@shopify/hydrogen 2026.4.6 → 2026.4.8

package/dist/development/index.cjs

@@ -490,7 +490,7 @@ function getPrivacyBanner() {
 }
 
 // package.json
-var version = "2026.4.6";
+var version = "2026.4.8";
 
 // src/analytics-manager/ShopifyAnalytics.tsx
 function getCustomerPrivacyRequired() {
@@ -992,6 +992,8 @@ function register(key) {
     }
   };
 }
+var noopPublish = () => {
+};
 function messageOnError(field, envVar) {
   return `[h2:error:Analytics.Provider] - ${field} is required. Make sure ${envVar} is defined in your environment variables. See https://h2o.fyi/analytics/consent to learn how to setup environment variables in the Shopify admin.`;
 }
@@ -1006,11 +1008,25 @@ function AnalyticsProvider({
   const { shop } = useShopAnalytics(shopProp);
   const [consentVersion, setConsentVersion] = react.useState(0);
   const [privacyReady, setPrivacyReady] = react.useState(false);
-  const [carts, setCarts] = react.useState({ cart: null, prevCart: null });
+  const [carts, setCartsState] = react.useState({ cart: null, prevCart: null });
+  const setCarts = react.useCallback(
+    (update) => react.startTransition(() => setCartsState(update)),
+    []
+  );
   const canTrack = customCanTrack ?? hasAnalyticsConsent;
+  const canTrackRef = react.useRef(canTrack);
+  canTrackRef.current = canTrack;
+  const guardedPublish = react.useCallback(
+    (event, payload) => {
+      if (canTrackRef.current()) publish(event, payload);
+    },
+    []
+  );
   const onConsentChange = react.useCallback(() => {
-    setPrivacyReady(true);
-    setConsentVersion((version2) => version2 + 1);
+    react.startTransition(() => {
+      setPrivacyReady(true);
+      setConsentVersion((version2) => version2 + 1);
+    });
   }, []);
   if (!!shop) {
     if (/\/68817551382$/.test(shop.shopId)) {
@@ -1048,8 +1064,7 @@ function AnalyticsProvider({
       canTrack,
       ...carts,
       customData,
-      publish: canTrack() ? publish : () => {
-      },
+      publish: canTrack() ? guardedPublish : noopPublish,
       shop,
       subscribe,
       register,
@@ -1062,7 +1077,7 @@ function AnalyticsProvider({
     carts,
     carts.cart?.updatedAt,
     carts.prevCart,
-    publish,
+    guardedPublish,
     subscribe,
     customData,
     shop,
@@ -1091,7 +1106,9 @@ function useAnalytics() {
 function useShopAnalytics(shopProp) {
   const [shop, setShop] = react.useState(null);
   react.useEffect(() => {
-    Promise.resolve(shopProp).then(setShop);
+    Promise.resolve(shopProp).then((resolvedShop) => {
+      react.startTransition(() => setShop(resolvedShop));
+    });
     return () => {
     };
   }, [setShop, shopProp]);
@@ -1857,7 +1874,7 @@ function generateUUID() {
 }
 
 // src/version.ts
-var LIB_VERSION = "2026.4.6";
+var LIB_VERSION = "2026.4.8";
 
 // src/utils/graphql.ts
 function minifyQuery(string) {
@@ -3541,7 +3558,7 @@ function useOptimisticCart(cart) {
 }
 
 // src/changelogHandler.ts
-var DEFAULT_GITHUB_CHANGELOG_URL = "https://raw.githubusercontent.com/Shopify/hydrogen/main/docs/changelog.json";
+var DEFAULT_GITHUB_CHANGELOG_URL = "https://raw.githubusercontent.com/Shopify/hydrogen/2026-04/docs/changelog.json";
 async function changelogHandler({
   request,
   changelogUrl
@@ -3845,6 +3862,17 @@ function getRedirectUrl(requestUrl) {
     }
   }
 }
+function getSameOriginPath(target, origin) {
+  if (!target) return void 0;
+  try {
+    const url = target.startsWith("/") ? new URL(target, origin) : new URL(target);
+    if (url.origin !== origin) return void 0;
+    const path = `${url.pathname}${url.search}${url.hash}`;
+    return path.startsWith("//") ? void 0 : path;
+  } catch {
+    return void 0;
+  }
+}
 function isLocalPath(requestUrl, redirectUrl) {
   try {
     return new URL(requestUrl).origin === new URL(redirectUrl, requestUrl).origin;
@@ -4183,7 +4211,9 @@ function createCustomerAccountClient({
         codeVerifier: verifier,
         state,
         nonce,
-        redirectPath: getRedirectUrl(request.url) || getHeader(request, "Referer") || defaultRedirectPath
+        redirectPath: getRedirectUrl(request.url) || // The same HTTPS origin the OAuth `redirect_uri` uses, so an http
+        // `request.url` still matches the https pages customers browse.
+        getSameOriginPath(getHeader(request, "Referer"), httpsOrigin) || defaultRedirectPath
       });
       loginUrl.searchParams.append("code_challenge", challenge);
       loginUrl.searchParams.append("code_challenge_method", "S256");