@shopify/hydrogen 2026.4.7 → 2026.4.8

package/dist/development/index.cjs

@@ -490,7 +490,7 @@ function getPrivacyBanner() {
 }
 
 // package.json
-var version = "2026.4.7";
+var version = "2026.4.8";
 
 // src/analytics-manager/ShopifyAnalytics.tsx
 function getCustomerPrivacyRequired() {
@@ -1874,7 +1874,7 @@ function generateUUID() {
 }
 
 // src/version.ts
-var LIB_VERSION = "2026.4.7";
+var LIB_VERSION = "2026.4.8";
 
 // src/utils/graphql.ts
 function minifyQuery(string) {
@@ -3558,7 +3558,7 @@ function useOptimisticCart(cart) {
 }
 
 // src/changelogHandler.ts
-var DEFAULT_GITHUB_CHANGELOG_URL = "https://raw.githubusercontent.com/Shopify/hydrogen/main/docs/changelog.json";
+var DEFAULT_GITHUB_CHANGELOG_URL = "https://raw.githubusercontent.com/Shopify/hydrogen/2026-04/docs/changelog.json";
 async function changelogHandler({
   request,
   changelogUrl
@@ -3862,6 +3862,17 @@ function getRedirectUrl(requestUrl) {
     }
   }
 }
+function getSameOriginPath(target, origin) {
+  if (!target) return void 0;
+  try {
+    const url = target.startsWith("/") ? new URL(target, origin) : new URL(target);
+    if (url.origin !== origin) return void 0;
+    const path = `${url.pathname}${url.search}${url.hash}`;
+    return path.startsWith("//") ? void 0 : path;
+  } catch {
+    return void 0;
+  }
+}
 function isLocalPath(requestUrl, redirectUrl) {
   try {
     return new URL(requestUrl).origin === new URL(redirectUrl, requestUrl).origin;
@@ -4200,7 +4211,9 @@ function createCustomerAccountClient({
         codeVerifier: verifier,
         state,
         nonce,
-        redirectPath: getRedirectUrl(request.url) || getHeader(request, "Referer") || defaultRedirectPath
+        redirectPath: getRedirectUrl(request.url) || // The same HTTPS origin the OAuth `redirect_uri` uses, so an http
+        // `request.url` still matches the https pages customers browse.
+        getSameOriginPath(getHeader(request, "Referer"), httpsOrigin) || defaultRedirectPath
       });
       loginUrl.searchParams.append("code_challenge", challenge);
       loginUrl.searchParams.append("code_challenge_method", "S256");