shapi-cli 0.1.0 → 0.3.0

package/advisories/meta-graph-page-insights-reach-video-views-removed.json

@@ -0,0 +1,57 @@
+{
+  "id": "meta-graph-page-insights-reach-video-views-removed",
+  "provider": "meta-graph",
+  "title": "Page Insights reach and 3-second video viewer metrics removed on 2026-06-15",
+  "summary": "By 2026-06-15, on all API versions, the Page/post reach metrics (page_impressions_unique, post_impressions_unique and their paid, viral, nonviral, organic and fan variants, the page_posts_impressions family, page_posts_served_impressions_organic_unique) and the 3-second viewer metrics (page_video_views_unique, post_video_views_unique) return an invalid metric error. SHAPI flags calls that request one of these metrics.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*/*/insights"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "metric",
+        "values": [
+          "page_impressions_unique",
+          "page_impressions_paid_unique",
+          "page_impressions_viral_unique",
+          "page_impressions_nonviral_unique",
+          "page_posts_impressions",
+          "page_posts_impressions_unique",
+          "page_posts_impressions_paid",
+          "page_posts_impressions_paid_unique",
+          "page_posts_impressions_organic_unique",
+          "page_posts_served_impressions_organic_unique",
+          "page_posts_impressions_viral",
+          "page_posts_impressions_viral_unique",
+          "page_posts_impressions_nonviral",
+          "page_posts_impressions_nonviral_unique",
+          "post_impressions_unique",
+          "post_impressions_paid_unique",
+          "post_impressions_fan_unique",
+          "post_impressions_organic_unique",
+          "post_impressions_viral_unique",
+          "post_impressions_nonviral_unique",
+          "page_video_views_unique",
+          "post_video_views_unique"
+        ]
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-02-18",
+    "url": "https://developers.facebook.com/blog/post/2026/02/18/introducing-graph-api-v25-and-marketing-api-v25/"
+  },
+  "effectiveDate": "2026-06-15",
+  "severity": "critical",
+  "migrationNote": "Switch reach and unique-viewer reporting to page_total_media_view_unique and post_total_media_view_unique (and page_media_view/post_media_view with is_from_ads for paid vs organic). The numbers use a different method, so do not splice them onto historical reach series, and drop metrics that have no replacement (viral/nonviral reach).",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/reference/v22.0/insights",
+    "https://developers.facebook.com/blog/post/2026/02/18/introducing-graph-api-v25-and-marketing-api-v25/",
+    "https://developers.facebook.com/docs/platforminsights/page/deprecated-metrics",
+    "https://docs.supermetrics.com/docs/facebook-insights-field-changes-june-30-2026.md"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-root-ids-lookup-removed.json

@@ -0,0 +1,30 @@
+{
+  "id": "meta-graph-root-ids-lookup-removed",
+  "provider": "meta-graph",
+  "title": "Root GET /?ids= multi-object lookup returns an error from 2026-10-27",
+  "summary": "Graph API dropped legacy protocol features: root requests of the form GET /?ids=a,b (or /{version}/?ids=) return an error on v26.0+ since 2026-07-29 and on all supported versions from 2026-10-27. Meta does not state the error code.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/*"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "query": [
+      {
+        "name": "ids"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-07-29",
+    "url": "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  },
+  "effectiveDate": "2026-10-27",
+  "severity": "critical",
+  "migrationNote": "Replace each GET /?ids=... call with one request per object, or send the per-object requests in a single batch request (POST / with a batch parameter), and merge the results in your code.",
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/version26.0"
+  ],
+  "status": "verified"
+}

package/advisories/meta-graph-v20-sunset.json

@@ -19,6 +19,15 @@
   "effectiveDate": "2026-09-24",
   "severity": "high",
   "migrationNote": "Move the version segment to a supported version (v22.0 or later) and re-test the fields you read.",
-  "sources": ["https://developers.facebook.com/docs/graph-api/changelog/versions"],
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v20.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  ],
   "status": "verified"
 }

package/advisories/meta-graph-v21-sunset.json

@@ -19,6 +19,15 @@
   "effectiveDate": "2027-01-21",
   "severity": "high",
   "migrationNote": "Move the version segment to a supported version (v22.0 or later) and re-test the fields you read.",
-  "sources": ["https://developers.facebook.com/docs/graph-api/changelog/versions"],
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/v21.0/",
+      "to": "/v26.0/"
+    }
+  },
+  "sources": [
+    "https://developers.facebook.com/docs/graph-api/changelog/versions"
+  ],
   "status": "verified"
 }

package/advisories/openai-assistants-api-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-assistants-api-shutdown",
+  "provider": "openai",
+  "title": "Assistants API removed on 2026-08-26",
+  "summary": "OpenAI removed the Assistants API on 2026-08-26, one year after its 2025-08-26 deprecation notice. Calls to the assistants endpoints, and to the threads, messages and runs endpoints that go with them (/v1/threads/**), no longer work. The replacement is the Responses API plus the Conversations API.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v1/assistants/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-26",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2026-08-26",
+  "severity": "critical",
+  "migrationNote": "Move assistants to prompts (configuration created in the dashboard), threads to Conversations, and runs to Responses (send input items or a conversation id to the Responses API), and run the tool-call loop in your own code. Thread messages can no longer be fetched from the API, so read history from your own stored copy.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/docs/assistants/migration"
+  ],
+  "status": "verified"
+}

package/advisories/openai-audio-translations-endpoint-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-audio-translations-endpoint-shutdown",
+  "provider": "openai",
+  "title": "/v1/audio/translations shuts down on 2027-02-26",
+  "summary": "OpenAI deprecated the audio translations endpoint on 2026-08-26 and shuts it down on 2027-02-26, together with whisper-1 and the gpt-4o transcribe models. After that date every call to POST /v1/audio/translations fails.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/v1/audio/translations"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-08-26",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2027-02-26",
+  "severity": "high",
+  "migrationNote": "Replace calls to POST /v1/audio/translations with the Realtime translations interface (v1/realtime/translations) that OpenAI names as the replacement, and move transcription off whisper-1 to gpt-live-transcribe or gpt-transcribe before 2027-02-26.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/reference/resources/audio"
+  ],
+  "status": "verified"
+}

package/advisories/openai-evals-api-shutdown.json

@@ -0,0 +1,27 @@
+{
+  "id": "openai-evals-api-shutdown",
+  "provider": "openai",
+  "title": "Evals API shuts down on 2026-11-30",
+  "summary": "OpenAI is retiring the Evals platform: existing evals become read-only on 2026-10-31, and the Evals dashboard and API shut down on 2026-11-30. After that, calls to /v1/evals and its runs fail.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v1/evals/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-06-03",
+    "url": "https://developers.openai.com/api/docs/deprecations"
+  },
+  "effectiveDate": "2026-11-30",
+  "severity": "critical",
+  "migrationNote": "Export the eval definitions and results you need before 2026-11-30, stop creating or updating evals (they are read-only from 2026-10-31), and move eval runs to Promptfoo following OpenAI's \"Moving from OpenAI Evals to Promptfoo\" guide.",
+  "sources": [
+    "https://developers.openai.com/api/docs/deprecations",
+    "https://developers.openai.com/api/reference/resources/evals"
+  ],
+  "status": "verified"
+}

package/advisories/quickbooks-companyinfo-neoenabled-removed.json

@@ -0,0 +1,29 @@
+{
+  "id": "quickbooks-companyinfo-neoenabled-removed",
+  "provider": "quickbooks",
+  "title": "CompanyInfo no longer returns the NeoEnabled NameValue",
+  "summary": "Since 2026-01-27 in production (2025-12-10 in sandbox), the CompanyInfo entity no longer includes the NeoEnabled attribute in its NameValue list. Code that looks up NeoEnabled gets no entry, while the API reference samples still show it.",
+  "endpoint": {
+    "method": "GET",
+    "path": "/v3/company/{realmId}/companyinfo/{companyId}"
+  },
+  "changeClass": "field-rename",
+  "trigger": {
+    "fields": [
+      "NeoEnabled"
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-12-01",
+    "url": "https://medium.com/intuitdev/upcoming-changes-to-apis-and-tools-that-may-impact-your-application-df4680ae3535"
+  },
+  "effectiveDate": "2026-01-27",
+  "severity": "low",
+  "migrationNote": "Treat a missing NeoEnabled entry in CompanyInfo.NameValue as normal, and stop deciding behavior from it. The same applies to CompanyInfo returned by the query endpoint.",
+  "sources": [
+    "https://medium.com/intuitdev/upcoming-changes-to-apis-and-tools-that-may-impact-your-application-df4680ae3535",
+    "https://developer.intuit.com/app/developer/qbo/docs/api/accounting/most-commonly-used/companyinfo"
+  ],
+  "status": "verified"
+}

package/advisories/quickbooks-minorversion-below-75-ignored.json

@@ -9,7 +9,12 @@
   },
   "changeClass": "version-sunset",
   "trigger": {
-    "query": [{ "name": "minorversion", "below": 75 }]
+    "query": [
+      {
+        "name": "minorversion",
+        "below": 75
+      }
+    ]
   },
   "firstObserved": "2025-08-01",
   "publishedNotice": {
@@ -19,6 +24,13 @@
   "effectiveDate": "2025-08-01",
   "severity": "high",
   "migrationNote": "Set minorversion=75 (or remove it) and re-test parsing against minor version 75 responses.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "query": {
+      "name": "minorversion",
+      "value": "75"
+    }
+  },
   "sources": [
     "https://blogs.intuit.com/?p=34635",
     "https://www.apideck.com/blog/ai-built-accounting-integrations-maintenance",

package/advisories/quickbooks-refresh-token-five-year-hard-expiry.json

@@ -0,0 +1,29 @@
+{
+  "id": "quickbooks-refresh-token-five-year-hard-expiry",
+  "provider": "quickbooks",
+  "title": "Refresh tokens hard-expire after five years, first ones in February 2027",
+  "summary": "Intuit refresh tokens now have a maximum lifetime of five years, even if they are used regularly. For apps on restricted or granular scopes, tokens issued from February 2022 start expiring in February 2027. For com.quickbooks.accounting and com.quickbooks.payments, tokens issued from October 2023 start expiring in October 2028. Intuit gives only the month, so the effective date here is the first day of that month.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/oauth2/v1/tokens/bearer"
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-11-12",
+    "url": "https://medium.com/intuitdev/important-changes-to-refresh-token-policy-8443779d40db"
+  },
+  "effectiveDate": "2027-02-01",
+  "severity": "high",
+  "migrationNote": "On refresh, send x_refresh_token_hard_expires_in=true and store the returned x_refresh_token_hard_expires_in (seconds left in the five-year lifetime) alongside the token. Treat invalid_grant from /oauth2/v1/tokens/bearer as a disconnect that needs the user to reconnect, not as a retryable error. Prompt users to re-authorize before the hard expiry, and set the Reconnect URL in the developer portal app settings.",
+  "sources": [
+    "https://medium.com/intuitdev/important-changes-to-refresh-token-policy-8443779d40db",
+    "https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0",
+    "https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/faq",
+    "https://developer.intuit.com/app/developer/qbo/docs/release-notes/general-release-notes"
+  ],
+  "status": "unverified"
+}

package/advisories/salesforce-soap-login-broad-ip-range-token-required.json

@@ -0,0 +1,30 @@
+{
+  "id": "salesforce-soap-login-broad-ip-range-token-required",
+  "provider": "salesforce",
+  "title": "SOAP login() from a broad IP range needs a security token from 2026-12-15",
+  "summary": "Starting 2026-12-15 in sandboxes and 2027-01-31 in production, SOAP API login() for a user whose org or profile login IP range is broad (larger than /8 IPv4 or /29 IPv6) fails without a security token (or mTLS); username and password alone fail with TOKEN_REQUIRED (Login History result 1502). It applies to login() on /services/Soap/c/{v} and /services/Soap/u/{v} in API 31.0-64.0.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/services/Soap/*/*",
+    "hosts": [
+      "login.salesforce.com",
+      "test.salesforce.com"
+    ]
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-25",
+    "url": "https://help.salesforce.com/s/articleView?id=005132110&type=1"
+  },
+  "effectiveDate": "2026-12-15",
+  "severity": "critical",
+  "migrationNote": "Preferably switch the integration to an External Client App with OAuth 2.0 before 2026-12-15 (sandbox) / 2027-01-31 (production). As a stopgap, append the user's security token to the password in the login() call, or narrow the org Network Access or profile Login IP Ranges so they are no longer broad; test with the 'SOAP API login() Security Remediation' release update.",
+  "sources": [
+    "https://help.salesforce.com/s/articleView?id=005132110&type=1"
+  ],
+  "status": "verified"
+}

package/advisories/salesforce-soap-login-disabled-when-unused.json

@@ -0,0 +1,30 @@
+{
+  "id": "salesforce-soap-login-disabled-when-unused",
+  "provider": "salesforce",
+  "title": "SOAP login() turned off in orgs with no use in six months, from 2026-12-15",
+  "summary": "In a one-time check on 2026-12-15 (sandboxes) and 2027-01-31 (production), Salesforce disables SOAP API login() in orgs that had no SOAP login() call in the previous six months; after that, login() fails in that org. Rarely run jobs (annual, seasonal, disaster recovery) can look inactive and then break. One call by any user in the window keeps login() on.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/services/Soap/*/*",
+    "hosts": [
+      "login.salesforce.com",
+      "test.salesforce.com"
+    ]
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-25",
+    "url": "https://help.salesforce.com/s/articleView?id=005132110&type=1"
+  },
+  "effectiveDate": "2026-12-15",
+  "severity": "critical",
+  "migrationNote": "Check Login History (API Type SOAP Enterprise/Partner) and the API Total Usage event log (API_FAMILY SOAP, API_RESOURCE login) for every integration that uses SOAP login(), including rarely run jobs, and move them to an External Client App with OAuth 2.0 before 2026-12-15 (sandbox) / 2027-01-31 (production).",
+  "sources": [
+    "https://help.salesforce.com/s/articleView?id=005132110&type=1"
+  ],
+  "status": "verified"
+}

package/advisories/salesforce-soap-login-use-any-api-auth-required.json

@@ -0,0 +1,31 @@
+{
+  "id": "salesforce-soap-login-use-any-api-auth-required",
+  "provider": "salesforce",
+  "title": "SOAP login() requires the Use Any API Auth permission from 2026-12-01",
+  "summary": "Salesforce enforces a new control on SOAP API login() in all orgs on 2026-12-01: login() succeeds only for users with the Use Any API Auth user permission, and otherwise is rejected with INSUFFICIENT_ACCESS. It is already the default in new orgs. It applies to login() on the Enterprise (/services/Soap/c/{v}) and Partner (/services/Soap/u/{v}) endpoints in API 31.0-64.0; login() is already unavailable in 65.0 and later.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/services/Soap/*/*",
+    "hosts": [
+      "login.salesforce.com",
+      "test.salesforce.com"
+    ]
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-08-25",
+    "url": "https://help.salesforce.com/s/articleView?id=005132110&type=1"
+  },
+  "effectiveDate": "2026-12-01",
+  "severity": "critical",
+  "migrationNote": "Assign the Use Any API Auth permission (permission set or profile) to every integration user that still calls SOAP login(), and test with the 'Assign Use Any API Auth Permission for SOAP login()' release update. Plan the real fix at the same time: authenticate through an External Client App with OAuth 2.0 (JWT bearer or client credentials for server-to-server, web server flow for user-driven apps), because login() is retired in Summer '27.",
+  "sources": [
+    "https://help.salesforce.com/s/articleView?id=005132110&type=1",
+    "https://developer.salesforce.com/docs/platform/api/guide/api-eol-soap.html"
+  ],
+  "status": "verified"
+}

