Digivante research, peak season 2026
The vendor freeze gap
Your code freeze protects the code you control. We examined 628 ecommerce vendors to find out who protects the rest.
Salesforce production waves as published for most instances; check yours on Salesforce Trust. Shopify’s Winter ’26 Edition shipped 150+ updates on 10 December 2025.
What we mean by the gap
The vendor freeze gap is the difference between the code a merchant freezes and the code that can still change in their live storefront.
Who freezes, who ships, and who won’t say
Every position below is dated and sourced. Shopify appears twice, and that’s the most instructive finding in the research.
Freezes
5
A published, verifiable vendor-side commitment to hold changes during peak.
- Adyenpayments
- Google Cloudcloud
- Shopify*platform
- PowerReviewsreviews
- Mastercardpayments
Ships into the window
8
A confirmed release, mandatory upgrade or material change inside peak.
- AWScloud
- Salesforceplatform
- Adobe Commerceplatform
- Shopify*platform
- OpenAIAI channel
- FedExcarrier
- UPScarrier
- USPScarrier
None found
10
Searched thoroughly, no public peak change policy. Recorded as a finding, not a gap.
- Stripepayments
- CloudflareCDN
- AkamaiCDN
- Klaviyoemail, SMS
- AttentiveSMS
- Rechargesubscriptions
- Yotporeviews
- Bazaarvoicereviews
- Gorgiasservice
- Quantum Metricanalytics
* Shopify documents a code freeze around Black Friday, then shipped its largest seasonal release on 10 December 2025. “None found” means we searched the vendor’s public documentation, changelog, status pages and help centre in August and September 2026 and found no peak policy. It does not mean none exists, and we’ll correct the record gladly.
Six things the research found
Good vendor discipline exists, which makes its absence a choice
Adyen names the exact days it freezes deployment, from Singles Day through Black Friday, Cyber Monday, Christmas and New Year, and requires senior engineering and operational sign-off for any exception. It also lets merchants pause point-of-sale updates. The standard has been set in public.
The largest cloud providers diverge sharply
Google Cloud says it freezes key services in the two weeks around Black Friday and times that freeze to its retail customers. AWS holds re:Invent, its biggest launch event of the year, from 30 November to 4 December 2026. It opens on Cyber Monday.
Mandatory upgrades land weeks before peak
Salesforce’s Winter ’27 release reaches most production instances on 3 and 10 October. It can’t be declined or delayed, and one enforced change removes the OAuth username-password flow, which quietly stops integrations that still depend on it.
The best freeze in its category didn’t cover the season
Shopify cuts deployments from around forty a day to critical fixes only for Black Friday. Its Winter ’26 Edition, with more than 150 updates, then launched on 10 December 2025, seven weeks earlier than the late-January slot Editions used to occupy.
The app layer is almost entirely silent
We found no public peak policy from Klaviyo, Attentive, Recharge, Yotpo, Bazaarvoice or Gorgias, all of which run auto-updating code in the storefront. PowerReviews, Bazaarvoice’s direct competitor, has published dated freeze windows two years running and says in advance what will pause.
The biggest concentration risk changed during peak, twice
Around 99.3% of Shopify storefronts sit behind Cloudflare. Its 18 November 2025 outage, which Cloudflare’s own report attributes to a bug in a Bot Management feature file, hit stores days before Black Friday. A shorter outage followed on 5 December. No merchant freeze reaches that layer.
Where your stack can change without you
We assessed where each vendor’s code actually runs. In 404 of 628 cases, it sits in the shopper’s live path: a script, a hosted API, an auto-updating app or an edge configuration.
Categories at the top of the chart are the ones to question first. Client-side scripts, meaning tag managers, consent banners, personalisation, experiments and review widgets, are the quiet cluster. They update themselves, run before the page renders, and rarely throw an error when they go wrong. They just move a conversion rate.
Exposure is our structural assessment of where a vendor’s code runs, not a claim about any named vendor’s behaviour.
