Shopify Updates October 2026: What Actually Matters for Merchants

Key takeaways

• A checkout phishing campaign ran through storefront apps. Since at least October 10, code loaded by apps including Hulk Product Options, Selleasy and Swym Wishlist Plus sent some shoppers to a fake checkout that captured their card details. No source says Shopify’s own checkout was breached. The test that could catch the first wave takes five minutes.
• No new or updated storefront script tags since October 1. Existing ones keep loading until March 1, 2027, when Shopify stops injecting them. The replacement, an app embed, stays off until you switch it on in the theme editor.
• Shopify launched Canvas on October 1, a design surface where Sidekick edits the whole store from chat. It is early access: you cannot add or configure app embeds or customise Markets in it yet, and a Canvas theme stops receiving theme updates.
• Any agent that supports MCP can now check out with your store. Shop MCP (October 13) gives it catalog search, carts and checkout, with Shop Pay for shoppers signed in with Shop, and no partnership needed. Agents see compare-at prices since October 9, and Google’s Universal Cart went live in the US on October 15.
• BFCM operations got proper tools. Batch fulfillment for up to 250 orders (October 16), automatic label buying in Flow (October 15), and discounts inside Rollouts, so you can test an offer before Black Friday (October 2).
• Developers: Events is generally available, Hydrogen 2026-10 shipped, and API version 2025-10 was retired on October 16.

Here are the Shopify updates for October 2026, ranked by what actually matters for a merchant rather than dumped as a flat changelog. September put AI agents inside checkout. The first half of October was about who gets to change what your shoppers see: attackers working through third-party apps, Shopify’s own AI through Canvas, and any agent that wants to place an order.

We publish this mid-month so you can act while it matters, and update it at month-end if anything significant lands.

For last month’s changes, see the September 2026 Shopify updates.

At a glance: the October 2026 release notes in one table

The 3 October updates worth your time first

If you read nothing else this month:

1. Run the checkout test in a private window. Add a product, click Checkout, and read the address bar the moment the checkout page appears. If it is not your own domain or your myshopify.com address, stop and treat it as an incident. Then open App embeds in the theme editor and switch off every app you don’t use.
2. Ask every storefront app vendor whether it still uses script tags, and when its app embed ships. When it does, you have to switch the embed on yourself, in the live theme and in any duplicate you are preparing for BFCM.
3. Check what agents see before your BFCM prices go live. Agents can now check out through Shop MCP, see compare-at prices, and compare you inside Google’s Universal Cart. Product data and honest prices are what they compare.

1. The Shopify checkout phishing campaign: what to check

What happened. On October 10, developer Roman Zipp clicked Checkout on a Shopify store and landed on a lookalike checkout on a domain he didn’t recognise.¹ The page sent his test card details to an attacker’s server, then moved him on to the store’s real checkout, so an order would have completed normally. Over the following week HulkApps (Hulk Product Options), Logbase (Selleasy) and Swym (Wishlist Plus) each confirmed that an unauthorized party had changed what their apps loaded on some storefronts.²

Where it stands on October 19. Swym said in an FAQ published on October 19 that new activity starting at 21:17 UTC on October 18 used Wishlist Plus’s access to add scripts to some stores, so it switched the app off for every merchant and revoked its Shopify credentials. It took the FAQ down later that day, and its status page still lists an ongoing incident. The App Store listings for Hulk Product Options, Swym Wishlist Plus and Selleasy all read “not currently available”.²

What Shopify has said. No source says Shopify’s own checkout or systems were breached. The code ran on storefront pages, before checkout loaded. Shopify has not published a post, help article or changelog entry about the campaign. A spokesperson told iTnews that apps must meet Shopify’s security standards, that Shopify acts when they fall short, including by delisting them, and that it then asks the developer to contact affected merchants.³ Separately, on October 15 Shopify released a shopify app security check command that scans app code and theme extensions for unsafe patterns. It was not presented as a response to the campaign, and running it is recommended, not required.⁴

Why merchants care. Two things make this worse than a normal app outage. In the first wave the code arrived inside app settings, not theme files, so searching your theme would have found nothing. And because the fake page passed shoppers on to the real checkout, orders look normal. The signal comes from customers instead: an email about an odd-looking payment page, or card fraud soon after ordering from you.

