Skip to main content

App security updates: IP allowlist is now required

The IP allowlist is now required for every public app by November 20, or November 11 if you use bulk ops. ASN support covers serverless hosting. Plus token updates.
Read the full story
Changelog
Subscribe

Surfaces & APIs

Versions

Change type

Latest 2026-10Release candidate 2027-01

  1. November 2026

    Surface
    1. Order routing functions can now rank locations across multiple fulfillment groups in the unstable Function APIs.
      Functions
    2. IP allowlists are now required for public apps
      Action requiredPlatform
    3. App IP allowlists now support apps with serverless hosting through ASNs
      Dev Dashboard
    4. Test app network access configuration on dev stores
      Platform
    5. RETRY_DECLINED added to CustomerPaymentMethodRevocationReason
      GraphQL Admin API

  2. October 2026

    Surface
    1. currententrychange now returns the previous page in event.from for customer account full-page extensions
      Breaking changesCustomer Account API
    2. UI extensions now support a larger number of locales
      Platform
    3. Gift Card line_item_id will become read-only in REST Admin API version 2027-01
      Breaking changesAdmin REST API
    4. New trusted vault origin signal in Payments Apps API
      Payments Apps API
    5. FulfillmentOrderDestination now includes provinceCode
      GraphQL Admin API
    6. Shop SDK lead capture now supports Rich Authorization Requests
      Tools
    7. Start Sidekick conversations from your app
      App Bridge
    8. Editions: Fall 2026
    9. Shopify App Pricing: Plan Feature Targeting
      App store
    10. Shopify App Store: Estimated local-currency prices
      App store
    11. Merchant email now available on the ThemeSale object in the Partners API
      Themes
    12. Introducing theme app add-ons: Build and bundle apps with your themes
      Shopify Theme Store
    13. Make your app's activity reportable in Shopify Analytics with App Events
      App Events API
    14. App Events: Send events from Checkout and Customer Account UI extensions
      App Events API
    15. Shopify Flow: manage automations through AI Toolkit
      API
    16. Managed mode for Shopify Tax
      Breaking changesAdmin REST API
    17. First sign-ins to customer accounts now set Customer.state and send customers/enable webhooks
      GraphQL Admin API
    18. Add selling plans to draft order line items with the Admin GraphQL API
      GraphQL Admin API
    19. Cart and checkout permalinks now support UCP at /buy
      UCP
    20. Store and app install details in the Dev Dashboard
      Dev Dashboard
    21. Manage payouts, billing, and settings in Dev Dashboard
      Dev Dashboard

    22. Security update: Offline token dates, new security features

      Offline token enforcement dates, plus new security features: client credentials access, IP restrictions, network access declarations, identity verification, and a new app security hub.

      Platform
    23. Migrate to expiring offline access tokens before January 1, 2027
      Action requiredPlatform
    24. Secure your app with network access rules in shopify.app.toml
      Platform
    25. Restrict Admin API access with an IP allowlist
      Dev Dashboard
    26. Promoted Placements beta now includes Shop Campaigns
      Catalog
    27. Search brands that don't sell on Shopify in the Catalog API (beta)
      Catalog
    28. Analytics queryable capability is configurable in shopify.app.toml for metaobject definitions
      API
    29. Unlink a customer's identity provider subject with the GraphQL Admin API
      GraphQL Admin API
    30. Discover a merchant's retail stores with UCP location search and lookup
      UCP
    31. POS UI extensions now support reactive storage access
      POS Extensions
    32. POS UI extensions 2026-10 adds s-pos-list, a virtualized list with custom row templates
      POS Extensions
    33. Polaris 2.0 is now stable
      Polaris
    34. Metaobject analytics queryable capability available in the Admin API
      GraphQL Admin API

    35. Securing your app, together

      Act now to secure your app: We're asking every app dev to act this week. We have new tools to help, including AI security scans, expiring tokens, and better log filtering. Read on to learn how.

      Platform
    36. Enable the analytics queryable capability on metafield and metaobject definitions from your app's TOML
      Tools
    37. Exclusive > timestamp filters exclude the full second
      GraphQL Admin API
    38. Checkout MCP and Cart MCP now support UCP buyer consent
      UCP

    39. Build with confidence: Shopify AI Toolkit's security check

      Check your app for security vulnerabilities with `shopify app security check`. Run it before you submit an app, and on every release, to catch problems in your own code and get remediation guidance.

      AI Toolkit

    40. Hydrogen 2026-10 is now available

      The new Hydrogen is now GA: A framework-agnostic JavaScript library to add Shopify commerce to your existing stack, plus skills for coding agents and starters for React Router and Next.js.

