packages/unhead/test/unit/plugins/validate.test.ts (1)

951-963: Test comment is technically inaccurate.

The comment states preconnects with and without crossorigin are "logically duplicates," but they establish different connection pools (non-CORS vs CORS). Both may be intentionally needed.

Consider updating the comment to acknowledge this is a design trade-off:

-      // Two preconnects to the same origin: one with crossorigin, one without.
-      // They hash differently so unhead keeps both, but they are logically duplicates.
+      // Two preconnects to the same origin: one with crossorigin, one without.
+      // While these technically serve different connection pools, having both
+      // is uncommon. The rule flags this as a potential oversight.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/unhead/test/unit/plugins/validate.test.ts` around lines 951 - 963,
Update the in-test comment in the test case that pushes two preconnect links
(the "warns on duplicate preconnect for same origin with different props"
it-block) to note that preconnects with and without crossorigin create different
connection pools (non-CORS vs CORS) and therefore may be intentionally distinct;
clarify this is a deliberate design trade-off related to the
'duplicate-resource-hint' validation rule and reference the relevant items (the
head.push entries, createValidationHead, and renderSSRHead) so future readers
understand why the test exists.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

packages/unhead/src/plugins/validate.ts (1)

616-626: ⚠️ Potential issue | 🟡 Minor

Preconnect deduplication key should account for crossorigin attribute.

The deduplication key ${rel}:${href} will flag legitimate preconnect pairs that differ by crossorigin as duplicates. Having both variants is intentional when an origin serves both CORS and non-CORS resources:

<link rel="preconnect" href="https://cdn.example.com">           <!-- For images -->
<link rel="preconnect" href="https://cdn.example.com" crossorigin> <!-- For fonts -->

These establish separate connection pools in the browser.

,

Proposed fix: include crossorigin in key for preconnects

 for (const tag of tags) {
   if (tag.tag === 'link' && tag.props.href && (tag.props.rel === 'preload' || tag.props.rel === 'prefetch' || tag.props.rel === 'preconnect')) {
-    const key = `${tag.props.rel}:${tag.props.href}`
+    const crossoriginSuffix = tag.props.rel === 'preconnect' && 'crossorigin' in tag.props ? ':cors' : ''
+    const key = `${tag.props.rel}:${tag.props.href}${crossoriginSuffix}`
     if (resourceHintsSeen.has(key))

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/unhead/src/plugins/validate.ts` around lines 616 - 626, The dedupe
key for resource hints in validate.ts currently uses `${rel}:${href}` and
incorrectly treats preconnects with different crossorigin attributes as
duplicates; update the logic in the loop that builds resourceHintsSeen
(referencing resourceHintsSeen, tag, tag.props.rel, tag.props.href,
tag.props.crossorigin) so that when tag.props.rel === 'preconnect' the key
includes the crossorigin value (e.g.
`${rel}:${href}:crossorigin=${tag.props.crossorigin}`) while keeping existing
keys for preload/prefetch unchanged, then use that key for the
resourceHintsSeen.has/set checks and duplicate reporting via
report('duplicate-resource-hint', ...).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes