fix(source-shopify): upgrade Shopify API version from 2025-10 to 2026-07

[devin-ai-integration]

What

source-shopify is pinned to Shopify Admin API version 2025-10, which Shopify publishes as accessible only until October 16, 2026 15:00 UTC (supported versions table). After that date Shopify silently falls forward to the oldest accessible stable version, so behavior would drift unversioned rather than hard-fail.

This moves the connector to 2026-07, the newest released stable version (accessible until July 16, 2027). 2026-10 is deliberately not targeted — it does not release until October 1, 2026.

Same shape as the previous bump, #75255 (2025-01 → 2025-10).

Related to https://github.com/airbytehq/oncall/issues/11712:

• https://github.com/airbytehq/oncall/issues/11712

How

ShopifyStream.api_version is a single class attribute that is interpolated into both the REST base URL (/admin/api/{api_version}/) and the GraphQL/bulk graphql.json URL, so the functional change is one line. The rest is test fixture URLs, the version bump, and the changelog.

Review guide

1. source_shopify/streams/base_streams.py — the actual version pin.
2. unit_tests/test_api_version.py — new test; asserts the pinned version is threaded through the real URL-building code paths (REST url_base and the bulk job manager's graphql.json URL), so a future bump that misses one surface fails.
3. unit_tests/test_limit_reducing_error_handler.py, unit_tests/integration/test_bulk_stream.py, unit_tests/test_discount_codes_sync.py — mock-server URLs.
4. metadata.yaml, pyproject.toml, docs/integrations/sources/shopify.md — 3.5.1 → 3.5.2.

Breaking-change evaluation

Not breaking: no schema, spec, PK/cursor, stream, or state changes. Patch bump. The connector has enableProgressiveRollout: false, so no -rc.N suffix.

Behavioral surface between 2025-10 and 2026-07 that I checked against Shopify's docs (all subsequently confirmed empirically by the regression runs below):

• bulkOperationRunQuery.groupObjects default flipped to false in 2026-01 (changelog); confirmed on the 2026-07 mutation reference (Default:false). The connector already passes groupObjects: true explicitly in ShopifyBulkTemplates.prepare, so this is a no-op — but that explicit true is now load-bearing and must not be removed. An existing unit test asserts it is present.
• ProductVariant.taxCode is deprecated but still queryable on 2026-07 (verified in the 2026-07 ProductVariant reference). Left as-is; no schema change.
• New Collection model in 2026-07 (changelog) — documented as non-breaking; legacy members stay queryable. The connector's Collection bulk query does not select ruleSet at all, so no schema impact. See User Impact.
• Invalid metafield queries now error in the Admin GraphQL API — the connector's bulk queries filter only on updated_at and never filter on metafields (metafields are selected, not queried against), so this does not apply.
• REST Admin API is legacy but still served for 2026-07 (/admin/api/2026-07/… resource docs resolve). Many streams still use REST; a REST→GraphQL migration is explicitly out of scope here.

User Impact

No user action required, no schema or config changes.

Two behaviors worth flagging:

• collections.sort_order is corrected. On 2025-10 the bulk collections stream reported a collection whose true sort order is most-relevant as BEST_SELLING, because MOST_RELEVANT did not exist in the 2025-10 GraphQL enum and was coerced. On 2026-07 it reports MOST_RELEVANT, matching what the REST custom_collections stream already returned. The field is typed ["null", "string"] with no enum, so nothing breaks — the old value was simply wrong. Observed directly in the regression run; worth a line in release comms.
• collections may return more rows. Shopify filters collections using new collection-model features out of collections queries on pre-2026-07 API versions, so shops using those features may see additional records — new rows, not changed ones. Not observed in validation (the test shop does not use those features), so this one remains untested.

Test Coverage

Added unit_tests/test_api_version.py (fails on the old pin). Full connector unit suite: 270 passed.

