Journal.
Long-form notes on Hyvä, Shopify Plus, motion budgets, real-time 3D, AI UX and the boring parts of shipping premium digital products.
- J–06810.2026 · Shopify · 5 min
Shopify app security check: scan vs agent
Shopify CLI 4.9.0 adds an app security check that splits audits into a local scan and agent review prompts, so gate CI on the scan and read the agent output.
- J–06710.2026 · Shopify · 5 min
JPEG XL vs AVIF: Chrome 155 and product images
Chrome 155 turned on JPEG XL on October 6, 2026, so stores should test it against AVIF for gallery and zoom images while Shopify's CDN still serves WebP.
- J–06610.2026 · Web platform · 5 min
Vite dev server security: localhost vs --host
Vite patched three dev server flaws on October 6, 2026, and teams that run the dev server with --host for device testing are the ones the two file leaks reach.
- J–06510.2026 · Mobile · 5 min
Expo UIScene lifecycle: AppDelegate vs scene
Expo SDK 58 moves iOS apps to the UIScene lifecycle Apple now requires, and push, deep link and launch property code that reads the app window breaks first.
- J–06410.2026 · Shopify · 5 min
Hydrogen hydration fix: urgent vs transition
Hydrogen 2026.4.7 stops Analytics.Provider from forcing client renders mid-hydration and closes a consent leak that moving updates to startTransition exposed.
- J–06310.2026 · Shopify · 5 min
Shopify Rollouts: discount status vs reach
Shopify Rollouts can serve a discount to part of your traffic while its status says otherwise, and apps on pre-2026-10 API versions lose the discount entirely.
- J–06210.2026 · Web platform · 5 min
Next.js 16.3.8 security: self-hosted vs Vercel
Next.js 16.3.8 fixes seven bugs, four of them cache leaks that hit self-hosted storefronts harder than Vercel, while a critical fix is still pending upstream.
- J–06109.2026 · Shopify · 5 min
Shopify packed dimensions vs weight-only rates
Shopify packed dimensions let checkout quote multi-item orders on the smallest box that fits, fixing weight-only rates that leak margin on premium packaging.
- J–06009.2026 · Shopify · 5 min
Shopify WebMCP checkout vs Checkout MCP
Shopify WebMCP checkout lets browser agents place orders once the buyer confirms. When to pick it over Checkout MCP, and the PUT and signing traps to plan for.
- J–05909.2026 · Shopify · 5 min
Shopify AI Toolkit: one skill vs 21 skills
Shopify merged 21 AI Toolkit skills into one router that picks the right API more reliably, but it sends prompts and code to Shopify by default. Opt out first.
- J–05809.2026 · Magento & Hyvä · 5 min
PHP 8.4.26 CVEs: streams vs curl on Magento
Six of the eleven advisories in PHP 8.4.26 are triggered by the server your code calls, so Magento integrations built on streams need auditing, not curl ones.
- J–05709.2026 · Shopify · 5 min
Shopify Events 100-point limit: split or slim
Shopify Events now caps every subscription query at 100 points, down from 250, so fat product queries should be split into narrow ones per downstream system.
- J–05609.2026 · Web platform · 5 min
Next.js next/og RCE: CVSS 9.5 vs 5.3
The same CVE that Next.js scores 9.5 critical is rated only 5.3 moderate upstream in Satori, so your dependency scanner will under-report the next/og RCE.
- J–05509.2026 · Shopify · 4 min
Shopify automaticDiscounts vs discountNodes
Shopify removes the automaticDiscounts query in API version 2027-01, and the obvious replacement, automaticDiscountNodes, is already deprecated as well.
- J–05409.2026 · Shopify · 5 min
Shopify UI extensions: 64 KB, cut or appeal
Shopify now rejects any UI extension over 64 KB compressed at deploy, down from roughly 2 MB, and the exception form is an audit, not an escape hatch.
- J–05309.2026 · Shopify · 5 min
Shopify Events 2026-10 breaks on October 1
Shopify Events payloads changed on September 16 and every subscription must be on API version 2026-10 by October 1 or your next deploy ships the break.
- J–05209.2026 · Shopify · 5 min
Shopify metafieldsSet: flat cost vs dynamic
Shopify's metafieldsSet mutation stopped costing a flat 10 points on September 15, and the same 25 metafields now cost 14 or 260 points depending on owners.
