Shopify CLI 4.0.0

The release of Shopify CLI 4.0 today brings clarity to CLI versioning, the introduction of automatic updates, and the announced removal of the deprecated --force flag from shopify app deploy.

Semantic Versioning

Shopify CLI is now following semantic versioning practices. Releases with new features will be minor versions, and bug fixes will be patch versions. When required, major version releases will be used to communicate breaking changes to CLI command structure or behavior.

For more information, see our announcement of the move to SemVer.

Automatic Upgrades

Starting with Shopify CLI 4.0, Shopify CLI upgrades itself automatically using the package manager you installed it with. Auto-upgrade is skipped in CI, project-local installs, and for major version releases. Automatic upgrades can be disabled with the shopify config autoupgrade off command.

⚠️ Breaking Changes

App

• Remove the deprecated --force (-f) flag and SHOPIFY_FLAG_FORCE environment variable from shopify app deploy. Use --allow-updates for CI/CD environments, or --allow-updates --allow-deletes if you also want to allow removals. The --no-release flag continues to work and implicitly allows updates and deletes. (96281e6)
• Remove the deprecated --force (-f) flag and SHOPIFY_FLAG_FORCE environment variable from shopify app release. Use --allow-updates for CI/CD environments, or --allow-updates --allow-deletes if you also want to allow removals. Passing both --allow-updates and --allow-deletes skips the confirmation prompt (matching the previous --force behavior). (c36d5c2)
• Remove the deprecated --type (-t) flag and SHOPIFY_FLAG_EXTENSION_TYPE environment variable from shopify app generate extension. Use --template (SHOPIFY_FLAG_EXTENSION_TEMPLATE) instead. (ad69d29)
• Remove the deprecated shopify app generate schema command. Use shopify app function schema instead. (f23fe6c)
• Remove the deprecated shopify app scaffold extension command. Use shopify app generate extension instead. (ec867ef)
• Remove the deprecated top-level shopify webhook trigger alias. Use shopify app webhook trigger instead. (60d2697)
• Remove the deprecated --shared-secret flag and SHOPIFY_FLAG_SHARED_SECRET environment variable from shopify app webhook trigger. Use --client-secret (SHOPIFY_FLAG_CLIENT_SECRET) instead. (38ce793)

Theme

• Remove the deprecated shopify theme serve command. Use shopify theme dev instead. (a960ee9)

General

• Drop support for Node 20 (0c35553)

Patch Changes

App

• Fix Spawn ETXTBSY bug with multiple Functions using trampoline binaries (2520541)
• Show Local URL in dev info when no App URL is available (e4ec92b)
• Detect files added during a running dev session (f8eabc1)
• Handle modern Bun bun.lock files when cleaning up app templates so non-Bun projects do not keep stale Bun lockfiles or .gitignore entries (a7d448b)
• Fix shopify app build intermittently failing with "Source and destination must not be the same" on UI extensions when the local esbuild output directory and the bundle output directory resolve to the same path but differ as strings (e.g. due to . segments, trailing slashes, or path joining quirks). The same-path guard now normalizes both paths via resolvePath before comparison. (e94c94e)
• Fix uid being written outside the [[extensions]] block in single-entry array-of-tables TOMLs (the shape produced by shopify app init templates) (1bf342d)
• Guard app bundle uploads against oversized bundles and asset paths resolving outside the app directory (926db8b)
• Display a friendly error message instead of a stack trace when running shopify app config link --client-id=<id> against a Dev Dashboard app and the client ID does not exist (8a9c5a1)
• Hide the deprecated remix template from shopify app init --template help text and validation messages. The React Router template has replaced Remix as the supported choice. Passing --template remix continues to work for backwards compatibility. (6cb484f)
• The CLI-generated shopify.d.ts now types the shopify binding as Api & ShopifyGlobal (intersection) for UI extension targets whose .d.ts re-exports a ShopifyGlobal type. Existing consumers who access the target API via shopify.* are unaffected; new host-level APIs like shopify.addEventListener now type-check automatically for opt-in targets (e.g. POS background extensions). Targets that do not re-export ShopifyGlobal emit the same output as before. (c70e536)
• Fix unhelpful error when extension locale file has invalid UTF-8 (d5028b5)
• Fix dev and build command for web_pixel extensions (dc70080)

Theme

• Upload config/settings_schema.json before any other theme file. Fixes theme push failing on the first push when blocks or sections reference a color_palette theme setting. (1e8963e)
• Fix theme dev proxy to support SFAPI requests (8f4e546)
• Fix theme dev analytics being dropped on Ctrl+C (c6a114d)

General

• Make the autocomplete prompt feel instant when filtering against in-memory choices (67745ee)
• Also treat OPT_OUT_INSTRUMENTATION=true as an analytics opt-out, in addition to the existing SHOPIFY_CLI_NO_ANALYTICS=1 environment variable (2cb5f44)