What's Changed
App
- Skip lockfiles in every
shopify app security checkscan directory, including--include-dirpaths, so large repository-root lockfiles no longer leave the secret checkunresolvedby @jplhomer in #8825 - Check Dependabot and Renovate configuration at the app's Git repository root when the app is nested below it by @jplhomer in #8826
- Detect React Router code in additional directories, such as servers added with
--include-dirandweb/directories, so the relevant source checks can run by @jplhomer in #8827 - Clarify agent-check instructions for React Router authentication, metafield writes, and
frame-ancestorsCSP policies, including when to report completed checks versus unresolved investigations by @jplhomer in #8830 - Clarify the
--blockinglevels and itsnonedefault, and when to use--skip-instructions, inshopify app securityhelp by @jplhomer in #8853
Full Changelog: 4.9.2...4.9.3