What to do. Our full guide, Shopify checkout phishing attack: what happened and how to check your store, has the timeline, the domains named so far and the complete check. The short version:

1. In a fresh private window, add a product and click Checkout from the cart page. Read the address bar the moment the checkout page loads. Close the window, open a new private window and repeat from the cart drawer, then once more on your phone.
2. Open Online Store > Edit theme > App embeds and list every embed that is switched on. Each one can load code on every page. Switch off and uninstall what you don’t use.
3. If you run one of the named apps, follow the vendor’s status page. If you saw a redirect, capture the URL and a screenshot and switch the app’s embed off, then contact Shopify Support and your payment provider.

The guide also has a read-only prompt for running the live checkout test with Fudge, and is clear about what a clean result can and cannot prove.

2. Storefront script tags: no new ones since October 1, gone on March 1, 2027

What changed. From October 1, 2026, apps can no longer create or update storefront script tags. The scriptTagCreate and scriptTagUpdate mutations fail on every API version, so an app pinned to an older version gets no extra time.⁵ Script tags that already exist keep loading until March 1, 2027. On that date Shopify stops injecting them into storefront pages, and any that are left simply do nothing.

The replacement for storefront JavaScript is an app embed block in a theme app extension, and for analytics a web pixel.⁵ Two details land on the merchant. An app embed is off until you switch it on in the theme editor, and it is switched on per theme. And until March 1, a store running both an old script tag and its new embed loads the script twice.

One trap in the meantime: an app that still relies on script tags cannot add one to a store that installs it after October 1, so it has no storefront script there at all.⁵ Don’t uninstall and reinstall an older app to fix a problem with it.

Shopify has softened one part of the plan. The warning that was due to appear on October 1 when a merchant installs an app still using script tags is not being shown “for now”, and Shopify staff say usage will be reviewed again in January. The March 1 date has not moved.⁶

Why merchants care. This is the same pattern as Shopify Scripts in June and checkout additional scripts in August: nothing errors, something just stops. An app that never ships an embed keeps working on stores that already had it until March 1, and then its widget disappears. An app that does ship one needs you to turn it on, and you will only know to do that if the vendor tells you.

There is a link to the phishing campaign, with a limit. Every app embed is listed in the theme editor with a switch next to it, while script tags ran without appearing in the theme editor at all.⁵ Once every app has moved, you can at least see every third party that runs code on your storefront, and switch it off. Seeing the switch is not the same as seeing the code, though. HulkApps traces the redirects linked to its app to the Hulk Product Options theme app extension, and an embed still loads whatever its vendor’s servers send.²

Apps created in your own admin are a special case. They cannot use app extensions, so they have no embed to move to. Shopify’s advice is to move the script into the theme itself, in a custom Liquid block or the code editor, and it notes that editing theme code takes the theme off its automatic upgrade path.⁵

What to do.

1. Send one message to every vendor whose app shows anything on your storefront: “Does your app still use script tags, and when does your app embed ship?” A vendor that cannot answer is the one to replace, and before BFCM is a better time than in February.
2. When an embed ships, switch it on in your published theme and in any duplicate you are preparing for BFCM. Then check the widget does not load twice.
3. If a custom app adds a script to your storefront, move the script into your theme before March 1 and have whoever built the app delete the old script tag.

That last step is theme work, and it is the kind Fudge does: it reads your theme, adds the code and puts the change in a draft theme for you to preview. A prompt like this one covers it:

My custom app loads [script URL] on my storefront through a script tag, and script tags stop loading on March 1, 2027. Add the same script to my theme instead, loaded only on [the pages that need it] and with the same attributes it has today. Make the change in a draft copy of my live theme, and tell me how to check it works before I publish.

