@shopify/cli-hydrogen 11.1.11 → 11.1.13

package/README.md

@@ -8,7 +8,7 @@ The Hydrogen extension for the [Shopify CLI](https://shopify.dev/apps/tools/cli)
 
 The most common way to test the cli changes locally is to do the following:
 
-- Run `npm run build` in this directory (`packages/cli` from the root of the repo).
+- Run `pnpm run build` in this directory (`packages/cli` from the root of the repo).
 - Run `npx shopify hydrogen` anywhere else in the monorepo, for example `npx shopify hydrogen init`.
 - If you want to test a command inside of a template, run the command from within that template or use the `--path` flag to point to another template or any Hydrogen app.
 - If you want to make changes to a file that is generated when running `npx shopify hydrogen generate`, make changes to that file from inside of the `templates/skeleton` directory.

package/dist/assets/hydrogen/starter/CHANGELOG.md

@@ -1,5 +1,29 @@
 # skeleton
 
+## 2026.1.4
+
+### Patch Changes
+
+- Remove redundant Storefront API proxy route from skeleton template. The server now automatically proxies requests to `/api/:version/graphql.json` via `createRequestHandler` with `proxyStandardRoutes: true` (enabled by default since December 2025). ([#3572](https://github.com/Shopify/hydrogen/pull/3572)) by [@itsjustriley](https://github.com/itsjustriley)
+
+  Developers no longer need a manual route file for the tokenless Storefront API. Existing apps with this route can safely delete it - the server-level proxy provides the same functionality with better cookie forwarding and analytics integration.
+
+- Updated dependencies [[`b0a75c1d759706931876f056662de2497cb3e688`](https://github.com/Shopify/hydrogen/commit/b0a75c1d759706931876f056662de2497cb3e688), [`a44ee3566b9bb9a7f43f05dfaae6f1f2ab1d548f`](https://github.com/Shopify/hydrogen/commit/a44ee3566b9bb9a7f43f05dfaae6f1f2ab1d548f)]:
+  - @shopify/hydrogen@2026.1.4
+
+## 2026.1.3
+
+### Patch Changes
+
+- Improve screen reader experience for paginated product grids by hiding decorative arrow characters from assistive technology. ([#3557](https://github.com/Shopify/hydrogen/pull/3557)) by [@itsjustriley](https://github.com/itsjustriley)
+
+- Fix broken `aria-label` on territory code input in address form. The label was the raw developer string `"territoryCode"` instead of a human-readable `"Country code"`. ([#3607](https://github.com/Shopify/hydrogen/pull/3607)) by [@itsjustriley](https://github.com/itsjustriley)
+
+- Add aria-label to ProductPrice for improved screen reader accessibility ([#3558](https://github.com/Shopify/hydrogen/pull/3558)) by [@itsjustriley](https://github.com/itsjustriley)
+
+- Updated dependencies [[`108243003a7f36349a446478f4e8ab0cade3e13a`](https://github.com/Shopify/hydrogen/commit/108243003a7f36349a446478f4e8ab0cade3e13a)]:
+  - @shopify/hydrogen@2026.1.3
+
 ## 2026.1.2
 
 ### Patch Changes

package/dist/assets/hydrogen/starter/app/components/PaginatedResourceSection.tsx

@@ -2,15 +2,17 @@ import * as React from 'react';
 import {Pagination} from '@shopify/hydrogen';
 
 /**
- * <PaginatedResourceSection > is a component that encapsulate how the previous and next behaviors throughout your application.
+ * <PaginatedResourceSection> encapsulates the previous and next pagination behaviors throughout your application.
  */
 export function PaginatedResourceSection<NodesType>({
   connection,
   children,
+  ariaLabel,
   resourcesClassName,
 }: {
   connection: React.ComponentProps<typeof Pagination<NodesType>>['connection'];
   children: React.FunctionComponent<{node: NodesType; index: number}>;
+  ariaLabel?: string;
   resourcesClassName?: string;
 }) {
   return (
@@ -23,15 +25,33 @@ export function PaginatedResourceSection<NodesType>({
         return (
           <div>
             <PreviousLink>
-              {isLoading ? 'Loading...' : <span>↑ Load previous</span>}
+              {isLoading ? (
+                'Loading...'
+              ) : (
+                <span>
+                  <span aria-hidden="true">↑</span> Load previous
+                </span>
+              )}
             </PreviousLink>
             {resourcesClassName ? (
-              <div className={resourcesClassName}>{resourcesMarkup}</div>
+              <div
+                aria-label={ariaLabel}
+                className={resourcesClassName}
+                role={ariaLabel ? 'region' : undefined}
+              >
+                {resourcesMarkup}
+              </div>
             ) : (
               resourcesMarkup
             )}
             <NextLink>
-              {isLoading ? 'Loading...' : <span>Load more ↓</span>}
+              {isLoading ? (
+                'Loading...'
+              ) : (
+                <span>
+                  Load more <span aria-hidden="true">↓</span>
+                </span>
+              )}
             </NextLink>
           </div>
         );