Live validation was subsequently run against the prerelease 3.5.2-preview.b71c9db: two regression runs in comparison mode over all 48 streams, control 3.5.1 (2025-10) vs. this build (2026-07). SPEC/CHECK/DISCOVER/READ all pass on both sides, the discovered catalog is byte-identical, and READ emits 1658 records with a delta of 0 on every emitting stream. Debug-level request logging confirms every REST endpoint and the bulk graphql.json URL actually moved to /admin/api/2026-07/, ruling out silent fall-forward — which is the part unit tests cannot cover. The only behavioral difference found is the collections.sort_order correction described above. Full evidence: #83335 (comment)

Caveat: the integration-test shop is small (1658 records, 4 collections) and does not exercise new-collection-model features, so scale-dependent and new-collection-model behavior is untested.

Can this PR be safely reverted and rolled back?

• YES 💚
• NO ❌

Link to Devin session: https://app.devin.ai/sessions/00d2fd487dd542fb99460bfd9da0c1ef

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

• 🛠️ Quick Fixes
  • /format-fix - Fixes most formatting issues.
  • /bump-version - Bumps connector versions, scraping changelog description from the PR title.
    • Bump types: patch (default), minor, major, major_rc, rc, promote.
    • The rc type is a smart default: applies minor_rc if stable, or bumps the RC number if already RC.
    • The promote type strips the RC suffix to finalize a release.
    • Example: /bump-version type=rc or /bump-version type=minor
  • /bump-progressive-rollout-version - Alias for /bump-version type=rc. Bumps with an RC suffix and enables progressive rollout.
• ❇️ AI Testing and Review (internal link: AI-SDLC Docs):
  • /ai-prove-fix - Runs prerelease readiness checks, including testing against customer connections.
  • /ai-canary-prerelease - Rolls out prerelease to 5-10 connections for canary testing.
  • /ai-review - AI-powered PR review for connector safety and quality gates.
• 📝 AI Documentation:
  • /ai-docs-review - AI-powered documentation review for PRs with connector changes.
  • /ai-create-docs-pr - Creates a documentation PR for connector changes, stacked on the current PR.
• 🚀 Connector Releases:
  • /publish-connectors-prerelease - Publishes pre-release connector builds (tagged as {version}-preview.{git-sha}) for all modified connectors in the PR.
  • /enable-autopilot-rollouts - Enables autopilot progressive rollouts for the modified connector(s) in the PR, remediating "autopilot rollouts not enabled for {connector-name}" auto-merge blockers. Sets defaultRolloutMode: autopilot and enableProgressiveRollout: true, preserving any existing autopilotConfig.
    • Optional args: connector=<CONNECTOR_NAME> (defaults to the modified connectors in the PR), strategy=fast|slow|default (defaults to fast).
    • Example: /enable-autopilot-rollouts or /enable-autopilot-rollouts connector=source-faker strategy=slow
• ☕️ JVM connectors:
  • /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
    Example: /update-connector-cdk-version connector=destination-bigquery
• 🐍 Python connectors:
  • /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
  • /poe source example lock - Alias for /poe connector source-example lock.
  • /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
  • /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.
• ⚙️ Admin commands:
  • /force-merge reason="<REASON>" - Force merges the PR using admin privileges, bypassing CI checks. Requires a reason.
    Example: /force-merge reason="CI is flaky, tests pass locally"

📚 Show Repo Guidance

Helpful Resources

• Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
• Developing Connectors Locally
• Managing Connector Secrets
• On-Demand Regression Tests
• #connector-ci-issues
• #connector-publish-updates
• #connector-build-statuses

📝 Edit this welcome message.

[github-actions]

Note

Autopilot progressive rollouts are not enabled for the following modified connector(s):

• source-shopify

This is a courtesy heads-up only — it does not block merge or fail any check.
To enable automatic progressive rollouts for the connector(s) above, comment
/enable-autopilot-rollouts on this PR. This sets defaultRolloutMode: autopilot
and enableProgressiveRollout: true in each connector's metadata.yaml,
preserving any existing autopilotConfig.

[github-actions]

Deploy preview for airbyte-docs ready!

