@rsbuild/core 0.7.2 → 0.7.3

package/dist/index.cjs

@@ -596,7 +596,10 @@ var init_config = __esm({
       scriptLoading: "defer"
     });
     getDefaultSecurityConfig = () => ({
-      nonce: ""
+      nonce: "",
+      sri: {
+        enable: false
+      }
     });
     getDefaultToolsConfig = () => ({
       cssExtract: {
@@ -765,15 +768,15 @@ function loadEnv({
     publicVars
   };
 }
-var import_node_fs2, import_node_path5, import_shared6, import_dotenv_expand, import_dotenv;
+var import_node_fs2, import_node_path5, import_shared6, import_dotenv, import_dotenv_expand;
 var init_loadEnv = __esm({
   "src/loadEnv.ts"() {
     "use strict";
     import_node_fs2 = __toESM(require("fs"));
     import_node_path5 = require("path");
     import_shared6 = require("@rsbuild/shared");
-    import_dotenv_expand = require("../compiled/dotenv-expand/index.js");
     import_dotenv = require("../compiled/dotenv/index.js");
+    import_dotenv_expand = require("../compiled/dotenv-expand/index.js");
     init_helpers();
   }
 });
@@ -849,11 +852,10 @@ function getEntryObject(config, target) {
   if (!config.source?.entry) {
     return {};
   }
-  return (0, import_shared8.mergeChainedOptions)({
-    defaults: {},
-    options: config.source?.entry,
-    utils: { target },
-    useObjectParam: true
+  return (0, import_shared8.reduceConfigsMergeContext)({
+    initial: {},
+    config: config.source?.entry,
+    ctx: { target }
   });
 }
 var import_shared8, pluginEntry;
@@ -916,7 +918,7 @@ async function createContextByConfig(options, bundlerType, config = {}) {
   return {
     entry: getEntryObject(config, "web"),
     targets: config.output?.targets || [],
-    version: "0.7.2",
+    version: "0.7.3",
     rootPath,
     distPath,
     cachePath,
@@ -1385,10 +1387,10 @@ async function modifyRspackConfig(context, rspackConfig, utils) {
     utils
   );
   if (context.config.tools?.rspack) {
-    modifiedConfig = (0, import_shared13.mergeChainedOptions)({
-      defaults: modifiedConfig,
-      options: context.config.tools.rspack,
-      utils,
+    modifiedConfig = await (0, import_shared13.reduceConfigsAsyncWithContext)({
+      initial: modifiedConfig,
+      config: context.config.tools.rspack,
+      ctx: utils,
       mergeFn: utils.mergeConfig
     });
   }
@@ -3200,12 +3202,12 @@ var init_basic = __esm({
       name: "rsbuild:basic",
       setup(api) {
         api.modifyBundlerChain(
-          (chain, { env, isProd: isProd4, target, bundler, CHAIN_ID: CHAIN_ID3 }) => {
+          (chain, { env, isProd: isProd5, target, bundler, CHAIN_ID: CHAIN_ID3 }) => {
             const config = api.getNormalizedConfig();
             chain.name(import_shared25.TARGET_ID_MAP[target]);
             chain.devtool((0, import_shared25.getJsSourceMap)(config));
             chain.context(api.context.rootPath);
-            chain.mode(isProd4 ? "production" : "development");
+            chain.mode(isProd5 ? "production" : "development");
             chain.merge({
               infrastructureLogging: {
                 // Using `error` level to avoid `cache.PackFileCacheStrategy` logs
@@ -3218,9 +3220,9 @@ var init_basic = __esm({
                 exportsPresence: "error"
               }
             });
-            const isMinimize = isProd4 && config.output.minify !== false;
+            const isMinimize = isProd5 && config.output.minify !== false;
             chain.optimization.minimize(isMinimize);
-            const usingHMR = (0, import_shared25.isUsingHMR)(config, { target, isProd: isProd4 });
+            const usingHMR = (0, import_shared25.isUsingHMR)(config, { target, isProd: isProd5 });
