This was occurring as part of a rollout of an update to the embedded app sdk, so this is being applied to more and more shops. For now, the safest bet would be to first try computing an hmac like normal (all params) and if that fails, tryng again without the locale and protocol params.
Sorry for the headaches everyone, he team is nearly finished writing the fix and it should be deploying before too long.
For those of us that have implemented the temporary fix, are our apps going to be OK after the Shopify team issue a fix?
This made our day (actually late night for my time zone). Support incidents coming in, then trying to investigate, then applying the temp fix and now wondering whether we need to revert the temp fix in the next few hours.
IMHO, for an incident like this, you should have sent a "heads-up" email to app publishers.