Project:	airbyte-docs
Status:	✅  Deploy successful!
Preview URL:	https://airbyte-docs-4fd8r7fuk-airbyte-growth.vercel.app
Latest Commit:	b71c9db

Deployed with vercel-action

[github-actions]

source-shopify Connector Test Results

285 tests   275 ✅  2m 0s ⏱️
  2 suites   10 💤
  2 files      0 ❌

Results for commit b71c9db.

♻️ This comment has been updated with latest results.

[Airbyte Support Bot (airbyte-support-bot)]

↪️ Triggering /ai-prove-fix per Hands-Free AI Triage Project triage next step.

Reason: Draft /ai-fix PR with green CI and no prove-fix run on record; validating the Shopify API version upgrade against live connections is the next pipeline gate.

• https://github.com/airbytehq/oncall/issues/11712

Devin session

[octavia-bot]

🔍 AI Prove Fix session starting... Running readiness checks and testing against customer connections. View playbook

• 🔗 Session URL: https://app.devin.ai/sessions/b9e4e3803d344737b79460c37cf88ef3

✅ Devin AI session created successfully!

[Airbyte Support Bot (airbyte-support-bot)]

🧪 Fix Validation Evidence

🟢 Outcome: Fix Proven

Two independent regression-test runs (comparison mode, all 48 streams, Airbyte integration-test shop) put 3.5.1/2025-10 side by side with this PR's build on 2026-07. SPEC/CHECK/DISCOVER/READ all ✅ on both sides: the discovered catalog is byte-identical, and READ emits 1658 records with a delta of 0 on every one of the 45 emitting streams. Debug-level request logging confirms the pin genuinely reaches the wire — every REST endpoint and the bulk graphql.json URL moved to /admin/api/2026-07/, with matching per-endpoint call counts and no endpoint appearing on only one side. That rules out Shopify's silent fall-forward, which is exactly what unit tests cannot do.

One real behavioral difference, and it is an improvement: on 2025-10 the bulk collections stream misreported one collection's sort_order as BEST_SELLING while the REST custom_collections stream reported the true value most-relevant — MOST_RELEVANT does not exist in the 2025-10 GraphQL enum, so it was coerced. On 2026-07 the two surfaces agree. sort_order is typed ["null", "string"] with no enum, so nothing breaks; the previous value was simply wrong.

🚦 Next Steps

1. This PR appears ready for review and merge. It is currently in draft — mark it ready when you're satisfied with the evidence.
2. The test shop is small (1658 records, 4 collections) and does not use 2026-07's new-collection-model features, so scale-dependent and new-collection-model behavior is untested. Consider /ai-canary-prerelease on 3.5.2-preview.b71c9db before general release.
3. Worth a line in release comms: shops with a most-relevant collection sort order will see collections.sort_order change from the incorrect BEST_SELLING to MOST_RELEVANT.
4. The daily_hands_free_triage automation will monitor the release rollout after merge.

---

📋 Connector & PR Details

Connector: source-shopify
PR: #83335 (commit b71c9db)
Pre-release Version Tested: 3.5.2-preview.b71c9db — publish workflow
Comparison Baseline: latest (auto) = 3.5.1. No override_control_image: the latest published version is the pre-bump version, so control-vs-target is exactly 2025-10 vs 2026-07.
Regression runs: run 1 — all streams · run 2 — all streams + debug logs
Detailed Results: https://github.com/airbytehq/oncall/issues/11712#issuecomment-5178875698

📝 Evidence Plan

This is a proactive version bump ahead of Shopify's Oct 16, 2026 sunset, not a fix for an active customer symptom. Shopify's fall-forward policy means an expired pin degrades silently rather than hard-failing, so there is no "before" error to make disappear. The evidence goal was therefore equivalence + no regression while demonstrably exercising 2026-07.

Proving Criteria

1. CHECK succeeds on the target — 2026-07 accepted on both REST and GraphQL surfaces.
2. DISCOVER identical between control and target — no silent schema drift across four API-version steps.
3. READ equivalent — no stream erroring on target that succeeds on control, and no record-count decrease on any stream.
4. Artifacts confirm the target actually issued requests against /admin/api/2026-07/… and the bulk graphql.json on 2026-07, rather than falling forward.