package/dist/assets/hydrogen/starter/app/components/ProductPrice.tsx

@@ -9,7 +9,7 @@ export function ProductPrice({
   compareAtPrice?: MoneyV2 | null;
 }) {
   return (
-    <div className="product-price">
+    <div aria-label="Price" className="product-price" role="group">
       {compareAtPrice ? (
         <div className="product-price-on-sale">
           {price ? <Money data={price} /> : null}

package/dist/assets/hydrogen/starter/app/routes/account.addresses.tsx

@@ -468,7 +468,7 @@ export function AddressForm({
         />
         <label htmlFor="territoryCode">Country Code*</label>
         <input
-          aria-label="territoryCode"
+          aria-label="Country code"
           autoComplete="country"
           defaultValue={address?.territoryCode ?? ''}
           id="territoryCode"

package/dist/assets/hydrogen/starter/package.json

@@ -2,7 +2,7 @@
   "name": "skeleton",
   "private": true,
   "sideEffects": false,
-  "version": "2026.1.2",
+  "version": "2026.1.4",
   "type": "module",
   "scripts": {
     "build": "shopify hydrogen build --codegen",
@@ -14,7 +14,7 @@
   },
   "prettier": "@shopify/prettier-config",
   "dependencies": {
-    "@shopify/hydrogen": "2026.1.2",
+    "@shopify/hydrogen": "2026.1.4",
     "graphql": "^16.10.0",
     "graphql-tag": "^2.12.6",
     "isbot": "^5.1.22",
@@ -32,7 +32,7 @@
     "@react-router/fs-routes": "7.12.0",
     "@shopify/cli": "3.91.1",
     "@shopify/hydrogen-codegen": "0.3.3",
-    "@shopify/mini-oxygen": "4.0.1",
+    "@shopify/mini-oxygen": "4.0.2",
     "@shopify/oxygen-workers-types": "^4.1.6",
     "@shopify/prettier-config": "^1.1.2",
     "@total-typescript/ts-reset": "^0.6.1",
@@ -54,7 +54,7 @@
     "graphql-config": "^5.0.3",
     "prettier": "^3.4.2",
     "typescript": "^5.9.2",
-    "vite": "^6.2.4",
+    "vite": "^6.4.2",
     "vite-tsconfig-paths": "^4.3.1"
   },
   "engines": {

package/dist/assets/hydrogen/starter/storefrontapi.generated.d.ts

@@ -377,13 +377,6 @@ export type FooterQuery = {
   >;
 };
 
-export type StoreRobotsQueryVariables = StorefrontAPI.Exact<{
-  country?: StorefrontAPI.InputMaybe<StorefrontAPI.CountryCode>;
-  language?: StorefrontAPI.InputMaybe<StorefrontAPI.LanguageCode>;
-}>;
-
-export type StoreRobotsQuery = {shop: Pick<StorefrontAPI.Shop, 'id'>};
-
 export type FeaturedCollectionFragment = Pick<
   StorefrontAPI.Collection,
   'id' | 'title' | 'handle'
@@ -1283,10 +1276,6 @@ interface GeneratedQueryTypes {
     return: FooterQuery;
     variables: FooterQueryVariables;
   };
-  '#graphql\n  query StoreRobots($country: CountryCode, $language: LanguageCode)\n   @inContext(country: $country, language: $language) {\n    shop {\n      id\n    }\n  }\n': {
-    return: StoreRobotsQuery;
-    variables: StoreRobotsQueryVariables;
-  };
   '#graphql\n  fragment FeaturedCollection on Collection {\n    id\n    title\n    image {\n      id\n      url\n      altText\n      width\n      height\n    }\n    handle\n  }\n  query FeaturedCollection($country: CountryCode, $language: LanguageCode)\n    @inContext(country: $country, language: $language) {\n    collections(first: 1, sortKey: UPDATED_AT, reverse: true) {\n      nodes {\n        ...FeaturedCollection\n      }\n    }\n  }\n': {
     return: FeaturedCollectionQuery;
     variables: FeaturedCollectionQueryVariables;

package/dist/commands/hydrogen/dev.js

@@ -7,7 +7,7 @@ import { renderSuccess, renderInfo } from '@shopify/cli-kit/node/ui';
 import { AbortError } from '@shopify/cli-kit/node/error';
 import { removeFile } from '@shopify/cli-kit/node/fs';
 import { setH2OVerbose, isH2Verbose, muteDevLogs, enhanceH2Logs } from '../../lib/log.js';
-import { commonFlags, overrideFlag, flagsToCamelObject, DEFAULT_INSPECTOR_PORT, DEFAULT_APP_PORT } from '../../lib/flags.js';
+import { commonFlags, overrideFlag, flagsToCamelObject, DEFAULT_APP_PORT, DEFAULT_INSPECTOR_PORT } from '../../lib/flags.js';
 import { spawnCodegenProcess } from '../../lib/codegen.js';
 import { getAllEnvironmentVariables } from '../../lib/environment-variables.js';
 import { displayDevUpgradeNotice } from './upgrade.js';
@@ -103,6 +103,9 @@ async function runDev({
   if (!process.env.NODE_ENV) process.env.NODE_ENV = "development";
   if (verbose) setH2OVerbose();
   if (!isH2Verbose()) muteDevLogs();
+  if (appPort === 0) {
+    appPort = await findPort(DEFAULT_APP_PORT);
+  }
   const root = appPath ?? process.cwd();
   const cliCommandPromise = getCliCommand(root);
   const backgroundPromise = getDevConfigInBackground(