- J–05109.2026 · Shopify · 5 min
Shopify Discounts Allocator vs Discount API
Shopify removed the Discounts Allocator Function API on September 10, and from September 29 any app still declaring its target fails its entire deploy.
- J–05009.2026 · Magento & Hyvä · 5 min
PHP 8.6 session defaults vs Magento cookies
PHP 8.6 beta 3 locked three session ini flips on September 10, and Magento storefronts already handle Lax, but every other PHP process on the box does not.
- J–04909.2026 · Shopify · 6 min
Shopify CLI dev stores vs Magento environments
Shopify CLI 4.8 turns a dev store into a command capped at 250 per organization, while Adobe Commerce Cloud Pro still rations two integration branches.
- J–04809.2026 · Magento & Hyvä · 5 min
Adobe Commerce zero-day: APSB26-146 vs 138
CVE-2026-75650 scores a CVSS 10.0 and was exploited before Adobe's September 7 hotfix. Patching is step one of twelve, and a Hyvä frontend changes nothing.
- J–04709.2026 · Magento & Hyvä · 5 min
Turbopack chunking vs Hyvä's zero-bundle bet
Turbopack's chunking flags moved nextjs.org from 96 requests to 38, while a Hyvä storefront has no chunk graph to tune at all. Pick the tradeoff on purpose.
- J–04609.2026 · Shopify · 5 min
Shopify POS 11.14: one barcode vs many
Shopify POS 11.14 finds a variant from any barcode attached to it, but the Admin API still documents one field. Audit your identifiers before you rely on it.
- J–04509.2026 · Shopify · 4 min
Polaris CDN semver: pinned vs stable
Shopify's Polaris CDN adopted semantic versioning on August 31, giving app teams a pinned production channel for the first time. Pin the minor, stage the RC.
- J–04408.2026 · Magento & Hyvä · 5 min
PHP 8.4.25 vs 8.5.10 for Magento stacks
PHP 8.4.25 and 8.5.10 shipped the same day with zero CVEs, but only one line keeps active support past December, and that gap decides your Magento plan.
- J–04308.2026 · PHP & Node · 5 min
Node.js 24.20 LTS vs 26.8 Current
Node.js shipped 24.20.0 LTS and 26.8.0 Current on the same day, and the LTS line got the far better release: audit mode and runtime permission dropping.
- J–04208.2026 · Web platform · 6 min
Next.js 16.3.3: AVIF RCE vs Windows RCE
Next.js 16.3.3 patches two critical remote code execution bugs, and the AVIF one is the expensive fix because patching turns AVIF image optimization off.
- J–04108.2026 · Magento & Hyvä · 5 min
Hyva Checkout compatibility: official vs shim
Sendcloud's Hyva Checkout module is now officially maintained, which matters less for the feature list than for who absorbs the cost of the next upgrade.
- J–04008.2026 · Web platform · 5 min
Next.js August security release: one critical
Next.js pre-announced one critical vulnerability for August 26, so headless commerce teams now get six days to plan a patch window instead of scrambling.
- J–03908.2026 · Shopify · 5 min
Shopify Hydrogen preview vs Liquid themes
Shopify's framework agnostic Hydrogen preview just paid down six items of headless tax, which changes when a premium brand should actually leave Liquid.
- J–03808.2026 · Magento & Hyvä · 5 min
Next.js 16.3 vs Hyvä for app-like stores
Next.js 16.3 brings Instant Navigations and View Transitions, closing the app-like gap with Hyvä, so the storefront choice is now ownership and not speed.
- J–03708.2026 · Mobile · 5 min
Flutter 3.47 ships standalone UI packages
Flutter 3.47 ships material_ui and cupertino_ui as standalone 1.0 packages and makes Impeller the default renderer on desktop, so plan the iOS 15 bump.
- J–03608.2026 · Web platform · 5 min
React Native 0.87 locks its API before 1.0
React Native 0.87 makes the Strict TypeScript API the default and breaks deep imports, so upgrade now and fix them before 0.88 removes the escape hatch.
- J–03508.2026 · Magento & Hyvä · 4 min
PHP 8.6 beta 1: what Magento teams do now
PHP 8.6 beta 1 landed August 13, 2026 with partial function application locked in, but no Magento line runs it yet, so keep storefronts on PHP 8.4 or 8.5.
