Notes from the studio.
Long-form notes on Hyvä, Shopify Plus, motion budgets, real-time 3D, AI UX and the boring parts of shipping premium digital products.
Hyva Checkout compatibility: official vs shim
Sendcloud's Hyva Checkout module is now officially maintained, which matters less for the feature list than for who absorbs the cost of the next upgrade.
Read →Next.js August security release: one critical
Next.js pre-announced one critical vulnerability for August 26, so headless commerce teams now get six days to plan a patch window instead of scrambling.
Read →Shopify Hydrogen preview vs Liquid themes
Shopify's framework agnostic Hydrogen preview just paid down six items of headless tax, which changes when a premium brand should actually leave Liquid.
Read →Next.js 16.3 vs Hyvä for app-like stores
Next.js 16.3 brings Instant Navigations and View Transitions, closing the app-like gap with Hyvä, so the storefront choice is now ownership and not speed.
Read →Flutter 3.47 ships standalone UI packages
Flutter 3.47 ships material_ui and cupertino_ui as standalone 1.0 packages and makes Impeller the default renderer on desktop, so plan the iOS 15 bump.
Read →React Native 0.87 locks its API before 1.0
React Native 0.87 makes the Strict TypeScript API the default and breaks deep imports, so upgrade now and fix them before 0.88 removes the escape hatch.
Read →PHP 8.6 beta 1: what Magento teams do now
PHP 8.6 beta 1 landed August 13, 2026 with partial function application locked in, but no Magento line runs it yet, so keep storefronts on PHP 8.4 or 8.5.
Read →Adobe Commerce APSB26-92 security patch
Adobe's APSB26-92 patch, out August 11, 2026, is likely the last to cover Magento 2.4.5 and 2.4.6, so Open Source stores should apply it before upgrading.
Read →Shopify order tax recalculates Aug 31
Shopify's orderUpdate mutation starts recalculating taxes when a shipping address changes on August 31, 2026, so audit any custom order-edit flow now.
Read →Shopify checkout extensibility deadline Aug 26
Non-Plus Shopify stores must move to checkout extensibility by August 26, 2026 or get auto-upgraded, stripping checkout.liquid and Additional Scripts edits.
Read →Shopify Oxygen now free on development stores
Shopify now lets you deploy Hydrogen storefronts to Oxygen from free development stores as of August 3, 2026, so you can prototype headless before paying.
Read →Magento 2.4.5 and 2.4.6 end of support Aug 11
Magento 2.4.6 reaches end of standard support on August 11, 2026, and Open Source stores get no extended safety net, so plan your upgrade to 2.4.8 or 2.4.9 now.
Read →Shopify account component now theme-required
Shopify now requires the shopify-account web component in every Theme Store theme as of July 30, 2026, retiring custom login templates and classic accounts.
Read →Hyvä Commerce vs Enterprise: what changed
Hyvä's Solstice release splits the suite: Hyvä Commerce for Magento Open Source and Mage-OS, Hyvä Enterprise for Adobe Commerce, plus a checkout on Magewire v3.
Read →Node.js July 2026: HTTP/2 and permissions
The Node.js July 2026 security release patches 11 CVEs across 26.x, 24.x and 22.x, and for a second month HTTP/2 and the Permission Model lead the list.
Read →Next.js security patch: middleware bypass
Next.js July 2026 security release patches a middleware auth bypass (CVE-2026-64642, CVSS 8.3) plus two SSRF flaws, so upgrade headless storefronts to 16.2.11.
Read →Shopify Managed Markets now handles EU returns
Shopify Managed Markets now auto-handles the EU 14-day right of withdrawal from July 16 2026, so DTC brands selling into Europe face a merchant-of-record call.
Read →PHP 8.6 alpha 2: what it means for Magento
PHP 8.6 alpha 2 landed July 16 2026 with clamp() and stricter core functions and a late-2026 stable target, so Magento and Hyva teams should test now.
Read →Adobe Commerce APSB26-73: patch the auth flaw
Adobe Commerce security patch APSB26-73 lands July 14 2026 with 13 fixes, including two unauthenticated flaws, so Magento merchants should patch this week.
Read →Shopify Customer Account API drops Checkout
Shopify removes Customer.lastIncompleteCheckout and the Checkout type in API version 2026-10, so headless customer-account cart recovery needs a rebuild now.