For the manual route, our guide to adding custom JavaScript in Shopify covers where the code should go.

3. Canvas: Shopify’s AI store designer arrives in early access

What changed (October 1). Shopify launched Canvas, a design surface that lays every page of your store out on one zoomable workspace.⁷ It renders the real store rather than a mockup, so you can preview interactions, animations, different products and screen sizes. You click an element to edit it, or ask Sidekick, for anything from one section to a store-wide redesign. Shopify says Sidekick now edits theme files directly, checks its own work with screenshots and code validation, and made more than 25 million theme edits in the first half of 2026.⁷

Who has it. It is rolling out as early access to some stores, on desktop only. You start from Online Store > Themes, either by creating a new theme in Canvas or by duplicating a Shopify or custom theme into it. The original theme stays in the classic theme editor.⁸

The limits at launch:

• It works only with Shopify’s own themes and custom themes. Third-party themes from the Theme Store are not supported.
• You cannot add or configure app blocks or app embeds.
• No Markets customisation. Theme content is translated in the Translate & Adapt app, not inside Canvas.
• A theme edited in Canvas stops receiving theme updates, and opens only in Canvas, not in the theme editor.
• Theme files cannot be downloaded, and blocks are added by asking Sidekick rather than by hand.⁸

On the app question, a Shopify staff member told developers on launch day that support for theme app extensions is planned within the next few weeks, and before Canvas becomes the default editor.⁹

Why merchants care. A store-wide AI redesign is now built into Shopify, and Shopify says Canvas does not replace the theme editor yet. The limits decide who can use it today. If your store relies on an app embed or app block for reviews, subscriptions, a wishlist or tracking, you cannot add or configure it in Canvas yet, and Markets customisation is not available either. For a new store, or a brand on a Shopify theme with few apps, it is worth an afternoon now.

What to do. Try it on a duplicate, never on your live theme. Before publishing a Canvas theme, list every app embed and app block your live theme uses and check each one on the Canvas copy, because you cannot add or configure them in Canvas. Decide, too, whether you can live without theme updates and with a theme you can no longer open in the classic editor.

A disclosure, since this is our category: we build Fudge, the AI operator for Shopify stores, and it also edits a store from a prompt. It edits your existing theme code, whichever theme you run, and puts every change in a draft theme for you to preview before anything goes live. Read our view of the two with that in mind.

4. Any agent that supports MCP can now check out with your store

What changed. Four releases in eight days, all pointing the same way.

• Shop MCP (October 13). Shopify opened a hosted server at mcp.shop.com that gives any AI agent supporting the Model Context Protocol search across more than 1 billion products in Shopify Catalog, carts, checkout with the selling store, and Shop Pay for a shopper signed in with Shop.¹⁰ Search needs no API key. The agent completes checkout only after the shopper confirms the total and the payment method, and the order arrives in your admin like any other. In September, WebMCP let an agent check out once it was on your store in the shopper’s browser. With Shop MCP, a shopper signed in with Shop can pay with Shop Pay without leaving the agent, and anyone else gets a link to finish on your checkout.
• Compare-at prices (October 9). Shopify Catalog now sends compare-at prices to AI agents when they are higher than the current price, so an agent can see a markdown. Before this, agents only saw the current price. Shopify switches sharing on by default for most stores, and off for stores that use compare-at as a manufacturer’s or reference price. The setting is in the Compare-at section of the Catalog product data mapping, under Sales channels > Agentic > Sources > Shopify Catalog.¹¹
• Buyer consent (October 16). Agents using Shopify’s Checkout and Cart MCP can now pass on the buyer’s choices about analytics, data sharing and email or SMS marketing. If the agent sends nothing, your store’s regional defaults apply, and a buyer whose country is unknown is treated as opted out.¹²
• Google Universal Cart (October 15). Google launched a cart that holds products from many retailers across Google Search, including AI Mode, and the Gemini app in the US, with price-drop and restock alerts. Shoppers pay with Google Pay at participating stores or transfer the cart to the merchant’s site, and the merchant stays the seller of record. Google names “many Shopify merchants” among its partners.¹³

