shakapacker 8.3.0 → 9.0.0.beta.0

data/docs/subresource_integrity.md

@@ -0,0 +1,54 @@
+# Subresource integrity
+It's a cryptographic hash that helps browsers check that the served js or css file has not been tampered in any way.
+
+[MDN - Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)
+
+## Important notes
+- If you somehow modify the file after the hash was generated, it will automatically be considered as tampered, and the browser will not allow it to be executed.
+- Enabling subresource integrity generation, will change the structure of `manifest.json`. Keep that in mind if you utilize this file in any other custom implementation.
+
+Before:
+```json
+{
+  "application.js": "/path_to_asset"
+}
+```
+
+After:
+```json
+{
+  "application.js": {
+    "src": "/path_to_asset",
+    "integrity": "<sha256-hash> <sha384-hash> <sha512-hash>"
+  }
+}
+```
+
+## Possible CORS issues
+Enabling subresource integrity for an asset, actually enforces CORS checks on that resource too. Which means that
+if you haven't set that up properly beforehand, it will probably lead to CORS errors with cached assets.
+
+[MDN - How browsers handle Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#how_browsers_handle_subresource_integrity)
+
+## Configuration
+
+By default, this setting is disabled, to ensure backwards compatibility, and let developers adapt at their own pace.
+This may change in the future, as it is a very nice security feature, and it should be enabled by default.
+
+To enable it, just add this in `shakapacker.yml`
+```yml
+  integrity:
+    enabled: true    
+```
+
+For further customization, you can also utilize the options `hash_functions` that control the functions used to generate 
+integrity hashes. And `cross_origin` that sets the cross-origin loading attribute.
+
+```yml
+  integrity:
+    enabled: true
+    hash_functions: ["sha256", "sha384", "sha512"]
+    cross_origin: "anonymous" # or "use-credentials"
+```
+
+This will utilize under the hood webpack-subresource-integrity plugin and will modify `manifest.json` to include integrity hashes.

data/docs/troubleshooting.md

@@ -17,6 +17,11 @@
 
 4. You can also pass additional options to the command to run the webpack-dev-server and start the webpack-dev-server with the option `--debug-shakapacker`
 
+5. ChatGPT and other AI tools can consume this output file. Change the NODE_ENV per your needs. Then upload the file to your favorite AI tool.
+   ```
+   NODE_ENV=development bin/shakapacker --profile --json > /tmp/webpack-stats.json
+   ```
+
 ## Incorrect peer dependencies
 Shakapacker uses peer dependencies to make it easier to manage what versions are being used for your app, which is especially
 useful for patching security vulnerabilities. However, not all package managers will actually enforce these versions - notably,

data/lib/install/bin/shakapacker

@@ -4,10 +4,22 @@ ENV["RAILS_ENV"] ||= "development"
 ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile", __FILE__)
 
 require "bundler/setup"
+require "pathname"
 require "shakapacker"
-require "shakapacker/webpack_runner"
 
 APP_ROOT = File.expand_path("..", __dir__)
 Dir.chdir(APP_ROOT) do
-  Shakapacker::WebpackRunner.run(ARGV)
+  config = Shakapacker::Configuration.new(
+    root_path: Pathname.new(APP_ROOT),
+    config_path: Pathname.new(File.join(APP_ROOT, "config/shakapacker.yml")),
+    env: ENV["RAILS_ENV"] || ENV["NODE_ENV"] || "development"
+  )
+
+  if config.rspack?
+    require "shakapacker/rspack_runner"
+    Shakapacker::RspackRunner.run(ARGV)
+  else
+    require "shakapacker/webpack_runner"
+    Shakapacker::WebpackRunner.run(ARGV)
+  end
 end

data/lib/install/bin/shakapacker-rspack

@@ -0,0 +1,13 @@
+#!/usr/bin/env ruby
+
+ENV["RAILS_ENV"] ||= "development"
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile", __FILE__)
+
+require "bundler/setup"
+require "shakapacker"
+require "shakapacker/rspack_runner"
+
+APP_ROOT = File.expand_path("..", __dir__)
+Dir.chdir(APP_ROOT) do
+  Shakapacker::RspackRunner.run(ARGV)
+end

data/lib/install/config/rspack/rspack.config.js

@@ -0,0 +1,6 @@
+// See the shakacode/shakapacker README and docs directory for advice on customizing your rspackConfig.
+const { generateRspackConfig } = require('shakapacker/rspack')
+
+const rspackConfig = generateRspackConfig()
+
+module.exports = rspackConfig

data/lib/install/config/shakapacker.yml

@@ -39,10 +39,13 @@ default: &default
   # Select loader to use, available options are 'babel' (default), 'swc' or 'esbuild'
   webpack_loader: 'babel'
 