- J–03408.2026 · Magento & Hyvä · 4 min
Adobe Commerce APSB26-92 security patch
Adobe's APSB26-92 patch, out August 11, 2026, is likely the last to cover Magento 2.4.5 and 2.4.6, so Open Source stores should apply it before upgrading.
- J–03308.2026 · Shopify · 4 min
Shopify order tax recalculates Aug 31
Shopify's orderUpdate mutation starts recalculating taxes when a shipping address changes on August 31, 2026, so audit any custom order-edit flow now.
- J–03208.2026 · Shopify · 4 min
Shopify checkout extensibility deadline Aug 26
Non-Plus Shopify stores must move to checkout extensibility by August 26, 2026 or get auto-upgraded, stripping checkout.liquid and Additional Scripts edits.
- J–03108.2026 · Shopify · 4 min
Shopify Oxygen now free on development stores
Shopify now lets you deploy Hydrogen storefronts to Oxygen from free development stores as of August 3, 2026, so you can prototype headless before paying.
- J–03008.2026 · Magento & Hyvä · 4 min
Magento 2.4.5 and 2.4.6 end of support Aug 11
Magento 2.4.6 reaches end of standard support on August 11, 2026, and Open Source stores get no extended safety net, so plan your upgrade to 2.4.8 or 2.4.9 now.
- J–02908.2026 · Shopify · 4 min
Shopify account component now theme-required
Shopify now requires the shopify-account web component in every Theme Store theme as of July 30, 2026, retiring custom login templates and classic accounts.
- J–02807.2026 · Magento & Hyvä · 4 min
Hyvä Commerce vs Enterprise: what changed
Hyvä's Solstice release splits the suite: Hyvä Commerce for Magento Open Source and Mage-OS, Hyvä Enterprise for Adobe Commerce, plus a checkout on Magewire v3.
- J–02707.2026 · PHP & Node · 4 min
Node.js July 2026: HTTP/2 and permissions
The Node.js July 2026 security release patches 11 CVEs across 26.x, 24.x and 22.x, and for a second month HTTP/2 and the Permission Model lead the list.
- J–02607.2026 · Web platform · 4 min
Next.js security patch: middleware bypass
Next.js July 2026 security release patches a middleware auth bypass (CVE-2026-64642, CVSS 8.3) plus two SSRF flaws, so upgrade headless storefronts to 16.2.11.
- J–02507.2026 · Shopify · 5 min
Shopify Managed Markets now handles EU returns
Shopify Managed Markets now auto-handles the EU 14-day right of withdrawal from July 16 2026, so DTC brands selling into Europe face a merchant-of-record call.
- J–02407.2026 · Magento & Hyvä · 4 min
PHP 8.6 alpha 2: what it means for Magento
PHP 8.6 alpha 2 landed July 16 2026 with clamp() and stricter core functions and a late-2026 stable target, so Magento and Hyva teams should test now.
- J–02307.2026 · Magento & Hyvä · 5 min
Adobe Commerce APSB26-73: patch the auth flaw
Adobe Commerce security patch APSB26-73 lands July 14 2026 with 13 fixes, including two unauthenticated flaws, so Magento merchants should patch this week.
- J–02207.2026 · Shopify · 4 min
Shopify Customer Account API drops Checkout
Shopify removes Customer.lastIncompleteCheckout and the Checkout type in API version 2026-10, so headless customer-account cart recovery needs a rebuild now.
- J–02107.2026 · Shopify · 4 min
Shopify market-driven shipping ends profiles
Shopify market-driven shipping moves merchant shipping from delivery profiles into Markets and deprecates the legacy delivery profile APIs from August 2026.
- J–02006.2026 · Shopify · 4 min
Shopify UCP Cart MCP replaces Storefront MCP
Shopify is deprecating its Storefront MCP cart tools for UCP Cart MCP, with legacy tools live only until August 31, 2026, as agent checkout becomes the default.
- J–01906.2026 · Shopify · 4 min
Shopify Scripts end June 30: move to Functions
Shopify Scripts stop working on June 30, 2026 with no extension, leaving Plus stores about a week to move discount, shipping and payment logic to Functions.
- J–01806.2026 · PHP & Node · 4 min
Node.js ships 12 CVE fixes: what to patch first
Node.js shipped twelve CVE fixes across 26.x, 24.x and 22.x on June 18, two of them high severity; here is what a headless commerce team should patch first.
