shopify-upgrade-guard 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +6 -3
  2. package/THIRD_PARTY_NOTICES.md +23 -1
  3. package/data/versions.json +1 -1
  4. package/dist/index.js +1 -1
  5. package/dist/licenses.txt +18 -0
  6. package/package.json +3 -2
  7. package/src/extension-config.js +232 -0
  8. package/src/graphql.js +13 -0
  9. package/src/rules.js +30 -4
  10. package/src/scan.js +1 -1
  11. package/src/version-data.js +1 -1
  12. package/src/version.js +1 -1
package/README.md CHANGED
@@ -16,7 +16,7 @@ Shopify Upgrade Guard is an offline, evidence-backed CLI and GitHub Action for S
16
16
 
17
17
  Maintained by RexCode Digital Ltd.
18
18
 
19
- Part of the **RexCode Shopify developer tools** suite. Requires Node.js 20 or later for the CLI. The parser remains on GraphQL 16 because GraphQL 17.0.2 requires Node.js 22 or later, which would drop the supported Node.js 20 runtime. [Releases](https://github.com/RexCode-Digital/shopify-upgrade-guard/releases) · [npm](https://www.npmjs.com/package/shopify-upgrade-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-upgrade-guard)
19
+ Part of the **RexCode Shopify developer tools** suite. This source version requires Node.js 22 or later for the CLI. [Releases](https://github.com/RexCode-Digital/shopify-upgrade-guard/releases) · [npm](https://www.npmjs.com/package/shopify-upgrade-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-upgrade-guard)
20
20
 
21
21
  ## Quick start
22
22
 
@@ -102,13 +102,14 @@ The rule pack is intentionally focused. Literal GraphQL checks parse supported d
102
102
  | --- | --- | --- |
103
103
  | `UG-CHECKOUT-001` | `useBuyerJourneyIntercept` / `buyerJourney.intercept` | [Shopify changelog](https://shopify.dev/changelog/deprecating-the-usebuyerjourneyintercept-api-on-checkout-ui-extensions) |
104
104
  | `UG-CHECKOUT-002` | Checkout `block_progress` capability | [Shopify changelog](https://shopify.dev/changelog/deprecating-the-usebuyerjourneyintercept-api-on-checkout-ui-extensions) |
105
+ | `UG-EXT-001` | Missing `owner_type` in eligible Checkout or Customer Account UI extension metafield declarations | [Shopify changelog](https://shopify.dev/changelog/posts/metafield-owner-types-required-for-checkout-and-customer-account-ui-extensions) |
105
106
  | `UG-REST-001` | Legacy Admin REST usage | [REST Admin API](https://shopify.dev/docs/api/admin-rest) |
106
107
  | `UG-VERSION-001` | Unsupported or target-retiring API versions | [API versioning](https://shopify.dev/docs/api/usage/versioning) |
107
108
  | `UG-VERSION-002` | Supported versions older than the latest stable version | [API versioning](https://shopify.dev/docs/api/usage/versioning) |
108
109
  | `UG-CUSTOMER-001` | Customer Account checkout removals relevant to 2026-10 | [Shopify changelog](https://shopify.dev/changelog/customer-account-api-last-incomplete-checkout-and-checkout-types-removed) |
109
110
  | `UG-POS-001` | Removed POS `session.currentSession.staffMemberId` usage | [Shopify changelog](https://shopify.dev/changelog/removed-session-currentsession-staffmemberid-from-pos-ui-extensions-2026-10) |
110
111
  | `UG-ADMIN-001` | Legacy Admin GraphQL `priceRule` usage | [2026-10 release notes](https://shopify.dev/release-notes/2026-10) |
111
- | `UG-ADMIN-002` | Literal GraphQL root `automaticDiscounts` removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/automaticdiscounts-query-is-removed-in-api-version-2027-01) |
112
+ | `UG-ADMIN-002` | Literal GraphQL `automaticDiscounts` root field and removed `DiscountAutomaticConnection` / `DiscountAutomaticEdge` types | [Official removal](https://shopify.dev/changelog/posts/automaticdiscounts-query-is-removed-in-api-version-2027-01) |
112
113
  | `UG-ADMIN-003` | GraphQL `metafieldInteger` collection conditions and types removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/metafieldinteger-collection-condition-removed-in-api-version-2027-01) |
113
114
  | `UG-ADMIN-004` | `ProductVariant.barcode` read deprecated in 2026-10; it still works and no removal date is announced | [Official deprecation](https://shopify.dev/changelog/posts/product-variant-barcode-is-being-replaced-by-barcodes) |
114
115
  | `UG-ADMIN-006` | Literal `marketCurrencySettingsUpdate` Admin mutation removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/removing-marketcurrencysettingsupdate-mutation) |
@@ -119,6 +120,8 @@ The rule pack is intentionally focused. Literal GraphQL checks parse supported d
119
120
 
