Releasesby Glyph
App security updates: IP allowlist is now required
Shopify now requires public apps to turn on IP allowlists by November 20, 2026, and public apps using bulk operations by November 12, 2026, to restrict API access to trusted networks.
Also shipped Nov 5, 2026Shopify in November 2026 →
Gemini Omni 1.2 Flash
Gemini Omni 1.2 Flash is now generally available, offering omni-modal processing for text, image, and video. New features include standalone video upscaling, extended generation durations, and reference-guided video editing.
Use GPT-6-Cyber to investigate vulnerabilities, reproduce them in an authorized test environment, and verify
OpenAI has released GPT-6-Cyber, a model designed to investigate vulnerabilities, reproduce them in authorized environments, and verify fixes.
Gemini Enterprise: Prepaid credits for Pay-as-you-go subscriptions and usage above quota
Prepaid credits are now generally available for self-serve Cloud Billing accounts, allowing users to pay for Gemini Enterprise usage without an invoiced billing account.
The BigQuery Metadata curation console page has been removed
The BigQuery Metadata curation console page has been deprecated. Users should now use Knowledge Catalog for data discovery, profiling, and governance tasks.
Conversational analytics in BigQuery is now available in the asia-northeast1 (Tokyo) location
Conversational analytics in BigQuery is now supported in the asia-northeast1 (Tokyo) region.
Announcing Web Answer on Amazon Bedrock AgentCore
Web Answer is now generally available on Amazon Bedrock AgentCore. It provides a managed tool that returns synthesized, cited answers grounded in web sources in a single call.
More from Shopify developer platformEvery Shopify developer platform release →
Order routing functions can now rank locations across multiple fulfillment groups in the unstable Function APIs
Shopify order routing functions in the unstable Function APIs can now rank locations across multiple fulfillment groups.
IP allowlists are now required for public apps
Shopify requires public apps using bulk operations to configure IP allowlists by November 12, 2026, and all other public apps by November 20, 2026, preventing leaked API tokens from being used elsewhere.
App IP allowlists now support apps with serverless hosting through ASNs
Public apps without static IP addresses can now configure up to 10 Autonomous System Numbers (ASNs) and country restrictions in the Dev Dashboard IP allowlist settings.
Partner apps must enable bulk operations before use
Apps must now explicitly enable access to bulk queries or mutations in the Partner Dashboard to use them with the GraphQL Admin API. Unauthorized requests will return an access denied error.
Apps must enable bulk operations before use
Apps must now explicitly enable access to bulk queries or mutations in the Partner Dashboard to use them with the GraphQL Admin API. Unauthorized requests will return an access denied error.
Merchant notes on store credit transactions
The GraphQL Admin API now allows attaching optional notes to store credit transactions. This feature is available in version 2027-01 and later.
Test app network access configuration on dev stores
Shopify launched a feature preview on dev stores allowing developers to test app network access configurations and verify allowed navigation hosts and external server requests.
RETRY_DECLINED added to CustomerPaymentMethodRevocationReason
Shopify GraphQL Admin API version 2027-01 added RETRY_DECLINED to CustomerPaymentMethod.revokedReason for subscription payment methods blocked by payment processors after failed retry attempts.