@pack/hydrogen Changelog

Release notes for every published version of @pack/hydrogen. For usage, see the @pack/hydrogen reference.

5.0.0

Released October 29, 2026

Major Changes

Breaking: A/B tests that change different fields now serve together, even on the same query. Two site-settings tests that change different settings, or two tests changing different sections of one page, can both reach a visitor and both apply in one response, up to three per query. Tests that change the same field still split visitors, and personalizations behave as in 4.x.

Deploy the CMS first: the rules query now reads each variant's overriddenFields. Against a CMS without it the query fails and no test is served at all.

Upgrade between tests, not during one: a visitor split between two tests today can be assigned both after the upgrade. Existing assignments are kept. See Upgrading to 5.0.

A query serving two or more variants sends X-Pack-Test-Variant-Ids and X-Pack-Published-At in place of the single-test headers. Both are part of the query cache key.

Adds externalTestAssignments to createPackClient, for storefronts that assign tests themselves (with Amplitude, for instance). Pass every assignment for the request, by test id or handle and variant id or handle. Pack serves each on the queries it changes, stacking tests that change different fields. Passing the option turns off Pack's own assignment for the request, and pack.abTests lists the tests served. A test URL parameter still takes precedence.

4.2.0

Released October 26, 2026

Minor Changes

Offer an A/B exposure again when it didn't complete on the request that assigned the test (consent came later, the visitor left first, the impression wasn't seen). It's offered on later requests that match the test's targeting, until __pack_exposed records it or 24 hours after assignment. Only assignments made from this version are owed, so nothing assigned earlier is reported again.

Patch Changes

pack.query()'s options argument is now optional in its type, matching the implementation, so pack.query(QUERY) type-checks.
Document that testExposureCallback must not check consent itself: gate on hasUserConsent, or return false when an exposure isn't sent.
Write the __pack cookie only when the request changed it, plus once a day to renew its expiry. A response that rewrote an unchanged session could land after /pack/consent and erase the visitor id it had just minted, so a visitor who accepted the banner could get two ids seconds apart. A session with nothing in it is no longer written, and one emptied by a consent withdrawal removes the cookie.

Side effects: a declined visitor with no preview flags who has never been drawn for a test no longer has a persistent Pack cookie, so the visitor_recency condition classifies them as new once the 30-minute __pack_s marker lapses. PackSession.commit() on an empty session now returns an expiring cookie instead of an empty one.

4.1.0

Released October 16, 2026

Minor Changes

PackTestProvider's testExposureCallback can return false to say an exposure was not sent; Pack then leaves it out of __pack_exposed. Passing hasUserConsent={undefined} now holds exposures until the theme passes a boolean, instead of falling back to the server's consent. Omitting the prop still uses the server's consent. An explicit undefined held exposures in 3.x too; in development, Pack now warns when exposures stay held this way.

4.0.0

Released October 6, 2026

Major Changes

Breaking: a visitor is now assigned to every A/B test they're eligible for, instead of one chosen at random, and tests apply per query, so a site-settings test and a page test can both serve on one page. Two tests that change the same content never serve together; which one a visitor gets is fixed per visitor.

Upgrade between tests, not during one: on a store running two or more tests, upgrading changes who is in each test. Existing assignments are kept.

If your theme calls useAbTest() or useAbTestVariantHandle() without an argument, pass the test's handle, e.g. useAbTest('homepage-hero'). Adds useAbTests() and a dependency on graphql. See Upgrading to @pack/hydrogen 4.0.

Minor Changes

A visitor's variant is now derived from their visitor id and the test, so it's the same wherever it's evaluated. Traffic percentages apply to visitors: a 10% variant reaches 10% of visitors, where each page view used to draw again. Targeting is also evaluated in the browser, and a rule that can't be evaluated excludes only its own test. Removes json-rules-engine.
Serves personalizations: one variant shown to everyone in an audience, using the same cached rules feed as A/B tests. A personalization wins over an A/B test that changes the same content. Audiences that check whether the visitor is signed in need getCustomerContext on createPackClient. It receives { request } and returns { isLoggedIn }; without it, those audiences are refused.
Honors visitor consent. PackProvider forwards the Shopify privacy banner's answer to a new /pack/consent endpoint, which sets __pack_user_consent from the server. Without analytics consent, the Pack visitor id is no longer persisted. For other consent tools, call setPackConsent() from @pack/react, or pass getConsent to PackSession.init. Visitors who haven't answered are treated as consenting by default (unknownConsent changes that). PackTestProvider now defaults hasUserConsent to the visitor's analytics consent, so themes that never passed it start reporting exposures. usePackCookies() is deprecated.

