Releasesby Glyph
New `article_list` input setting for themes
You can now add an article_list input setting to your theme sections and blocks. This new setting type outputs an article picker that lets merchants select multiple published articles, which can be used for creating featured article sections, related content areas, or article galleries.
Also shipped Jan 26, 2026Shopify in January 2026 →
Security Update: DoS vulnerability in Next.js and React Server Components
A denial-of-service (DoS) vulnerability (CVE-2026-23864, CVSS 7.5) has been disclosed affecting React Server Components (RSCs), a feature used by Next.js and other React metaframeworks. A malicious payload can cause memory exhaustion or excessive CPU consumption.
DuckDB 1.4.4 Bugfix Release
This is a bug fix release for various issues discovered after we released 1.4.3. Please excuse the erroneous release earlier. Cast Fix: Correctly handle negative exponent with a number with a decimal in VARCHAR -> INTEGER cast [Storage] Fix NULL filter check for constant segments fixing staged upload for install.duckdb.org - hopefully Remove undefined loop...
WAF Release - 2026-01-26
This week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 ( https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗ ). Key Findings CVE-2026-23864 ( https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗ ) affects react-server-dom-parcel , react-server-dom-turbopack , and react-server-dom-webpack packages.
Tailscale v1.94.1
Note : 1.94.0 was a release candidate intended for testing only. All Platforms New: tailscaled_home_derp_region_id client metrics are available. New: tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays .
FigJam diagramming in Claude
Prompt to turn conversations, documents, and images into visual diagrams to break down complexity and visualize the bigger picture.
Compiler cache for builds and Workflows
Control build caching behavior on EAS with environment variables to speed up subsequent builds by up to 30%.
More from Shopify developer platformEvery Shopify developer platform release →
Let buyers update subscription payment methods without leaving your extension
Buyers can now replace the payment method on their subscription contract without navigating away from your Customer Account UI extension. Simply invoke the intent and the native payment flow handles the rest, no need to store or display cards yourself.
Checkout UI extensions now default to non-blocking behavior
As of January 26, 2026, Checkout UI extensions that support blocking now default to non-blocking behavior. To enable blocking, merchants must explicitly activate the Allow app to block checkout setting in the checkout and accounts editor.
Ensuring POS UI extension stability by hardening callback handling
Starting with POS 10.19.0 , unhandled errors in extension callbacks trigger an error page instead of failing silently. This change ensures a more stable and predictable experience for merchants and helps developers identify issues proactively.
Events data now limited to one year retention
Access to events data older than one year is no longer available via the Admin GraphQL Event interface or the Admin REST events resource . This update is part of our ongoing efforts to optimize data management and improve system performance. Please review and update any dependencies on these events.
Enhanced Discount Function configuration with Admin UI extensions
Admin UI extensions for Discount Functions can now interact with the selected discount method and manage discount classes, letting you customize the discount configuration experience directly within the Shopify admin. This is a non-breaking change that adds new functionality to existing discount UI extensions.
Discouraging use of `receiptJson` on `OrderTransaction` in the GraphQL Admin API
We’re discouraging use of OrderTransaction.receiptJson . You should stop relying on receiptJson in production apps. receiptJson is gateway-defined , inconsistently shaped , and may change without notice . Because its structure isn’t stable or typed, changes can lead to unexpected app failures.
Localization support for POS UI extensions
Starting in POS 10.19, you can now localize your POS UI extensions for international merchants, staff, and customers. You can Translate extension text : Define locale files with translation strings that automatically resolve based on customer and shop locales.
shopify.app.extensions() in App Bridge now supports Admin and Theme app extensions
The shopify.app.extensions() method in App Bridge now supports Admin and Theme app extensions, in addition to the previously available checkout and customer account extensions. With this update, your embedded app can query the status of extensions across all major surfaces.