package/dist/commands/hydrogen/upgrade.js

@@ -6,7 +6,7 @@ import { ensureInsideGitDirectory, isClean } from '@shopify/cli-kit/node/git';
 import Command from '@shopify/cli-kit/node/base-command';
 import { renderSuccess, renderInfo, renderConfirmationPrompt, renderTasks, renderSelectPrompt, renderWarning } from '@shopify/cli-kit/node/ui';
 import { isDirectory, readFile, mkdir, fileExists, touchFile, removeFile, writeFile } from '@shopify/cli-kit/node/fs';
-import { getPackageManager, getDependencies, installNodeModules } from '@shopify/cli-kit/node/node-package-manager';
+import { getPackageManager, getDependencies } from '@shopify/cli-kit/node/node-package-manager';
 import { exec } from '@shopify/cli-kit/node/system';
 import { AbortError } from '@shopify/cli-kit/node/error';
 import { resolvePath, joinPath, dirname } from '@shopify/cli-kit/node/path';
@@ -106,7 +106,7 @@ async function runUpgrade({
       availableUpgrades,
       currentDependencies
     });
-    cumulativeRelease = getCummulativeRelease({
+    cumulativeRelease = getCumulativeRelease({
       availableUpgrades,
       currentVersion,
       currentDependencies,
@@ -128,7 +128,11 @@ async function runUpgrade({
     appPath,
     selectedRelease,
     currentDependencies,
-    targetVersion
+    targetVersion,
+    cumulativeRemoveDependencies: cumulativeRelease.removeDependencies,
+    cumulativeRemoveDevDependencies: cumulativeRelease.removeDevDependencies,
+    cumulativeDependencies: cumulativeRelease.dependencies,
+    cumulativeDevDependencies: cumulativeRelease.devDependencies
   });
   await validateUpgrade({
     appPath,
@@ -336,20 +340,31 @@ async function getSelectedRelease({
   ) : void 0;
   return targetRelease ?? promptUpgradeOptions(currentVersion, availableUpgrades);
 }
-function getCummulativeRelease({
+function getCumulativeRelease({
   availableUpgrades,
   selectedRelease,
   currentVersion,
   currentDependencies
 }) {
   const currentPinnedVersion = getAbsoluteVersion(currentVersion);
-  if (!availableUpgrades?.length) {
-    return { features: [], fixes: [] };
-  }
+  const empty = {
+    features: [],
+    fixes: [],
+    removeDependencies: [],
+    removeDevDependencies: [],
+    dependencies: {},
+    devDependencies: {}
+  };
+  if (!availableUpgrades?.length) return empty;
   if (selectedRelease.dependencies?.["@shopify/hydrogen"] === "next") {
     return {
+      ...empty,
       features: selectedRelease.features || [],
-      fixes: selectedRelease.fixes || []
+      fixes: selectedRelease.fixes || [],
+      removeDependencies: selectedRelease.removeDependencies ?? [],
+      removeDevDependencies: selectedRelease.removeDevDependencies ?? [],
+      dependencies: selectedRelease.dependencies ?? {},
+      devDependencies: selectedRelease.devDependencies ?? {}
     };
   }
   const upgradingReleases = availableUpgrades.filter((release) => {
@@ -359,14 +374,65 @@ function getCummulativeRelease({
     if (!isSameHydrogenVersion || !currentDependencies) return false;
     return hasOutdatedDependencies({ release, currentDependencies });
   });
-  return upgradingReleases.reduce(
-    (acc, release) => {
-      acc.features = [...acc.features, ...release.features];
-      acc.fixes = [...acc.fixes, ...release.fixes];
-      return acc;
-    },
-    { features: [], fixes: [] }
+  const features = upgradingReleases.flatMap((r) => r.features);
+  const fixes = upgradingReleases.flatMap((r) => r.fixes);
+  const releasesByVersion = [...upgradingReleases].sort(
+    (a, b) => semver.compare(a.version, b.version)
   );
+  const removedDepsAt = /* @__PURE__ */ new Map();
+  const removedDevDepsAt = /* @__PURE__ */ new Map();
+  releasesByVersion.forEach((release, i) => {
+    release.removeDependencies?.forEach((dep) => {
+      removedDepsAt.set(dep, i);
+    });
+    release.removeDevDependencies?.forEach((dep) => {
+      removedDevDepsAt.set(dep, i);
+    });
+  });
+  const reinstalledDeps = /* @__PURE__ */ new Set();
+  const reinstalledDevDeps = /* @__PURE__ */ new Set();
+  for (let i = 0; i < releasesByVersion.length; i++) {
+    const release = releasesByVersion[i];
+    if (!release) continue;
+    const dependencies2 = release.dependencies ?? {};
+    const devDependencies2 = release.devDependencies ?? {};
+    Object.keys(dependencies2).forEach((dep) => {
+      const removalI = removedDepsAt.get(dep);
+      if (removalI !== void 0 && i >= removalI) {
+        reinstalledDeps.add(dep);
+      }
+    });
+    Object.keys(devDependencies2).forEach((dep) => {
+      const removalI = removedDevDepsAt.get(dep);
+      if (removalI !== void 0 && i >= removalI) {
+        reinstalledDevDeps.add(dep);
+      }
+    });
+  }
+  const removeDependencies = [
+    ...new Set(
+      releasesByVersion.flatMap((r) => r.removeDependencies ?? []).filter((dep) => !reinstalledDeps.has(dep))
+    )
+  ];
+  const removeDevDependencies = [
+    ...new Set(
+      releasesByVersion.flatMap((r) => r.removeDevDependencies ?? []).filter((dep) => !reinstalledDevDeps.has(dep))
+    )
+  ];
+  const dependencies = {};
+  const devDependencies = {};
+  for (const release of releasesByVersion) {
+    Object.assign(dependencies, release.dependencies ?? {});
+    Object.assign(devDependencies, release.devDependencies ?? {});
