@shopify/cli-hydrogen 11.1.12 → 11.1.14

package/README.md

@@ -8,7 +8,7 @@ The Hydrogen extension for the [Shopify CLI](https://shopify.dev/apps/tools/cli)
 
 The most common way to test the cli changes locally is to do the following:
 
-- Run `npm run build` in this directory (`packages/cli` from the root of the repo).
+- Run `pnpm run build` in this directory (`packages/cli` from the root of the repo).
 - Run `npx shopify hydrogen` anywhere else in the monorepo, for example `npx shopify hydrogen init`.
 - If you want to test a command inside of a template, run the command from within that template or use the `--path` flag to point to another template or any Hydrogen app.
 - If you want to make changes to a file that is generated when running `npx shopify hydrogen generate`, make changes to that file from inside of the `templates/skeleton` directory.

package/dist/assets/hydrogen/starter/CHANGELOG.md

@@ -1,5 +1,39 @@
 # skeleton
 
+## 2026.4.0
+
+### Major Changes
+
+- Update Storefront API and Customer Account API from 2026-01 to 2026-04. ([#3651](https://github.com/Shopify/hydrogen/pull/3651)) by [@itsjustriley](https://github.com/itsjustriley)
+
+  ## Breaking changes
+
+  **JSON metafield values limited to 128KB**: When using API version 2026-04 or later, the Storefront API limits JSON type metafield writes to 128KB. This limit applies at the API level - Hydrogen passes through to the Storefront API without additional restriction. Apps that used JSON metafields before April 1, 2026 are grandfathered at the existing 2MB limit. Large metafield values continue to be readable by all API versions.
+
+  ## New features
+
+  **New `MERCHANDISE_LINE_TRANSFORMERS_RUN_ERROR` cart error code**: Cart operations (`cartCreate`, `cartLinesAdd`, etc.) now return a specific `MERCHANDISE_LINE_TRANSFORMERS_RUN_ERROR` error code when a Cart Transform Function fails at runtime, instead of the previous generic `INVALID` error code. If you handle cart errors in your storefront code, you may want to add handling for this new code.
+
+  ## Changelog links
+  - [Storefront API 2026-04 changelog](https://shopify.dev/changelog?filter=api&api_version=2026-04&api_type=storefront-graphql)
+  - [Customer Account API 2026-04 changelog](https://shopify.dev/changelog?filter=api&api_version=2026-04&api_type=customer-account-graphql)
+
+### Patch Changes
+
+- Updated dependencies [[`e7215ed0d7a74cacfa8c935f414c1cf32fc2ccd0`](https://github.com/Shopify/hydrogen/commit/e7215ed0d7a74cacfa8c935f414c1cf32fc2ccd0), [`92ab8e8b59807bbdb5dbecaa18629292d5566135`](https://github.com/Shopify/hydrogen/commit/92ab8e8b59807bbdb5dbecaa18629292d5566135), [`b0caa5c013380c7837f049f48da089a1671e2c6d`](https://github.com/Shopify/hydrogen/commit/b0caa5c013380c7837f049f48da089a1671e2c6d)]:
+  - @shopify/hydrogen@2026.4.0
+
+## 2026.1.4
+
+### Patch Changes
+
+- Remove redundant Storefront API proxy route from skeleton template. The server now automatically proxies requests to `/api/:version/graphql.json` via `createRequestHandler` with `proxyStandardRoutes: true` (enabled by default since December 2025). ([#3572](https://github.com/Shopify/hydrogen/pull/3572)) by [@itsjustriley](https://github.com/itsjustriley)
+
+  Developers no longer need a manual route file for the tokenless Storefront API. Existing apps with this route can safely delete it - the server-level proxy provides the same functionality with better cookie forwarding and analytics integration.
+
+- Updated dependencies [[`b0a75c1d759706931876f056662de2497cb3e688`](https://github.com/Shopify/hydrogen/commit/b0a75c1d759706931876f056662de2497cb3e688), [`a44ee3566b9bb9a7f43f05dfaae6f1f2ab1d548f`](https://github.com/Shopify/hydrogen/commit/a44ee3566b9bb9a7f43f05dfaae6f1f2ab1d548f)]:
+  - @shopify/hydrogen@2026.1.4
+
 ## 2026.1.3
 
