vercel / vercel/next.js

[SRI] `integrity` missing for stylesheets

Open
#74,149 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
142k
Forks
32.4k
Avg merge
2d 14h
Merged PRs (30d)
351

Description

Link to the code that reproduces this issue

https://github.com/darthmaim-reproductions/vercel-next.js-74149

To Reproduce
  1. Clone the reproduction
  2. Run npm run build
  3. Open .next/server/app/index.html and observe that stylesheets don't have integrity set.
    <link rel="stylesheet" href="/_next/static/css/8da8fb13d9b551fb.css" data-precedence="next"/>
    
Current vs. Expected behavior

Included stylesheets currently don't get the integrity attribute.

Stylesheets should have integrity set.

Provide environment information
Node.js v22.5.1

Operating System:
  Platform: linux
  Arch: x64
  Version: #1 SMP Tue Nov 5 00:21:55 UTC 2024
  Available memory (MB): 15953
  Available CPU cores: 8
Binaries:
  Node: 22.5.1
  npm: 10.8.2
  Yarn: 1.22.22
  pnpm: N/A
Relevant Packages:
  next: 15.1.1-canary.13 // Latest available version is detected (15.1.1-canary.13).
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.3.3
Next.js Config:
  output: N/A
Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

The stylesheet hash is correctly included in .next/server/subresource-integrity-manifest.json, its just missing in the html.

Related:

  • #74147

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run npm run build in the linked reproduction and inspect .next/server/app/index.html alongside .next/server/subresource-integrity-manifest.json. Trace how the manifest's stylesheet hash reaches generated HTML; done means included stylesheet links contain the corresponding integrity attribute.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nextjs, react
Domain
build-system, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.