What’s New and Deprecation Timeline

The Admin GraphQL, Storefront, Customer Account, Functions, Webhooks and Partner APIs are versioned quarterly. A version is named YYYY-MM, is released at 17:00 UTC on the first day of its month and stays accessible for at least twelve months, which means that two consecutive versions overlap for at least nine months. Three kinds of version exist: a stable version, a release candidate (published on the same day as the previous stable release, so the 2027-01 candidate appeared on 2026-10-01) and the unstable version, which changes continuously. On the check date the status table is:

A request to a version that is no longer accessible is not rejected: it falls forward to the oldest accessible stable version, and the response header X-Shopify-API-Version tells the caller which version actually answered. That is a convenience for old integrations and a trap for new ones, because a query written for 2025-10 can start failing validation without any deploy of your own. Pin the version in every URL (/admin/api/2026-10/graphql.json) and calendar the end date of the version you pin.

The pattern in the status table is regular enough to compute. The script below reproduces the table from the rule "released on the 1st at 17:00 UTC, accessible until the 16th of the same month a year later at 15:00 UTC" and prints the days left for each supported version, which is the number a team should put in its own calendar.

Output, from running the script with Node.js 24:

The first four rows agree with the published table; the last row extends the pattern and is not itself a published date. Pocket Coffee’s companion app pins 2026-10, so its own deadline is 2027-10-16, and the shop’s older Partner reports that still call 2026-01 have until 2027-01-16.

Source: Shopify developer docs: API versioning

Versions govern API schemas. A removal inside a version follows the schema’s own deprecation text: a field is marked deprecated with a reason, and the reason names the version in which it will disappear. The 2026-10 schema contains, for example, the automaticDiscounts query with the text "This will be removed in 2027-01", and currentBulkOperation, deprecated in favour of bulkOperations. Several surfaces are unversioned and may change at any time: the Ajax API, App Bridge APIs, the Catalog API, the Customer Privacy API, Liquid, OAuth endpoints, Shop Minis, Shop Pay Wallet, Storefront Web Components and the Web Pixels API. Libraries such as Hydrogen, Hydrogen React and the React Router app package are versioned by major release instead.

The Admin schema of each version can be downloaded anonymously, which makes the deprecation lifecycle measurable. The script below loads the five schemas that were available on the check date, counts deprecated fields in each and compares 2026-10 with the 2027-01 release candidate to see what disappears.

Output:

Two lessons come out of the numbers. First, about four hundred schema fields are deprecated at any moment and only a handful leave in a given quarter, so a deprecated field is a signal to plan, not to panic. Second, scriptTagCreate is still in every schema, including 2027-01, even though calling it returns a user error from 2026-10-01: the runtime behaviour of a deprecation can change independently of the schema of a version, which is why the changelog entry, not the schema alone, is the source of truth for the script tag deadline below. This is also the reason a schema diff cannot replace reading the changelog.

Source: Shopify developer docs: GraphQL Admin API reference (schemas fetched through the introspection proxy at shopify.dev/admin-graphql-direct-proxy/<version>; the script ran offline on the saved files)

Every announcement with a date lands in the developer changelog at https://shopify.dev/changelog, which is also published as a feed at https://shopify.dev/changelog/feed.xml. On 2026-10-27 the feed held 785 entries back to 2024-10-28. The entries that matter for deprecations share a structure: what is changing, why, who is affected, a dated timeline, the migration path and related docs. Three habits make the changelog useful.

At the HTTP level, since 2025-02-24 the response header X-Shopify-API-Deprecated-Reason carries the actual GraphQL deprecation text for a request that used a deprecated field, so logging that header in the companion app’s API client gives an early warning without any scheduled review. Theme Check gives the same kind of signal for theme code: its DeprecatedTag and DeprecatedFilter checks flag the include tag and the img_url filter, as the next example shows.

A theme’s own code can be audited offline. The snippet below is what a 2021-era Pocket Coffee theme might contain for the roast date badge: an include, a parser-blocking script tag in the markup, and the old img_url filter.