- J–01706.2026 · Shopify · 4 min
Shopify Hydrogen goes framework-agnostic
Shopify is pulling Hydrogen's cart, product and money logic out of React Router into framework-agnostic primitives, so headless teams can pick any JS stack.
- J–01606.2026 · Shopify · 4 min
Shopify metafield definitions are now required for headless
Shopify now hides app metafields from the Customer Account API unless they carry a definition, so headless storefronts that skipped the schema break silently.
- J–01506.2026 · Magento & Hyvä · 4 min
Hyvä vs Luma: what a 250-user load test reveals
A 250-user load test puts Hyvä at 5.2x faster than Luma on median response, but the p95 numbers tell a harder truth about uncached Magento under load.
- J–01406.2026 · Shopify · 5 min
Shopify silent SSO replaces logged_in on headless checkout
Shopify just renamed the silent SSO parameter for headless checkout from logged_in=true to sso=silent. The shift signals where Customer Account API is heading.
- J–01306.2026 · Magento & Hyvä · 4 min
Hyvä AI search hits 41% click-through on Doofinder
A Hyvä storefront paired with a Doofinder AI assistant just shipped a 41 percent click-through rate from conversation to product. Here is why it matters.
- J–01206.2026 · Magento & Hyvä · 5 min
PHP 8.4.22 patches ten CVEs your Magento stack needs
PHP 8.4.22 and 8.5.7 just shipped ten CVE fixes, including a SOAP use-after-free and an FPM XSS. Magento 2.4.9 stacks need the rollout in production now.
- J–01106.2026 · PHP & Node · 5 min
Node.js 26.3 permission.drop locks down storefront BFFs
Node.js 26.3.0 adds permission.drop(), httpValidation and a 64 KiB buffer pool. For headless commerce BFFs, the runtime finally hardens itself after boot.
- J–01006.2026 · Shopify · 5 min
Shopify cart view_key ends an optimistic cart hack
Shopify just made cart view_key valid in cartLinesUpdate and cartLinesRemove. For headless Plus storefronts, the optimistic cart race condition is finally gone.
- J–00906.2026 · Shopify · 5 min
Mage-OS beat Shopify with a data ownership pitch
Mage-OS just published the pitch that won a 900-person German publisher back from Shopify. The argument: AI commoditises features, data ownership is the moat.
- J–00806.2026 · Magento & Hyvä · 5 min
Hyvä Enterprise All-Inclusive bundles Adobe Commerce
Hyvä just relaunched Hyvä Enterprise as an All-Inclusive suite for Adobe Commerce. B2B, Sensei, Adobe EDS, gift cards and loyalty are bundled at €5,500.
- J–00706.2026 · AI & automation · 6 min
What e-commerce automation actually costs, and saves
Automation is sold as a magic button. It is really a trade: engineering hours now against manual hours and errors forever. Here is how we scope that trade honestly.
- J–00605.2026 · Shopify · 5 min
Shopify agents.md and llms.txt are now Liquid templates
Shopify just made agents.md, llms.txt and llms-full.txt overridable via Liquid templates. The brand voice your AI shopping agent hears is now yours to set.
- J–00505.2026 · Shopify · 5 min
Shopify App Home is now a Preact UI extension
Shopify just shipped App Home as a Preact admin UI extension. For studios building custom Plus apps, the iframe shell finally has a serious alternative now.
- J–00405.2026 · Magento & Hyvä · 5 min
Magento 2.4.9 is the biggest framework jump since 2.0
Magento 2.4.9 GA drops Laminas MVC, TinyMCE and PHP 8.2, lands Symfony 7.4 and native PHP OAuth. For Hyvä studios, this is the upgrade you cannot defer.
- J–00305.2026 · Mobile · 5 min
Flutter 3.44 unbundles Material and Cupertino
Flutter 3.44 pulls Material and Cupertino out of the core SDK into independently versioned packages. For mobile studios that means new dependency hygiene.
- J–00205.2026 · Shopify · 4 min
Shopify Next Gen Events end the webhook glue era
Shopify's Next Gen Events bring field-level triggers, GraphQL payloads and edge filters. The middleware tax on Plus integrations is finally going away.
- J–00105.2026 · 2 min
We're starting a journal
A short note on what we plan to write about, and why the studio is making editorial work a first-class part of how we share what we build.
New entries, monthly.
Hyvä, automation, motion budgets and the boring parts of shipping. No noise, unsubscribe anytime.