shopify-upgrade-guard 0.2.6 → 0.4.0

package/README.md

@@ -16,7 +16,7 @@ Shopify Upgrade Guard is an offline, evidence-backed CLI and GitHub Action for S
 
 Maintained by RexCode Digital Ltd.
 
-Part of the **RexCode Shopify developer tools** suite. Requires Node.js 20 or later for the CLI. [Releases](https://github.com/RexCode-Digital/shopify-upgrade-guard/releases) · [npm](https://www.npmjs.com/package/shopify-upgrade-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-upgrade-guard)
+Part of the **RexCode Shopify developer tools** suite. This source version requires Node.js 22 or later for the CLI. [Releases](https://github.com/RexCode-Digital/shopify-upgrade-guard/releases) · [npm](https://www.npmjs.com/package/shopify-upgrade-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-upgrade-guard)
 
 ## Quick start
 
@@ -39,7 +39,7 @@ Upgrade Guard separates **current debt** from **target-version blockers**, so te
 
 - **Target-aware** — evaluate findings against the Shopify version you actually plan to adopt.
 - **Evidence-backed** — Shopify-specific rules link to official Shopify documentation or changelog evidence.
-- **PR-aware** — distinguish newly introduced findings from pre-existing debt.
+- **PR-aware** — compare independent base and head tree scans, including renamed files, to distinguish new, existing, and resolved findings.
 - **Baseline-friendly** — adopt the tool without forcing a big-bang cleanup of historical findings.
 - **CI-ready** — human, JSON, and SARIF output plus a GitHub Action.
 - **Offline by default** — ordinary scans require no network access, Shopify token, or store access.
@@ -67,7 +67,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: RexCode-Digital/shopify-upgrade-guard@223ec33e119f920ecc9f9a5df722a2f6fda0df40 # v0.2.5
+      - uses: RexCode-Digital/shopify-upgrade-guard@b0a6816f95d783f703bf031c9920004fbb865bc1 # v0.2.6
         with:
           target: 2026-10
           fail-on: warning
@@ -88,10 +88,12 @@ Use the immutable patch release tag or a reviewed full commit SHA. Existing mino
 
 ### Action outputs
 
-`outcome`, `finding-count`, `new-finding-count`, `error-count`, `current-versions`, and `result-json`.
+`outcome`, `finding-count`, `new-finding-count`, `resolved-finding-count`, `error-count`, `current-versions`, and `result-json`.
 
 The Action is bundled and runs on the current GitHub `node24` JavaScript Action runtime.
 
+The example above pins v0.2.6, which does not expose `resolved-finding-count`. The independent base/head comparison and resolved-finding behaviour described below are part of the unreleased changes here; they are not available from the current npm package or Action.
+
 ## What it catches today
 