+  # Select bundler to use, available options are 'webpack' (default) or 'rspack'
+  bundler: 'webpack'
+
   # Raises an error if there is a mismatch in the shakapacker gem and npm package being used
   ensure_consistent_versioning: true
 
-  # Select whether the compiler will use SHA digest ('digest' option) or most most recent modified timestamp ('mtime') to determine freshness
+  # Select whether the compiler will use SHA digest ('digest' option) or most recent modified timestamp ('mtime') to determine freshness
   compiler_strategy: digest
 
   # Select whether the compiler will always use a content hash and not just in production
@@ -55,6 +58,16 @@ default: &default
   # SHAKAPACKER_ASSET_HOST will override both configurations.
   # asset_host: custom-path
 
+  # Utilizing webpack-subresource-integrity plugin, will generate integrity hashes for all entries in manifest.json
+  # https://github.com/waysact/webpack-subresource-integrity/tree/main/webpack-subresource-integrity
+  integrity:
+    enabled: false
+    # Which cryptographic function(s) to use, for generating the integrity hash(es). Default sha-384. Other possible values sha256, sha512
+    hash_functions: ["sha384"]
+    # Default "anonymous". Other possible value "use-credentials"
+    # https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#cross-origin_resource_sharing_and_subresource_integrity
+    cross_origin: "anonymous"
+
 development:
   <<: *default
   compile: true
@@ -71,7 +84,7 @@ development:
     # Hot Module Replacement updates modules while the application is running without a full reload
     # Used instead of the `hot` key in https://webpack.js.org/configuration/dev-server/#devserverhot
     hmr: false
-    # If HMR is on, CSS will by inlined by delivering it as part of the script payload via style-loader. Be sure
+    # If HMR is on, CSS will be inlined by delivering it as part of the script payload via style-loader. Be sure
     # that you add style-loader to your project dependencies.
     #
     # If you want to instead deliver CSS via <link> with the mini-css-extract-plugin, set inline_css to false.
@@ -114,7 +127,7 @@ production:
   # Production depends on precompilation of packs prior to booting for performance.
   compile: false
 
-  # Use content hash for naming assets. Cannot be overridden by for production.
+  # Use content hash for naming assets. Cannot be overridden in production.
   useContentHash: true
 
   # Cache manifest.json for performance

data/lib/install/package.json

@@ -0,0 +1,30 @@
+{
+  "rspack": {
+    "@rspack/cli": "^1.0.0",
+    "@rspack/core": "^1.0.0",
+    "rspack-manifest-plugin": "^5.0.0"
+  },
+  "webpack": {
+    "mini-css-extract-plugin": "^2.0.0",
+    "terser-webpack-plugin": "^5.3.1",
+    "webpack": "^5.76.0",
+    "webpack-assets-manifest": "^5.0.6 || ^6.0.0",
+    "webpack-cli": "^4.9.2 || ^5.0.0 || ^6.0.0",
+    "webpack-dev-server": "^4.15.2 || ^5.2.2",
+    "webpack-merge": "^5.8.0 || ^6.0.0",
+    "webpack-subresource-integrity": "^5.1.0"
+  },
+  "common": {
+    "compression-webpack-plugin": "^9.0.0 || ^10.0.0|| ^11.0.0",
+    "css-loader": "^6.0.0 || ^7.0.0",
+    "sass-loader": "^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0",
+    "style-loader": "^3.0.0 || ^4.0.0"
+  },
+  "babel": {
+    "@babel/core": "^7.17.9",
+    "@babel/plugin-transform-runtime": "^7.17.0",
+    "@babel/preset-env": "^7.16.11",
+    "@babel/runtime": "^7.17.9",
+    "babel-loader": "^8.2.4 || ^9.0.0 || ^10.0.0"
+  }
+}

data/lib/install/template.rb

@@ -8,7 +8,6 @@ require "package_json"
 force_option = ENV["FORCE"] ? { force: true } : {}
 
 copy_file "#{__dir__}/config/shakapacker.yml", "config/shakapacker.yml", force_option
-remove_file "#{__dir__}/package.json" if force_option[:force]
 
 say "Copying webpack core config"
 directory "#{__dir__}/config/webpack", "config/webpack", force_option
@@ -112,7 +111,15 @@ rescue PackageJson::Error
 end
 
 def fetch_peer_dependencies
-  PackageJson.read("#{__dir__}/../../").fetch("peerDependencies")
+  PackageJson.read("#{__dir__}").fetch(ENV["SHAKAPACKER_BUNDLER"] || "webpack")
+end
+
+def fetch_common_dependencies
+  ENV["SKIP_COMMON_LOADERS"] ? {} : PackageJson.read("#{__dir__}").fetch("common")
+end
+
+def fetch_babel_dependencies
+  ENV["USE_BABEL_PACKAGES"] ? PackageJson.read("#{__dir__}").fetch("babel") : {}
 end
 
 Dir.chdir(Rails.root) do
@@ -130,13 +137,16 @@ Dir.chdir(Rails.root) do
   end
 
   peers = fetch_peer_dependencies
+  peers = peers.merge(fetch_common_dependencies)
+  peers = peers.merge(fetch_babel_dependencies)
+
   dev_dependency_packages = ["webpack-dev-server"]
 
   dependencies_to_add = []
   dev_dependencies_to_add = []
 
   peers.each do |(package, version)|
-    major_version = version.match(/(\d+)/)[1]
+    major_version = version.split("||").last.match(/(\d+)/)[1]
     entry = "#{package}@#{major_version}"
 
     if dev_dependency_packages.include? package

data/lib/shakapacker/configuration.rb

@@ -88,6 +88,18 @@ class Shakapacker::Configuration
     fetch(:compiler_strategy)
   end
 
+  def bundler
+    fetch(:bundler) || "webpack"
+  end
+
+  def rspack?
+    bundler == "rspack"
+  end
+
+  def webpack?
+    bundler == "webpack"
+  end
+
   def fetch(key)
     data.fetch(key, defaults[key])
   end
@@ -99,6 +111,10 @@ class Shakapacker::Configuration
     )
   end
 
+  def integrity
+    fetch(:integrity)
+  end
+
   private
     def data
       @data ||= load

data/lib/shakapacker/dev_server_runner.rb

@@ -75,12 +75,20 @@ module Shakapacker
           env["NODE_OPTIONS"] = "#{env["NODE_OPTIONS"]} --inspect-brk --trace-warnings"
         end
 
-        cmd += ["--config", @webpack_config]
-        cmd += ["--progress", "--color"] if @pretty
-
-        # Default behavior of webpack-dev-server is @hot = true
-        cmd += ["--hot", "only"] if @hot == "only"
-        cmd += ["--no-hot"] if !@hot
+        # Add bundler-specific flags and config
+        bundler = get_bundler_type
+        if bundler == "webpack"
+          cmd += ["--config", @webpack_config]
+          cmd += ["--progress", "--color"] if @pretty
+          # Default behavior of webpack-dev-server is @hot = true
+          cmd += ["--hot", "only"] if @hot == "only"
+          cmd += ["--no-hot"] if !@hot
+        elsif bundler == "rspack"
+          # Only add config for rspack if it's not a rspack-specific command
+          cmd += ["--config", @webpack_config]
+          # Rspack supports --hot but not --no-hot or --progress/--color
+          cmd += ["--hot"] if @hot && @hot != false
+        end
 
         cmd += @argv
 
@@ -90,7 +98,9 @@ module Shakapacker
       end
 
       def build_cmd
-        package_json.manager.native_exec_command("webpack", ["serve"])
+        bundler = get_bundler_type
+        command = bundler == "rspack" ? "rspack" : "webpack"
+        package_json.manager.native_exec_command(command, ["serve"])
       end
   end
 end

data/lib/shakapacker/helper.rb

@@ -109,11 +109,11 @@ module Shakapacker::Helper
     @javascript_pack_tag_loaded = true
 
     capture do
-      concat javascript_include_tag(*async, **options.dup.tap { |o| o[:async] = true })
+      render_tags(async, :javascript, **options.dup.tap { |o| o[:async] = true })
       concat "\n" if async.any? && deferred.any?
-      concat javascript_include_tag(*deferred, **options.dup.tap { |o| o[:defer] = true })
+      render_tags(deferred, :javascript, **options.dup.tap { |o| o[:defer] = true })
       concat "\n" if sync.any? && deferred.any?
-      concat javascript_include_tag(*sync, **options)
+      render_tags(sync, :javascript, options)
     end
   end
 