 ### Patch Changes

package/dist/assets/hydrogen/starter/package.json

@@ -2,7 +2,7 @@
   "name": "skeleton",
   "private": true,
   "sideEffects": false,
-  "version": "2026.1.3",
+  "version": "2026.4.0",
   "type": "module",
   "scripts": {
     "build": "shopify hydrogen build --codegen",
@@ -14,7 +14,7 @@
   },
   "prettier": "@shopify/prettier-config",
   "dependencies": {
-    "@shopify/hydrogen": "2026.1.3",
+    "@shopify/hydrogen": "2026.4.0",
     "graphql": "^16.10.0",
     "graphql-tag": "^2.12.6",
     "isbot": "^5.1.22",
@@ -54,7 +54,7 @@
     "graphql-config": "^5.0.3",
     "prettier": "^3.4.2",
     "typescript": "^5.9.2",
-    "vite": "^6.2.4",
+    "vite": "^6.4.2",
     "vite-tsconfig-paths": "^4.3.1"
   },
   "engines": {

package/dist/lib/graphql/admin/client.js

@@ -1,6 +1,50 @@
 import { AbortError } from '@shopify/cli-kit/node/error';
 import { graphqlRequest } from '@shopify/cli-kit/node/api/graphql';
 
+const KNOWN_USER_ERRORS = [
+  {
+    pattern: "app is not installed",
+    abort: [
+      "Hydrogen sales channel isn't installed",
+      "Install the Hydrogen sales channel on your store to start creating and linking Hydrogen storefronts: https://apps.shopify.com/hydrogen"
+    ]
+  },
+  {
+    pattern: "Access denied for hydrogenStorefrontCreate field",
+    abort: [
+      "Couldn't connect storefront to Shopify",
+      [
+        "Common reasons for this error include:",
+        {
+          list: {
+            items: [
+              "The Hydrogen sales channel isn't installed on the store.",
+              "You don't have the required account permission to manage apps or channels.",
+              "You're trying to connect to an ineligible store type (Trial, Development store)"
+            ]
+          }
+        }
+      ]
+    ]
+  },
+  {
+    pattern: "Access denied for hydrogenStorefronts field",
+    abort: [
+      "Couldn't access Hydrogen storefronts",
+      [
+        "Common reasons for this error include:",
+        {
+          list: {
+            items: [
+              "You don't have full access to apps or access to the Hydrogen channel.",
+              "The Hydrogen sales channel isn't installed on the store."
+            ]
+          }
+        }
+      ]
+    ]
+  }
+];
 async function adminRequest(query, session, variables) {
   const api = "Admin";
   const url = `https://${session.storeFqdn}/admin/api/unstable/graphql.json`;
@@ -14,29 +58,10 @@ async function adminRequest(query, session, variables) {
     });
   } catch (error) {
     const errors = error.errors;
-    if (errors?.some?.((error2) => error2.message.includes("app is not installed"))) {
-      throw new AbortError(
-        "Hydrogen sales channel isn't installed",
-        "Install the Hydrogen sales channel on your store to start creating and linking Hydrogen storefronts: https://apps.shopify.com/hydrogen"
-      );
-    }
-    if (errors?.some?.(
-      (error2) => error2.message.includes(
-        "Access denied for hydrogenStorefrontCreate field"
-      )
-    )) {
-      throw new AbortError("Couldn't connect storefront to Shopify", [
-        "Common reasons for this error include:",
-        {
-          list: {
-            items: [
-              "The Hydrogen sales channel isn't installed on the store.",
-              "You don't have the required account permission to manage apps or channels.",
-              "You're trying to connect to an ineligible store type (Trial, Development store)"
-            ]
-          }
-        }
-      ]);
+    for (const { pattern, abort } of KNOWN_USER_ERRORS) {
+      if (errors?.some?.((e) => e.message.includes(pattern))) {
+        throw new AbortError(...abort);
+      }
     }
     throw error;
   }

package/dist/lib/setups/routes/generate.js

@@ -22,8 +22,7 @@ const ROUTE_MAP = {
   account: "account*",
   search: ["search", "api.predictive-search"],
   robots: "[robots.txt]",
-  sitemap: ["[sitemap.xml]", "sitemap.$type.$page[.xml]"],
-  tokenlessApi: "api.$version.[graphql.json]"
+  sitemap: ["[sitemap.xml]", "sitemap.$type.$page[.xml]"]
 };
 let allRouteTemplateFiles = [];
 async function getResolvedRoutes(routeKeys = Object.keys(ROUTE_MAP)) {