Patch Changes

Keeps the visitor's test id when a personalization's result depends on it (a holdout, or traffic below 100%), so each visitor stays in the same group. Personalizations shown to their whole audience behave as before.
The Pack session id is now a standard random UUID (crypto.randomUUID()). It was generated with Math.random() on the server and wasn't a valid UUID. Existing ids are kept.

3.3.1

Released September 9, 2026

Patch Changes

Fix the geo_region audience signal on Oxygen. buildIdentityBundle read the visitor's region from oxygen-buyer-province, which Oxygen does not set — the correct header is oxygen-buyer-region-code. On Oxygen the region was therefore always undefined, and because geo conditions fail closed on a missing code, any audience using "Region / state" silently matched nobody. Country was unaffected. Oxygen's other region header, oxygen-buyer-region, is deliberately not used: it carries the display name ("California") rather than the ISO 3166-2 code the Cloudflare and Vercel headers send, so reading it would make one audience behave differently per host.

3.3.0

Released August 12, 2026

Minor Changes

Add SSR audience resolution: buildIdentityBundle (request headers + cookies + optional Shopify customer), a pluggable condition-evaluator registry, and resolveRulesTree to evaluate an audience rules tree (AND/OR/NOT + typed condition leaves) against an identity bundle. Wired into test assignment — testsByRulesV2 now fetches each running test's pinned audience rules and gates eligibility on them at SSR via applyAudienceGating, so a visitor only enters a test whose audience they match. Fails closed on resolver errors.
Add the builtin audience condition evaluator: a single condition type dispatched by key to a library of curated signals over the identity bundle. v1 set: auth_status (Shopify customer session), device (User-Agent), visitor_recency (new vs. returning), geo_country / geo_region (CDN geo, equals/in_list/not_in_list), referrer_source (paid/organic/social/direct/email/referral from utm_medium + Referer host), and utm_param (a specific UTM param, case-insensitive). Unknown keys and unrecognized values fail closed. Mirrors backpack's built-in library.

visitor_recency is session-aware. It introduces a short-lived __pack_s session cookie (30-minute rolling) alongside the existing __pack cookie, carrying the new/returning verdict ("r"/"n") decided once when a session starts. The evaluator trusts that verdict while the marker is present — so a long or returning session's later page views stay stable — and decides from prior-visit cookies only on a session's first request. referrer_source treats a same-site referrer as direct (not referral) and classifies a present-but-unrecognized utm_medium or utm_source (e.g. sms/push/a custom source) as referral; direct is reserved for no medium, no source, and no referrer.
Add the cookie audience condition evaluator: matches a cookie by name + operator (exists / equals / contains / regex / …) over the identity bundle's cookie jar, evaluated at SSR with no I/O. Adds hasConsent to the identity bundle (binary __pack_user_consent signal) so consent-sensitive conditions can fail closed. Mirrors backpack's cookie condition; part of "SDK Release A" (cookie + built-in conditions).

Patch Changes

Keep the storefront preview bar within mobile viewports, show preview link or content release context when provided, and use a shorter accessible Exit preview action.

3.2.8

Released July 21, 2026

Patch Changes

Forward the selected content release as an X-Pack-Release-Id header and persist it in the preview session, so release content renders consistently while navigating the storefront in the customizer instead of intermittently falling back to live content.
Updated dependencies
- @pack/client@1.0.4

3.2.7

Released June 19, 2026

Patch Changes

Remove the deprecated Pack error tracking integration from the Hydrogen and React SDK packages.

3.2.6

Released June 16, 2026

Patch Changes

Stop re-rolling a user's A/B test variant when their session expires by time. An existing, still-eligible assignment is now preserved (validated against current rules and refreshed in place); only a paused/removed test or a removed variant triggers a new assignment. Previously a returning user whose session passed the 4h expiry was re-bucketed by a fresh Math.random(), flipping their variant and corrupting test results by counting the same user under multiple variants.

3.2.5

Released June 2, 2026

Patch Changes

Expose the selected preview/customizer A/B test through pack.abTest (and getPackContextData().packAbTest) so code-driven storefront variants render the previewed variant in the customizer and preview links, matching the live site. Previously preview mode returned an isPreview sentinel and only the variant's CMS content resolved, leaving code-driven variants on the control.

3.2.4

Released May 20, 2026

Patch Changes

Prevent preview mode and explicitly forced A/B test requests from automatically resolving or storing a natural test assignment before Pack request headers are set.

3.2.3

Released May 5, 2026

Patch Changes

Prevent route prefetch requests from assigning A/B tests before the visitor navigates to the targeted route.

3.2.2

Released March 30, 2026

Patch Changes

Fix stale preview context leaking between local storefront sessions

3.2.1

Released March 17, 2026

Patch Changes

Track control impressions for tests that use the ON_ELEMENT_VIEW trigger.