Why merchants care. The agent no longer needs your homepage, your collection pages or a partnership with Shopify. It needs your catalog data. Shopify’s own figures for April to June 2026 put a number on why that matters: AI-referred sessions converted 80% better than organic search, AI-referred orders were 14% larger, and AI brought nearly twice as many first-time customers as other channels.¹⁴

Its holiday survey adds the limit. 65% of shoppers plan to use AI for at least one holiday shopping task, but only about a third trust an agent to buy on their behalf.¹⁵ Expect agents to research and fill carts this season more often than they finish the purchase.

What to do.

1. Open the Catalog product data mapping and confirm compare-at sharing is set the way you want before your BFCM markdowns go live. Make sure every compare-at price is one you can stand behind, because agents now show the comparison.
2. Review your customer privacy and marketing consent settings, since they now apply to buyers who arrive through an agent without a stated choice.
3. Run the free Shopify Catalog data audit to see what an agent finds when it reads your products, and fix thin titles and missing variant attributes first.
4. If you sell in the US through Google Merchant Center, check that feed prices and stock match the store, because Universal Cart’s alerts are built on them.

For the background on how Shopify has been rolling these channels out since December, read our Agentic Storefronts guide.

5. BFCM operations: batch fulfillment, automatic labels and testable offers

BFCM 2026 runs from November 27 to 30. Four October releases land in time for it.

Fulfill orders in batches (October 16). You can now group up to 250 fulfillments, selected by hand or by batching recent orders automatically, and run them through a Pick, Print, Pack workflow.¹⁶ Pick prints a pick list. Print buys every label and prints the packing slips, labels and customs forms together. Pack uses scan-to-verify with a tone for a match or a mistake. Steps can be renamed, reordered and assigned to staff. It needs a merchant-managed location in a country where you can buy Shopify Shipping labels.

Flow buys shipping labels (October 15). A new Purchase shipping label action buys a label as orders come in, using the carrier and service (or the cheapest available), package, weight and ship date you set.¹⁷ Conditions can include an order tag, specific products or single-item orders, and there is a ready-made template. It buys one label per fulfillment per run and skips orders assigned to a third-party fulfillment service.

Discounts in Rollouts (October 2). A discount can now be part of a Rollout, Shopify’s native launch and testing tool.¹⁸ You can release an offer to a share of online-store traffic and expand it, test it against your existing offers on conversion, or schedule it to go live with the theme and checkout changes it belongs to. Rollouts are available from the Basic plan, and experiments from Grow. In an experiment the control group sees your usual discounts without the one you are testing, and a partial-traffic rollout only applies to the online store.

Your own notes on Analytics reports (October 1). Staff with the Reports permission can now add annotations to time-series reports, with a title, description and a date or date range, alongside the ones Shopify and your apps add.¹⁹

Why merchants care. On a normal day, buying labels and printing slips one order at a time is a minor cost. On Cyber Monday it is the queue. Discount rollouts let you test the Black Friday offer in October, when a wrong guess costs a few days of margin on part of your traffic, rather than finding out on the day.

What to do.

1. Run one real batch this month, with the people who will run it in November.
2. If most of your orders are single items, set up the Flow template for those and keep the rest manual.
3. Put next month’s offer into an experiment against your current one now. Our Shopify BFCM playbook has the week-by-week timeline, including what to freeze and when.
4. Annotate September 21 (the session measurement change), October 8 to 15 (the ChatGPT referral gap, covered below) and every campaign launch, so November’s reports explain themselves.

