Recent releases from organizations and products in the Commerce category.
POS now accepts Alipay, WeChat Pay, Satispay, Scalapay, and GrabPay for in-person sales through Shopify Payments, with customers scanning a QR code to pay. Each method can be enabled in Payments settings in admin, and availability varies by country.
Shopify Payments on POS now accepts debit-only Cartes Bancaires transactions for in-person sales in France, on WisePad 3 and POS Terminal devices.
Card payments process faster in Shopify POS and cash, gift card, and split payments need fewer taps. Receipt selection is pre-filled when Shopify recognizes the buyer, and email domain shortcuts speed up manual email entry at the register.
Partner-built apps must now enable bulk queries and bulk mutations separately in the Partner Dashboard before running bulkOperationRunQuery or bulkOperationRunMutation, and requests without access return an access denied error across all GraphQL Admin API versions. Apps that already run bulk operations keep access, but apps inactive for 31 days lose it until re-enabled.
Apps must now have access to bulk queries or bulk mutations enabled in the Partner Dashboard before running bulkOperationRunQuery or bulkOperationRunMutation, and requests without access return an access denied error. Apps already running bulk operations have access enabled automatically, but apps that haven't run one in the last 31 days lose it.
GraphQL Admin API version 2027-01 lets apps attach an optional merchant-only note of up to 5,000 characters when crediting or debiting a store credit account, and read it back on credit, debit, and debit-revert transactions. Notes are optional, so existing integrations need no changes and no new access scope.
The apps index in Settings > Apps now shows each app's latest activity and highlights security issues, with access, permissions, and activity combined on the app details page. Merchants can also check whether an app has adopted expiring access tokens and enforced IP restrictions.
Apps without static IP addresses can now add their hosting provider's autonomous system numbers to the IP allowlist in the Dev Dashboard, entering up to 10 ASNs limited to up to 10 countries. Requests from outside the allowed networks fail with a 403 status code, and IP allowlists will soon be required for all public apps.
All public apps must configure an IP allowlist in the Dev Dashboard by November 20, 2026, with apps using bulk operations required to comply by November 12. Apps that miss the bulk-operations deadline will have bulk operations fail, and apps without an allowlist by November 20 will be delisted from the Shopify App Store and blocked from new installs.
All public apps calling the Admin API must enable an IP allowlist by November 20, 2026, with bulk operations blocked from November 12 for apps without one. Merchants can now see each app's token expiry and allowlist status under Settings > Apps, and dev store previews can test network_access declarations before release.
Thanks for using Shopify! We update our app regularly. This update includes bug fixes and performance improvements.
Apps can now validate their network_access configuration on a dev store created with the network_access_testing feature preview. The preview warns about links to hosts outside allowed_navigation_hosts and console-logs storefront requests to servers outside allowed_sources, without blocking anything.
In GraphQL Admin API version 2027-01, CustomerPaymentMethod.revokedReason can return RETRY_DECLINED when a subscription payment method is revoked because the payment processor blocked further retry attempts. Earlier API versions continue to return TOO_MANY_CONSECUTIVE_FAILURES, and the customer_payment_methods/revoke webhook payload is unchanged.
The collection details page in Shopify admin now allows inline description editing with formatting visible, and the theme template selector sits under the collection title. Conditions use a grouped layout with clearer matching controls, and on desktop the sources column stays visible alongside products with per-source actions in a ⋯ menu.
Starting in API version 2027-01, the currententrychange event in customer account full-page extensions sets event.from to the page the customer navigated away from instead of the page they navigated to. Extensions should read the new page from shopify.navigation.currentEntry.url, which works on 2025-10 and later.
UI extensions no longer have a 256 KB combined size limit on locale files, so extensions with many languages no longer fail to deploy; the 30 KB per-file limit still applies and no action is required. Apps that dropped languages or trimmed translations to stay under the old cap can add them back and run shopify app deploy.
In REST Admin API version 2027-01 and later, Shopify ignores line_item_id in Gift Card create and update requests, so apps can no longer add, replace, or clear a gift card's line-item association. Responses still include existing associations, and earlier API versions keep their current behavior.
The 2027-01 release candidate adds an optional trusted_vault_origin Boolean to payment_method.data on credit card payment and verification requests; when true, apps should not reject the request for missing CVV alone while still running fraud checks, 3-D Secure, and any CVV validation. The field requires Shopify enablement and is omitted on earlier API versions, and production apps should stay on a supported stable version while testing on 2027-01.
Buyers with shipping addresses in Japan or Singapore now see prompts to track orders with Shop across thank you pages, order status pages, and notification emails. The Shop app and Shop.com are also now available in Japanese.
