v3.6.0 - Release Notes
What's New
shopify-app-express v8 + OAuth token exchange
@shopify/shopify-app-express is bumped to ^8.0.0. The template already met its breaking-change requirements (Node 22+, express as a direct dependency), so no code changes were needed there.
On top of the bump, the template now opts into the new tokenExchange future flag:
sessionStorage: new BetterSQLiteSessionStorage(DB_PATH),
+ future: {
+ tokenExchange: true
+ }This swaps the install/reload flow from the classic OAuth redirect to token exchange, removing the auth-redirect flicker for embedded apps. It works out of the box here since index.html already loads the modern App Bridge CDN script, which auto-attaches the session token to same-origin fetch calls — no client changes required.
Session storage adapter fix
@minisylar/shopify-app-session-storage-better-sqlite is bumped to ^2.0.1. The previous release still peer-depended on @shopify/shopify-api ^13 / @shopify/shopify-app-session-storage ^5, one major behind what shopify-app-express@8 ships. That skew caused npm to install two separate copies of @shopify/shopify-api side by side, which broke the TypeScript branch with:
Type 'BetterSQLiteSessionStorage' is not assignable to type 'SessionStorage'.
...Types have separate declarations of a private property 'compressedScopes'.
2.0.1 updates the peer ranges to ^14.0.0 / ^6.0.0, so npm resolves a single copy and the type error goes away.
better-sqlite3 → 13.0.3
npm install-scripts allowlist
Added an allowScripts block to the root package.json, approving the native build/postinstall scripts for better-sqlite3 and esbuild (and, on the TypeScript branch, @swc/core). npm now blocks unreviewed install scripts by default — without this block, a fresh npm install silently skips building better-sqlite3's native bindings.
Misc dependency updates
Routine version bumps across the board, including:
@shopify/cli→^4.6.1vue→^3.5.41,pinia→^4.0.3,vue-router→^5.2.0,vue-i18n→^11.4.8vite→^8.2.1,vite-plugin-vue-devtools→^8.2.1(TypeScript branch)vue-tsc→^3.3.9(TypeScript branch)eslint,eslint-plugin-vue,prettier,@shopify/app-bridge-types, and other tooling packages
Upgrading from v3.5.0
- Update your dependencies:
npm install
- If you maintain your own session storage adapter, make sure it targets
@shopify/shopify-api ^14.0.0and@shopify/shopify-app-session-storage ^6.0.0— otherwise you'll hit the same duplicate-package type error described above when paired withshopify-app-express@8. - Token exchange is now enabled by default in
shopify.js/shopify.ts. If your app doesn't use Shopify managed installation, remove thefuture.tokenExchangeblock before upgrading.
No breaking API changes beyond what shopify-app-express@8 itself requires (already satisfied by this template).
TypeScript version
A TypeScript variant of this template is available:
npx degit Mini-Sylar/shopify-app-vue-template#typescript your-app-nameThe TypeScript branch includes all of the above changes plus full type coverage across models, webhooks, middleware, and routes.