Releasesby Glyph
Standardization of Asset URL Version Parameters
We're updating the format of versioning query parameters appended to store assets such as CSS and JS. Previously, some assets used a bare numeric query parameter, (for example, ?108 ), while others used a key-value format with the v query parameter. Moving forward, all asset URLs will consistently use the ?v=VERSION_STRING format for versioning.
Also shipped Jan 12, 2026Shopify in January 2026 →
WAF Release - 2026-01-12
This week's release focuses on improvements to existing detections to enhance coverage. Key Findings Existing rule enhancements have been deployed to improve detection resilience against SQL Injection.
See your organization’s AI credits usage history
Admins on Organization and Enterprise plans can now view historical AI credit usage data to better plan for future costs.
Email security - Enhanced visibility for post-delivery actions
The Action Log now provides enriched data for post-delivery actions to improve troubleshooting. In addition to success confirmations, failed actions now display the targeted Destination folder and a specific failure reason within the Activity field. Note Error messages will vary depending on whether you are using Google Workspace or Microsoft 365.
Rules - Metro code field now available in Rules
The ip.src.metro_code field in the Ruleset Engine is now populated with DMA (Designated Market Area) data. You can use this field to build rules that target traffic based on geographic market areas, enabling more granular location-based policies for your applications.
Security Center - Cloudflare Threat Events now support STIX2 format
We are excited to announce that Cloudflare Threat Events now supports the STIX2 (Structured Threat Information Expression) format. This was a highly requested feature designed to streamline how security teams consume and act upon our threat intelligence.
Workers - Validate your generated types with `wrangler types --check`
Wrangler now supports a --check flag for the wrangler types command. This flag validates that your generated types are up to date without writing any changes to disk. This is useful in CI/CD pipelines where you want to ensure that developers have regenerated their types after making changes to their Wrangler configuration.
More from Shopify developer platformEvery Shopify developer platform release →
Stricter Liquid parsing for themes and theme app extensions
Starting January 13, 2026, Shopify is enforcing stricter Liquid parsing for all themes. This improves code quality, prevents syntax errors, and enables future Liquid enhancements. If your theme contains Liquid code that doesn't meet the stricter parsing requirements, we'll automatically rewrite those files to be compatible.
Deprecated `deliveryShippingOriginAssign` mutation
Support for legacy mode profiles in shipping has been discontinued, as this feature has been inactive for some time. Consequently, the GraphQL Admin API is being updated to align with this change.
Shop Minis development now requires Partner account permissions
The Shop Minis CLI has been updated to ensure only authorized team members can create and manage Shop Minis. This is done by verifying the necessary permissions within your Partner organization. What's changing To develop Shop Minis, you must now have the Manage apps permission enabled on your Partner account.
Deprecating shopify_y and shopify_s cookies for Hydrogen
Shopify will stop setting the shopify_y and shopify_s cookies in 2026. If you use these cookies, your storefront will continue to work normally. However, if you don’t upgrade, visitor and session attribution won't be reliable in in Shopify Analytics. For Hydrogen storefronts, upgrade by April 30, 2026.
Storefront API now returns a specific error code when Cart Transform Functions fail
As of API version 2026-04, the Storefront API will return a MERCHANDISE_LINE_TRANSFORMERS_RUN_ERROR cart error code when a Cart Transform Function encounters a runtime error during cart operations such as cartCreate or cartLinesAdd .
Migrate metafields with `shopify app import-custom-data-definitions`
shopify app import-custom-data-definitions is now available in Shopify CLI version 3.89. This command helps you migrate existing metafield and metaobject definitions for your app to declarative TOML management . All app-owned definitions configured on your dev store are automatically converted to their TOML equivalent.
Localization support for POS UI extensions
Starting in POS 10.19, you can now localize your POS UI extensions for international merchants, staff, and customers. You can Translate extension text : Define locale files with translation strings that automatically resolve based on customer and shop locales.
shopify.app.extensions() in App Bridge now supports Admin and Theme app extensions
The shopify.app.extensions() method in App Bridge now supports Admin and Theme app extensions, in addition to the previously available checkout and customer account extensions. With this update, your embedded app can query the status of extensions across all major surfaces.