Releasesby Glyph
Removing deprecated PRIVATE and PUBLIC_READ enums on metaobject definitions
We are updating the MetaobjectAdminAccess enum by deprecating the PRIVATE and PUBLIC_READ values. These values are now obsolete and are never returned by the API. This change removes ambiguity, as the deprecated access values do not accurately reflect the actual access behaviors.
Also shipped May 20, 2026Shopify in May 2026 →
WAF Release - 2026-05-20
Key Findings Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. Continuous Rule Improvements We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns.
Request-based autoscaling for App Platform is now in general availability
Request-based autoscaling for App Platform is now in general availability. Service components can scale automatically based on HTTP traffic metrics, including requests per second and P95 request duration, in addition to or instead of CPU …
DuckDB v1.5.3 Bugfix Release
This is a bugfix release for various issues discovered after we released v1.5.2. Please also refer to the announcement blog post: https://duckdb.org/2026/05/20/announcing-duckdb-153 Use DB serialization compatibility for json_serialize_sql DuckLake Bump fix: resolve current catalog in ADBC Ingest to avoid temp table shadowing Fix TIMESTAMPFORMAT being...
DNS - New DNS records UX is rolling out
Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans.
Radar - Content type distribution and API traffic share on Cloudflare Radar
Radar now includes two new charts on the traffic page ↗ that provide deeper insights into the composition of HTTP traffic: a content type distribution chart and an API traffic share chart. Content type distribution The new Content type ↗ chart displays the distribution of HTTP response content types, grouped into high-level categories.
More from Shopify developer platformEvery Shopify developer platform release →
Feature preview: Customer account improvements
Customer accounts are getting a visual refresh, featuring improved navigation, layout, and consistency across devices. You can preview these changes now and test your Shopify Extensions within the updated layout. What's changing: Single-column native pages : These are now consistent across both desktop and mobile, with simplified navigation.
Shop Minis March April 2026 update
New Features Optional Consent Users can now reject scopes and continue using your Mini. Consent is no longer all-or-nothing , if a user declines a scope, your Mini should gracefully degrade rather than block the experience. If your Mini hard-fails when a scope is rejected, please update it using the new hooks below.
Expiring offline access tokens required for all public apps as of January 1, 2027
We're changing how public apps handle offline access tokens to enhance merchant data protection. Starting January 1, 2027, all public apps must use expiring offline access tokens when calling the Admin API. After that date, public apps still using non-expiring tokens will receive authentication errors.
Shopify CLI 4.0: SemVer, auto-updates, removing deprecated flags and commands
The release of Shopify CLI 4.0 today brings clarity to CLI versioning, the introduction of automatic updates, and the announced removal of the deprecated --force flag from shopify app deploy . Semantic Versioning Shopify CLI is now following semantic versioning practices.
New `checkoutToken` field added to the `Order` object
The checkoutToken field is now available on the GraphQL Admin API's Order object. This field returns the token associated with the checkout that was used to create the order, matching the existing checkout_token field in the REST Admin API.
Next Generation Events now available in developer preview
Next Generation Events are now available in developer preview. Events give you field-level control over when a subscription fires, what data it carries, and what triggers each delivery, fixing three common friction points faced with traditional webhooks: over-delivery, fixed payloads, and no built-in signal for what changed.
Function run log details are now automatically visible with the right access scopes
You no longer need to ask merchants to share function run logs with you. These logs are now automatically available in the Dev Dashboard for any function your app has the necessary access scopes to view. What's Changed Function run logs in the Dev Dashboard are now accessible based on the access scopes granted to your app by the merchant.