The Shopify paradox
Around the Black Friday weekend, Shopify runs the most disciplined freeze we found at the platform layer: a documented feature freeze and code freeze, with deployments cut from roughly forty a day to critical fixes only.
Then its Winter ’26 Edition launched on 10 December 2025, with more than 150 updates, including Agentic Storefronts, which make products discoverable and purchasable inside ChatGPT, Copilot and Perplexity. Winter Editions used to arrive in late January. Winter ’24 went live on 31 January 2024.
And a freeze isn’t immunity. On Cyber Monday 2025, Shopify merchants reported trouble with admin logins and point-of-sale checkouts until later that day.
Freezing the Black Friday weekend isn’t the same as freezing the season. December is a second risk window, not a recovery period.
What a good vendor peak policy looks like
The five published policies add up to a practical standard any vendor in your live path could meet. Use it as the bar when you ask them.
- Named dates
- The freeze window is stated in dates, not “around the holidays”.Adyen, PowerReviews
- A named exception process
- What counts as an emergency, and who signs it off.Adyen
- A customer-timed window
- The freeze follows the customer’s risk period and moves when it moves.Google Cloud
- A merchant opt-out
- You can pause automatic updates for your own account.Adyen
- Disclosed degradation
- What stops working during the freeze is stated in advance.PowerReviews
- Public and dated
- Published openly and refreshed each season, not buried in a contract.PowerReviews
The 2026 collision calendar
Every confirmed vendor date across the run-up, set against the typical merchant freeze. Status as at 21 September 2026.
- Adobe Commerce monthly security patchPassed
- FedEx first demand surcharges take effectConfirmed
- Salesforce Winter ’27 production wave, mandatoryConfirmed
- Salesforce Winter ’27 production wave, mandatoryConfirmed
- Typical merchant code freeze beginsNorm
- FedEx main package surcharges beginConfirmed
- FedEx maximum surcharge windowConfirmed
- Black Friday
- Cyber Monday
- AWS re:Invent 2026, opening on Cyber MondayConfirmed
- OpenAI December launch run, based on the 2024 precedentWatch
- Shopify Winter Edition, based on 10 December 2025Watch
- Freezes lift and the backlog ships, into the returns peakNorm
- FedEx and USPS peak pricing endsConfirmed
Close the gap from your side
None of this depends on vendors changing their behaviour. Work through it in order, starting this week.
-
Inventory what can change without you
Every vendor with code, scripts, hosted APIs or configuration in a revenue path, including everything loaded through your tag manager. The list will be longer than you expect.
-
Pin every version you can
Payment API versions, SDKs, runtimes, and model versions on any AI in a customer-facing path. Accept no upgrades after September. Vendors that can’t be pinned go to the top of your monitoring list.
-
Ask in writing before October
Send critical vendors the ten-question peak questionnaire in the report. An answer gives you something to plan against. A non-answer tells you something too.
-
Verify your critical journeys on real devices
The freeze assumes a known-good starting point, so establish one across the devices, browsers, payment methods and markets your customers use. If you’re on Salesforce, do it after your October upgrade weekend, not before.
-
Capture October baselines
Authorisation rate, fraud declines, bot challenges, search conversion, consent and tag firing, Core Web Vitals, send revenue. Vendor changes rarely throw errors. They move a rate by a few points.
-
Alert on rates, and be ready to re-verify fast
When a vendor change lands mid-freeze, you need to re-check the affected journeys within hours, without breaking your own freeze to do it.
-
Plan past Cyber Monday
Give December its own watch list, and stage the January thaw so the backlog doesn’t all ship into the returns peak at once.
Keep testing through the freeze
Freezes usually pause testing too, on the reasonable assumption that nothing is changing. This research says otherwise. Your storefront keeps changing all season, just not because of you.
Automated suites check your code against a known environment. Vendor changes alter the environment itself, in production, with no pull request to trigger a test run. The failures they cause are the ones automation handles worst: a review widget pushing the basket button off-screen on one browser, a consent change silencing analytics, a bot rule that starts challenging real customers on mobile.