Running Theme Check from Shopify CLI 5.0.0 (shopify theme check -o json, Skeleton as the base theme, 41 files) reports three errors and four warnings, of which these belong to deprecations:

Source: Shopify developer docs: Theme Check

The modern version renders the price snippet with render, which gives the snippet its own scope, uses image_url with image_tag, and documents the snippet’s parameters with the doc tag:

Theme Check on the modern pair finds no errors and no deprecations. The only remaining findings are two OrphanedSnippet warnings, because the test theme has no template that renders roast-badge; in a real theme a section would render it.

Source: Shopify developer docs: Theme Check and Shopify Liquid reference: render (the checks listed come from shopify theme check --list, Theme Check 3.31.0)

The Developer tab introduced the edition as "A completely new way to build for commerce with the power of AI". The developer-relevant announcements, in the order of the page, were:

The Developer tab grouped its announcements as Platform and Apps plus Extensions:

Pocket Coffee’s use of these editions is small and concrete. The Coffee Club discount that a Script would have implemented is a Discount Function. The "order placed" logger can use a webhook with a field-level trigger rather than polling. The companion app can be deployed with an app automation token and shopify app deploy --allow-updates, and the roast badge becomes an app embed block.

Source: Shopify Editions: Winter '26 and Shopify Editions: Spring '26, with The Winter '26 Edition is here and Shopify Editions: Spring '26

The REST Admin API was Shopify’s first Admin API and the one that every book before 2022 teaches. Its page states that it is a legacy API as of 2024-10-01 and that "some newer features may only be available in GraphQL". From 2025-04-01 all new public apps submitted to the App Store must be built with the GraphQL Admin API only. The documentation publishes no shutdown date for REST, and this page does not invent one; the version-fall-forward rule still applies, so a REST URL with an expired version is answered by the oldest supported version rather than rejected.

Practical consequences for existing code:

The migration template for a read is mechanical. The Pocket Coffee companion app used to list the beans product with GET /admin/api/2026-10/products.json?title=Single-origin beans and read variants[].sku, price and inventory_quantity from each. The GraphQL equivalent selects the same fields, paginates with a cursor, and was validated against the downloaded 2026-10 and 2027-01 schemas:

Source: Shopify developer docs: GraphQL Admin API reference

The query was validated, not executed: running it needs an access token for a shop. To send it, POST it with the variable {"first": 10} to https://<shop>.myshopify.com/admin/api/2026-10/graphql.json with the header X-Shopify-Access-Token: ${SHOPIFY_ACCESS_TOKEN}.

Source: Shopify developer docs: REST Admin API reference and Shopify developer docs: Build apps with the GraphQL Admin API

Until Checkout Extensibility, a Shopify Plus merchant customized checkout by editing layout/checkout.liquid, and every merchant could add "additional scripts" and script tags to the Order status page. The official page on checkout.liquid states the state of play per step:

The replacement is not a single feature: it is the set that Shopify calls Checkout Extensibility. Checkout UI extensions render a block at a named target (they are scaffolded with Preact and Polaris web components, with a compiled bundle limit of 64 KB, and 128 KB for full-page customer account extensions); Shopify Functions replace price, shipping and payment logic; the Checkout and Accounts Configuration API handles branding (2026-05-13); web pixels replace tracking scripts. Checkout UI extensions on the Information, Shipping and Payment steps are available on Plus only, while Thank you and Order status extensions are available on all plans. Later changes to the same surface: extensions default to non-blocking behaviour (2026-01-26), checkout metafields are deprecated in checkout and customer account UI extensions (2026-04-27), useBuyerJourneyIntercept was deprecated (2026-07-02) and owner_type becomes required for metafield declarations in 2027-01.

Pocket Coffee is not on Plus, so its only checkout surfaces are the Thank you and Order status pages. Its old "gift a roast date" note in the additional scripts box stopped working for good on 2026-08-26 and is rebuilt as a Thank you extension. The details of building one belong to the page on checkout extensibility.