+  }
+  return {
+    features,
+    fixes,
+    removeDependencies,
+    removeDevDependencies,
+    dependencies,
+    devDependencies
+  };
 }
 function displayConfirmation({
   cumulativeRelease,
@@ -377,7 +443,7 @@ function displayConfirmation({
   if (features.length || fixes.length) {
     renderInfo({
       headline: `Included in this upgrade:`,
-      //@ts-ignore we know that filter(Boolean) will always return an array
+      // @ts-expect-error - filter(Boolean) removes falsy values, leaving only objects
       customSections: [
         features.length && {
           title: "Features",
@@ -461,10 +527,20 @@ function maybeIncludeDependency({
 function buildUpgradeCommandArgs({
   selectedRelease,
   currentDependencies,
-  targetVersion
+  targetVersion,
+  cumulativeDependencies,
+  cumulativeDevDependencies
 }) {
   const args = [];
-  for (const dependency of Object.entries(selectedRelease.dependencies)) {
+  const effectiveDependencies = {
+    ...cumulativeDependencies ?? {},
+    ...selectedRelease.dependencies
+  };
+  const effectiveDevDependencies = {
+    ...cumulativeDevDependencies ?? {},
+    ...selectedRelease.devDependencies
+  };
+  for (const dependency of Object.entries(effectiveDependencies)) {
     const shouldUpgradeDep = maybeIncludeDependency({
       currentDependencies,
       dependency,
@@ -480,7 +556,7 @@ function buildUpgradeCommandArgs({
       )}`
     );
   }
-  for (const dependency of Object.entries(selectedRelease.devDependencies)) {
+  for (const dependency of Object.entries(effectiveDevDependencies)) {
     const shouldUpgradeDep = maybeIncludeDependency({
       currentDependencies,
       dependency,
@@ -497,7 +573,7 @@ function buildUpgradeCommandArgs({
     );
   }
   const currentRemix = Object.entries(currentDependencies).find(isRemixDependency);
-  const selectedRemix = Object.entries(selectedRelease.dependencies).find(
+  const selectedRemix = Object.entries(effectiveDependencies).find(
     isRemixDependency
   );
   if (currentRemix && selectedRemix) {
@@ -514,7 +590,7 @@ function buildUpgradeCommandArgs({
   const currentReactRouter = Object.entries(currentDependencies).find(
     isReactRouterDependency
   );
-  const selectedReactRouter = Object.entries(selectedRelease.dependencies).find(
+  const selectedReactRouter = Object.entries(effectiveDependencies).find(
     isReactRouterDependency
   );
   if (selectedReactRouter) {
@@ -537,12 +613,16 @@ async function upgradeNodeModules({
   appPath,
   selectedRelease,
   currentDependencies,
-  targetVersion
+  targetVersion,
+  cumulativeRemoveDependencies,
+  cumulativeRemoveDevDependencies,
+  cumulativeDependencies,
+  cumulativeDevDependencies
 }) {
   const tasks = [];
   const depsToRemove = [
-    ...selectedRelease.removeDependencies || [],
-    ...selectedRelease.removeDevDependencies || []
+    ...cumulativeRemoveDependencies,
+    ...cumulativeRemoveDevDependencies
   ].filter((dep) => dep in currentDependencies);
   if (depsToRemove.length > 0) {
     tasks.push({
@@ -559,17 +639,24 @@ async function upgradeNodeModules({
   const upgradeArgs = buildUpgradeCommandArgs({
     selectedRelease,
     currentDependencies,
-    targetVersion
+    targetVersion,
+    cumulativeDependencies,
+    cumulativeDevDependencies
   });
   if (upgradeArgs.length > 0) {
     tasks.push({
       title: `Upgrading dependencies`,
       task: async () => {
-        await installNodeModules({
-          directory: appPath,
-          packageManager: await getPackageManager(appPath),
-          args: upgradeArgs
-        });
+        const packageManager = await getPackageManager(appPath);
+        const command = packageManager === "npm" ? "install" : packageManager === "yarn" ? "add" : packageManager === "pnpm" ? "add" : packageManager === "bun" ? "install" : "install";
+        const extraArgs = packageManager === "npm" || packageManager === "unknown" ? ["--legacy-peer-deps"] : [];
+        await exec(
+          resolvePackageManagerName(packageManager),
+          [command, ...extraArgs, ...upgradeArgs],
+          {
+            cwd: appPath
+          }
+        );
       }
     });
   }
@@ -577,6 +664,9 @@ async function upgradeNodeModules({
     await renderTasks(tasks, {});
   }
 }
+function resolvePackageManagerName(packageManager) {
+  return packageManager === "unknown" ? "npm" : packageManager;
+}
 async function uninstallNodeModules({
   directory,
   packageManager,
@@ -584,8 +674,12 @@ async function uninstallNodeModules({
 }) {
   if (args.length === 0) return;
   const command = packageManager === "npm" ? "uninstall" : packageManager === "yarn" ? "remove" : packageManager === "pnpm" ? "remove" : packageManager === "bun" ? "remove" : "uninstall";
-  const actualPackageManager = packageManager === "unknown" ? "npm" : packageManager;
-  await exec(actualPackageManager, [command, ...args], { cwd: directory });
+  const extraArgs = packageManager === "npm" || packageManager === "unknown" ? ["--legacy-peer-deps"] : [];
+  await exec(
+    resolvePackageManagerName(packageManager),
+    [command, ...extraArgs, ...args],
+    { cwd: directory }
+  );
 }
 function appendRemixDependencies({
   currentDependencies,
@@ -954,4 +1048,4 @@ async function displayDevUpgradeNotice({
   }
 }
 
