Checkout is becoming the new commerce front door

Shopify had the loudest fortnight in the category. On 30 Oct, it introduced a feature connecting AI shopping agents to merchant checkout and said its Fall ’26 Update would focus on AI and security. On 3 Nov, Shopify CLI 5.0.0 added standardised JSON output and a new app dev command for agentic workflows. That is not just positioning. It is product surface, developer workflow and checkout flow moving in the same direction.

The company also bought shop.com for $99 million, reported on 4 Nov and again on 7 Nov, with the transaction described as a record for domain name sales. On 6 Nov, Shopify mandated IP allowlisting for public apps to protect Admin API access. On the payments side, its 6 Nov changelog said Shopify POS can now accept Cartes Bancaires debit payments in France, with faster staff checkout and five new local payment methods for in-store transactions.

The commercial wrapper shifted at the same time. On 31 Oct, Shopify removed the POS Pro tier, removed “millions of tokens” from Basic and added a “Try 3 days free, then $1/month for 3 months” promotion. On 3 Nov, it removed tier descriptors including “For solo entrepreneurs”, “For small teams”, “For global reach” and “For complex businesses”. On 7 Nov, “Start for free” appeared on the Agentic tier. The message is plain: Shopify is reducing persona language, leaning into entry offers and making agentic commerce legible at the plan level.

The most useful signals this fortnight were not all headline events. Shopify’s sequence matters: pricing copy moved on 31 Oct, plan descriptors changed on 3 Nov, site navigation added “Catalog” and removed “B2B” on 4 Nov, then Agentic gained “Start for free” on 7 Nov. Taken individually, each edit is small. Taken together, they show a company re-cutting the path from discovery to catalogue to checkout.

BigCommerce made a similar packaging move through support. On 4 Nov, Growth, Scale and Performance tier language changed around 24/7 live phone and chat support, express routing, priority support and GMV thresholds. On 6 Nov, 24/7 live phone and chat, with express routing, appeared on Growth, while Scale and Performance gained stronger support language. In a market where migration risk is often operational rather than technical, support is being sold as product.

Shopware’s site also moved in a revealing order. On 31 Oct it added E-Commerce Berlin Expo pages while removing a North America page and omnichannel-related pages. On 2 Nov, it added new product pages for North America, omnichannel commerce resources and its ecosystem. On 5 Nov, navigation added “Omnichannel” and removed “Agentic Commerce”. Yet repositories named agentic-commerce appeared on 2 Nov and again in the 7 Nov set. The public menu and the engineering namespace did not move in lockstep.

Commercetools spent the period reinforcing proof and plumbing. On 7 Nov, it added customer logos for Ace Southern and Aiaiai ApS, and published new case studies for Ace Southern, Adelco, Aiaiai ApS, APG & Co., ARK Bokhandel, Bang & Olufsen, Bausch & Lomb, BIC, Bikes.de and BMW. For an enterprise commerce platform, that is the right kind of surface area: named buyers, sector range and implementation evidence.

The developer trail pointed the same way. On 31 Oct, Commercetools launched repositories including commerce-mcp, visualizer, commercetools-sync-java and training assets. On 1 Nov, @commercetools/commerce-mcp 4.2.2 updated dependencies. On 2 Nov, @commercetools/nimbus 3.8.0 changed DataTable behaviour when duplicate row ids are present. On 5 Nov and 8 Nov, commercetools-sdk-java-v2 20.4.0 included changelog updates and path traversal prevention improvements. Across the same window, new repositories included payment integration templates, Adyen, PayPal and application kits.

BigCommerce’s movement was narrower but coherent. On 3 Nov, it launched product pages for Printlane and Shipwave Channels and published a blog post on setting price combos. Its GitHub additions included stencil-cli on 3 Nov, consul on 4 Nov, script-loader-js on 5 Nov and bigcommerce-for-wordpress on 6 Nov. That is less theatrical than Shopify’s agent push, but it keeps attention on channels, storefront tooling and adjacent ecosystems.

WooCommerce’s fortnight was dominated by security disclosures affecting WooCommerce and related plugins. On 1 Nov, five CVEs published on 6 Oct were observed, including CVE-2026-32557 with a CVSS score of 9.3 for SQL injection and CVE-2026-32568 with a CVSS score of 9.9 for remote code execution. On 2 Nov, six CVEs published on 6 and 7 Oct were observed, including high-severity issues such as unauthenticated broken access control and cross-site scripting. On 4 Nov, CVE-2026-105878, published on 8 Oct, described a missing authorisation issue in the YITH WooCommerce Product Bundles plugin.

The pattern continued. On 5 Nov, three CVEs published on 9 Oct named WooCommerce and covered lack of capability checks and deserialisation of untrusted data. On 6 Nov, six CVEs published on 10 Oct named vulnerabilities in WooCommerce plugins, including CVE-2026-103889, a critical remote code execution issue in the 3D Product configurator plugin. On 7 Nov, six more CVEs published on 10 Oct included CVE-2026-106608 for privilege escalation and CVE-2026-106609 for missing authorisation. On 8 Nov, CVE-2026-40800, with a CVSS score of 9.3, named SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin up to version 1.5.3.

WooCommerce was not static during that period. On 5 Nov, WooCommerce 11.2.2 was released. On 6 Nov, its changelog focused on express checkout, buy now, pay later options for holiday shoppers and AutomateWoo 6.9.1 through 6.9.4 updates including tighter workflow access and confirmed email signups. It also created repositories around fraud protection, PayPal payments, Google Analytics integration, mobile apps and PHP stubs across the fortnight. The issue is not inactivity. It is that the plugin ecosystem creates a larger trust surface than a tightly controlled platform.