Source: Shopify developer docs: checkout.liquid and Shopify Help Center: Upgrade your checkout

Shopify Scripts were small Ruby programs, edited in the Script Editor app, that changed line item prices, shipping rates and payment methods at checkout on Plus stores. The deprecation, announced in the developer changelog on 2026-04-09 and echoed in Winter '26 ("Shopify Functions replace Scripts in 2026"), has two dates:

Because the second date is in the past on the check date, nothing remains to schedule: the logic that Scripts used to run is either rebuilt or silently gone. The replacement is Shopify Functions: Discount (the unified Discount API, since the Product, Order and Shipping Discount Function APIs were deprecated in 2025-04), Cart Transform, Delivery Customization, Payment Customization, Cart and Checkout Validation, Fulfillment Constraints and Order Routing. Functions compile to WebAssembly, Rust being the strongly recommended language and JavaScript supported through Javy. The fixed limits are a 256 kB binary and 10,000 kB of memory; the instruction count is a dynamic limit, 11 million for carts of up to 200 lines and scaling above that, and the input query is capped at 3000 bytes. Custom apps containing Functions require Plus, while public apps with Functions work on all plans. Shopify offers a Scripts customizations report to classify each existing Script as replaceable by a Function, by a public app, or neither.

For Pocket Coffee the Coffee Club rule ("10% off beans for the Coffee Club group, free shipping above 40 EUR") is the kind of rule that a Script implemented and that a Discount Function now implements. The full build, including a JavaScript Function compiled to Wasm and executed locally with shopify app function run, is on the page about Shopify Functions.

Source: Shopify developer changelog: Shopify Scripts will be deprecated on June 30, 2026 and Shopify Help Center: Shopify Scripts

A script tag is a record, created through the Admin API, that makes Shopify add a JavaScript URL to a storefront without any change to theme code. The changelog entry of 2026-08-24 sets two dates:

The scriptTags query and the scriptTagDelete mutation keep working, which is what makes a cleanup possible. Shopify’s reason is visibility: a script tag does not appear in the theme editor, so merchants cannot find or control it, whereas an app embed block does and a web pixel runs in a sandbox that respects customer privacy permissions. The migration is to ship an app embed block in a theme app extension (for UI or behaviour) or a web pixel (for analytics and conversion tracking only). Theme app extensions allow up to 30 app blocks (raised from 25 on 2026-02-03).

An audit-and-cleanup pair for the companion app lists every script tag it created, then deletes one by id. Both documents validate against the 2026-10 and 2027-01 schemas:

Source: Shopify developer docs: GraphQL Admin API reference

The replacement for Pocket Coffee’s roast date badge (a script tag that wrote "Roasted on …​" into the product page) is an app embed block. This theme app extension is complete, and shopify app build built it offline from a placeholder app configuration (client id of 32 zeros, example.invalid URLs) with Theme Check passing on the extension:

Source: Shopify developer docs: Configure theme app extensions

The block has "target": "body", which makes it an app embed block: the merchant switches it on in the theme editor under App embeds. A block with "target": "section" would be an app block placed inside a section instead. Deploying the extension and enabling it in a theme needs a real app registration and a store, so that part was not executed.

Source: Shopify developer changelog: Script tags are deprecated and will stop running on March 1, 2027 and Shopify developer docs: Theme app extensions

Shopify has two customer account systems. Legacy customer accounts are the Liquid-based pages (login with a password, the customers/* templates in the theme). New customer accounts are hosted by Shopify, passwordless by default, and extensible through customer account UI extensions. The changelog entry of 2026-02-26 deprecates the legacy system:

For Pocket Coffee the practical test is whether the theme still ships a templates/customers folder. The Skeleton base theme does not have one (listing its templates folder confirms it), so the Coffee Club members (ada@example.test in the running example) sign in through new customer accounts. The details are on the pages on reference themes and the Storefront API and headless.

Source: Shopify developer changelog: Legacy customer accounts are now deprecated

An offline access token lets an app call the Admin API without a merchant present (a webhook handler, a background job). Historically it never expired: it lasted until the app was uninstalled or the secret was revoked. The platform is moving to expiring offline access tokens: an access token that lasts one hour (expires_in 3600), paired with a refresh token that lasts 90 days (refresh_token_expires_in 7776000). Every refresh returns a new access token and a new refresh token. The dates are:

With 66 days to the 2027-01-01 date on the check day, this is the nearest hard deadline for an App Store app. The app template already opts in. This is the relevant part of app/shopify.server.ts in the public React Router template (commit 48b841a, 2026-10-09), which pins API version ApiVersion.October26, and the matching fields in its Prisma Session model:

An app that stores tokens itself, rather than through the session storage of the library, needs equivalent columns and a refresh job. The request that asks for an expiring token during the token exchange is the same call that issues a non-expiring one plus expiring=1; it is documented on the page on authentication and access scopes. It needs a real ID token from an embedded app session and was not executed here.