-export { buildUpgradeCommandArgs, Upgrade as default, displayConfirmation, displayDevUpgradeNotice, getAbsoluteVersion, getAvailableUpgrades, getChangelog, getCummulativeRelease, getHydrogenVersion, getPackageVersion, getSelectedRelease, isRunningFromHydrogenMonorepo, runUpgrade, upgradeNodeModules, validateUpgrade };
+export { buildUpgradeCommandArgs, Upgrade as default, displayConfirmation, displayDevUpgradeNotice, getAbsoluteVersion, getAvailableUpgrades, getChangelog, getCumulativeRelease, getHydrogenVersion, getPackageVersion, getSelectedRelease, isRunningFromHydrogenMonorepo, runUpgrade, upgradeNodeModules, validateUpgrade };

package/dist/lib/graphql/admin/client.js

@@ -1,6 +1,50 @@
 import { AbortError } from '@shopify/cli-kit/node/error';
 import { graphqlRequest } from '@shopify/cli-kit/node/api/graphql';
 
+const KNOWN_USER_ERRORS = [
+  {
+    pattern: "app is not installed",
+    abort: [
+      "Hydrogen sales channel isn't installed",
+      "Install the Hydrogen sales channel on your store to start creating and linking Hydrogen storefronts: https://apps.shopify.com/hydrogen"
+    ]
+  },
+  {
+    pattern: "Access denied for hydrogenStorefrontCreate field",
+    abort: [
+      "Couldn't connect storefront to Shopify",
+      [
+        "Common reasons for this error include:",
+        {
+          list: {
+            items: [
+              "The Hydrogen sales channel isn't installed on the store.",
+              "You don't have the required account permission to manage apps or channels.",
+              "You're trying to connect to an ineligible store type (Trial, Development store)"
+            ]
+          }
+        }
+      ]
+    ]
+  },
+  {
+    pattern: "Access denied for hydrogenStorefronts field",
+    abort: [
+      "Couldn't access Hydrogen storefronts",
+      [
+        "Common reasons for this error include:",
+        {
+          list: {
+            items: [
+              "You don't have full access to apps or access to the Hydrogen channel.",
+              "The Hydrogen sales channel isn't installed on the store."
+            ]
+          }
+        }
+      ]
+    ]
+  }
+];
 async function adminRequest(query, session, variables) {
   const api = "Admin";
   const url = `https://${session.storeFqdn}/admin/api/unstable/graphql.json`;
@@ -14,29 +58,10 @@ async function adminRequest(query, session, variables) {
     });
   } catch (error) {
     const errors = error.errors;
-    if (errors?.some?.((error2) => error2.message.includes("app is not installed"))) {
-      throw new AbortError(
-        "Hydrogen sales channel isn't installed",
-        "Install the Hydrogen sales channel on your store to start creating and linking Hydrogen storefronts: https://apps.shopify.com/hydrogen"
-      );
-    }
-    if (errors?.some?.(
-      (error2) => error2.message.includes(
-        "Access denied for hydrogenStorefrontCreate field"
-      )
-    )) {
-      throw new AbortError("Couldn't connect storefront to Shopify", [
-        "Common reasons for this error include:",
-        {
-          list: {
-            items: [
-              "The Hydrogen sales channel isn't installed on the store.",
-              "You don't have the required account permission to manage apps or channels.",
-              "You're trying to connect to an ineligible store type (Trial, Development store)"
-            ]
-          }
-        }
-      ]);
+    for (const { pattern, abort } of KNOWN_USER_ERRORS) {
+      if (errors?.some?.((e) => e.message.includes(pattern))) {
+        throw new AbortError(...abort);
+      }
     }
     throw error;
   }

