Releasesby Glyph
App security updates: Thank you, plus what's required next
Shopify announced mandatory IP allowlists for public apps calling Admin API bulk operations by November 20, 2026, alongside new API access controls in the Partner Dashboard.
Also shipped Nov 14, 2026Shopify in November 2026 →
Docling 2.150.1
IBM released Docling version 2.150.1 with bug fixes across DOCX, ODS, JATS, AsciiDoc, and EPUB document conversion modules.
More from Shopify developer platformEvery Shopify developer platform release →
Checkout Function `cart.deliverableLine` inputs now model `cost` and link to their relevant `cart.line`
Shopify updated Checkout Function cart.deliverableLine inputs to model cost details and link directly to their corresponding cart.line objects.
Market metafields break ties between equally specific markets by market handle
Shopify updated Market.metafield and Market.metafields resolution to break ties between equally specific markets using the market handle order instead of update timestamps across Storefront, Liquid, and Function APIs.
Market.metafields matches keys in any case as of Storefront API version 2027-01
Shopify announced that Storefront API version 2027-01 will perform case-insensitive key matching for Market.metafields queries, matching the existing behavior of Market.metafield.
Remove your app from the Shopify App Store yourself
You can now start sunsetting your app and remove it from the Shopify App Store yourself, from the Partner Dashboard. You no longer need to contact Shopify Support. What's new In the Partner Dashboard, go to Apps > your app > Distribution , and click Remove from App Store . Choose a sunset date at least 30 days from now.
IP allowlists are now required for custom apps installed outside your organization
We're enhancing protection of merchants by requiring IP allowlists for custom apps, if those apps are installed on stores outside of the organization that owns them. Starting November 20, 2026 at 11:59 PM ET: Apps must have an IP allowlist for new installs. Starting January 1, 2027 at 11:59 PM ET: Allowlists are required for existing installs.
App IP allowlists now support IP addresses and ASNs together, and up to 250 IPs
Your app's IP allowlist in the Dev Dashboard can now include IP addresses and autonomous system numbers (ASNs) in the same allowlist. This helps apps whose requests come from a mix of static and dynamic IP addresses. You can also now configure up to 250 IP addresses or ranges, up from 100.
Storefront MCP policies and FAQs tool is being deprecated in favor of UCP MCP Ask tool
The search_shop_policies_and_faqs tool is deprecated in favor of the UCP Ask MCP tool. Developers must migrate to the ask_business tool by January 15, 2027.
Customer data erasure requests updated from 10 days to 5
As of November 10, 2026, customer data erasure requests will no longer be held in a pending state for 10 days. Erasure requests will now be processed 5 days after the request was submitted, regardless of when the customer's most recent order was placed.