3.2.0

Released February 21, 2026

Minor Changes

Add Pack error tracking packages and integrate them into the Hydrogen and React SDKs.
- Introduce @pack/errors for shared DSN parsing, sanitization, fingerprinting, and server error event helpers.
- Introduce @pack/errors-react for browser error capture (uncaught, unhandledrejection) and React error boundary reporting.
- Wire @pack/hydrogen to send server events for thrown errors and 5xx response fallbacks.
- Wire @pack/react to include the new React error tracking integration.

Patch Changes

Updated dependencies
- @pack/errors@0.1.1

3.1.1

Released February 18, 2026

Patch Changes

Track test activations for experiments that use the on_view impression trigger.

3.1.0

Released February 11, 2026

Minor Changes

Bump @shopify/hydrogen peer dependency from ^2025.7.2 to ^2026.1.0

Upgrades to support Shopify Hydrogen 2026.1.0. Pack's API usage (CacheCustom, createWithCache, getStorefrontHeaders) remains compatible with no breaking changes to Pack's public API.

Beta tested on live storefronts with no issues.

Patch Changes

Updated dependencies
- @pack/packlytics@2.1.0

3.0.0

Released February 9, 2026

Major Changes

Upgrade to Shopify Hydrogen 2025.7.x

Breaking Changes:
- @pack/hydrogen: Upgraded to @shopify/hydrogen ^2025.7.2 which requires React Router 7. New peer dependencies: react-router ^7.12.0, @shopify/hydrogen ^2025.7.2. Removed peer dependencies: @remix-run/server-runtime, @shopify/remix-oxygen. Node engine bumped to >=20.0.0.
- @pack/packlytics: Updated to support @shopify/hydrogen ^2025.7.2. New required peer dependency: @shopify/hydrogen ^2025.7.2. Node engine bumped to >=20.0.0.
- @pack/react: Major version bump to align with ecosystem upgrade.

Patch Changes

Updated dependencies
- @pack/packlytics@2.0.0

2.1.1

Released February 6, 2026

Patch Changes

Upgrade cookie@0.7.0 in @pack/hydrogen due to vulnerability detected in version

2.1.0

Released November 10, 2025

Minor Changes

Add i18n option to createPackClient.

Patch Changes

Add preview context support with locale and draft parameters.
Updated dependencies
- @pack/client@1.0.3

2.0.6

Released September 16, 2025

Patch Changes

Add backwards compatibility for preview mode detection in <PackTestRoute />.

2.0.5

Released September 10, 2025

Patch Changes

No longer fire test exposure in preview mode so page data is not revalidated (especially in the Pack Customizer).

2.0.4

Released September 4, 2025

Patch Changes

Remove env var for test-cache-check.

2.0.3

Released September 4, 2025

Patch Changes

Fix: Use production test-cache-check URL when NODE_ENV is set to development.

2.0.2

Released September 3, 2025

Patch Changes

Workaround to support Remix bug (https://github.com/remix-run/remix/issues/10263).

2.0.1

Released September 2, 2025

Patch Changes

Optimize A/B test service usage.

2.0.0

Released August 25, 2025

Major Changes

Add comprehensive A/B testing support to Pack.
Integrate comprehensive Pack A/B testing features.

1.0.9

Released July 14, 2025

Patch Changes

Bump patch so deprecated beta is not latest version on npm.

1.0.8

Released February 19, 2025

Patch Changes

Add errors code
Updated dependencies
- @pack/client@1.0.2

1.0.7

Released February 19, 2025

Patch Changes

Fix destroy session

1.0.6

Released November 14, 2024

Patch Changes

Fix import package

1.0.5

Released August 22, 2024

Patch Changes

Remove errant console.log.

1.0.4

Released August 16, 2024

Patch Changes

Fix issues where (1) local development is not using content environment and (2) the Customizer is not initializing to the content environment.

1.0.3

Released August 12, 2024

Patch Changes

Move Packlytics trigger to the front
Updated dependencies
- @pack/packlytics@1.0.1

1.0.2

Released July 26, 2024

Patch Changes

Pass client name when creating pack client

1.0.1

Released June 20, 2024

Patch Changes

Adds call to cache check service before Pack queries to generate cache key

1.0.0

Released May 28, 2024

Major Changes

Pack analytics

Patch Changes

Updated dependencies
- @pack/client@1.0.0
- @pack/packlytics@1.0.0

0.1.2

Released March 21, 2024

Patch Changes

Add default theme data support

The Pack client now supports default theme data, allowing the storefront to function with default content when no token is provided. This enables developers to run and preview their storefronts locally without needing to set up a Pack account.