package/dist/lib/patch-cli.js

@@ -0,0 +1,198 @@
+import { readFileSync, existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+function isErrnoException(err) {
+  return err instanceof Error && "code" in err;
+}
+const MARKER = "// [hydrogen-monorepo-patch]";
+function getRunJsPath(root) {
+  return resolve(root, "node_modules", "@shopify", "cli", "bin", "run.js");
+}
+function isPatchApplied(content) {
+  return content.includes(MARKER);
+}
+function generatePatchedContent() {
+  return `#!/usr/bin/env node
+${MARKER}
+
+// Mirrors upstream @shopify/cli/bin/run.js behavior.
+// This is not introduced by the patch \u2014 @shopify/cli ships with this line.
+// Changing it here would create a behavioral divergence between dev and production.
+process.removeAllListeners('warning')
+
+// --- Monorepo detection ---
+// Walk up from cwd to find the hydrogen monorepo root.
+// We look for packages/cli/package.json with the correct package name \u2014
+// if it matches, we know we're inside the monorepo and should load the
+// local @shopify/cli-hydrogen
+const {existsSync, readFileSync} = await import('node:fs');
+const {resolve, dirname} = await import('node:path');
+
+let monorepoRoot = null;
+let dir = process.cwd();
+while (true) {
+  const candidate = resolve(dir, 'packages', 'cli', 'package.json');
+  if (existsSync(candidate)) {
+    try {
+      const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
+      if (pkg.name === '@shopify/cli-hydrogen') {
+        monorepoRoot = dir;
+        break;
+      }
+    } catch {
+      // Ignore malformed package.json and keep walking
+    }
+  }
+  const parent = dirname(dir);
+  if (parent === dir) break; // reached filesystem root
+  dir = parent;
+}
+
+if (monorepoRoot) {
+  // We're in the hydrogen monorepo. Start @shopify/cli normally but
+  // inject pluginAdditions so oclif loads @shopify/cli-hydrogen from
+  // the monorepo's workspace (packages/cli) instead of the version
+  // bundled inside @shopify/cli/dist.
+  //
+  // This uses the same pluginAdditions mechanism that ShopifyConfig
+  // uses internally
+  const {fileURLToPath} = await import('node:url');
+  const {Config, run, flush} = await import('@oclif/core');
+
+  // root must point to @shopify/cli's installed location so oclif
+  // can find its package.json, oclif config, and bundled commands.
+  const cliRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+  const c = '\\x1b[38;5;209m';
+  const d = '\\x1b[2m';
+  const r = '\\x1b[0m';
+  console.log('');
+  console.log(c + '  \u250C\u2500\u2500 hydrogen-monorepo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510' + r);
+  console.log(c + '  \u2502' + r + '                                                          ' + c + '\u2502' + r);
+  console.log(c + '  \u2502' + r + '  Using local cli-hydrogen plugin from packages/cli       ' + c + '\u2502' + r);
+  console.log(c + '  \u2502' + r + d + '  Bundled commands replaced with local source             ' + r + c + '\u2502' + r);
+  console.log(c + '  \u2502' + r + '                                                          ' + c + '\u2502' + r);
+  console.log(c + '  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518' + r);
+  console.log('');
+
+  // Tell ShopifyConfig to skip its own monorepo detection since we
+  // are handling pluginAdditions ourselves.
+  process.env.IGNORE_HYDROGEN_MONOREPO = '1';
+
+  const config = new Config({
+    root: cliRoot,
+    // pluginAdditions tells oclif's plugin loader to read the
+    // monorepo root's package.json, find @shopify/cli-hydrogen in
+    // its dependencies (workspace:*), and load that as a core plugin.
+    // Because workspace:* symlinks to packages/cli, oclif loads the
+    // local source code \u2014 exactly what we want for development.
+    pluginAdditions: {
+      core: ['@shopify/cli-hydrogen'],
+      path: monorepoRoot,
+    },
+    // Skip the oclif manifest cache so commands are loaded fresh from
+    // disk rather than from a potentially stale oclif.manifest.json.
+    ignoreManifest: true,
+  });
+
+  await config.load();
+
+  // --- Post-load command replacement ---
+  // After loading, both the bundled hydrogen commands (from @shopify/cli's
+  // root plugin) and the local ones (from pluginAdditions) are registered.
+  // Since @shopify/cli@3.83.0 (which upgraded to oclif v4),
+  // determinePriority is no longer an overridable instance method, so we
+  // manually replace the bundled commands with the external plugin's
+  // versions using oclif's private _commands Map.
+  const externalPlugin = Array.from(config.plugins.values()).find(
+    (p) => p.name === '@shopify/cli-hydrogen' && !p.isRoot,
+  );
+
+  if (!externalPlugin) {
+    throw new Error(
+      '[hydrogen-monorepo] Could not find local @shopify/cli-hydrogen plugin. ' +
+      'The patch may need updating for the current @shopify/cli version.'
+    );
+  }
+
+  const cmds = config._commands;
+  if (!cmds || !(cmds instanceof Map)) {
+    throw new Error(
+      '[hydrogen-monorepo] Cannot replace bundled commands \u2014 oclif internals changed. ' +
+      'The patch may need updating for the current oclif version.'
+    );
+  }
+
+  // Delete bundled hydrogen commands (canonical IDs + aliases + hidden aliases)
+  for (const command of externalPlugin.commands) {
+    if (!command.id.startsWith('hydrogen')) continue;
+    cmds.delete(command.id);
+    for (const alias of [...(command.aliases ?? []), ...(command.hiddenAliases ?? [])]) {
+      cmds.delete(alias);
+    }
+  }
+  // Re-insert commands from the local plugin. loadCommands handles
+  // alias registration and command permutations correctly.
+  config.loadCommands(externalPlugin);
+
+  await run(process.argv.slice(2), config);
+  await flush();
+} else {
+  // Not in the monorepo \u2014 run the standard @shopify/cli entrypoint.
+  const {default: runCLI} = await import('../dist/index.js');
+  runCLI({development: false});
+}
+`;
+}
+function generateOriginalContent() {
+  return `#!/usr/bin/env node
+
+process.removeAllListeners('warning')
+
+import runCLI from '../dist/index.js'
+
+runCLI({development: false})
+`;
+}
+function applyPatch(runJsPath) {
+  let current;
+  try {
+    current = readFileSync(runJsPath, "utf8");
+  } catch (err) {
+    if (isErrnoException(err) && err.code === "ENOENT") {
+      throw new Error(
+        `@shopify/cli is not installed (${runJsPath} not found). Run 'pnpm install' first.`
+      );
+    }
+    throw err;
+  }
+  if (isPatchApplied(current)) return false;
+  const backupPath = runJsPath + ".backup";
+  if (!existsSync(backupPath)) {
+    writeFileSync(backupPath, current);
+  }
+  writeFileSync(runJsPath, generatePatchedContent());
+  return true;
+}
+function removePatch(runJsPath) {
+  let current;
+  try {
+    current = readFileSync(runJsPath, "utf8");
+  } catch (err) {
+    if (isErrnoException(err) && err.code === "ENOENT") {
+      return false;
+    }
+    throw err;
+  }
+  if (!isPatchApplied(current)) return false;
+  const backupPath = runJsPath + ".backup";
+  const hasBackup = existsSync(backupPath);
+  const original = hasBackup ? readFileSync(backupPath, "utf8") : generateOriginalContent();
+  writeFileSync(runJsPath, original);
+  if (hasBackup) {
+    unlinkSync(backupPath);
+  }
+  return true;
+}
+
+export { MARKER, applyPatch, generateOriginalContent, generatePatchedContent, getRunJsPath, isPatchApplied, removePatch };