             if (usingHMR) {
               chain.plugin(CHAIN_ID3.PLUGIN.HMR).use(bundler.HotModuleReplacementPlugin);
             }
@@ -3402,7 +3404,7 @@ async function applyCSSRule({
   rule,
   config,
   context,
-  utils: { target, isProd: isProd4, CHAIN_ID: CHAIN_ID3 },
+  utils: { target, isProd: isProd5, CHAIN_ID: CHAIN_ID3 },
   importLoaders = 1
 }) {
   const browserslist = await (0, import_shared28.getBrowserslistWithDefault)(
@@ -3411,7 +3413,7 @@ async function applyCSSRule({
     target
   );
   const enableExtractCSS = isUseCssExtract(config, target);
-  const localIdentName = getCSSModulesLocalIdentName(config, isProd4);
+  const localIdentName = getCSSModulesLocalIdentName(config, isProd5);
   const cssLoaderOptions = getCSSLoaderOptions({
     config,
     importLoaders,
@@ -3422,9 +3424,9 @@ async function applyCSSRule({
     if (enableExtractCSS) {
       rule.use(CHAIN_ID3.USE.MINI_CSS_EXTRACT).loader(getCssExtractPlugin().loader).options(config.tools.cssExtract.loaderOptions).end();
     } else {
-      const styleLoaderOptions = (0, import_shared28.mergeChainedOptions)({
-        defaults: {},
-        options: config.tools.styleLoader
+      const styleLoaderOptions = (0, import_shared28.reduceConfigs)({
+        initial: {},
+        config: config.tools.styleLoader
       });
       rule.use(CHAIN_ID3.USE.STYLE).loader(getCompiledPath("style-loader")).options(styleLoaderOptions).end();
     }
@@ -3454,8 +3456,8 @@ var init_css = __esm({
     init_pluginHelper();
     enableNativeCss = (config) => !config.output.injectStyles;
     isUseCssExtract = (config, target) => !config.output.injectStyles && target !== "node" && target !== "web-worker";
-    getCSSModulesLocalIdentName = (config, isProd4) => config.output.cssModules.localIdentName || // Using shorter classname in production to reduce bundle size
-    (isProd4 ? "[local]-[hash:base64:6]" : "[path][name]__[local]-[hash:base64:6]");
+    getCSSModulesLocalIdentName = (config, isProd5) => config.output.cssModules.localIdentName || // Using shorter classname in production to reduce bundle size
+    (isProd5 ? "[local]-[hash:base64:6]" : "[path][name]__[local]-[hash:base64:6]");
     normalizeCssLoaderOptions = (options, exportOnlyLocals) => {
       if (options.modules && exportOnlyLocals) {
         let { modules } = options;
@@ -3492,12 +3494,12 @@ var init_css = __esm({
       });
       if (!hasAutoprefixer) {
         const { default: autoprefixer } = await import("@rsbuild/shared/autoprefixer");
-        const autoprefixerOptions = (0, import_shared28.mergeChainedOptions)({
-          defaults: {
+        const autoprefixerOptions = (0, import_shared28.reduceConfigs)({
+          initial: {
             flexbox: "no-2009",
             overrideBrowserslist: browserslist
           },
-          options: config.tools.autoprefixer
+          config: config.tools.autoprefixer
         });
         pluginObjects.push(autoprefixer(autoprefixerOptions));
       }
@@ -3532,10 +3534,10 @@ var init_css = __esm({
         },
         sourceMap: config.output.sourceMap.css
       };
-      const mergedConfig = (0, import_shared28.mergeChainedOptions)({
-        defaults: defaultPostcssConfig,
-        options: config.tools.postcss,
-        utils
+      const mergedConfig = (0, import_shared28.reduceConfigsWithContext)({
+        initial: defaultPostcssConfig,
+        config: config.tools.postcss,
+        ctx: utils
       });
       if (extraPlugins.length) {
         mergedConfig?.postcssOptions?.plugins.push(...extraPlugins);
@@ -3559,9 +3561,9 @@ var init_css = __esm({
         },