6. Shop now recognises shoppers while they browse

What changed (October 5). Shop can now recognise a Shop user while they browse your store, before they buy.²⁰ For those shoppers it means a faster-loading checkout, carts synced across devices and between the Shop app and your storefront, one-tap sign-in to customer accounts, and a Shop Pay button that shows their last-used card. Browsing and abandoned carts sync to the shopper’s Shop account, and Shop sends its own cart reminders. It is on by default, in every browser. Cart sync also works when a Shop user signs in to your customer accounts with the same email, but only on the new customer accounts, not legacy ones.

Why merchants care. It is a conversion feature you did not have to switch on, with two side effects. Shop now sends cart reminders to some of the same shoppers your own abandoned-cart flow emails. And Shopify collects this browsing data directly from Shop users, under its own privacy policy. There is no separate setting to turn it off: it comes with Shop Pay and Sign in with Shop.

What to do. Look at the timing of your abandoned-cart flow: if Shop has already reminded a shopper, your first email may arrive as the second reminder. If you are still on legacy customer accounts, you miss one sync path, the one where a Shop user signs in to your own store accounts. That is a small reason to move, and if you rely on a third-party social login app and are not on Plus, test it on the new accounts first, because merchants report those apps stop working there.²¹

7. Store policies can now update themselves

What changed (October 8). The changelog lists five policies that can now be automated: return and refund, contact information, terms of service, shipping, and legal notice. The Help Center page currently lists four, without legal notice.²² An automated policy follows Shopify’s template and updates itself when the relevant settings change, such as your address and email, shipping zones, EU or UK VAT numbers and return rules. You switch it on per policy under Settings > Policies with “Use automated policy”. You stay responsible for compliance.

Why merchants care. Policies drift. A store that adds a market, changes its return windows (which can vary by product since September 29) or opens a new warehouse usually forgets the policy page. The catch: switching automation on replaces your existing custom text and its translations with the template, and Sidekick cannot edit an automated policy.

What to do. Copy your current policy text somewhere safe before you switch anything on. Shipping and contact information are the natural first candidates, because they change most often. Leave terms of service manual if a lawyer wrote them.

8. Selling in more languages

Translate & Adapt auto-sync (October 9). Stores based in 12 European countries (Austria, Belgium, Denmark, France, Germany, Ireland, Italy, the Netherlands, Spain, Sweden, Switzerland and the UK) can now have Shopify translate up to 8 languages instead of 2, with a weekly auto-sync of new and changed content per language.²³ Auto-sync is off by default and set per language. Manual translations are never overwritten, legal policies are not auto-translated, and “Auto-translate” is now called “Translate now”. Using Translate now, auto-sync or both for a language takes one of the eight slots, and removing the language does not give the slot back.

Right-to-left languages (October 2). Shopify improved support for Arabic, Urdu and Hebrew across the admin and storefronts, including checkout, customer accounts and the Horizon family of themes.²⁴

What to do. If you are in one of the 12 countries, turn on auto-sync for the languages you already sell in, then spot-check product pages after the first sync, which can take up to a week. Pick new languages deliberately, since slots are not refunded. And read a sample of every language: we machine-translate this blog into German and French, and brand terms drift on almost every run.

