Shopify - update event topics for new-event-emitted trigger #15725
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 3 Skipped Deployments
|
WalkthroughThe pull request updates version numbers and dependency references across several Shopify component files. In the main package, the component version and its dependencies are bumped. The list of event topics in the constants file is expanded with multiple new entries. Additionally, two source modules have their version updated. These changes adjust static configuration values and exported constants without modifying core control flow logic. Changes
Sequence Diagram(s)Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 ESLint
components/shopify/sources/common/constants.mjsOops! Something went wrong! :( ESLint: 8.57.1 Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'jsonc-eslint-parser' imported from /eslint.config.mjs 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
⏰ Context from checks skipped due to timeout of 90000ms (2)
🔇 Additional comments (4)
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
components/shopify/package.json(2 hunks)components/shopify/sources/common/constants.mjs(5 hunks)components/shopify/sources/new-event-emitted/new-event-emitted.mjs(1 hunks)components/shopify/sources/new-product-created/new-product-created.mjs(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- components/shopify/sources/new-event-emitted/new-event-emitted.mjs
- components/shopify/sources/new-product-created/new-product-created.mjs
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: pnpm publish
- GitHub Check: Verify TypeScript components
- GitHub Check: Publish TypeScript components
🔇 Additional comments (6)
components/shopify/package.json (2)
18-18:❓ Verification inconclusive
Verify compatibility with shopify-api-node v3.14.2.
The minor version bump of shopify-api-node suggests new features or improvements that might be relevant to the new event topics.
🌐 Web query:
What are the changes in shopify-api-node v3.14.2 compared to v3.12.4?💡 Result:
The key changes between
shopify-api-nodev3.14.2 and v3.12.4 focus on enhanced rate-limiting strategies and alignment with Shopify's latest API updates:Rate Limit Handling Improvements
- Added
maxRetriesconfiguration
Now supports up to10retries (defaults to0) with automatic respect for Shopify'sRetry-Afterheaders[1].- Optimized
autoLimitalgorithm
Client-side leaky bucket implementation avoids429 Rate Limit Exceedederrors more effectively[1].Shopify Platform Alignment
- Support for API version
2025-04
Includes critical updates:
1️⃣ New error codeNON_TEST_ORDER_LIMIT_REACHEDfor subscription billing attempts[2][5]
2️⃣ Partial payment recording viaorderCreateManualPaymentmutation[2][5]
3️⃣ Merged payout statuses ("In Transit" → "Scheduled")[2][5]Parameter Handling Changes
- Simplified nested object syntax when creating resources:
// Old: { country: { code: 'FR' } } // New: { code: 'FR' } shopify.country.create({ code: 'FR' })Automatically wraps parameters in required parent keys[1].
Deprecations & Breaking Changes
- Removed support for deprecated Shopify APIs:
1️⃣ Explicit metafield access grants (ended Feb 24)[2][5]
2️⃣ Legacy liquid syntaxshop.metaobjects→ standardizedmetaobjects.type.handle[2][5]Maintenance Updates
- Dependency updates including Rust 1.84 support in CLI tools[2][10]
- Improved JWT parsing with unified leeway handling[3]
Developers should test retry logic adjustments and update any hardcoded API versions referencing deprecated endpoints before upgrading[1][7].
Citations:
- 1: https://www.npmjs.com/package/shopify-api-node
- 2: https://shopify.dev/changelog
- 3: https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md
- 4: MONEI/Shopify-api-node#386
- 5: https://shopify.dev/docs/api/release-notes/2024-04
- 6: https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/migrating/notable-changes/
- 7: https://shopify.dev/docs/api/usage/versioning
- 8: https://community.shopify.com/c/shopify-apps/struggling-with-shopify-api-node-argument-type-error-how-to-fix/td-p/1775290
- 9: https://shopify.dev/docs/api/release-notes
- 10: https://community.shopify.com/c/technical-q-a/deprecating-rest-api/m-p/2678768
Action Required: Verify Compatibility with Shopify-API-Node v3.14.2
The upgrade to v3.14.2 introduces several non-trivial changes compared to v3.12.4. Please ensure that the following areas in our code are reviewed and tested for compatibility:
Enhanced Rate-Limiting:
- New
maxRetriesconfiguration (defaulting to 0 and now supporting up to 10 retries).- Improvements in the client-side autoLimit algorithm to better handle
429 Rate Limit Exceedederrors.Shopify API Alignment:
- Support for API version
2025-04which includes new error codes (e.g.,NON_TEST_ORDER_LIMIT_REACHED) and endpoint changes like theorderCreateManualPaymentmutation.- Review any hardcoded API versions or deprecated endpoints in our integration.