120
121
  Supported inventory surfaces include Admin REST, Admin GraphQL, Checkout UI extensions, Customer Account UI extensions, POS UI extensions, Functions, Shopify app TOML, and recognized Shopify client configuration.
121
122
 
123
+ See the [2027-01 migration guide](docs/2027-01-migration.md) for the extension `owner_type` requirement, target-version behavior, evidence, and limits. The rule is in the Unreleased change set; existing npm packages and Action tags do not gain it until a release containing this branch is published.
124
+
122
125
  ## CLI
123
126
 
124
127
  ```text
@@ -160,7 +163,7 @@ Baselined findings remain reviewable while new fingerprints stay actionable.
160
163
 
161
164
  `--fail-on-new` requires a valid Git base comparison. Upgrade Guard scans the base commit and head tree independently, then matches findings by rule, file identity, and evidence; recognized file renames keep existing debt stable. JSON includes `resolvedFindings`, and human output reports their count. Fetch full history and provide `--base-ref`, or use the pull-request Action. Missing refs/history exit 2 instead of passing an incomplete comparison.
162
165
 
163
- The bundled snapshot, verified 14 October 2026, lists `2026-10` as the latest stable API and `2027-01` as a release candidate for development testing. Version status uses Shopify's exact `accessibleUntil` timestamp: `2025-10` remains accessible until 16 October 2026 at 15:00 UTC, then becomes unsupported. Future version names do not imply verified rule coverage.
166
+ The bundled snapshot, verified 21 October 2026, lists `2026-10` as the latest stable API and `2027-01` as a release candidate for development testing. Shopify lists `2027-01` as a release candidate until 1 January 2027, when it becomes stable. Version status uses Shopify's exact `accessibleUntil` timestamp; `2025-10` became unsupported on 16 October 2026 at 15:00 UTC. Future version names do not imply verified rule coverage.
164
167
 
165
168
  The 2027-01 tax payload change converts IDs in tax calculation requests and tax summary webhook payloads to Global IDs. Upgrade Guard cannot reliably tell whether arbitrary runtime parsing assumes numeric IDs, so tax app handlers need review against Shopify's [official migration note](https://shopify.dev/changelog/posts/tax-webhook-summary-and-calculation-requests-now-use-global-ids).
166
169
 
package/THIRD_PARTY_NOTICES.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Third-party notices
2
2
 
3
- The generated GitHub Action bundle `dist/index.js` contains third-party code. Its companion `dist/licenses.txt` is generated by ncc from the bundled dependency graph and carries the full licence texts for bundled modules. The direct GraphQL.js dependency is resolved in `package-lock.json` and is listed below.
3
+ The generated GitHub Action bundle `dist/index.js` contains third-party code. Its companion `dist/licenses.txt` is generated by ncc from the bundled dependency graph and carries the full licence texts for bundled modules. The direct GraphQL.js and TOML parser dependencies are resolved in `package-lock.json` and listed below.
4
4
 
5
5
  ## GraphQL.js
6
6
 
@@ -31,3 +31,25 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
31
31
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
32
32
  SOFTWARE.
33
33
  ```
34
+
35
+ ## @iarna/toml
36
+
37
+ - Upstream: [iarna/iarna-toml](https://github.com/iarna/iarna-toml)
38
+ - Version resolved by this repository: 2.2.5
39
+ - Licence: ISC
40
+
41
+ ```text
42
+ Copyright (c) 2016, Rebecca Turner <me@re-becca.org>
43
+
44
+ Permission to use, copy, modify, and/or distribute this software for any
45
+ purpose with or without fee is hereby granted, provided that the above
46
+ copyright notice and this permission notice appear in all copies.
47
+
48
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
49
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
50
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
51
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
52
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
53
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
54
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
55
+ ```
package/data/versions.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "verifiedAt": "2026-10-14",
2
+ "verifiedAt": "2026-10-21",
3
3
  "source": "https://shopify.dev/docs/api/usage/versioning",
4
4
  "versions": [
5
5
  {