Releasesby Glyph
IP allowlists are now required for custom apps installed outside your organization
We're enhancing protection of merchants by requiring IP allowlists for custom apps, if those apps are installed on stores outside of the organization that owns them. Starting November 20, 2026 at 11:59 PM ET: Apps must have an IP allowlist for new installs. Starting January 1, 2027 at 11:59 PM ET: Allowlists are required for existing installs.
Also shipped Nov 11, 2026Shopify in November 2026 →
Web search in apps
Retool added native web search capabilities to the app builder Chat tab and app functions, enabling agent applications to query live web data via a managed Tavily account.
Eval datasets, curated by Bayes from your agents' real conversations
Monte Carlo introduced automated evaluation dataset generation by Bayes, creating Golden and Improvement datasets from an agent's scored conversations across intent and issue clusters.
Pages are generally available
Databricks announced the general availability of Pages in Unity Catalog, providing governed definitions of business concepts organized by domain on the Discover page.
BigQuery project caps are generally available
Project caps, also known as scheduling policies, are now generally available for BigQuery Enterprise and Enterprise Plus editions. This feature allows users to limit maximum slots and concurrency per project within a reservation.
BigQuery reservation assignments support principal routing
BigQuery now allows specifying a principal property on reservation assignments to route queries to specific reservations based on the identity of the user or service account. This feature is generally available for Enterprise and Enterprise Plus editions.
BigQuery JSON_FLATTEN function is generally available
The JSON_FLATTEN function is now generally available. It extracts non-array values from JSON inputs, including those nested within consecutive arrays.
More from Shopify developer platformEvery Shopify developer platform release →
App IP allowlists now support IP addresses and ASNs together, and up to 250 IPs
Your app's IP allowlist in the Dev Dashboard can now include IP addresses and autonomous system numbers (ASNs) in the same allowlist. This helps apps whose requests come from a mix of static and dynamic IP addresses. You can also now configure up to 250 IP addresses or ranges, up from 100.
Storefront MCP policies and FAQs tool is being deprecated in favor of UCP MCP Ask tool
The search_shop_policies_and_faqs tool is deprecated in favor of the UCP Ask MCP tool. Developers must migrate to the ask_business tool by January 15, 2027.
Customer data erasure requests updated from 10 days to 5
As of November 10, 2026, customer data erasure requests will no longer be held in a pending state for 10 days. Erasure requests will now be processed 5 days after the request was submitted, regardless of when the customer's most recent order was placed.
Remove your app from the Shopify App Store yourself
You can now start sunsetting your app and remove it from the Shopify App Store yourself, from the Partner Dashboard. You no longer need to contact Shopify Support. What's new In the Partner Dashboard, go to Apps > your app > Distribution , and click Remove from App Store . Choose a sunset date at least 30 days from now.
Shopify App Store submission requirements: build, grow, then expand
Shopify has updated its App Store submission policies, requiring existing apps to have at least 10 installs on full-priced stores before listing additional apps. It also introduced escalating cooldown periods for rejected submissions.
Redesigned Partner Directory with profiles built on Shopify data
The Shopify Partner Directory has been redesigned. We've made it easier for merchants to explore and evaluate Partners based on a definitive, Shopify-confirmed record of their work, while making profiles easier for Partners to maintain.
Partner apps must enable bulk operations before use
Apps must now explicitly enable access to bulk queries or mutations in the Partner Dashboard to use them with the GraphQL Admin API. Unauthorized requests will return an access denied error.
Apps must enable bulk operations before use
Apps must now explicitly enable access to bulk queries or mutations in the Partner Dashboard to use them with the GraphQL Admin API. Unauthorized requests will return an access denied error.