Skip to content

@shopify/shopify-api@13.1.0

Choose a tag to compare

View all tags
@shopify-github-actions-access shopify-github-actions-access released this 24 Jun 18:11
@shopify/shopify-api@13.1.0
afeb12d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Minor Changes

  • 9264a64: Add REST resources for API version 2026-04
  • e4db082: Add webhookId (shopify-webhook-id) as a required field on Events webhooks. This is the true idempotency key for webhook deliveries. Previously, only eventId was extracted for Events webhooks and was used as a fallback for webhookId in downstream packages. This is no longer true. Both fields now coexist and represent distinct values.

Patch Changes

  • e510582: Updated @graphql-codegen/introspection, @graphql-codegen/typescript, isbot dependencies

  • 832fad0: Updated isbot dependencies

  • 6c95ae1: Use a cookie-specific derived key when signing OAuth state and session cookies instead of signing them directly with the app API secret. This prevents signed OAuth state cookies from being reused as valid Shopify webhook HMACs. OAuth state values are also now generated with 32 random bytes encoded as hex.

    Token-exchange-only flows that do not use signed OAuth/session cookies are not affected.

  • 7ec655a: Fix TypeScript type errors for consumers using ES2024+ lib targets

    Widen ArrayBuffer parameter types to ArrayBuffer | Uint8Array in crypto
    utilities and safe-compare, fixing TS2345 errors introduced by TypeScript 5.7's
    generic Uint8Array<ArrayBuffer> type.

Assets 2
Loading