package/advisories/shopify-admin-api-2026-01-unsupported.json

@@ -0,0 +1,33 @@
+{
+  "id": "shopify-admin-api-2026-01-unsupported",
+  "provider": "shopify",
+  "title": "Shopify Admin API version 2026-01 becomes unsupported on 2027-01-16",
+  "summary": "Admin API version 2026-01 is accessible until January 16, 2027 15:00 UTC. After that, requests to /admin/api/2026-01/... (REST and GraphQL) and webhooks pinned to 2026-01 fall forward to the oldest accessible stable version without an error, so responses can change shape silently. Every app still pinned to 2026-01 is hit.",
+  "endpoint": {
+    "method": "*",
+    "path": "/admin/api/2026-01/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://shopify.dev/docs/api/usage/versioning"
+  },
+  "effectiveDate": "2027-01-16",
+  "severity": "critical",
+  "migrationNote": "Move the version segment in your Admin API URLs and webhook subscriptions to a supported version (2026-04 or later; 2026-10 is the latest stable), work through the release notes for every version in between, and check the X-Shopify-API-Version response header to confirm Shopify is not falling forward.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/admin/api/2026-01/",
+      "to": "/admin/api/2026-10/"
+    }
+  },
+  "sources": [
+    "https://shopify.dev/docs/api/usage/versioning"
+  ],
+  "status": "verified"
+}

package/advisories/shopify-admin-api-2026-04-unsupported.json

@@ -0,0 +1,33 @@
+{
+  "id": "shopify-admin-api-2026-04-unsupported",
+  "provider": "shopify",
+  "title": "Shopify Admin API version 2026-04 becomes unsupported on 2027-04-16",
+  "summary": "Admin API version 2026-04 is accessible until April 16, 2027 15:00 UTC. After that, requests to /admin/api/2026-04/... (REST and GraphQL) and webhooks pinned to 2026-04 fall forward to the oldest accessible stable version without an error, so responses can change shape silently. Every app still pinned to 2026-04 is hit.",
+  "endpoint": {
+    "method": "*",
+    "path": "/admin/api/2026-04/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": null,
+    "url": "https://shopify.dev/docs/api/usage/versioning"
+  },
+  "effectiveDate": "2027-04-16",
+  "severity": "high",
+  "migrationNote": "Move the version segment in your Admin API URLs and webhook subscriptions to a supported version (2026-07 or later; 2026-10 is the latest stable), work through the release notes for every version in between, and check the X-Shopify-API-Version response header to confirm Shopify is not falling forward.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "path": {
+      "from": "/admin/api/2026-04/",
+      "to": "/admin/api/2026-10/"
+    }
+  },
+  "sources": [
+    "https://shopify.dev/docs/api/usage/versioning"
+  ],
+  "status": "verified"
+}

