From b101be57ed14b22befb0cf3f105b23ba685e9c47 Mon Sep 17 00:00:00 2001
From: Raphael Fakhri <153192858+RaphaelFakhri@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:58:41 +0000
Subject: [PATCH] Report CdnPreconnect for cdn.shopify.com without a path

---
 .changeset/cdn-preconnect-bare-origin.md      |  5 +++++
 .../src/checks/cdn-preconnect/index.spec.ts   | 20 +++++++++++++++++++
 .../src/checks/cdn-preconnect/index.ts        |  5 ++++-
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/cdn-preconnect-bare-origin.md

diff --git a/.changeset/cdn-preconnect-bare-origin.md b/.changeset/cdn-preconnect-bare-origin.md
new file mode 100644
index 000000000..f6b0fd9b4
--- /dev/null
+++ b/.changeset/cdn-preconnect-bare-origin.md
@@ -0,0 +1,5 @@
+---
+'@shopify/theme-check-common': patch
+---
+
+Report `CdnPreconnect` for `href="https://cdn.shopify.com"` and `href="//cdn.shopify.com"` without a trailing path, and stop reporting hosts that only contain `cdn.shopify.com` in their path.
diff --git a/packages/theme-check-common/src/checks/cdn-preconnect/index.spec.ts b/packages/theme-check-common/src/checks/cdn-preconnect/index.spec.ts
index 2832b4cdb..94b095f04 100644
--- a/packages/theme-check-common/src/checks/cdn-preconnect/index.spec.ts
+++ b/packages/theme-check-common/src/checks/cdn-preconnect/index.spec.ts
@@ -27,6 +27,26 @@ describe('Module: CdnPreconnect', () => {
     );
   });
 
+  it('should report preconnect to cdn.shopify.com without a trailing slash', async () => {
+    const sourceCode = `
+      <link rel="preconnect" href="https://cdn.shopify.com" crossorigin>
+      <link rel="preconnect" href="//cdn.shopify.com">
+    `;
+
+    const offenses = await runLiquidCheck(CdnPreconnect, sourceCode);
+    expect(offenses).to.have.length(2);
+  });
+
+  it('should not report preconnect to other hosts', async () => {
+    const sourceCode = `
+      <link rel="preconnect" href="https://fonts.shopifycdn.com" crossorigin>
+      <link rel="preconnect" href="https://example.com/cdn.shopify.com.html">
+    `;
+
+    const offenses = await runLiquidCheck(CdnPreconnect, sourceCode);
+    expect(offenses).to.have.length(0);
+  });
+
   it('should not report other link types', async () => {
     const sourceCode = `
       <link rel="preload" href="https://example.com/foo.css" as="style"/>
diff --git a/packages/theme-check-common/src/checks/cdn-preconnect/index.ts b/packages/theme-check-common/src/checks/cdn-preconnect/index.ts
index 3165fc9f1..a336c429e 100644
--- a/packages/theme-check-common/src/checks/cdn-preconnect/index.ts
+++ b/packages/theme-check-common/src/checks/cdn-preconnect/index.ts
@@ -29,7 +29,10 @@ export const CdnPreconnect: LiquidCheckDefinition = {
 
       const isShopifyCdn = node.attributes
         .filter(isValuedHtmlAttribute)
-        .some((attr) => isAttr(attr, 'href') && valueIncludes(attr, '.+cdn.shopify.com.+'));
+        .some(
+          (attr) =>
+            isAttr(attr, 'href') && valueIncludes(attr, '(https?:)?//cdn\\.shopify\\.com(/\\S*)?'),
+        );
 
       if (!isShopifyCdn) return;