@@ -166,7 +166,9 @@ module Shakapacker::Helper
 
     @stylesheet_pack_tag_loaded = true
 
-    stylesheet_link_tag(*(requested_packs | appended_packs), **options)
+    capture do
+      render_tags(requested_packs | appended_packs, :stylesheet, options)
+    end
   end
 
   def append_stylesheet_pack_tag(*names)
@@ -238,4 +240,38 @@ module Shakapacker::Helper
     rescue
       path_to_asset(current_shakapacker_instance.manifest.lookup!(name), options)
     end
+
+    def lookup_integrity(source)
+      (source.respond_to?(:dig) && source.dig("integrity")) || nil
+    end
+
+    def lookup_source(source)
+      (source.respond_to?(:dig) && source.dig("src")) || source
+    end
+
+    # Handles rendering javascript and stylesheet tags with integrity, if that's enabled.
+    def render_tags(sources, type, options)
+      return unless sources.present? || type.present?
+
+      sources.each.with_index do |source, index|
+        tag_source = lookup_source(source)
+
+        if current_shakapacker_instance.config.integrity[:enabled]
+          integrity = lookup_integrity(source)
+
+          if integrity.present?
+            options[:integrity] = integrity
+            options[:crossorigin] = current_shakapacker_instance.config.integrity[:cross_origin]
+          end
+        end
+
+        if type == :javascript
+          concat javascript_include_tag(tag_source, **options)
+        else
+          concat stylesheet_link_tag(tag_source, **options)
+        end
+
+        concat "\n" unless index == sources.size - 1
+      end
+    end
 end

data/lib/shakapacker/manifest.rb

@@ -67,7 +67,12 @@ class Shakapacker::Manifest
     end
 
     def find(name)
-      data[name.to_s].presence
+      return nil unless data[name.to_s].present?
+
+      return data[name.to_s] unless data[name.to_s].respond_to?(:dig)
+
+      # Try to return src, if that fails, (ex. entrypoints object) return the whole object.
+      data[name.to_s].dig("src") || data[name.to_s]
     end
 
     def full_pack_name(name, pack_type)
@@ -109,9 +114,10 @@ Shakapacker can't find #{bundle_name} in #{config.manifest_path}. Possible cause
 2. Your app has code with a non-standard extension (like a `.jsx` file) but the extension is not in the `extensions` config in `config/shakapacker.yml`
 3. You have set compile: false (see `config/shakapacker.yml`) for this environment
    (unless you are using the `bin/shakapacker -w` or the `bin/shakapacker-dev-server`, in which case maybe you aren't running the dev server in the background?)
-4. webpack has not yet FINISHED running to reflect updates.
+4. Your bundler (webpack/rspack) has not yet FINISHED running to reflect updates.
 5. You have misconfigured Shakapacker's `config/shakapacker.yml` file.
-6. Your webpack configuration is not creating a manifest.
+6. Your bundler configuration is not creating a manifest with the expected structure.
+7. There's a mismatch between your bundler choice (webpack vs rspack) and the manifest format.
 
 Your manifest contains:
 #{JSON.pretty_generate(@data)}

data/lib/shakapacker/rspack_runner.rb

@@ -0,0 +1,57 @@
+require "shellwords"
+
+require_relative "runner"
+
+module Shakapacker
+  class RspackRunner < Shakapacker::Runner
+    RSPACK_COMMANDS = [
+      "help",
+      "h",
+      "--help",
+      "-h",
+      "version",
+      "v",
+      "--version",
+      "-v",
+      "info",
+      "i"
+    ].freeze
+
+    def run
+      env = Shakapacker::Compiler.env
+      env["SHAKAPACKER_CONFIG"] = @shakapacker_config
+      env["NODE_OPTIONS"] = ENV["NODE_OPTIONS"] || ""
+
+      cmd = build_cmd
+
+      if @argv.delete("--debug-shakapacker")
+        env["NODE_OPTIONS"] = "#{env["NODE_OPTIONS"]} --inspect-brk"
+      end
+
+      if @argv.delete "--trace-deprecation"
+        env["NODE_OPTIONS"] = "#{env["NODE_OPTIONS"]} --trace-deprecation"
+      end
+
+      if @argv.delete "--no-deprecation"
+        env["NODE_OPTIONS"] = "#{env["NODE_OPTIONS"]} --no-deprecation"
+      end
+
+      # Rspack commands are not compatible with --config option.
+      if (@argv & RSPACK_COMMANDS).empty?
+        cmd += ["--config", @webpack_config]
+      end
+
+      cmd += @argv
+
+      Dir.chdir(@app_path) do
+        Kernel.exec env, *cmd
+      end
+    end
+
+    private
+
+      def build_cmd
+        package_json.manager.native_exec_command("rspack")
+      end
+  end
+end

data/lib/shakapacker/runner.rb

@@ -1,7 +1,9 @@
 require_relative "utils/misc"
 require_relative "utils/manager"
+require_relative "configuration"
 
 require "package_json"
+require "pathname"
 
 module Shakapacker
   class Runner
@@ -16,7 +18,12 @@ module Shakapacker
 
       @app_path              = File.expand_path(".", Dir.pwd)
       @shakapacker_config    = ENV["SHAKAPACKER_CONFIG"] || File.join(@app_path, "config/shakapacker.yml")
-      @webpack_config        = find_webpack_config
+      @config                = Configuration.new(
+        root_path: Pathname.new(@app_path),
+        config_path: Pathname.new(@shakapacker_config),
+        env: ENV["RAILS_ENV"] || ENV["NODE_ENV"] || "development"
+      )
+      @webpack_config        = find_bundler_config
 
       Shakapacker::Utils::Manager.error_unless_package_manager_is_obvious!
     end
@@ -26,6 +33,45 @@ module Shakapacker
     end
 
     private
+      def find_bundler_config
+        if @config.rspack?
+          find_rspack_config_with_fallback
+        else
+          find_webpack_config
+        end
+      end
+
+      def get_bundler_type
+        @config.bundler
+      end
+
+      def find_rspack_config_with_fallback
+        # First try rspack-specific paths
+        rspack_paths = %w[ts js].map do |ext|
+          File.join(@app_path, "config/rspack/rspack.config.#{ext}")
+        end
+
+        rspack_path = rspack_paths.find { |f| File.exist?(f) }
+        return rspack_path if rspack_path
+
+        # Fallback to webpack config with deprecation warning
+        webpack_paths = %w[ts js].map do |ext|
+          File.join(@app_path, "config/webpack/webpack.config.#{ext}")
+        end
+
+        webpack_path = webpack_paths.find { |f| File.exist?(f) }
+        if webpack_path
+          $stderr.puts "⚠️  DEPRECATION WARNING: Using webpack config file for Rspack bundler."
+          $stderr.puts "   Please create config/rspack/rspack.config.js and migrate your configuration."
+          $stderr.puts "   Using: #{webpack_path}"
+          return webpack_path
+        end
+
+        # No config found
+        $stderr.puts "rspack config #{rspack_paths.last} not found, please run 'bundle exec rails shakapacker:install' to install Shakapacker with default configs or create the missing config file."
+        exit(1)
+      end
+
       def find_webpack_config
         possible_paths = %w[ts js].map do |ext|
           File.join(@app_path, "config/webpack/webpack.config.#{ext}")
@@ -33,7 +79,7 @@ module Shakapacker
         path = possible_paths.find { |f| File.exist?(f) }
         unless path
           $stderr.puts "webpack config #{possible_paths.last} not found, please run 'bundle exec rails shakapacker:install' to install Shakapacker with default configs or add the missing config file for your custom environment."
-          exit!
+          exit(1)
         end
         path
       end

data/lib/shakapacker/version.rb

@@ -1,4 +1,4 @@
 module Shakapacker
   # Change the version in package.json too, please!
-  VERSION = "8.3.0".freeze
+  VERSION = "9.0.0.beta.0".freeze
 end

