Changes to Shopify, WooCommerce, WordPress and n8n that a small online shop may need to act on, recorded from each platform’s official changelog from 2 November to 8 November 2026. Each entry links to the original.
In REST Admin API version 2027-01 and later, the line_item_id property on the Gift Card resource is read-only. Shopify ignores the property in create and update requests. Remove it from those requests before you upgrade.
Starting in API version 2027-01, in customer account full-page extensions the Navigation API currententrychange event sets event.from to the page the customer navigated away from, instead of the page they navigated to. This is a breaking change for customer account full-page extensions that read the new page from event.from. Update them to read shopify.navigation.currentEntry before you move them to 2027-01.
We're enhancing protection of merchants by adding IP allowlist configuration as a requirement for public apps. All public apps using bulk operations must configure an allowlist by November 12, 2026, and all other public apps must configure an allowlist by November 20, 2026.
As of GraphQL Admin API version 2027-01, the FulfillmentOrderDestination object has a provinceCode field. It returns the alphanumeric code of the destination's province or state, such as ON for Ontario, so apps can read the code directly instead of mapping the province name themselves.
You can now test your app's [network_access] settings on a dev store with the new network access testing feature preview. The preview helps you confirm you have the right networks listed, and find hosts and servers you missed.
As of GraphQL Admin API version2027-01, CustomerPaymentMethod.revokedReason can return a new value: RETRY_DECLINED. Shopify uses this value when a subscription payment method is revoked because the payment processor has blocked any further retry attempts. On earlier API versions, these revocations continue to return TOO_MANY_CONSECUTIVE_FAILURES.
On Oct 27 we recommended the IP allowlist. It is now required for every public app by November 20, or November 12 if you use bulk ops. An IP allowlist means a leaked token can't be used anywhere but your own servers. With the busiest weeks of the year for merchants almost here, we're asking for it now.
Apps without static IP addresses, such as apps on serverless platforms, can now add your hosting provider's autonomous system numbers (ASNs) to your app's IP allowlist in the Dev Dashboard.
Thu, 05 Nov 2026 17:00:00 +0000
As of GraphQL Admin API version 2027-01, you can attach a merchant-only note when crediting or debiting a store credit account and read those notes on store credit transactions. Notes are optional, so existing integrations continue to work without changes or required updates.
Starting today, apps need access to bulk operations before they can run bulk queries or bulk mutations with the GraphQL Admin API. You can enable access for your app in the Partner Dashboard.
Starting today, apps need access to bulk operations before they can run bulk queries or bulk mutations with the GraphQL Admin API. You can enable access for your app in the Partner Dashboard.
A subscriptions function security update is now available for WooPayments. If you run the WooPayments plugin, please check your version and update to the fix version listed.
WooCommerce 11.2.2 has been released with a number of updates focused on security. We strongly recommend updating to the latest release.
8 bug fixes.
52 new features, 122 bug fixes.
48 new features, 114 bug fixes.
2 bug fixes.
3 new features.
2 bug fixes.
3 new features, 3 bug fixes.
Tell us what you run and we’ll check what the change means for your shop.
hello@pushbuild.com