Parameter Handling Refinements:
- Simplified syntax for nested objects (e.g., converting
{ country: { code: 'FR' } }to{ code: 'FR' }). Verify that our resource creation calls match the updated expected structure.Deprecations and Breaking Changes:
- Removal of support for deprecated Shopify APIs such as explicit metafield access grants and legacy liquid syntax modifications.
Note: The package change in
components/shopify/package.json(line 18) now specifies:"shopify-api-node": "^3.14.2"Make sure that our code and tests cover all the affected functionality, especially around rate limiting and API version-specific behavior.
13-13:❓ Verification inconclusive
Verify compatibility with @pipedream/platform v3.0.3.
The major version bump (1.x.x → 3.x.x) of @pipedream/platform could introduce breaking changes.
🌐 Web query:
What are the breaking changes in @pipedream/platform v3.0.3 compared to v1.2.0?💡 Result:
The transition from @pipedream/platform v1.2.0 to v3.0.3 introduces several significant breaking changes, primarily driven by architectural shifts in component development and workflow execution:
Component Model Changes
New
defineComponentstructure: Code steps now wrap logic indefineComponent({ ... })instead of direct function parameters[2][3].// Old (v1) async (event, steps) => { ... } // New (v3) defineComponent({ async run({ steps, $ }) { ... } })Props instead of params: Input handling now uses explicitly declared props rather than automatic params generation[3]:
export default defineComponent({ props: { apiKey: { type: "string", label: "API Key" } }, async run({ steps, $ }) { console.log(this.apiKey) } })Execution Environment Changes
- Exit method relocation:
$end()has been replaced with$.flow.exit()[2]- Event access: Trigger events now live at
steps.trigger.eventinstead of directeventparameter[2]- Built-in functions: Special functions like
$respondbecame namespaced under$(e.g.,$.respond)[2]Package Management
- Top-level imports: Now support ES module syntax instead of requiring inline requires[2]:
// Old (v1) async (event) => { const axios = require('axios') } // New (v3) import axios from "axios" defineComponent({...})Authentication Handling
- Managed auth requires explicit app props:
gh: { type: "app", app: "github" }- Credential access changed from
authsobject to component props (this.gh.$auth)[3]Development Workflow
- Local development requirement: Actions can no longer be developed in UI - must use CLI and maintain code in GitHub repos[3]
- Update mechanism: New action versions require explicit workflow updates through UI clicks rather than automatic inheritance[3]
These changes aim to improve type safety, enable better code reuse through components, and provide more explicit control flow[2][3]. Migrating requires rewriting step definitions, updating authentication patterns, and adapting to new component-based architecture[2][3].
Citations:
- 1: https://rubyreferences.github.io/rubychanges/3.3.html
- 2: https://pipedream.com/docs/migrate-from-v1
- 3: https://pipedream.com/docs/components/migrating
- 4: http://www.globalphasing.com/buster/ReleaseNotes/ReleaseNotes-BUSTER_snapshot_20240710.txt
- 5: https://github.com/boltops-tools/pipedream/blob/master/CHANGELOG.md
- 6: https://devcommunity.pipedrive.com/t/frequent-breaking-changes-in-production-api/6691
- 7: https://pipedream.com
- 8: https://chrissainty.com/posts/
- 9: https://www.isric.org/sites/default/files/WOSISprocedureManual_2020nov17web.pdf
- 10: open-webui/open-webui#4791
Action Required: Verify @pipedream/platform v3.0.3 Compatibility
The upgrade from v1.2.0 to v3.0.3 introduces major architectural changes that may affect component behavior. Please ensure the following are addressed:
- Component Structure: The new version requires wrapping logic within
defineComponent({ ... })rather than using direct function parameters.- Input Handling: Automatic parameter passing is replaced with explicitly declared props. Confirm that any code relying on legacy parameter handling is updated accordingly.
- Execution Environment: Notice changes such as replacing
$end()with$.flow.exit(), and accessing trigger events viasteps.trigger.event.- ES Module Imports: Make sure module imports follow ES module syntax as top-level imports.
- Authentication Adjustments: Review modifications in how managed authentication is handled (e.g., changing from
authsobject to component props).Review and verify that your components leveraging @pipedream/platform conform to these changes to prevent any runtime issues.
components/shopify/sources/common/constants.mjs (4)
12-14: LGTM! App-related event topics added.The new app-related event topics align with the PR objectives and follow consistent naming conventions.
80-85: LGTM! Metafield and metaobject event topics added.The new metafield and metaobject event topics follow consistent naming conventions and don't involve protected customer data.
31-32:❓ Verification inconclusive
Verify compliance with protected customer data restrictions.
The following event topics might involve protected customer data:
CUSTOMERS_DELETECUSTOMERS_MERGEPlease confirm these events don't expose sensitive customer information as per Shopify's documentation.
🌐 Web query:
What customer data is exposed in Shopify webhook events for customer deletion and merging?💡 Result:
Shopify's customer deletion and merging processes trigger specific webhooks with varying levels of customer data exposure:
Customer Deletion Webhooks
customers/redact(GDPR Compliance):
Triggers when a merchant manually erases personal data or after Shopify's automated 2-year purge[2][9]. The payload includes:
customer_id(Shopify-assigned ID)shop_id(store identifier)
No personal data (names/addresses) is included since these are anonymized as "Anonymous" during deletion[2][9].
customers/delete:
Sent when a customer profile is manually deleted via Shopify admin. The payload contains:
- Full customer object before deletion, including:
- Name
- Address
- Phone number[6][10]
Customer Merging Webhooks
customers/update:
Triggered when merging duplicate customer profiles via Shopify admin[3][6]. The payload includes:
- Final merged customer record (retained contact info)
- No explicit indication of merged IDs in standard payloads
Note: Merged profiles retain order history but lose redundant personal data from duplicates[3].
Key Distinctions
Action Webhook Personal Data Exposure Use Case Example GDPR Deletion customers/redactNone (IDs only)[2][9][10] Compliance with privacy requests Manual Deletion customers/deleteFull pre-deletion snapshot[6] App cleanup workflows Profile Merge customers/updateFinal merged record only[3][6] Syncing CRM systems For GDPR-compliant deletions via automated purges or manual erasure, apps must rely on stored customer IDs rather than expecting personal data in
customers/redactpayloads[2][9]. Merging operations require apps to infer changes from updated customer records rather than explicit merge notifications[3][6].Citations:
- 1: https://hookdeck.com/webhooks/platforms/getting-started-shopify-webhooks-guide
- 2: https://community.shopify.com/c/shopify-discussions/does-shopify-s-2-year-personal-data-purge-trigger-a-quot/m-p/2545944
- 3: https://help.shopify.com/en/manual/customers/manage-customers
- 4: https://www.accentuate.io/es/blogs/wiki/how-to-use-customer-webhooks-in-shopify-to-enhance-your-e-commerce-app
- 5: https://www.accentuate.io/blogs/wiki/how-to-delete-webhook-on-shopify
- 6: https://bsscommerce.com/shopify/shopify-webhooks/
- 7: https://help.shopify.com/en/manual/fulfillment/setup/notifications/webhooks
- 8: https://community.shopify.com/c/shopify-apis-and-sdks/webhook-not-deleted-after-multiple-failures/td-p/431037
- 9: https://community.shopify.com/c/technical-q-a/what-is-considered-customer-data-for-quot-customers-redact-quot/td-p/2334868
- 10: https://shopify.dev/docs/apps/build/webhooks
Action: Confirm Data Handling Compliance for Customer Deletion and Merge Events
After reviewing Shopify’s documentation, please verify the following:
CUSTOMERS_DELETE ("customers/delete")
This event sends the full pre-deletion customer object (including name, email, address, and phone) when a customer is manually deleted. Ensure that your handling of this event prevents any inadvertent logging or exposure of sensitive customer data.CUSTOMERS_MERGE ("customers/merge")
Note that Shopify typically uses the "customers/update" webhook for merge operations. Confirm that this custom event does not introduce additional personal data exposure and that its usage aligns with your secure data processing requirements.Please review the processing and storage of these webhook payloads to ensure they comply with the appropriate data protection guidelines as outlined by Shopify.
