4.9.0

What's Changed

App

• Add shopify app security commands to check an app's source code for Shopify-specific security issues:
  • check runs deterministic rules and generates checks for your coding agent to investigate
  • record saves the agent's findings
  • review shows the combined results
  • instructions prints the workflow for a coding agent
  • clean removes local results

• Add app subscription-migrations commands by @tyler-eon in #8660
• Add shopify app import channel-config for partner channel spec import by @suzkiee in #8360
• Move import commands under a new app import topic by @nickwesselman in #8569
• Support target-level input query variables on functions by @saga-dasgupta in #8471
• Support optional owner_type in UI extension metafields by @kumar303 in #8534
• [Feature] Relative url patching on contract app extensions by @EliasJRH in #8362
• Stop reporting developer project errors as CLI crashes in build steps by @Suleimanlatrsh in #8627
• Fix repeated event config diffs when API versions are inherited by @cdarne in #8690
• Add --unsafe-validation to app dev by @dmerand in #8258
• Allow --config with --client-id on app deploy and dev by @isaacroldan in #8735
• Improve help for app config link flags by @gonzaloriestra in #8787

CLI

• Add --no-input to all commands by @gonzaloriestra in #8407
• Add --json-schema flag to commands by @gonzaloriestra in #8413
• Define JSON output schema for some commands (store commands, app versions list, organization list, version, config, auth)
• Print errors and events as JSON when using --json
• Fix text prompt underlines in Windows consoles by @amcaplan in #8489
• Recover gracefully when pnpm blocks build scripts during extension generation by @amcaplan in #8491
• Fix startup crash when the OS can't look up the current user's shell by @craigmichaelmartin in #8496
• Fix false success message when CLI self-upgrade installs the wrong version by @craigmichaelmartin in #8473
• [Feature] Add --language to doc fetch by @jplhomer in #8517
• Fix loading bar cleanup when tasks log messages by @gonzaloriestra in #8531
• Fix local storage initialization permission errors by @gonzaloriestra in #8572
• Retry gateway failures during device authorization by @gonzaloriestra in #8573
• Report unavailable shops and Admin API server errors instead of unknown CLI bugs by @Suleimanlatrsh in #8612
• Resolve store list --organization-id without listing every organization by @amcaplan in #8577
• hydrogen/Bump cli-hydrogen to 13.0.5 by @fredericoo in #8656
• Bump Shopify/theme-tools packages by @karreiro in #8668
• Write interactive prompts to stderr by default by @isaacroldan in #8812
• Remove lax Shopify API key secret check by @francisbeaudoin in #8503

Full Changelog: 4.8.0...4.9.0