      Hydrogen
    41. Add shopping and Shop Pay checkout to any agent with Shop MCP
      Tools
    42. Cart updates that result in no changes to the cart no longer trigger carts/update webhooks
      Ajax API
    43. Detect when a POS extension screen finishes navigating
      POS Extensions
    44. Identify the published version running in a POS extension
      POS Extensions
    45. Global Catalog REST API stops serving traffic on November 2, 2026
      DeprecatedCatalog
    46. Catalog API now returns compare-at prices as list_price
      Catalog
    47. Hydrogen developer preview update: October 8, 2026
      Hydrogen
    48. New owner_type field for metafield declarations in Checkout and Customer Account UI extensions, required in 2027-01
      Action requiredCheckout UI
    49. Shopify Flow: Flow Trigger Lifecycle Callback extensions now support relative url paths
      Tools
    50. Cart mutations reject unconfirmed writes in POS UI extensions 2026-10
      Breaking changesPOS Extensions
    51. POS UI extensions now return percentage values for percentage discounts
      Breaking changesPOS Extensions
    52. Per-customer request limit for the Customer Account API
      Customer Account API
    53. Downgrade app access scopes from write to read
      GraphQL Admin API
    54. Hydrogen developer preview update: October 2, 2026
      Hydrogen
    55. What's new in Polaris 2.0.0-rc.1
      Polaris

    56. More control over commerce updates with Next Gen Events

      Fewer deliveries, richer payloads, no follow-up queries: Events is a declarative replacement for classic webhooks, now generally available across 18 topics.

      Events & webhooks
    57. New Shop Campaigns metrics and dimensions in ShopifyQL API version 2026-10
      ShopifyQL
    58. Rollouts queries and webhooks in the Admin GraphQL API
      GraphQL Admin API
    59. Discounts can now be included in Rollouts
      Action requiredGraphQL Admin API
    60. Orders webhooks now include selling_plan_id on line items
      Events & webhooks
    61. New fiscalDeviceIdentifier field on PointOfSaleDevice
      GraphQL Admin API
    62. metafieldInteger collection condition removed in API version 2027-01
      Breaking changesGraphQL Admin API
    63. Added parseWarnings to ShopifyqlQueryResponse
      GraphQL Admin API
    64. The orderCancel mutation now returns a structured jobResult
      GraphQL Admin API
    65. SMS marketing consent now available on the CustomerPhoneNumber object
      Action requiredGraphQL Admin API
    66. Tax webhook summary and calculation requests now use Global IDs
      Breaking changesGraphQL Admin API
    67. New SubscriptionContractCalculation API for subscription management
      Action requiredGraphQL Admin API
    68. Inventory shipment webhooks include inventory transfer IDs
      Events & webhooks
    69. Updated function syntax on the segment query language
      Breaking changesGraphQL Admin API
    70. Return policy profiles are now available in the GraphQL Admin API
      GraphQL Admin API
    71. New APIs for buyer-requested order edits
      GraphQL Admin API
    72. New tax fields for return shipping fees in the GraphQL Admin API
      GraphQL Admin API

    73. 2026-10: Release notes

      Covers order tax recalculation, metafield filter errors, and removed checkout fields.

  3. September 2026

    Surface
    1. Use app intents for your discount app
      Functions
    2. More resilient token exchanges when migrating tokens without a user session
      GraphQL Admin API
    3. Manage packed product dimensions with the GraphQL Admin API
      GraphQL Admin API
    4. Move existing subscriptions to Shopify App Pricing
      App store
    5. Sidekick can now invoke app intents without tools
      Platform
    6. WebMCP support for checkout
      Platform
    7. AI Toolkit skills have been consolidated to shopify
      Action requiredAI Toolkit

    8. The new Dev Dashboard: your command center for building

      One home for your apps and the stores you work in: Designed to make your everyday easier.

      Dev Dashboard
    9. Shopify Payments Balance Transaction GraphQL type supports currency conversion type
      GraphQL Admin API
    10. Polaris 2.0 release candidate
      Polaris
    11. Events subscription query complexity limit is changing to 100 points
      Breaking changesEvents & webhooks
    12. Polaris CDN 1.1 is now stable
      Polaris
    13. Removing marketCurrencySettingsUpdate mutation
      Breaking changesGraphQL Admin API
    14. Unlimited private plans and target stores in Shopify App Pricing
      App store
    15. New translatable boolean field for Metafield GraphQL Object
      GraphQL Admin API
    16. The automaticDiscounts query is removed in API version 2027-01
      Breaking changesGraphQL Admin API
    17. Request a bundle size exception for existing UI extensions
      Admin Extensions
    18. Adding a canceled receive action to the inventory shipments API
      GraphQL Admin API
    19. Removed session.currentSession.staffMemberId from POS UI Extensions (2026-10)
      Breaking changesPOS Extensions
    20. Purchase Order Read API
      GraphQL Admin API
    21. Query market hierarchies with the GraphQL Admin API
      GraphQL Admin API
    22. New Pricing audit trail for contextual product variant prices
      GraphQL Admin API