhooksFour additional topics are now available for Events
- ToolsBuild Shopify apps in PHP and Python with new official packages
- ThemesGitHub commits now name the last theme editor
- HydrogenOxygen is now available on trial plan stores
- Action requiredGraphQL Admin APIScript tags are deprecated and will stop running on March 1, 2027
- PlatformApp intents on
admin.app.intent.linknow open as a full-page navigation - HydrogenHydrogen developer preview update: August 18, 2026
- GraphQL Admin APIShop Campaigns performance data now available via ShopifyQL
- PlatformStandard storefront events and actions now support cart attributes
- GraphQL Admin APIDraft order and transfer/shipment inventory is moving from reserved to committed
- PlatformWebMCP support for Liquid and Hydrogen storefronts
- HydrogenOxygen is now available on development stores
- GraphQL Admin APIThe
orderCreatemutation now supports multiple tracking numbers for each fulfillment - Built for ShopifyUpdated Built for Shopify requirements for Fulfillment services apps
July 2026
Surface- HydrogenHydrogen developer preview update: July 30, 2026
- GraphQL Admin APINew fields for cash management activities and drawers in POS
- Dev DashboardMerchants now see partner details on collaborator requests
- ThemesThe shopify-account component for customer accounts is now a Theme Store requirement
- FunctionscreatedAt is now available on the Customer object in Shopify Functions
- Breaking changesGraphQL Admin APIUpdating an order's shipping address recalculates taxes as of API version 2026-10
- POS ExtensionsPOS UI extensions can now print directly to hardware receipt printers
- GraphQL Admin APISubscriptionContractCalculation API now available in early access
- Breaking changesGraphQL Admin APIInvalid metafield queries now return errors in the GraphQL Admin API