package/dist/lib/setups/routes/generate.js

@@ -22,8 +22,7 @@ const ROUTE_MAP = {
   account: "account*",
   search: ["search", "api.predictive-search"],
   robots: "[robots.txt]",
-  sitemap: ["[sitemap.xml]", "sitemap.$type.$page[.xml]"],
-  tokenlessApi: "api.$version.[graphql.json]"
+  sitemap: ["[sitemap.xml]", "sitemap.$type.$page[.xml]"]
 };
 let allRouteTemplateFiles = [];
 async function getResolvedRoutes(routeKeys = Object.keys(ROUTE_MAP)) {

package/dist/lib/template-pack.js

@@ -1,8 +1,14 @@
+import { createReadStream } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { readFile, writeFile, mkdtemp, rm } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, isAbsolute } from 'node:path';
+import { pipeline } from 'node:stream/promises';
 import { tmpdir } from 'node:os';
+import gunzipMaybe from 'gunzip-maybe';
+import { extract } from 'tar-fs';
 
+const WINDOWS_SHELL_OPTS = process.platform === "win32" ? { shell: true } : {};
+const PNPM_PACK_TIMEOUT_IN_MS = 6e4;
 const DEPENDENCY_SECTIONS = [
   "dependencies",
   "devDependencies",
@@ -20,7 +26,9 @@ async function getPackedTemplatePackageJson(sourceTemplateDir) {
       ["pack", "--pack-destination", tempDir, "--json"],
       {
         cwd: sourceTemplateDir,
-        encoding: "utf8"
+        encoding: "utf8",
+        timeout: PNPM_PACK_TIMEOUT_IN_MS,
+        ...WINDOWS_SHELL_OPTS
       }
     );
     const parsedResult = JSON.parse(rawPackResult.trim());
@@ -28,14 +36,15 @@ async function getPackedTemplatePackageJson(sourceTemplateDir) {
     if (!packedTarball) {
       throw new Error("pnpm pack did not return a tarball filename.");
     }
-    const packedManifestRaw = execFileSync(
-      "tar",
-      [
-        "-xOf",
-        packedTarball.startsWith("/") ? packedTarball : join(tempDir, packedTarball),
-        "package/package.json"
-      ],
-      { encoding: "utf8" }
+    const tarballPath = isAbsolute(packedTarball) ? packedTarball : join(tempDir, packedTarball);
+    await pipeline(
+      createReadStream(tarballPath),
+      gunzipMaybe(),
+      extract(tempDir)
+    );
+    const packedManifestRaw = await readFile(
+      join(tempDir, "package", "package.json"),
+      "utf8"
     );
     return JSON.parse(packedManifestRaw);
   } finally {
@@ -81,4 +90,4 @@ async function replaceWorkspaceProtocolVersions({
   );
 }
 
