Developer preview release notes: October 2, 2026

New

Customer Accounts in the React Router template

The React Router template's account icon opens /account, where shoppers sign in, sign out, and see their orders. It needs a real store, SHOP_ID, PUBLIC_CUSTOMER_ACCOUNT_API_CLIENT_ID, SESSION_SECRET, and HTTPS. Locally, run dev:https.

Customer Account URLs for local HTTPS

When the dev server starts, localHttps() registers the Customer Account callback, JavaScript origin, and logout URLs through Shopify CLI. It needs @shopify/cli-hydrogen 13.0.4 or later. If registration fails, it prints the values to enter by hand.

Buy permalinks

handleShopifyRoutes forwards UCP /buy/{items} permalinks to your Shopify store, alongside /cart/{items}.

Tracking values for analytics destinations

Destinations can read the shopper's uniqueToken and visitToken with getTrackingValues(), which every subscribe callback receives in its second argument. Both are empty strings when tracking isn't allowed.

hydrogen setup in an empty folder

In an empty folder, hydrogen setup offers to scaffold the React Router template or to install only the AI coding skills.

Changed

Storefront API and Customer Account API 2026-10

Hydrogen uses version 2026-10 of the Storefront API and Customer Account API, up from 2026-04. Changes from the 2026-07 and 2026-10 releases apply. The ones most likely to affect you:

• Customer address mutations send countryCode, like US, instead of territoryCode.
• Order.shippingTitle is removed. Use Order.shippingLine.title.
• Customer.lastIncompleteCheckout and the Checkout types are removed.
• Cart.discountAllocations and CartDiscountAllocation.discountApplication are deprecated in favor of Cart.discountApplications, CartDeliveryGroup.discountAllocations, and CartDiscountAllocation.sourceDiscountApplication.
• ShopPayPaymentRequestSession.paymentRequest is deprecated and can be null.

hydrogen gql check --fail-on-warn may now fail on newly deprecated fields.

Analytics destinations

analytics.subscribe() and analytics.destroy() are removed. Register consumers with analytics.addDestination(): give the destination a name, and register event handlers with the subscribe function its setup callback receives.

Destinations receive events once analytics processing is allowed, including events from before they registered. Register each destination once in the browser, not in a component that mounts and unmounts, or it receives those events again.

Custom consent banners need setup()

consent: {mode: "custom-banner"} on ShopifyScripts requires an async setup() that syncs your consent provider's choice to window.Shopify.customerPrivacy. Analytics events wait until it resolves.

Responses that set cookies aren't cached

Any response with Set-Cookie, including your own, gets Cache-Control: private, no-store, replacing your cache headers.

Tracking cookies

ShopifyScripts no longer sets the legacy _shopify_y and _shopify_s cookies, and existing ones are expired on the next consent request Hydrogen proxies. If you read them, use getTrackingValues() instead. The shopper's Sec-GPC header is forwarded to Shopify.

Vue form callbacks

Vue formProps() callbacks receive a SubmitEvent, matching React.

React Router template content

The shop name, logo, payment icons, homepage hero, and New arrivals in the React Router template come from your store.

Fixes

• Customer Account login and logout redirects, the return_to and redirect params in handleShopifyRedirects, and cart form redirects stay on your domain. Customer Account values without a leading /, like account/orders, now go to the default redirect.
• JSONP requests are rejected before they reach Shopify.
• formatMoney().amount keeps the minus sign on negative amounts.
• Cart analytics deduplication works with the built-in cart query. It used to need a custom CartFragment that selected updatedAt.
• Predictive search uses your configured limit when a request sends an empty or invalid one.
• React's predictive search actions keep working after the provider's props change.
• The product form stays subscribed to the cart under React StrictMode.
• @shopify/hydrogen/ts-plugin loads in editors, so GraphQL hover docs and completions work inside gql().
• The React Router and Next.js templates work with mock.shop without a token.
• In the React Router template, the header cart icon and collection sort work without JavaScript, filters stay usable while results load, and removing a cart line with the keyboard keeps focus nearby.

Removed

• analytics.subscribe() and analytics.destroy(). Use analytics.addDestination().
• The standalone CartProvider, useCart, useCartActions, and useCartForm exports from @shopify/hydrogen/react. Use the ones from createCartComponents<typeof cartHandlers>(), which keep your CartFragment types. useCartActions() still has refresh().
• The EventPayloads type. Use PayloadFor<"product_viewed"> for one event or AnalyticsEventMap[AnalyticsEventName] for any event.
• The locations, path, and extensions fields on StorefrontApiError. They were never populated. GraphQL errors are in result.errors.

Migration

For migration guidance, compare the commits that bracket this release. The diff shows the changes between the previous preview and this release:

Code Example
Copy
git diff e58f34891..5fa006e3b