Read →Shopify market-driven shipping ends profiles
Shopify market-driven shipping moves merchant shipping from delivery profiles into Markets and deprecates the legacy delivery profile APIs from August 2026.
Read →Shopify UCP Cart MCP replaces Storefront MCP
Shopify is deprecating its Storefront MCP cart tools for UCP Cart MCP, with legacy tools live only until August 31, 2026, as agent checkout becomes the default.
Read →Shopify Scripts end June 30: move to Functions
Shopify Scripts stop working on June 30, 2026 with no extension, leaving Plus stores about a week to move discount, shipping and payment logic to Functions.
Read →Node.js ships 12 CVE fixes: what to patch first
Node.js shipped twelve CVE fixes across 26.x, 24.x and 22.x on June 18, two of them high severity; here is what a headless commerce team should patch first.
Read →Shopify Hydrogen goes framework-agnostic
Shopify is pulling Hydrogen's cart, product and money logic out of React Router into framework-agnostic primitives, so headless teams can pick any JS stack.
Read →Shopify metafield definitions are now required for headless
Shopify now hides app metafields from the Customer Account API unless they carry a definition, so headless storefronts that skipped the schema break silently.
Read →Hyvä vs Luma: what a 250-user load test reveals
A 250-user load test puts Hyvä at 5.2x faster than Luma on median response, but the p95 numbers tell a harder truth about uncached Magento under load.
Read →Shopify silent SSO replaces logged_in on headless checkout
Shopify just renamed the silent SSO parameter for headless checkout from logged_in=true to sso=silent. The shift signals where Customer Account API is heading.
Read →Hyvä AI search hits 41% click-through on Doofinder
A Hyvä storefront paired with a Doofinder AI assistant just shipped a 41 percent click-through rate from conversation to product. Here is why it matters.
Read →PHP 8.4.22 patches ten CVEs your Magento stack needs
PHP 8.4.22 and 8.5.7 just shipped ten CVE fixes, including a SOAP use-after-free and an FPM XSS. Magento 2.4.9 stacks need the rollout in production now.
Read →Node.js 26.3 permission.drop locks down storefront BFFs
Node.js 26.3.0 adds permission.drop(), httpValidation and a 64 KiB buffer pool. For headless commerce BFFs, the runtime finally hardens itself after boot.
Read →Shopify cart view_key ends an optimistic cart hack
Shopify just made cart view_key valid in cartLinesUpdate and cartLinesRemove. For headless Plus storefronts, the optimistic cart race condition is finally gone.
Read →Mage-OS beat Shopify with a data ownership pitch
Mage-OS just published the pitch that won a 900-person German publisher back from Shopify. The argument: AI commoditises features, data ownership is the moat.
Read →What e-commerce automation actually costs, and saves
Automation is sold as a magic button. It is really a trade: engineering hours now against manual hours and errors forever. Here is how we scope that trade honestly.
Read →Hyvä Enterprise All-Inclusive bundles Adobe Commerce
Hyvä just relaunched Hyvä Enterprise as an All-Inclusive suite for Adobe Commerce. B2B, Sensei, Adobe EDS, gift cards and loyalty are bundled at €5,500.
Read →Shopify agents.md and llms.txt are now Liquid templates
Shopify just made agents.md, llms.txt and llms-full.txt overridable via Liquid templates. The brand voice your AI shopping agent hears is now yours to set.
Read →Shopify App Home is now a Preact UI extension
Shopify just shipped App Home as a Preact admin UI extension. For studios building custom Plus apps, the iframe shell finally has a serious alternative now.
Read →Magento 2.4.9 is the biggest framework jump since 2.0
Magento 2.4.9 GA drops Laminas MVC, TinyMCE and PHP 8.2, lands Symfony 7.4 and native PHP OAuth. For Hyvä studios, this is the upgrade you cannot defer.
Read →Flutter 3.44 unbundles Material and Cupertino
Flutter 3.44 pulls Material and Cupertino out of the core SDK into independently versioned packages. For mobile studios that means new dependency hygiene.
Read →Shopify Next Gen Events end the webhook glue era
Shopify's Next Gen Events bring field-level triggers, GraphQL payloads and edge filters. The middleware tax on Plus integrations is finally going away.
Read →We're starting a journal
A short note on what we plan to write about, and why the studio is making editorial work a first-class part of how we share what we build.
Read →