Disproving Criteria

Target CHECK/DISCOVER failing where control succeeds · any DISCOVER schema delta · any stream with fewer records on target · new error messages absent from control · deprecated fields the connector still selects (e.g. ProductVariant.taxCode) failing to resolve.

Cases Attempted

• Run 1 — GSM integration test secrets, all 48 streams, comparison mode. All four verbs ✅, zero record deltas, catalogs byte-identical. Criteria 1–3 met. Criterion 4 unverifiable: request URLs are not logged at INFO.
• Run 2 — same, with enable_debug_logs=True to surface request URLs. Criterion 4 met; all run-1 results reproduced identically, confirming the collections.sort_order difference is deterministic rather than run-to-run noise.

No customer connection was pinned or synced. Escalation to a customer connection_id was not needed: the change is a global URL-version pin affecting every stream on every config, not gated on customer-specific auth, sync mode, data volume, or field values, so GSM credentials exercise it exactly as a customer connection would. source-shopify uses no refresh_token_updater / SingleUseRefreshTokenOauth2Authenticator, so it is not on the forced-OAuth-write-back list that mandates live testing.

✅ Pre-flight Checks

• Viability — One functional line (ShopifyStream.api_version), which is interpolated into both the REST url_base and the bulk graphql.json URL. Remainder is a new guard test, mock-server URL fixtures, the version bump, and the changelog.
• Safety — No obfuscation, no new network destinations, no credential-handling changes; allowedHosts unchanged.
• Breaking Change — Not breaking. Verified against the diff, not just PR metadata: no schema, spec, PK/cursor, stream, or state changes; no new required config; patch bump. The observed collections.sort_order value change is a corrected value within an unconstrained ["null", "string"] field, not a type or schema change.
• Pin Exclusion — N/A. Regression tests run in an isolated sandbox and pin nothing; no set_cloud_connector_version_override call was made.
• Reversibility — Rolling back to 3.5.1 restores the 2025-10 pin. No state or config format change, so the prior version reads anything this version writes.

📊 Detailed Evidence Log

Protocol comparison (identical in both runs)

Verb	Control 3.5.1	Target (PR)	Result
SPEC	0 ✅	0 ✅	identical message counts
CHECK	0 ✅ SUCCEEDED	0 ✅ SUCCEEDED	identical
DISCOVER	0 ✅	0 ✅	catalog JSON byte-identical, 48 streams
READ	0 ✅	0 ✅	1658 records both sides, delta 0 on all 45 emitting streams; STATE 93/93, TRACE 141/141

DISCOVER equality was verified by deserializing and comparing both catalog.jsonl artifacts, not by reading the summary table.

Criterion 4 — request URLs (run 2, debug logs)

Endpoint	Control (2025-10)	Target (2026-07)
graphql.json (bulk + GraphQL)	270	268
orders	32	32
events	24	24
articles	16	16
pages / blogs	14 / 14	14 / 14
smart_collections	8	8
shopify_payments, shop, collects	4 each	4 each
tender_transactions, price_rules, metafields, locations, draft_orders, customers, custom_collections, checkouts	2 each	2 each

Every URL moved; none appears on one side only. The graphql.json 270 vs 268 gap is two fewer bulk-job status polls on the target (a bulk operation completed one poll interval sooner); bulk poll-loop log counts are 84 on both sides. It accounts for the LOG delta of −2 and has no record impact.

Non-differences ruled out

• products.online_store_preview_url differs on 5 of 478 records, but only inside the _bt signed-preview token, whose embedded exp timestamp reflects the few minutes between the control and target invocations. Per-request nonce, unrelated to API version.
• All other 44 streams: record payloads compared field-by-field after sorting — identical.
• ProductVariant.taxCode (deprecated on 2026-07): product_variants returned 928 identical records, so the deprecated selection still resolves.
• bulkOperationRunQuery.groupObjects default flip to false in 2026-01: no record-count or payload change on any bulk stream, confirming the connector's explicit groupObjects: true still takes effect. That explicit true is now required — removing it would silently change bulk output shape.
• Invalid-metafield-query errors on 2026-07: all 13 metafield_* streams returned identical counts with no errors.
• New Collection model: collections returned 4 records on both sides, so this shop does not use new-collection-model features. The record increase flagged in the PR's User Impact section was not observed and remains untested.