9. Other Shopify updates in October 2026, in brief

• Sidekick in the checkout and accounts editor (October 13). It explains checkout and customer account settings, recommends apps, and in Checkout Blocks helps plan blocks for the checkout, thank-you and order status pages. It guides; you make the change.²⁵
• Pay international suppliers from Shopify Balance (October 6). Eligible US Balance users can send money to recipients in 13 countries from the Balance mobile app, for $0.10 per transfer ($0.50 to Hong Kong and Mexico) plus a 0.75% exchange fee, arriving in one to three business days.²⁶
• Purchase order reports (October 6). Three new Analytics reports cover purchase order costs, transfers and what is still on order, and the data can be exported.
• Royal Mail pickup points at checkout (October 15) for stores shipping from UK locations, at Post Office branches and Royal Mail Customer Service Points, with uncollected parcels held for 18 days.
• DHL eCommerce labels in the Netherlands and Poland (October 16): domestic shipments from the Netherlands, and shipments to other EU countries from Poland.
• POS smart grid suggestions (October 12, POS 11.17 or later). Tiles suggested from your own products, discounts and POS activity, plus a prompt to remove tiles nobody has used for a year.
• TikTok announced Buy Direct and a Shopping Assistant (October 5) and named Shopify among the partners building them. There is no launch date, market list or fee yet, and nothing has appeared in the Shopify admin.²⁷
• ChatGPT referral traffic went missing for about a week. From around October 8, links inside ChatGPT answers stopped carrying the utm_source=chatgpt.com tag, so those visits showed up as direct traffic. Links in the sources panel and shopping links kept it. Adobe’s Cedric Huesler reported a fix rolling out from October 15 and says OpenAI confirmed the bug to him, but OpenAI has made no public statement, and most ChatGPT clicks still arrive with no referrer.²⁸ If AI referrals dipped in that window, annotate it before deciding demand fell.
• Outages. Third-party monitor StatusGator logged three short ones: admin, storefront and POS login errors on October 7 (about 13:15 to 14:06 UTC), storefront errors in the UK on the morning of October 8, and admin login failures from about 14:37 to 15:39 UTC that afternoon. Shopify acknowledged that one on its status page at the time, but the page no longer lists any October incidents. Shopify staff also confirmed a short Admin API disruption on October 1 and intermittent Admin GraphQL errors on October 14 on the developer forum.²⁹
• Shopify reports its third-quarter results on November 3, before the market opens, the last update before BFCM.³⁰

What merchants are talking about

Five themes ran through the community in the first half of October. Shopify staff replied in none of the merchant threads below; the only staff posts on the merchant forum were announcements.

• The new admin is the loudest complaint by far. About a dozen threads cover the dark sidebar, which merchants with poor eyesight call an accessibility problem, the Sidekick bar that cannot be hidden, archived orders that no longer look different, search moving into the sidebar, the J and K keyboard shortcuts disappearing, and slower metafield editing.³¹ There is still no documented way back. Developers have their own version: the most-replied developer thread of the month asks how to remove Sidekick from embedded apps, and staff said on October 8 that no app-level opt-out is planned.³² We build an embedded app, and posted in that thread ourselves about two chat boxes stacking on top of each other.
• Getting paid. Payout holds that support has “escalated” with no timeline run through several threads, one with more than $116,000 blocked. A thread opened on October 18 describes every payment method on several stores owned by one company being declined since October 17 under a “highest” fraud risk rule.³³ The redesigned Payouts page also lost a clean printable statement, which bookkeepers noticed as soon as it reached their stores.
• Fraud worries, mostly not about the campaign. Merchants noticed that order risk analysis no longer shows the billing address match and IP location indicators, only a low, medium or high verdict, and say support called it a new change.³⁴ Account takeovers that change payout bank details and fake “Shopify payment support” emails each got their own thread. The checkout phishing campaign had one small thread by October 19, opened that afternoon by a merchant whose customers on three stores were sent to a checkout-guard domain on .top.³⁴
• Changes merchants say arrived without warning. A Swedish seller says UK VAT stopped being charged from September 29 on orders over £135 shipped from the EU, and that support confirmed the change; Shopify has not posted about it. Non-Plus stores moving to new customer accounts found their third-party social login apps stopped working, and one says registrations fell by nearly half. Merchants who relied on Stocky are still splitting freight and duty into cost per item by hand.²¹
• AI orders nobody can see, and Merchant Center suspensions. Merchants report a handful of ChatGPT and Perplexity sessions and almost no orders labelled as AI, while customers who say they found the store in ChatGPT show up as direct traffic.³⁵ The busiest merchant thread started in the window is about Google Merchant Center “misrepresentation” suspensions, where peers keep finding the same causes: placeholder text in policy pages, and business names and addresses that differ from page to page. With Universal Cart built on Merchant Center data, and automated policies now available, that one is worth an hour this month.