86-88:❓ Verification inconclusive
Verify compliance with protected order data restrictions.
The following event topics might involve protected order data:
ORDERS_DELETEORDERS_RISK_ASSESSMENT_CHANGEDORDERS_SHOPIFY_PROTECT_ELIGIBILITY_CHANGEDPlease confirm these events don't expose sensitive order information.
🌐 Web query:
What order data is exposed in Shopify webhook events for order deletion and risk assessment?💡 Result:
Shopify's webhook system provides specific data for order deletion and risk assessment events:
Order Deletion Webhook
- Triggers when an order is permanently deleted from a store
- Exposes core identifiers and metadata:
- Order ID
- Shop domain reference
- Deletion timestamp[7][10]
- Does not include full order details (items/payment info) since the record is removed[1][7]
- Key header:
X-Shopify-Topic: orders/delete[7]Risk Assessment Webhook
- Triggers on
orders/risk_assessment_changedevents[9]- Contains:
- Risk analysis results (fraud indicators)
- Order financial details (payment methods used)
- Customer verification status[9]
- Risk recommendation (accept/deny transaction)[9]
- Includes both initial risk evaluation and subsequent reassessments[9]
Comparison Table
Feature Order Deletion Webhook Risk Assessment Webhook Trigger Condition Permanent removal of order New/changed fraud evaluation Data Scope Basic identification metadata Detailed risk indicators Recurrence Single event Multiple updates possible Typical Use Case Inventory/record cleanup Fraud prevention systems These events use Shopify's standard webhook format with JSON payloads containing event-specific data fields alongside shop/API metadata[6][7]. For precise field mappings, developers should test with actual webhook implementations as schema details can vary between Shopify API versions[4][6].
Citations:
- 1: https://community.shopify.com/c/technical-q-a/how-to-recognize-removed-item-from-order-in-webhook-payload/m-p/2014173
- 2: https://community.shopify.com/c/shopify-apis-and-sdks/webhook-not-deleted-after-multiple-failures/td-p/431037
- 3: https://ecommerce.folio3.com/blog/shopify-webhook-api-configuration/
- 4: https://shopify.dev/docs/api/admin-rest/2024-07/resources/webhook
- 5: https://www.accentuate.io/blogs/wiki/how-to-delete-webhook-on-shopify
- 6: https://shopify.dev/docs/api/webhooks
- 7: https://blog.adnabu.com/shopify/shopify-webhooks/
- 8: https://community.shopify.com/c/Shopify-APIs-SDKs/delete-webhook/td-p/692270
- 9: https://shopify.dev/docs/api/admin-graphql/2024-10/enums/WebhookSubscriptionTopic
- 10: https://help.shopify.com/en/manual/fulfillment/setup/notifications/webhooks
Subject: Verify Shopify Webhook Data Exposure Compliance
Based on the latest Shopify documentation details:
- ORDERS_DELETE: This event only sends core identifiers (order ID, shop domain, deletion timestamp) and does not expose detailed order content.
- ORDERS_RISK_ASSESSMENT_CHANGED: The webhook provides risk analysis information and financial details necessary for fraud prevention (e.g., risk indicators and payment methods) but does not include comprehensive order details.
- ORDERS_SHOPIFY_PROTECT_ELIGIBILITY_CHANGED: Documentation isn’t as detailed for this event. Please double-check that its payload likewise conforms to protected order data restrictions.
Ensure that the use and handling of data from the risk assessment and protect eligibility events remain compliant with security standards.
variants/in_stockandvariants/out_of_stockalready exist fornew-event-emittedshopify_developer_appaftershopifyupdates are publishedResolves #15691
Summary by CodeRabbit
New Features
Chores