package/dist/lib/upgrade-e2e-utils.js

@@ -0,0 +1,50 @@
+const DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies"
+];
+function parseCatalogFromWorkspaceYaml(yamlContent) {
+  const catalogVersions = {};
+  const catalogMatch = yamlContent.match(/^catalog:\s*\n((?:[ \t]+.+\n?)*)/m);
+  const catalogSection = catalogMatch?.[1];
+  if (!catalogSection) return catalogVersions;
+  for (const line of catalogSection.split("\n")) {
+    const match = line.match(
+      /^\s+['"]?([^'":]+?)['"]?\s*:\s*['"]?([^'"]+?)['"]?\s*$/
+    );
+    if (match?.[1] && match[2]) {
+      catalogVersions[match[1].trim()] = match[2].trim();
+    }
+  }
+  return catalogVersions;
+}
+function parseWorkspacePackagesFromYaml(yamlContent) {
+  const packagesMatch = yamlContent.match(
+    /^packages:\s*\n((?:[ \t]+-.+\n?)*)/m
+  );
+  const packagesSection = packagesMatch?.[1];
+  if (!packagesSection) return [];
+  return packagesSection.split("\n").map((line) => line.match(/^\s+-\s+(.+)/)?.[1]?.trim()).filter((path) => Boolean(path));
+}
+async function resolveWorkspaceProtocols({
+  packageJson,
+  catalogVersions,
+  resolveWorkspaceVersion,
+  fallbackVersion
+}) {
+  const resolved = JSON.parse(JSON.stringify(packageJson));
+  for (const section of DEPENDENCY_SECTIONS) {
+    const deps = resolved[section];
+    if (!deps) continue;
+    for (const [name, version] of Object.entries(deps)) {
+      if (version.startsWith("workspace:")) {
+        const resolvedVersion = await resolveWorkspaceVersion(name);
+        deps[name] = resolvedVersion ?? fallbackVersion;
+      } else if (version === "catalog:" && catalogVersions[name]) {
+        deps[name] = catalogVersions[name];
+      }
+    }
+  }
+  return resolved;
+}
+
+export { parseCatalogFromWorkspaceYaml, parseWorkspacePackagesFromYaml, resolveWorkspaceProtocols };

package/oclif.manifest.json

@@ -832,7 +832,7 @@
       "aliases": [],
       "args": {
         "routeName": {
-          "description": "The route to generate. One of home,page,cart,products,collections,policies,blogs,account,search,robots,sitemap,tokenlessApi,all.",
+          "description": "The route to generate. One of home,page,cart,products,collections,policies,blogs,account,search,robots,sitemap,all.",
           "name": "routeName",
           "options": [
             "home",
@@ -846,7 +846,6 @@
             "search",
             "robots",
             "sitemap",
-            "tokenlessApi",
             "all"
           ],
           "required": true
@@ -1676,5 +1675,5 @@
       ]
     }
   },
-  "version": "11.1.12"
+  "version": "11.1.14"
 }

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "@shopify:registry": "https://registry.npmjs.org"
   },
-  "version": "11.1.12",
+  "version": "11.1.14",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -16,7 +16,7 @@
     "@react-router/dev": "7.12.0",
     "@types/diff": "^5.0.2",
     "@types/gunzip-maybe": "^1.4.0",
-    "@types/node": "^22",
+    "@types/node": "22.19.15",
     "esbuild": "^0.25.0",
     "@types/prettier": "^2.7.2",
     "@types/source-map-support": "^0.5.10",
@@ -27,7 +27,7 @@
     "flame-chart-js": "2.3.2",
     "get-port": "^7.0.0",
     "type-fest": "^4.33.0",
-    "vite": "^6.2.4",
+    "vite": "^6.4.2",
     "vitest": "^1.0.4"
   },
   "dependencies": {
@@ -55,11 +55,11 @@
   },
   "peerDependencies": {
     "@graphql-codegen/cli": "^5.0.2",
-    "@react-router/dev": "7.12.0",
+    "@react-router/dev": "^7.12.0",
     "graphql-config": "^5.0.3",
     "vite": "^5.1.0 || ^6.2.0",
-    "@shopify/mini-oxygen": "4.0.2",
-    "@shopify/hydrogen-codegen": "0.3.3"
+    "@shopify/hydrogen-codegen": "0.3.3",
+    "@shopify/mini-oxygen": "4.0.2"
   },
   "peerDependenciesMeta": {
     "@graphql-codegen/cli": {

package/dist/assets/hydrogen/starter/app/routes/api.$version.[graphql.json].tsx

@@ -1,14 +0,0 @@
-import type {Route} from './+types/api.$version.[graphql.json]';
-
-export async function action({params, context, request}: Route.ActionArgs) {
-  const response = await fetch(
-    `https://${context.env.PUBLIC_CHECKOUT_DOMAIN}/api/${params.version}/graphql.json`,
-    {
-      method: 'POST',
-      body: request.body,
-      headers: request.headers,
-    },
-  );
-
-  return new Response(response.body, {headers: new Headers(response.headers)});
-}