All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog and adheres to Semantic Versioning.
- Make sure the bundled package includes the App Bridge lib 150, fixes missing files from v5.0.0-5.0.2
⚠️ [breaking] Upgraded@shopify/shopify-apiversion 149- See the library release notes for details on the breaking changes. By default, apps should only need to make changes to usages of
Shopify.Webhooksince other breaking changes are internally handled by this package.
- See the library release notes for details on the breaking changes. By default, apps should only need to make changes to usages of
- Replace deprecated EASDK call with App Bridge 148
- Replace deprecated metafields API request used for oauth token check with longer lived call to the shop endpoint 144
- Retry OAuth if cookie / session has expired on callback 112
- Fix authentication error if the Shopify session ended before its expiration date 94
- Remove
samesite=nonesetting fromcookie-options. 83
- Bumped
@shopify/shopify-apiversion to v1.2.1 to include the new API version (April21). 80
- Add
returnHeaderoption toverifyRequest, which allows using the middleware on XHR requests. 78
- Fix bad import path for type AccessMode. 63
- Ensure both
shopifyAuthandverifyRequestwork in offline mode. 59
- Sets the
USER_AGENT_PREFIXonShopify.Contextfor usage tracking data. 55
- [Feature] Start using the new Shopify library instead of implementing all of the server-side functions. 54
- Sets the
USER_AGENT_PREFIXonShopify.Contextfor usage tracking data. 51
- [Feature] Add missing associated user data to the session 23
- Fix inconsistency in authentication path prefix to remove trailing slash 29
- Bad release (misaligned tags). Please use
3.1.72instead.
- No changes from 3.1.68
- Moved to standalone repository
- Bad release. Please use 3.1.70 instead.
- Wrap
encodeURIvalues in double quotes 1613
- URI encode
configon redirection page 1612
- Include
prefixwhen redirect to the root endpoint 1498
- Protect against reflected XSS vulnerability 1455
- Include
prefixwhen we redirect to the/authpath.
- Fixes ITP 2.3 and Safari 13.1 enable cookies loop 1413
- Package now forces cookies.secure to be true 1255
- Package sets cookies to samesite:none and secure 1251
- Updated redirect script to use App Bridge 1242
- No longer errors out on fresh installs with no session 1022
- Package no longer allows sessions from one shop to bleed over into another 940
- Package now lists missing '@shopify/network' dependency 862
- Installation no longer fails if accessToken is invalid #844
- OAuth route no longer rejects uppercase shop domains #493
- HMAC validation no longer breaks when params are unsorted #451
- Start of Changelog