@shopify/hydrogen 2026.4.7 → 2026.4.8

package/dist/vite/chunk-IHK6YKEW.js

@@ -0,0 +1,80 @@
+// src/vite/dev-tooling-guard.ts
+var TUNNEL_HOST_SUFFIXES = [".trycloudflare.com", ".tryhydrogen.dev"];
+var DEV_TOOL_ROUTES = [
+  "/graphiql",
+  "/subrequest-profiler",
+  "/debug-network-server"
+];
+var LOOPBACK_V4_PREFIX = "127.";
+var LOOPBACK_V6 = "::1";
+var MAPPED_LOOPBACK_PREFIX = "::ffff:127.";
+function isLoopback(addr) {
+  if (!addr) return false;
+  return addr.startsWith(LOOPBACK_V4_PREFIX) || addr === LOOPBACK_V6 || addr.startsWith(MAPPED_LOOPBACK_PREFIX);
+}
+function hostFromHeader(raw) {
+  if (!raw) return "";
+  if (raw.startsWith("[")) {
+    const bracketEnd = raw.indexOf("]");
+    if (bracketEnd !== -1) return raw.slice(1, bracketEnd);
+  }
+  const colonIdx = raw.lastIndexOf(":");
+  return colonIdx > 0 ? raw.slice(0, colonIdx) : raw;
+}
+function isTunnelHost(hostname) {
+  const lower = hostname.toLowerCase().replace(/\.$/, "");
+  return TUNNEL_HOST_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+}
+function isDevToolRoute(pathname) {
+  const path = pathname.toLowerCase();
+  for (const route of DEV_TOOL_ROUTES) {
+    if (!path.startsWith(route)) continue;
+    const border = path[route.length];
+    if (border === void 0 || border === "/" || border === ".") return true;
+  }
+  return false;
+}
+function isRemoteDevToolingRequest(params) {
+  if (!isDevToolRoute(params.pathname)) return false;
+  if (isTunnelHost(hostFromHeader(params.host))) return true;
+  return !isLoopback(params.remoteAddress);
+}
+function createDevToolingGuard() {
+  return (req, res, next) => {
+    const raw = req.url ?? "";
+    if (raw !== "" && !raw.startsWith("/") && !raw.startsWith("?")) {
+      res.writeHead(400, { "Content-Type": "text/plain" });
+      res.end("Bad Request");
+      return;
+    }
+    const rawPath = raw.split("?")[0] ?? "";
+    let resolvedPath;
+    try {
+      const canonical = new URL(raw || "/", "http://n").pathname;
+      try {
+        resolvedPath = decodeURIComponent(canonical);
+      } catch {
+        resolvedPath = canonical;
+      }
+    } catch {
+      res.writeHead(400, { "Content-Type": "text/plain" });
+      res.end("Bad Request");
+      return;
+    }
+    const check = {
+      host: req.headers.host,
+      remoteAddress: req.socket?.remoteAddress
+    };
+    if (isRemoteDevToolingRequest({ pathname: rawPath, ...check }) || isRemoteDevToolingRequest({ pathname: resolvedPath, ...check })) {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Hydrogen dev tooling is only available from localhost.");
+      return;
+    }
+    next();
+  };
+}
+
+export {
+  isRemoteDevToolingRequest,
+  createDevToolingGuard
+};

package/dist/vite/dev-tooling-guard.d.ts

@@ -0,0 +1,10 @@
+import { Connect } from 'vite';
+
+declare function isRemoteDevToolingRequest(params: {
+    pathname: string;
+    host: string | undefined;
+    remoteAddress: string | undefined;
+}): boolean;
+declare function createDevToolingGuard(): Connect.NextHandleFunction;
+
+export { createDevToolingGuard, isRemoteDevToolingRequest };

package/dist/vite/dev-tooling-guard.js

@@ -0,0 +1,8 @@
+import {
+  createDevToolingGuard,
+  isRemoteDevToolingRequest
+} from "./chunk-IHK6YKEW.js";
+export {
+  createDevToolingGuard,
+  isRemoteDevToolingRequest
+};

package/dist/vite/plugin.js

@@ -1,6 +1,9 @@
 import {
   getCompatDate
 } from "./chunk-FAQ7TVHC.js";
+import {
+  createDevToolingGuard
+} from "./chunk-IHK6YKEW.js";
 import {
   setupHydrogenMiddleware
 } from "./chunk-QXBQVDMY.js";
@@ -149,6 +152,7 @@ function hydrogen(pluginOptions = {}) {
       configureServer: {
         order: "pre",
         handler: (viteDevServer) => {
+          viteDevServer.middlewares.use(createDevToolingGuard());
           return () => {
             setupHydrogenMiddleware(
               viteDevServer,

package/package.json

@@ -5,7 +5,7 @@
     "@shopify:registry": "https://registry.npmjs.org"
   },
   "type": "module",
-  "version": "2026.4.7",
+  "version": "2026.4.8",
   "license": "MIT",
   "main": "dist/index.cjs",
   "module": "dist/production/index.js",
@@ -80,7 +80,7 @@
     "use-resize-observer": "^9.1.0",
     "worktop": "^0.7.3",
     "@shopify/graphql-client": "1.4.1",
-    "@shopify/hydrogen-react": "2026.4.4"
+    "@shopify/hydrogen-react": "2026.4.5"
   },
   "devDependencies": {
     "react-router": "7.16.0",