[SRI] `integrity` missing for stylesheets
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 142k
- Forks
- 32.4k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 351
Description
Link to the code that reproduces this issue
https://github.com/darthmaim-reproductions/vercel-next.js-74149
To Reproduce
- Clone the reproduction
- Run
npm run build - Open
.next/server/app/index.htmland observe that stylesheets don't haveintegrityset.<link rel="stylesheet" href="/_next/static/css/8da8fb13d9b551fb.css" data-precedence="next"/>
Current vs. Expected behavior
Included stylesheets currently don't get the integrity attribute.
Stylesheets should have integrity set.
Provide environment information
Node.js v22.5.1
Operating System:
Platform: linux
Arch: x64
Version: #1 SMP Tue Nov 5 00:21:55 UTC 2024
Available memory (MB): 15953
Available CPU cores: 8
Binaries:
Node: 22.5.1
npm: 10.8.2
Yarn: 1.22.22
pnpm: N/A
Relevant Packages:
next: 15.1.1-canary.13 // Latest available version is detected (15.1.1-canary.13).
eslint-config-next: N/A
react: 19.0.0
react-dom: 19.0.0
typescript: 5.3.3
Next.js Config:
output: N/A
Which area(s) are affected? (Select all that apply)
Not sure
Which stage(s) are affected? (Select all that apply)
next build (local)
Additional context
The stylesheet hash is correctly included in .next/server/subresource-integrity-manifest.json, its just missing in the html.
Related:
- #74147
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run npm run build in the linked reproduction and inspect .next/server/app/index.html alongside .next/server/subresource-integrity-manifest.json. Trace how the manifest's stylesheet hash reaches generated HTML; done means included stylesheet links contain the corresponding integrity attribute.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nextjs, react
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100