-export { replaceWorkspaceProtocolVersions };
+export { WINDOWS_SHELL_OPTS, replaceWorkspaceProtocolVersions };

package/dist/lib/upgrade-e2e-utils.js

@@ -0,0 +1,50 @@
+const DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies"
+];
+function parseCatalogFromWorkspaceYaml(yamlContent) {
+  const catalogVersions = {};
+  const catalogMatch = yamlContent.match(/^catalog:\s*\n((?:[ \t]+.+\n?)*)/m);
+  const catalogSection = catalogMatch?.[1];
+  if (!catalogSection) return catalogVersions;
+  for (const line of catalogSection.split("\n")) {
+    const match = line.match(
+      /^\s+['"]?([^'":]+?)['"]?\s*:\s*['"]?([^'"]+?)['"]?\s*$/
+    );
+    if (match?.[1] && match[2]) {
+      catalogVersions[match[1].trim()] = match[2].trim();
+    }
+  }
+  return catalogVersions;
+}
+function parseWorkspacePackagesFromYaml(yamlContent) {
+  const packagesMatch = yamlContent.match(
+    /^packages:\s*\n((?:[ \t]+-.+\n?)*)/m
+  );
+  const packagesSection = packagesMatch?.[1];
+  if (!packagesSection) return [];
+  return packagesSection.split("\n").map((line) => line.match(/^\s+-\s+(.+)/)?.[1]?.trim()).filter((path) => Boolean(path));
+}
+async function resolveWorkspaceProtocols({
+  packageJson,
+  catalogVersions,
+  resolveWorkspaceVersion,
+  fallbackVersion
+}) {
+  const resolved = JSON.parse(JSON.stringify(packageJson));
+  for (const section of DEPENDENCY_SECTIONS) {
+    const deps = resolved[section];
+    if (!deps) continue;
+    for (const [name, version] of Object.entries(deps)) {
+      if (version.startsWith("workspace:")) {
+        const resolvedVersion = await resolveWorkspaceVersion(name);
+        deps[name] = resolvedVersion ?? fallbackVersion;
+      } else if (version === "catalog:" && catalogVersions[name]) {
+        deps[name] = catalogVersions[name];
+      }
+    }
+  }
+  return resolved;
+}
+
+export { parseCatalogFromWorkspaceYaml, parseWorkspacePackagesFromYaml, resolveWorkspaceProtocols };

package/oclif.manifest.json

@@ -832,7 +832,7 @@
       "aliases": [],
       "args": {
         "routeName": {
-          "description": "The route to generate. One of home,page,cart,products,collections,policies,blogs,account,search,robots,sitemap,tokenlessApi,all.",
+          "description": "The route to generate. One of home,page,cart,products,collections,policies,blogs,account,search,robots,sitemap,all.",
           "name": "routeName",
           "options": [
             "home",
@@ -846,7 +846,6 @@
             "search",
             "robots",
             "sitemap",
-            "tokenlessApi",
             "all"
           ],
           "required": true
@@ -1676,5 +1675,5 @@
       ]
     }
   },
-  "version": "11.1.11"
+  "version": "11.1.13"
 }

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "@shopify:registry": "https://registry.npmjs.org"
   },
-  "version": "11.1.11",
+  "version": "11.1.13",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -16,7 +16,7 @@
     "@react-router/dev": "7.12.0",
     "@types/diff": "^5.0.2",
     "@types/gunzip-maybe": "^1.4.0",
-    "@types/node": "^22",
+    "@types/node": "22.19.15",
     "esbuild": "^0.25.0",
     "@types/prettier": "^2.7.2",
     "@types/source-map-support": "^0.5.10",
@@ -27,7 +27,7 @@
     "flame-chart-js": "2.3.2",
     "get-port": "^7.0.0",
     "type-fest": "^4.33.0",
-    "vite": "^6.2.4",
+    "vite": "^6.4.2",
     "vitest": "^1.0.4"
   },
   "dependencies": {
@@ -59,7 +59,7 @@
     "graphql-config": "^5.0.3",
     "vite": "^5.1.0 || ^6.2.0",
     "@shopify/hydrogen-codegen": "0.3.3",
-    "@shopify/mini-oxygen": "4.0.1"
+    "@shopify/mini-oxygen": "4.0.2"
   },
   "peerDependenciesMeta": {
     "@graphql-codegen/cli": {

package/dist/assets/hydrogen/starter/app/routes/api.$version.[graphql.json].tsx

@@ -1,14 +0,0 @@
-import type {Route} from './+types/api.$version.[graphql.json]';
-
-export async function action({params, context, request}: Route.ActionArgs) {
-  const response = await fetch(
-    `https://${context.env.PUBLIC_CHECKOUT_DOMAIN}/api/${params.version}/graphql.json`,
-    {
-      method: 'POST',
-      body: request.body,
-      headers: request.headers,
-    },
-  );
-
-  return new Response(response.body, {headers: new Headers(response.headers)});
-}