The BFCM preparation thread keeps returning to one failure from last year: compare-at prices combined with store-wide discount codes, stacking further than the merchant intended.³⁵ Setting the offer up in Rollouts now, then placing a test order with a store-wide code on top, is a cheap way to find out in October.

Developers had a rougher fortnight than merchants. Function deploys with new or changed WebAssembly modules were blocked without notice on October 2, October 8 and October 15 to 16. Layout shift jumped in every embedded app when the new admin went live, and was fixed the same day. False “This app is unsupported” banners, caused by third parties using an app’s public token, were suppressed on October 6 and 8. And the expiring-token thread is still asking for the January 1, 2027 deadline to move; staff said on October 14 there is no answer yet.³⁶

October updates ranked by merchant impact

What to do this month: a checklist by store type

If you’re a DTC brand on a non-Plus plan:

• Run the checkout test in a fresh private window each time, once from the cart page and once from the cart drawer, on desktop and on your phone.
• List every app embed in your live theme. Switch off and uninstall the ones you don’t use.
• Ask each storefront app vendor about script tags, and switch on any new app embed yourself, in every theme you plan to publish.
• Confirm compare-at sharing in the Catalog product data mapping, and run the catalog data audit.
• Put the Black Friday offer into a rollout experiment (Grow and above), and annotate September 21 and October 8 to 15 in Analytics.

If you sell cross-border:

• In one of the 12 Translate & Adapt countries, turn on auto-sync for your existing languages and read a sample of each one.
• Before automating your shipping policy, save the current text, then check the automated version against your shipping zones and VAT numbers.
• Shipping from the UK: offer Royal Mail pickup points. From the Netherlands or Poland: compare DHL eCommerce rates in the admin.
• Universal Cart is US-only for now. Your other markets are unaffected.

If you run retail or POS:

• Update to POS 11.17 or later for smart grid suggestions, and grant the Customize smart grid permission to whoever owns the layout.
• If store locations ship online orders, try batch fulfillment there first.
• Move any Liquid receipt template to the new receipt editor before the automatic conversion on January 1, 2027. Most customisations migrate automatically, but check yours.

If you’re a developer or run headless:

• Anything still calling API version 2025-10 now falls forward to 2026-01, which itself retires on January 16, 2027. Test against 2026-04 or later; 2026-10 is the latest stable version.
• Ship your app embed if you still use script tags, deep-link merchants to switch it on, and delete your script tag once the embed is confirmed live.
• Run shopify app security check before each release, especially if a theme app extension renders merchant text settings as HTML.
• Move Events subscriptions from unstable to 2026-10, and segment queries to MATCHES syntax.
• Callers of the Global Catalog REST API have until November 2 to move to Global Catalog MCP.

Shopify developer updates and the deadline list

Events is generally available. Shopify’s next-generation webhook system went GA on API version 2026-10 on October 1.³⁷ Subscriptions live in shopify.app.toml with triggers, a GraphQL query and a filter, and 18 topics are available, from products and orders to metaobjects and inventory transfers. Classic webhooks keep working, and one app can run both. Preview users only need to change the events API version from unstable to 2026-10.

Hydrogen 2026-10 is out. The new Hydrogen is a library that works with any JavaScript framework, with starters for React Router and Next.js, and Vercel maintains a Next.js storefront built on it.³⁸ It uses the same standard storefront actions as Liquid themes, works with WebMCP agents and ships a set of agent skills. Existing Hydrogen storefronts keep working, and Oxygen hosting is still free.

