Unofficial Tracker

Every change to Shopify's App Bridge, tracked automatically.

No changelog, no versioning — just a minified app-bridge.js shipped to CDN and a prayer. We reverse-engineer every build so you don't have to.

Get notified How it works

Changelog

16 entries

6d27951e

Fixes case-sensitive link target handling and URL path normalization, and makes the shopifyQL API always available with lazy resolution.

  • The shopifyQL module now always exposes api.shopifyQL as a lazy proxy with an available() check, instead of only setting it after confirming backend support.
  • Link and window.open target attributes like _blank or _self are now normalized case-insensitively, fixing save-bar interception for links with mixed-case target values.
  • Fixed URL path normalization in parseUrl to collapse multiple leading slashes instead of just prepending one.
Files 12
+39 -36
9 modified
6d9a048d

Minor bootstrap update adds safe-area padding to Polaris modal dialogs on devices with bottom insets.

  • The injected safe-area stylesheet in _bootstrap.js now adds a rule targeting .Polaris-Modal-Dialog__Modal.
  • Modal dialogs get bottom padding equal to the shopify-safe-area-inset-bottom variable so content is not obscured by device insets like home indicators.
  • No modules were added or removed, and no public API methods changed in this build.
Files 2
+4 -4
ccda5568

Telemetry now reports element attributes and Polaris version; cleanup listener switched from beforeunload to pagehide.

  • The telemetry module now includes the custom element's attribute names in its ui-component telemetry payload.
  • Telemetry increment calls now attach the Polaris design system version when globalThis.polaris.version is available.
  • The internal utilities module now cleans up navigation listeners on the pagehide event instead of beforeunload.
Files 3
+14 -9
1 modified
cd7d0f3d

MobileBridgeNext safe area insets now inject styles via Constructable Stylesheets instead of a style element.

  • MobileBridgeNext now injects safe area inset styles using the Constructable Stylesheets API and document.adoptedStyleSheets instead of appending a style element to document.head.
  • Safe area inset style injection now includes feature detection and exits gracefully if CSSStyleSheet or adoptedStyleSheets APIs are unavailable.
  • The function for intercepting native browser APIs was renamed from restoreProperty to interceptProperty, affecting the fetch, print, share, window.open, and history modules.
Files 7
+54 -39
4 modified
c3591477

Navigation handler sets navigationVersion 2 on the shopify global and adds a history.pushState fallback for unresolved link navigations.

  • The navigation system now sets Symbol.for('navigationVersion') to 2 on the global shopify object at initialization, advertising the active navigation protocol version.
  • When home-link click simulation cannot process a URL, a new fallback uses history.pushState and dispatches a popstate event to complete the navigation instead of calling the App Bridge navigate API.
  • When navigating via a home link, the target URL is now derived from the home link element's href attribute rather than the original destination URL.
Files 2
+29 -13
ef8b61d3

The title-bar module adds groupType support to secondary action button groups.

  • The title-bar module now accepts a groupType property on secondary action button groups.
  • groupType is destructured from button group objects alongside label, icon, disabled, and buttons fields.
  • When groupType is provided on a button group, it is forwarded to the title bar protocol.
Files 2
+7 -4
1 modified
6bb9c034

Navigation utilities updated to support s-app-nav elements and fix home link detection via getAttribute fallback.

  • The qt selector function now includes s-app-nav as a navigation container, matching ui-nav-menu support for click interception.
  • App Bridge will now intercept and handle client-side navigation for clickable elements inside s-app-nav components.
  • Home link detection in the navigation handler now uses getAttribute('rel') as a fallback when the rel property is nullish, fixing routing for custom elements.
Files 2
+5 -4
fd311eae

Added idToken timeout and error hardening, sidekick conversation stream events, and title bar button pressed state.

  • The id-token module now enforces a 60-second timeout when requesting session tokens from the host, rejecting with a clear error if the host does not respond in time.
  • The id-token module now validates that retrieved tokens are non-empty strings, throwing an idToken unavailable error for missing or invalid tokens.
  • The fetch module now handles idToken failures gracefully, logging an error and skipping the Authorization header instead of propagating the exception.
Files 21
+107 -71
18 modified
af2eb2f3

The fetch interceptor removes extensionOriginFetch support, simplifying all intercepted requests to use native fetch.