package/advisories/shopify-global-catalog-rest-api-shutdown.json

@@ -0,0 +1,24 @@
+{
+  "id": "shopify-global-catalog-rest-api-shutdown",
+  "provider": "shopify",
+  "title": "Shopify Global Catalog REST API stops serving traffic on 2026-11-02",
+  "summary": "The Global Catalog REST API on discover.shopifyapps.com (/global/v2/search, /global/v2/p/{upid}, /global/v2/p/by-variant/{vid}, POST /global/v2/lookup, including saved-catalog requests) stops serving traffic on November 2, 2026, and requests to it will fail. Anything still calling it must move to the Global Catalog MCP server.",
+  "endpoint": {
+    "method": "*",
+    "path": "/global/v2/**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-10-09",
+    "url": "https://shopify.dev/changelog/posts/global-catalog-rest-api-stops-serving-traffic-on-november-2-2026"
+  },
+  "effectiveDate": "2026-11-02",
+  "severity": "critical",
+  "migrationNote": "Switch to the Global Catalog MCP server at https://catalog.shopify.com/api/ucp/mcp: use the search_catalog tool instead of GET /global/v2/search, get_product instead of the single-product and by-variant lookups, and lookup_catalog (up to 50 items per request) instead of POST /global/v2/lookup.",
+  "sources": ["https://shopify.dev/changelog/posts/global-catalog-rest-api-stops-serving-traffic-on-november-2-2026"],
+  "status": "verified"
+}

package/advisories/shopify-non-expiring-offline-tokens-rejected.json

@@ -0,0 +1,27 @@
+{
+  "id": "shopify-non-expiring-offline-tokens-rejected",
+  "provider": "shopify",
+  "title": "Shopify rejects non-expiring offline access tokens from public apps on 2027-01-01",
+  "summary": "Starting January 1, 2027, every public app (including ones created before April 1, 2026) must use expiring offline access tokens to call the Admin API. Shopify enforces this on GraphQL Admin API requests: a request with a non-expiring token gets 403 Forbidden with \"Non-expiring access tokens are no longer accepted for the Admin API\", and merchants lose access until they re-authenticate. Custom apps and merchant-created apps are not affected.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/admin/api/{version}/graphql.json"
+  },
+  "changeClass": "auth",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-05-20",
+    "url": "https://shopify.dev/changelog/posts/expiring-offline-access-tokens-required-for-all-public-apps-as-of-january-1-2027"
+  },
+  "effectiveDate": "2027-01-01",
+  "severity": "critical",
+  "migrationNote": "Exchange each stored non-expiring token for an expiring one with POST /admin/oauth/access_token (grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token_type and requested_token_type urn:shopify:params:oauth:token-type:offline-access-token, expiring=1), store the access token, refresh token and expiry, and refresh before expiry; on the official app templates set future.expiringOfflineAccessTokens: true and redeploy. Check API Health in the Dev Dashboard to confirm the app is migrated.",
+  "sources": [
+    "https://shopify.dev/changelog/posts/expiring-offline-access-tokens-required-for-all-public-apps-as-of-january-1-2027",
+    "https://shopify.dev/docs/apps/build/authentication-authorization/migrate-to-expiring-offline-access-tokens"
+  ],
+  "status": "verified"
+}

package/advisories/shopify-script-tags-stop-running.json

@@ -0,0 +1,27 @@
+{
+  "id": "shopify-script-tags-stop-running",
+  "provider": "shopify",
+  "title": "Shopify script tags stop running on storefronts on 2027-03-01",
+  "summary": "Script tags are deprecated in every Admin API version. Since October 1, 2026 the REST ScriptTag resource rejects POST and PUT and the GraphQL scriptTagCreate and scriptTagUpdate mutations return a user error; on March 1, 2027 Shopify stops injecting existing script tags into storefronts, so their JavaScript no longer loads. Listing and deleting script tags keeps working.",
+  "endpoint": {
+    "method": "*",
+    "path": "/admin/api/{version}/script_tags**"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-08-24",
+    "url": "https://shopify.dev/changelog/online-store-script-tags-deprecation"
+  },
+  "effectiveDate": "2027-03-01",
+  "severity": "high",
+  "migrationNote": "Stop creating or updating script tags (POST /admin/api/{version}/script_tags.json and PUT .../script_tags/{script_tag_id}.json already fail). Move storefront scripts to app embed blocks in a theme app extension, and analytics or conversion scripts to a web pixel; then delete the old script tags. Pinning an older API version does not delay this.",
+  "sources": [
+    "https://shopify.dev/changelog/online-store-script-tags-deprecation",
+    "https://shopify.dev/docs/api/admin-rest/latest/resources/scripttag"
+  ],
+  "status": "verified"
+}