 The rule pack is intentionally focused. Literal GraphQL checks parse supported documents and ignore malformed or dynamic queries; rule-specific context limits findings to Shopify API constructs that can be identified deterministically.
@@ -100,21 +102,26 @@ The rule pack is intentionally focused. Literal GraphQL checks parse supported d
 | --- | --- | --- |
 | `UG-CHECKOUT-001` | `useBuyerJourneyIntercept` / `buyerJourney.intercept` | [Shopify changelog](https://shopify.dev/changelog/deprecating-the-usebuyerjourneyintercept-api-on-checkout-ui-extensions) |
 | `UG-CHECKOUT-002` | Checkout `block_progress` capability | [Shopify changelog](https://shopify.dev/changelog/deprecating-the-usebuyerjourneyintercept-api-on-checkout-ui-extensions) |
+| `UG-EXT-001` | Missing `owner_type` in eligible Checkout or Customer Account UI extension metafield declarations | [Shopify changelog](https://shopify.dev/changelog/posts/metafield-owner-types-required-for-checkout-and-customer-account-ui-extensions) |
 | `UG-REST-001` | Legacy Admin REST usage | [REST Admin API](https://shopify.dev/docs/api/admin-rest) |
 | `UG-VERSION-001` | Unsupported or target-retiring API versions | [API versioning](https://shopify.dev/docs/api/usage/versioning) |
 | `UG-VERSION-002` | Supported versions older than the latest stable version | [API versioning](https://shopify.dev/docs/api/usage/versioning) |
 | `UG-CUSTOMER-001` | Customer Account checkout removals relevant to 2026-10 | [Shopify changelog](https://shopify.dev/changelog/customer-account-api-last-incomplete-checkout-and-checkout-types-removed) |
 | `UG-POS-001` | Removed POS `session.currentSession.staffMemberId` usage | [Shopify changelog](https://shopify.dev/changelog/removed-session-currentsession-staffmemberid-from-pos-ui-extensions-2026-10) |
 | `UG-ADMIN-001` | Legacy Admin GraphQL `priceRule` usage | [2026-10 release notes](https://shopify.dev/release-notes/2026-10) |
-| `UG-ADMIN-002` | Literal GraphQL root `automaticDiscounts` removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/automaticdiscounts-query-is-removed-in-api-version-2027-01) |
+| `UG-ADMIN-002` | Literal GraphQL `automaticDiscounts` root field and removed `DiscountAutomaticConnection` / `DiscountAutomaticEdge` types | [Official removal](https://shopify.dev/changelog/posts/automaticdiscounts-query-is-removed-in-api-version-2027-01) |
 | `UG-ADMIN-003` | GraphQL `metafieldInteger` collection conditions and types removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/metafieldinteger-collection-condition-removed-in-api-version-2027-01) |
 | `UG-ADMIN-004` | `ProductVariant.barcode` read deprecated in 2026-10; it still works and no removal date is announced | [Official deprecation](https://shopify.dev/changelog/posts/product-variant-barcode-is-being-replaced-by-barcodes) |
+| `UG-ADMIN-006` | Literal `marketCurrencySettingsUpdate` Admin mutation removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/removing-marketcurrencysettingsupdate-mutation) |
+| `UG-ADMIN-007` | `PRIVATE` / `PUBLIC_READ` literals passed as metaobject definition admin access removed in 2027-01 | [Official deprecation](https://shopify.dev/changelog/posts/removing-deprecated-private-and-public-read-enums-on-metaobject-definitions) |
 | `UG-SEGMENT-001` | Legacy function/date syntax inside literal segment GraphQL query arguments | [Official syntax update](https://shopify.dev/changelog/posts/updated-function-syntax-on-the-segment-query-language) |
 | `UG-ADMIN-005` | Source handling for removed inventory error `ITEM_NOT_STOCKED_AT_LOCATION` | [Official removal](https://shopify.dev/changelog/posts/removal-of-itemnotstockedatlocation-error) |
 | `UG-SCRIPT-001` | Cross-version Script Tag write restrictions; REST resource references require method review | [Script Tag deprecation](https://shopify.dev/changelog/online-store-script-tags-deprecation) |
 
 Supported inventory surfaces include Admin REST, Admin GraphQL, Checkout UI extensions, Customer Account UI extensions, POS UI extensions, Functions, Shopify app TOML, and recognized Shopify client configuration.
 