Full log, including the per-stream record-count table and the collections.sort_order analysis, is in the linked private issue.

---

Devin session

[github-actions]

Pre-release Connector Publish Started

Publishing pre-release build for connector source-shopify.
PR: #83335

Pre-release versions will be tagged as {version}-preview.b71c9db
and are available for version pinning via the scoped_configuration API.

View workflow run
❌ Pre-release Publish FAILED for source-shopify.

[Airbyte Support Bot (airbyte-support-bot)]

↪️ Triggering /ai-review per Hands-Free AI Triage Project triage next step.

Reason: /ai-prove-fix returned 🟢 Fix Proven on the current HEAD (two comparison regression runs across all 48 streams), so I marked the PR ready for review; an AI review is the next pipeline gate.

Devin session

[octavia-bot]

AI PR Review starting...

Reviewing PR for connector safety and quality.
View playbook

• 🔗 Session URL: https://app.devin.ai/sessions/44a04e11d5a649928ca68443ad26a73f

✅ Devin AI session created successfully!

[Airbyte Support Bot (airbyte-support-bot)]

🛡️ AI PR Review Report

🟢 Review Action: APPROVED

All 12 gates passed.

🔶 Risk Level: 3/5

One-line API version pin that shifts every REST and bulk request to a new Shopify Admin API version; blast radius covers all 48 streams, but two comparison regression runs show a byte-identical catalog and a record delta of 0.

---

📋 PR Details

Connector(s): source-shopify
PR: #83335
HEAD SHA: b71c9db7d5f31d3794d9c2c5dcd1968a7057c1bf
Session: https://app.devin.ai/sessions/44a04e11d5a649928ca68443ad26a73f

🔍 Gate Evaluation Details

Gate-by-Gate Analysis

Gate	Status	Enforced?	Details
PR Hygiene	PASS	Yes	Detailed description (~5.5k chars of real content), changelog row added for 3.5.2 in docs/integrations/sources/shopify.md, no unresolved human review comments.
Code Hygiene	PASS	WARNING	Source change (source_shopify/streams/base_streams.py) is accompanied by test changes in 4 unit-test files.
Test Coverage	PASS	Yes	fix in title triggers the gate; new unit_tests/test_api_version.py adds two assertions on the pinned version reaching both the REST url_base and the bulk graphql.json URL.
Code Security	PASS	Yes	No changed path matches auth/oauth/token/credential/secret patterns; metadata.yaml diff hunk only touches dockerImageTag (no allowedHosts / connectorBuildOptions / dockerRepository change).
Per-Record Performance	PASS	WARNING	No record-processing code touched; the only functional line is a class attribute string.
Breaking Dependencies	PASS	WARNING	pyproject.toml diff is the connector's own version (3.5.1 → 3.5.2); no dependency versions changed.
Backwards Compatibility	PASS	Yes (enforced)	No spec, schemas/*.json, stream, primary-key, cursor, or type/format changes in the diff. Regression comparison confirms the discovered catalog is byte-identical between 3.5.1 (2025-10) and this build (2026-07). Patch bump is appropriate.
Forwards Compatibility	PASS	Warning (elevates Risk Level)	No state, cursor, partition-router, pagination, or transformation code changed. page_info/limit occurrences appear only inside mock-server URL strings in unit tests. Rollback is a one-line revert; PR marks revert-safe.
Behavioral Changes	PASS	Warning (elevates Risk Level)	The functional hunk is a single api_version string; no rate-limit, retry, backoff, timeout, or error-handler code changed. limit=250/page_info matches are test fixture URLs only. The known upstream behavior delta (collections.sort_order now MOST_RELEVANT instead of the coerced BEST_SELLING) is documented in the PR's User Impact section.
Out-of-Scope Changes	PASS	Skip	All changes are under airbyte-integrations/connectors/source-shopify/** and docs/integrations/sources/shopify.md.
CI Checks	PASS	Yes	All core checks green on HEAD: Test source-shopify Connector, Lint source-shopify Connector, Build and Verify Artifacts (source-shopify), Format Check, Check Changelog Updated, Connector CI Checks Summary. 37 passed, 0 failed, 0 pending.
Live / E2E Tests	PASS	Yes	Validation is required (bug fix + API request-handling change). /ai-prove-fix posted 🟢 Fix Proven on this HEAD (comment 5178437266): two comparison regression runs over all 48 streams, SPEC/CHECK/DISCOVER/READ green on both sides, 1658 records with delta 0, and debug request logging confirming /admin/api/2026-07/ on the wire.