Catching those takes real people completing real journeys on real devices, at short notice, whenever a vendor change lands.
We should declare an interest here: Digivante sells real-user testing. The recommendation stands whoever does the testing for you.
Get the full report
Vendor-by-vendor findings with sources, the risk model, the full 2026 calendar, and three working appendices you can use this season: a vendor questionnaire, a baseline checklist and a week-by-week plan.
- 01The ritual and its blind spot
- 02How we did this
- 03The findings at a glance
- 04The vendors that freeze
- 05The vendors that ship into the window
- 06The Shopify paradox
- 07The silence
- 08Where the risk concentrates
- 09The 2026 collision calendar
- 10The case against freezing
- 11The peak readiness playbook
- 12What we still need
- A–DQuestionnaire, baselines, weekly plan, sources
Questions ecommerce teams ask
Which ecommerce vendors have a code freeze policy for Black Friday?
As of September 2026, we verified published vendor-side peak freezes from five vendors: Adyen, Google Cloud, Shopify, PowerReviews and Mastercard’s Merchant Cloud. Adyen’s is the most complete, naming specific days and an exception process. Shopify’s covers the Black Friday period but not December.
Does Stripe freeze code during Black Friday?
We found no public Stripe peak change policy when we searched in August and September 2026. Stripe publishes detailed peak guidance for merchants, and merchants can pin their Stripe API version, which is the most useful mitigation available.
Does Shopify freeze code for Black Friday?
Yes. Shopify documents a feature freeze and a code freeze around Black Friday and Cyber Monday, cutting deployments to critical fixes only. But its Winter ’26 Edition, with more than 150 updates, launched on 10 December 2025, inside the Christmas trading window.
Can a vendor change my site during my code freeze?
Yes. Of 628 ecommerce vendors we mapped, 404 have code, scripts, hosted APIs or configuration in the shopper’s live path, so they can change what customers see without you deploying anything. Your freeze only covers your own code.
When does Salesforce Winter ’27 reach production?
Salesforce’s published production upgrade weekends for Winter ’27 are 29 August, 3 October and 10 October 2026, with the October waves covering most instances. The upgrade is automatic and can’t be declined or delayed. Check your instance’s date on Salesforce Trust.
When is AWS re:Invent 2026?
AWS re:Invent 2026 runs from 30 November to 4 December 2026 in Las Vegas. Cyber Monday 2026 is 30 November, so AWS’s biggest launch week of the year opens on the same day.
What is the vendor freeze gap?
The vendor freeze gap is the difference between the code a merchant freezes and the code that can still change in their live storefront. It covers every third party whose releases reach your customers regardless of your own freeze.
How do I protect my store from vendor changes during peak?
Inventory the vendors that can change a revenue path, pin every version you can, ask critical vendors in writing what they’ll ship between mid-October and early January, capture October baselines for conversion-critical rates, and re-verify your key journeys on real devices whenever a vendor change lands.
How we did this, and how to correct us
Method
We mapped 628 vendors across 23 stack categories, assessed where each one’s code runs, and prioritised 125 whose changes can reach checkout. For each, we searched the vendor’s own documentation, changelog, status pages and help centre for a peak change policy, and checked for dated releases, mandatory upgrades and events inside the peak window. Every finding carries a source and the date it was checked. Full sources are in the report.
If you work at a vendor named here
We’d rather publish your policy than your silence. If you have a peak change policy and we missed it, send it to enquiries@digivante.com and we’ll update the record and say we got it wrong.
If you’re an engineer with a story
A vendor change that broke something during your freeze, or a vendor that handled peak well, is exactly the evidence this research needs. Contributions can be anonymised.
This page reflects publicly available information at the dates stated. “None found” indicates that no public policy was located, not that none exists. Vendor names are the property of their respective owners and no endorsement is implied. © 2026 Digivante Limited.