+See the [2027-01 migration guide](docs/2027-01-migration.md) for the extension `owner_type` requirement, target-version behavior, evidence, and limits. The rule is in the Unreleased change set; existing npm packages and Action tags do not gain it until a release containing this branch is published.
+
 ## CLI
 
 ```text
@@ -154,9 +161,11 @@ npx shopify-upgrade-guard baseline check
 
 Baselined findings remain reviewable while new fingerprints stay actionable.
 
-`--fail-on-new` requires a valid Git base comparison. Fetch full history and provide `--base-ref`, or use the pull-request Action. Missing refs/history exit 2 instead of passing an incomplete comparison.
+`--fail-on-new` requires a valid Git base comparison. Upgrade Guard scans the base commit and head tree independently, then matches findings by rule, file identity, and evidence; recognized file renames keep existing debt stable. JSON includes `resolvedFindings`, and human output reports their count. Fetch full history and provide `--base-ref`, or use the pull-request Action. Missing refs/history exit 2 instead of passing an incomplete comparison.
 
-The bundled snapshot, verified 4 October 2026, lists `2026-10` as latest stable and `2027-01` as release candidate. The RC is for testing. Shopify lists `2025-10` as unsupported while its accessibility table runs until 16 October 2026; support status and accessibility are distinct. Future version names do not imply verified rule coverage.
+The bundled snapshot, verified 21 October 2026, lists `2026-10` as the latest stable API and `2027-01` as a release candidate for development testing. Shopify lists `2027-01` as a release candidate until 1 January 2027, when it becomes stable. Version status uses Shopify's exact `accessibleUntil` timestamp; `2025-10` became unsupported on 16 October 2026 at 15:00 UTC. Future version names do not imply verified rule coverage.
+
+The 2027-01 tax payload change converts IDs in tax calculation requests and tax summary webhook payloads to Global IDs. Upgrade Guard cannot reliably tell whether arbitrary runtime parsing assumes numeric IDs, so tax app handlers need review against Shopify's [official migration note](https://shopify.dev/changelog/posts/tax-webhook-summary-and-calculation-requests-now-use-global-ids).
 
 ## Configuration
 
@@ -197,6 +206,8 @@ Building or maintaining Shopify apps?
 - **[Shopify Scope Guard](https://github.com/RexCode-Digital/shopify-scope-guard)** — Audit whether declared Shopify permissions are supported by offline code evidence.
 - **[Shopify App Review Guard](https://github.com/RexCode-Digital/shopify-app-review-guard)** — Run deterministic preflight checks for Shopify App Store and production readiness.
 
+See the [coordinated workflow example](https://github.com/RexCode-Digital/shopify-app-changeguard/blob/main/docs/ecosystem-workflow.md) to run all four published Actions in one pull-request workflow.
+
 GitHub Marketplace: [Shopify Upgrade Guard](https://github.com/marketplace/actions/shopify-upgrade-guard)
 
 All four tools run offline and require no Shopify credentials.
@@ -217,7 +228,7 @@ Start with [the contribution guide](CONTRIBUTING.md) or browse the [open issues]
 
 ## Roadmap
 
-Current priorities include additional verified Shopify breaking-change coverage, better PR base-tree classification, high-confidence Functions/Customer Account/POS/GraphQL rules, and maintainable GraphQL deprecation evidence.
+Current priorities include additional verified Shopify breaking-change coverage, high-confidence Functions/Customer Account/POS/GraphQL rules, and maintainable GraphQL deprecation evidence when Shopify provides a versioned source with clear redistribution rights. See the [metadata decision](docs/graphql-deprecation-metadata.md).
 
 See [ROADMAP.md](ROADMAP.md).
 
@@ -227,10 +238,10 @@ MIT — see [LICENSE](LICENSE).
 
 ## Immutable SHA usage
 
-The Action example pins the reviewed v0.2.3 release commit. Verify the release reference with:
+The Action example pins the reviewed v0.2.6 release commit. Verify the release reference with:
 
 ```bash
-gh api repos/RexCode-Digital/shopify-upgrade-guard/git/ref/tags/v0.2.5 --jq .object.sha
+git fetch --tags origin && git rev-parse 'v0.2.6^{commit}'
 ```
 
 Published patch tags and existing minor aliases are retained. Future releases do not move minor aliases; use an immutable patch tag or a reviewed full commit SHA.

package/THIRD_PARTY_NOTICES.md

@@ -1,6 +1,6 @@
 # Third-party notices
 
-The generated GitHub Action bundle `dist/index.js` contains third-party code. Its companion `dist/licenses.txt` is generated by ncc from the bundled dependency graph and carries the full licence texts for bundled modules. The direct GraphQL.js dependency is resolved in `package-lock.json` and is listed below.
+The generated GitHub Action bundle `dist/index.js` contains third-party code. Its companion `dist/licenses.txt` is generated by ncc from the bundled dependency graph and carries the full licence texts for bundled modules. The direct GraphQL.js and TOML parser dependencies are resolved in `package-lock.json` and listed below.
 
 ## GraphQL.js
 
@@ -31,3 +31,25 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
+
+## @iarna/toml
+
+- Upstream: [iarna/iarna-toml](https://github.com/iarna/iarna-toml)
+- Version resolved by this repository: 2.2.5
+- Licence: ISC
+
+```text
+Copyright (c) 2016, Rebecca Turner <me@re-becca.org>
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+```

package/action.yml

@@ -29,6 +29,8 @@ runs:
 outputs:
   new-finding-count:
     description: Number of findings classified as NEW
+  resolved-finding-count:
+    description: Number of findings resolved against the Git base tree
   outcome:
     description: Whether the configured failure policy passed
   finding-count:

package/data/versions.json

@@ -1,5 +1,5 @@
 {
-  "verifiedAt": "2026-10-04",
+  "verifiedAt": "2026-10-21",
   "source": "https://shopify.dev/docs/api/usage/versioning",
   "versions": [
     {
@@ -24,7 +24,7 @@
       "version": "2025-10",
       "releaseDate": "2025-10-01",
       "accessibleUntil": "2026-10-16T15:00:00Z",
-      "status": "unsupported"
+      "status": "stable"
     },
     {
       "version": "2026-01",