Source: Shopify developer changelog: Expiring offline access tokens required for all public apps as of January 1, 2027 and Shopify developer docs: Access tokens

The six items above are the large ones. These smaller, dated changes break code written for earlier years and are easy to miss. All dates come from the developer changelog or the Shopify documentation.

The automaticDiscounts row is one the schemas can prove. The following two documents select the Coffee Club’s automatic discounts with the old and new query. Validating both against the 2026-10 and the 2027-01 schemas with graphql@16 gives:

This is the cheapest regression test a team can add: run the project’s saved GraphQL documents against the release candidate schema in CI, and the removals show up as validation errors three months before the version becomes the one that old requests fall forward to. The graphql package must be version 16 for Shopify schemas: version 17 rejects the introspection result because of an interface-field deprecation rule.

Source: Shopify GraphQL Admin API: automaticDiscountNodes and Shopify developer changelog

In 2014 an app was a web application that a developer deployed to a host, registered in the Partners area and wired to a REST client. In 2026 an app is a project in a Shopify CLI workspace whose shopify.app.toml declares scopes, webhooks, extensions and the Polaris CDN; its configuration is deployed as an app version; many apps need no backend at all (an App Home built directly in the admin, a Function, a theme app extension). The Dev Dashboard replaced most of the Partner Dashboard for building: dev stores, client transfer stores and collaborator stores live there, a single organization can have up to 250 dev stores, and shopify store create dev makes one from the terminal. The page on apps and scaffolding describes the current scaffold, and the page on the development environment describes the workspace.

The Liquid language itself has changed least: the filters and objects in a 2021 book mostly still work. What changed is the structure around it. JSON templates compose sections; sections host blocks; blocks can be written as reusable theme blocks in the /blocks folder; app blocks from theme app extensions can be placed anywhere the theme allows. A section either defines its own local blocks or accepts @theme and @app blocks, not both. Stricter Liquid parsing was enforced for all themes on 2026-01-13, and a developer preview of {% block %} and {% partial %} tags (2026-07-21) shows where the language is heading. The theme architecture and sections and theme blocks pages cover the current model.

A book from before 2024 shows checkout customization as editing checkout.liquid and writing Ruby Scripts. Both are gone: the first from every step, the second since 2026-06-30. Checkout is now the platform’s most opinionated surface. You cannot change its markup; you can place Preact-and-web-components extensions at defined targets, change its logic with Functions, brand it through the configuration API, and track it with web pixels. The same pattern, "defined seams instead of free edits", also applies to customer accounts (UI extensions) and the storefront (app embed blocks).

Books from the Hydrogen v1 and Remix years describe a full-stack framework. Hydrogen 2026-10, generally available on 2026-10-14, is a framework-agnostic toolkit with entry points for the core, React and Vue bindings, customer account helpers and a Vite plugin, with a Next.js starter and a React Router starter for Oxygen. The earlier framework is documented as Legacy Hydrogen (2026-04 and earlier) with a migration guide. Customer sign-in for headless storefronts goes through the Customer Account API. Oxygen is still free on paid plans. Polaris and Hydrogen pages are covered in app UI and the Storefront API and headless.

Two areas did not exist at all when the books were written: AI tooling and agentic commerce. The Shopify AI Toolkit (skills and a plugin for coding agents), the Dev MCP server (@shopify/dev-mcp), the CLI commands shopify doc search, shopify doc fetch and shopify app security check, Sidekick app extensions, and the Catalog, Cart and Checkout MCPs are new in 2025-2026 and are covered in the page on the development environment. A reader who learned the platform from a book should treat the book’s concepts (products, variants, collections, orders, fulfilment, discounts) as current and its mechanics (how to authenticate, how to customize checkout, how to inject a script) as historical.

Source: Shopify developer docs: Shopify CLI for apps, Shopify developer docs: Themes and Shopify developer docs: Hydrogen