Well sports fans…
The latest I’ve been told is that now they believe the email could have been generated because the koa-shopify-auth library will be updated soon and we will need to update our dependency to use the latest version and that they will be sending out communications when the library is updated. And at that time, we will need to update to the latest version.
However, I’ve communicated to them that this makes me nervous as well because we don’t use the koa-shopify-auth library either. It’s an unnecessary dependency for our workflow as the app was already written with Express and it would be a substantial refactor for us to change that at this point. And it would be redundant to install both…and we are trying to keep the app as lean as possible for the best performance for our users.
With regard to Shopify auth, we are just implementing the OAuth2 flow ourselves to get the access token the first time, storing it, and then decoding the JWT for manually to secure all other requests.
Here’s to hoping that they can give us actual reassurance as to what is causing the problem and that we don’t have anything to worry about!
