The CLI's versioning scheme moves to SemVer, and the CLI now upgrades itself automatically.--force and legacy commands are removed, so CI/CD now --allow-updates/--allow-deletes for its workflow.
--force Removals and new flags--force removal (→ --allow-updates / --allow-deletes) )—three changes in total.
New features = minor, bug fixes = patch, breaking changes = major. The version number tells you whether the next update will break things.
The CLI updates itself through the package manager used to install it. CI, project-local installs, and major versions are excluded.
--force removalDeprecated because it couldn't distinguish high-risk operations (including deletions) from low-risk ones.--allow-updates / --allow-deletes to choose the level of granularity.
Respecting the package manager used to install it, the CLI updates itself through that same mechanism.
shopify config autoupgrade off lets you stop it. CI / project-local / major updates are excluded from the start.
--force Removal and a new flag| Item | Up to 3.x | Shopify CLI 4.0 |
|---|---|---|
| Unattended deploy | --force One shot (no granularity) |
Removed |
| Adding/updating extensions | --force is included (low risk) |
--allow-updates |
| Deleting extensions | --force is included (high risk) |
--allow-deletes |
| How easily accidents happen | No distinction → unintended deletions could occur | Nothing is deleted unless you explicitly state "allow deletion" |
--force removes the feature itself. If you hard-code --force in CI/CD, update it right away --allow-updates(plus, if needed, --allow-deletes) is what you need to rewrite it to.| Removed | Replacement | Target |
|---|---|---|
shopify app deploy --forceshopify app release --force |
--allow-updates / --allow-deletes |
app |
shopify webhook trigger |
shopify app webhook trigger |
app |
shopify theme serve |
shopify theme dev |
theme |
shopify app generate schema |
shopify app function schema |
app / function |
shopify app webhook trigger --shared-secret |
--client-secret |
app |
shopify app generate extension --type |
--template |
app |
--force — remove all of themAcross the entire repository, --force grep for it. Remove it unconditionally from deploy/release commands.
--allow-updatesThis is enough for flows that only add new extensions or only update existing extension code.
--allow-deletesAdd this only if you want to let CI tidy up extensions. It's safer not to apply it to production branches.
like 5.0 Only when a major update is releaseddo you need to watch for breaking changes to command structure or behavior. minor/patch updates can generally be accepted as-is.
The CLI version in CI is pinned. You can end up in a state where only local developers upgrade ahead, so you need to manage the CI-side version separately.
In CI/CD, as a rule, use only --allow-updates , and--allow-deletes should be limited to maintenance jobs or staging to prevent accidents.
theme serve / webhook trigger / generate schema / --type / --shared-secret tends to remain in internal wikis, Makefiles, and GitHub Actions YAML. Flush them out with a bulk grep.
shopify config autoupgrade off lets you turn off auto-updatesIn environments with strict version alignment (e.g., agency work where you want to lock the Shopify CLI version across multiple clients), the practical solution is to turn auto-upgrade OFF even on developer machines and distribute that via dotfiles.
shopify app deploy --force is hardcoded, and in the past a branch-cleanup mistake caused extensions to be deleted all at once.--force → --allow-updates as the replacement. Move any logic that permits deletion into a separate, manually-approved job, and there alone attach --allow-deletes .theme serve/webhook trigger/generate schema --type , etc.), so bumping to 4.0 may break CI.shopify config autoupgrade off , and pin the version per project via its package.json . Approach B: CI is excluded from auto-updates to begin with, so explicitly install a fixed version in CI.--force deprecation .--allow-updates / --allow-deletes , and once you clear out the 6 old commands, the migration is complete.