The app security check. The new shopify app security check command runs locally in the CLI or the AI Toolkit, is open source, and scans app code, extension configuration and dependencies, handing harder cases to your coding agent.⁴ Its checks include cross-site scripting in theme extensions, text settings rendered as unsafe HTML, script tag URLs an attacker could control, and leaked credentials. Given the month, run it.

Shop MCP for agent builders. The Shop MCP server at mcp.shop.com exposes catalog search, carts, checkout, Shop Pay and order lookup, with a new shop CLI. There are no webhooks at launch, so agents poll for checkout status.¹⁰

Sidekick now sits on top of embedded apps. A staff post on October 14 explained that after the admin redesign, Sidekick floats at the bottom centre of every admin screen, including embedded app pages, and there is no API to hide it. Shopify recommends that apps respect the safe-area insets and use App Bridge toasts. These are recommendations, not App Store requirements, and developers pushed back in the replies.³⁹

Changes that need code, in brief:

• Customer segment queries use MATCHES and NOT MATCHES from 2026-10, and relative dates such as -12m replace named ones like 12_months_ago.
• SMS marketing consent moved to CustomerPhoneNumber.smsMarketingConsent, and the flat SMS consent fields are deprecated.
• Discounts that belong to a Rollout carry a rollouts connection on 2026-10, and their own start and end dates no longer fully describe when they are live.
• POS UI extensions return the percentage, not the money amount, for percentage discounts from POS 11.15, whatever API version you pin. On 2026-10, cart mutations reject when POS does not confirm the write.
• A cart update that changes nothing no longer fires carts/update (October 12).
• The Customer Account API is limited to 3,000 requests per minute per customer per store, shared across all apps, with a Retry-After header on 429s (October 7).
• Checkout and customer account UI extensions must declare owner_type on metafields in 2027-01, and the Admin API’s metafieldInteger collection condition is removed in the same version.

The deadline digest, in date order: October 1 (script tag create and update calls fail; API 2026-10 stable; passed), October 15 (the card deposit endpoint requires a Shopify-issued mTLS certificate; passed), October 16 (API version 2025-10 retired; passed), October 23 (tax calculated on US return shipping fees for stores on Shopify Tax or Tax Platform), November 2 (Global Catalog REST API stops serving traffic), December 1 (Built for Shopify returns and subscription apps must sign buyers in through the Customer Account API), January 1, 2027 (expiring offline access tokens required for all public apps; POS Liquid receipt templates converted automatically; 2027-01 stable), January 16, 2027 (API version 2026-01 retired), March 1, 2027 (script tags stop loading on storefronts), May 1, 2027 (Built for Shopify apps must match the new admin look), July 1, 2027 (market-driven shipping on for every store, and every app must be compatible).⁴⁰

Where Shopify is heading

August was about Shopify removing custom code from its critical path. September was about Shopify adding distribution by default. October is about who can change what your shoppers see, and three parties gained reach in the same fortnight. Shopify’s own AI can now redesign the whole store through Canvas. Any agent that supports MCP can search it through Shop MCP and, for a shopper signed in with Shop, pay without opening it. And attackers working through app vendors’ systems changed what shoppers saw at the moment they went to pay.

The script tag deadline is the thread that ties them together. For several years Shopify has been moving code out of places where it ran with few limits (Shopify Scripts, checkout additional scripts, script tags) and into places with defined boundaries and a visible switch (Functions, checkout extensions, app embeds). The phishing campaign shows where that stops: the Hulk Product Options payload came through a theme app extension, and an embed still runs whatever its vendor sends. A switch helps a merchant notice and turn something off. It does not vet the code. Canvas comes at the problem from the other side: the more of the storefront Shopify’s own AI can build, the fewer apps need to load code into it. Its launch limits, with no app embeds and no third-party Theme Store themes, show how far that has to go.

For a merchant, the list for the rest of October is short and unglamorous: test your checkout, count your app embeds, get a date from every vendor still on script tags, check what agents can read in your catalog, and run one batch before November runs it for you.

FAQ