data/package/config.js

@@ -50,5 +50,7 @@ if (config.manifest_path) {
 } else {
   config.manifestPath = resolve(config.outputPath, "manifest.json")
 }
+// Ensure no duplicate hash functions exist in the returned config object
+config.integrity.hash_functions = [...new Set(config.integrity.hash_functions)]
 
 module.exports = config

data/package/environments/base.js

@@ -1,16 +1,20 @@
 /* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
-const { existsSync, readdirSync } = require("fs")
 const { basename, dirname, join, relative, resolve } = require("path")
+const { existsSync, readdirSync } = require("fs")
 const extname = require("path-complete-extname")
-// TODO: Change to `const { WebpackAssetsManifest }` when dropping 'webpack-assets-manifest < 6.0.0' (Node >=20.10.0) support
-const WebpackAssetsManifest = require("webpack-assets-manifest")
-const webpack = require("webpack")
-const rules = require("../rules")
 const config = require("../config")
 const { isProduction } = require("../env")
-const { moduleExists } = require("../utils/helpers")
+
+const pluginsPath = resolve(__dirname, "..", "plugins", `${config.bundler}.js`)
+const { getPlugins } = require(pluginsPath)
+const rulesPath = resolve(__dirname, "..", "rules", `${config.bundler}.js`)
+const rules = require(rulesPath)
+
+// Don't use contentHash except for production for performance
+// https://webpack.js.org/guides/build-performance/#avoid-production-specific-tooling
+const hash = isProduction || config.useContentHash ? "-[contenthash]" : ""
 
 const getFilesInDirectory = (dir, includeNested) => {
   if (!existsSync(dir)) {
@@ -73,45 +77,6 @@ const getModulePaths = () => {
   return result
 }
 
-// TODO: Remove WebpackAssetsManifestConstructor workaround when dropping 'webpack-assets-manifest < 6.0.0' (Node >=20.10.0) support
-const WebpackAssetsManifestConstructor =
-  "WebpackAssetsManifest" in WebpackAssetsManifest
-    ? WebpackAssetsManifest.WebpackAssetsManifest
-    : WebpackAssetsManifest
-const getPlugins = () => {
-  const plugins = [
-    new webpack.EnvironmentPlugin(process.env),
-    new WebpackAssetsManifestConstructor({
-      entrypoints: true,
-      writeToDisk: true,
-      output: config.manifestPath,
-      entrypointsUseAssets: true,
-      publicPath: config.publicPathWithoutCDN
-    })
-  ]
-
-  if (moduleExists("css-loader") && moduleExists("mini-css-extract-plugin")) {
-    const hash = isProduction || config.useContentHash ? "-[contenthash:8]" : ""
-    const MiniCssExtractPlugin = require("mini-css-extract-plugin")
-    plugins.push(
-      new MiniCssExtractPlugin({
-        filename: `css/[name]${hash}.css`,
-        chunkFilename: `css/[id]${hash}.css`,
-        // For projects where css ordering has been mitigated through consistent use of scoping or naming conventions,
-        // the css order warnings can be disabled by setting the ignoreOrder flag.
-        // Read: https://stackoverflow.com/questions/51971857/mini-css-extract-plugin-warning-in-chunk-chunkname-mini-css-extract-plugin-con
-        ignoreOrder: config.css_extract_ignore_order_warnings
-      })
-    )
-  }
-
-  return plugins
-}
-
-// Don't use contentHash except for production for performance
-// https://webpack.js.org/guides/build-performance/#avoid-production-specific-tooling
-const hash = isProduction || config.useContentHash ? "-[contenthash]" : ""
-
 module.exports = {
   mode: "production",
   output: {
@@ -121,7 +86,12 @@ module.exports = {
     // https://webpack.js.org/configuration/output/#outputhotupdatechunkfilename
     hotUpdateChunkFilename: "js/[id].[fullhash].hot-update.js",
     path: config.outputPath,
-    publicPath: config.publicPath
+    publicPath: config.publicPath,
+
+    // This is required for SRI to work.
+    crossOriginLoading: config.integrity.enabled
+      ? config.integrity.cross_origin
+      : false
   },
   entry: getEntryObject(),
   resolve: {
@@ -137,12 +107,10 @@ module.exports = {
 
   optimization: {
     splitChunks: { chunks: "all" },
-
     runtimeChunk: "single"
   },
 
   module: {
-    strictExportPresence: true,
     rules
   }
 }