Notes on the diff

• Functional change: api_version = "2025-10" → "2026-07" in source_shopify/streams/base_streams.py (interpolated into both the REST url_base and the bulk graphql.json URL).
• Test fixture URLs in test_bulk_stream.py and test_discount_codes_sync.py were switched to interpolate ShopifyStream.api_version rather than hard-coding, so they no longer drift on the next bump; test_limit_reducing_error_handler.py still hard-codes the version.
• The pre-release publish failure noted in comment 5178464133 is a pre-release check and is excluded from the CI Checks gate; /ai-prove-fix subsequently validated against 3.5.2-preview.b71c9db.

📚 Evidence Consulted

Evidence

• Changed files: 8 (metadata.yaml, pyproject.toml, source_shopify/streams/base_streams.py, 4 unit-test files, docs/integrations/sources/shopify.md)
• CI checks: 37 passed, 0 failed, 0 pending, 13 skipped on b71c9db
• PR labels: connectors/source/shopify, hyd-fix, hyd-prove, hyd-review
• PR description: present (detailed What / How / Review guide / Breaking-change evaluation / User Impact / Test Coverage)
• Existing bot reviews: none for this HEAD SHA
• /ai-prove-fix conclusion: 🟢 Fix Proven — fix(source-shopify): upgrade Shopify API version from 2025-10 to 2026-07 #83335 (comment)

[Airbyte Support Bot (airbyte-support-bot)]

↪️ Triggering /ai-ready per Hands-Free AI Triage Project triage next step.

Reason: /ai-review returned APPROVE for the exact current HEAD b71c9db7 on top of a 🟢 Fix Proven backed by two comparison regression runs, CI is green, and the branch is not conflicted.

Devin session

[octavia-bot-hoard]

Auto-merge evaluation: FAIL

Preconditions (all must pass)

Status	Check	Reasoning
✅	No Breaking Changes	Patch version bump 3.5.1 -> 3.5.2 with no spec, schema, primary key, cursor, stream, or state changes. The only functional change is the pinned Shopify Admin API version string in ShopifyStream.api_version. No metadata.yaml breakingChanges entry, no migration guide, no removed/renamed public APIs or config options. Two comparison regression runs across all 48 streams show a byte-identical catalog and zero record delta; the AI review's backwards/forwards compatibility gates both PASS.
✅	Ai Review Passed	Comment id 5179557151 by airbyte-support-bot contains the marker '', matching the current HEAD, with all 12 gates PASS.
✅	Airbyte Support Bot Assigned	Airbyte Support Bot assignment confirms automated merge eligibility.
✅	No Destination Changes	No destination-related changes detected.

Change scope (at least one must pass)

❌ No matching change scope detected.

Devin session | Workflow run

[Airbyte Support Bot (airbyte-support-bot)]

🙋 Escalated to #human-in-the-loop per Hands-Free AI Triage Project triage next step.

Reason: /ai-ready returned FAIL with every precondition passing — no breaking changes, AI review APPROVE matching the exact current HEAD, Airbyte Support Bot assigned, no destination changes. The single failure is No matching change scope detected, so the auto-merge scope classifier does not recognise this change shape. This is the fourth PR today blocked on that same check, alongside #82773, so it reads as an auto-merge scope-rule gap rather than a problem with the PR. A human needs to merge directly, or the scope rules need widening.

Devin session