  • The fetch module removes the extensionOriginFetch code path, which previously allowed extension-origin requests to be routed through a custom fetch implementation from internalApiPromise.
  • Helper utilities for serializing Request objects to plain objects and reconstructing Responses from ArrayBuffers were removed from the utilities module alongside extensionOriginFetch.
  • The session token retry logic in the fetch interceptor is simplified, with both the initial request and the auth-header retry now always using native self.fetch directly.
Files 17
+64 -118
14 modified
5fe14787

Intents module gains a reactive request signal and response now only exists when an intent is active.

  • The intents module now exposes api.intents.request as a reactive signal that tracks the current active intent value.
  • The api.intents.response property is now a getter returning undefined when no intent is active, instead of always being defined.
  • Intent request state is kept synchronized with the internal API via subscription and unsubscribed automatically on page unload.
Files 14
+126 -177
10 modified
b3f8e93d

Internal refactoring of private field utilities with a minor defensive hasOwnProperty improvement.

  • The private field access guard in _utilities.js was updated to use {}.hasOwnProperty.call instead of Object.prototype.hasOwnProperty.call, making it more resilient to prototype pollution.
  • Internal private field helpers were renamed and reorganized in _utilities.js: the counter variable and key-creation and field-check functions swapped names.
  • _bootstrap.js was updated to call the renamed private field helpers privateKeyCounter and checkPrivateField consistently.
Files 3
+18 -18
e35faefd

Several modules broadened protocol support from Shopify-only to all protocols, with minor error tracking improvements.

  • toast.show and toast.hide switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS, enabling them to work across all protocol environments.
  • sidekick.registerToolHandler and sidekick.registerContextCallback switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS.
  • tools.register, tools.unregister, and tools.clear switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS.
Files 20
+66 -67
16 modified
07f68577

Added mobile safe area inset support via a CSS custom property when the MobileBridgeNext flag is enabled.

  • Bootstrap now injects a --shopify-safe-area-inset-bottom CSS custom property initialized to 0px when the MobileBridgeNext feature flag is active.
  • The safe area inset bottom value is automatically subscribed to from the host and kept in sync as a CSS variable on the root element.
  • A body::after pseudo-element is added to reserve physical space at the bottom of the page equal to the safe area inset height.
Files 6
+43 -30
3 modified
d934d47f

The fetch module gained extensionOriginFetch support, and several modules narrowed their protocol scope to Shopify-only contexts.

  • The fetch module now supports an extensionOriginFetch handler that routes requests through a custom fetch implementation when available, affecting both initial and retry-on-session requests.
  • The toast module's show and hide methods now only activate in Shopify protocol contexts, replacing the previous all-protocols behavior.
  • The tools module's register, unregister, and clear methods now scope exclusively to Shopify protocols.
Files 24
+140 -188
20 modified
cdc43ba6

This build introduces first-class support for app intents — apps can now read structured intent data from the URL, respond to intents with ok/error/closed outcomes, and detect intent context via `environment.intent`. Two new modules (`analytics` and `tools`) were added, and the title bar gains support for `<s-button-group>` elements.

  • Two new modules registered: `analytics.js` and `tools.js`
  • `intents` module: new `api.data.intent` property that parses and exposes structured intent payload (`type`, `action`, `data`) from the URL's `intent` query parameter
  • `intents` module: new `api.intents.response` object with `ok()`, `error()`, and `closed()` methods for sending a response back to the intent caller (only exposed when an intent is present)
Files 26
+825 -709
21 modified
55c89da0

Initial baseline capture of Shopify's App Bridge CDN bundle. This is the first tracked build — all 38 modules and 4 infrastructure files have been deminified and catalogued.

  • Captured 34 feature modules including navigation, fetch, save-bar, toast, resource-picker, and POS
  • Identified 4 infrastructure files: bootstrap, utilities, remote-ui (RPC), and web-vitals
  • Bundle size: 88.5 KB minified, expanding to ~167 KB deminified across 38 files
+33 new