package/advisories/slack-files-upload-retired.json

@@ -0,0 +1,28 @@
+{
+  "id": "slack-files-upload-retired",
+  "provider": "slack",
+  "title": "files.upload Web API method sunset on 2025-11-12",
+  "summary": "Slack deprecated files.upload. Apps created on or after 2024-05-16 could not use it, and Slack's reference page says the method stops working and is sunset on 2025-11-12 for existing apps too (the date was moved from 2025-03-11). Code that still uploads through files.upload fails with method_deprecated or deprecated_endpoint errors.",
+  "endpoint": {
+    "method": "POST",
+    "path": "/api/files.upload"
+  },
+  "changeClass": "version-sunset",
+  "trigger": {
+    "any": true
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2025-03-17",
+    "url": "https://docs.slack.dev/changelog/2025/03/17/files-upload-extension"
+  },
+  "effectiveDate": "2025-11-12",
+  "severity": "critical",
+  "migrationNote": "Replace files.upload with the two-step flow: call files.getUploadURLExternal (filename, length) to get an upload_url and file_id, POST the file bytes to upload_url, then call files.completeUploadExternal with the file_id(s) and the channel_id, initial_comment or thread_ts you used to pass to files.upload. The official Slack SDKs wrap this as files_upload_v2 / filesUploadV2 / uploadV2.",
+  "sources": [
+    "https://docs.slack.dev/reference/methods/files.upload",
+    "https://docs.slack.dev/changelog/2025/03/17/files-upload-extension",
+    "https://docs.slack.dev/changelog/2024-04-a-better-way-to-upload-files-is-here-to-stay"
+  ],
+  "status": "verified"
+}

package/advisories/stripe-checkout-session-ui-mode-values-renamed.json

@@ -0,0 +1,53 @@
+{
+  "id": "stripe-checkout-session-ui-mode-values-renamed",
+  "provider": "stripe",
+  "title": "Stripe 2026-03-25.dahlia renames Checkout Session ui_mode values",
+  "summary": "From API version 2026-03-25.dahlia, Checkout Session ui_mode values hosted, embedded and custom are replaced by hosted_page, embedded_page and elements (and form is added). Creating a session with an old value fails, and code that compares the returned ui_mode to the old strings stops matching once the account or SDK is upgraded.",
+  "endpoint": {
+    "method": "*",
+    "path": "/v1/checkout/sessions/**"
+  },
+  "changeClass": "enum-added",
+  "trigger": {
+    "enums": [
+      {
+        "field": "ui_mode"
+      }
+    ]
+  },
+  "firstObserved": null,
+  "publishedNotice": {
+    "date": "2026-03-25",
+    "url": "https://docs.stripe.com/changelog/dahlia/2026-03-25/updates-available-checkout-session-ui-modes"
+  },
+  "effectiveDate": "2026-03-25",
+  "severity": "high",
+  "migrationNote": "When moving to 2026-03-25.dahlia or later, send ui_mode hosted_page instead of hosted, embedded_page instead of embedded and elements instead of custom, and update every comparison of session.ui_mode (including checkout.session webhook handlers) to the new values; handle the new form value too.",
+  "recipeId": "apply-fix",
+  "fix": {
+    "enums": [
+      {
+        "field": "ui_mode",
+        "values": [
+          {
+            "from": "hosted",
+            "to": "hosted_page"
+          },
+          {
+            "from": "embedded",
+            "to": "embedded_page"
+          },
+          {
+            "from": "custom",
+            "to": "elements"
+          }
+        ]
+      }
+    ]
+  },
+  "sources": [
+    "https://docs.stripe.com/changelog/dahlia/2026-03-25/updates-available-checkout-session-ui-modes",
+    "https://docs.stripe.com/api/checkout/sessions/create"
+  ],
+  "status": "verified"
+}