End-of-life API version
Detects parsed config and React Router server API versions past the 12-month support window and 30-day grace period.
| Detail | Value |
|---|---|
| Check ID | EOL_API_VERSION |
| Severity | Low |
| How it runs | Deterministic scan and agent review |
Anchor to Vulnerable exampleVulnerable example
app/shopify.server.ts
const shopify = shopifyApp({
// Past the 12-month support window plus the 30-day grace
// period. Removed fields start returning errors without a
// deploy on your side.
apiVersion: ApiVersion.January24,
});
// The same version is declared in configuration, and the check
// reads both:
//
// # shopify.app.toml
// [webhooks]
// api_version = "2024-01"
Anchor to How to fixHow to fix
Update api_version in shopify.app.toml and the ApiVersion enum in shopify.server.ts.
Move to the latest stable version, rather than the oldest one that's still supported, so that you get the full 12-month support window before you need to update again.
For more detail, see API versioning.
app/shopify.server.ts
const shopify = shopifyApp({
apiVersion: ApiVersion.October26,
});
export const apiVersion = ApiVersion.October26;
// Update both places: the check reads every shopify.app*.toml as
// well as the React Router server declaration.
//
// # shopify.app.toml
// [webhooks]
// api_version = "2026-10"
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?