         sourceMap: config.output.sourceMap.css
       };
-      const mergedCssLoaderOptions = (0, import_shared28.mergeChainedOptions)({
-        defaults: defaultOptions2,
-        options: config.tools.cssLoader,
+      const mergedCssLoaderOptions = (0, import_shared28.reduceConfigs)({
+        initial: defaultOptions2,
+        config: config.tools.cssLoader,
         mergeFn: import_shared28.deepmerge
       });
       const cssLoaderOptions = normalizeCssLoaderOptions(
@@ -3602,13 +3604,13 @@ __export(output_exports, {
   pluginOutput: () => pluginOutput
 });
 function getPublicPath({
-  isProd: isProd4,
+  isProd: isProd5,
   config,
   context
 }) {
   const { dev, output } = config;
   let publicPath = import_shared29.DEFAULT_ASSET_PREFIX;
-  if (isProd4) {
+  if (isProd5) {
     if (typeof output.assetPrefix === "string") {
       publicPath = output.assetPrefix;
     }
@@ -3641,20 +3643,23 @@ var init_output = __esm({
       name: "rsbuild:output",
       setup(api) {
         api.modifyBundlerChain(
-          async (chain, { CHAIN_ID: CHAIN_ID3, target, isProd: isProd4, isServer, isServiceWorker }) => {
+          async (chain, { CHAIN_ID: CHAIN_ID3, target, isProd: isProd5, isServer, isServiceWorker }) => {
             const config = api.getNormalizedConfig();
             const publicPath = getPublicPath({
               config,
-              isProd: isProd4,
+              isProd: isProd5,
               context: api.context
             });
             const jsPath = (0, import_shared29.getDistPath)(config, "js");
             const jsAsyncPath = (0, import_shared29.getDistPath)(config, "jsAsync");
-            const jsFilename = (0, import_shared29.getFilename)(config, "js", isProd4);
+            const jsFilename = (0, import_shared29.getFilename)(config, "js", isProd5);
             chain.output.path(api.context.distPath).filename(import_node_path15.posix.join(jsPath, jsFilename)).chunkFilename(import_node_path15.posix.join(jsAsyncPath, jsFilename)).publicPath(publicPath).pathinfo(false).hashFunction("xxhash64");
             if (isServer) {
               const serverPath = (0, import_shared29.getDistPath)(config, "server");
-              chain.output.path(import_node_path15.posix.join(api.context.distPath, serverPath)).filename("[name].js").chunkFilename("[name].js").libraryTarget("commonjs2");
+              chain.output.path(import_node_path15.posix.join(api.context.distPath, serverPath)).filename("[name].js").chunkFilename("[name].js").library({
+                ...chain.output.get("library") || {},
+                type: "commonjs2"
+              });
             }
             if (isServiceWorker) {
               const workerPath = (0, import_shared29.getDistPath)(config, "worker");
@@ -3669,7 +3674,7 @@ var init_output = __esm({
             if (isUseCssExtract(config, target)) {
               const extractPluginOptions = config.tools.cssExtract.pluginOptions;
               const cssPath = (0, import_shared29.getDistPath)(config, "css");
-              const cssFilename = (0, import_shared29.getFilename)(config, "css", isProd4);
+              const cssFilename = (0, import_shared29.getFilename)(config, "css", isProd5);
               const cssAsyncPath = (0, import_shared29.getDistPath)(config, "cssAsync");
               chain.plugin(CHAIN_ID3.PLUGIN.MINI_CSS_EXTRACT).use(getCssExtractPlugin(), [
                 {
@@ -3719,10 +3724,10 @@ function applyAlias({
   if (!alias) {
     return;
   }
-  const mergedAlias = (0, import_shared30.mergeChainedOptions)({
-    defaults: {},
-    options: alias,
-    utils: { target }
+  const mergedAlias = (0, import_shared30.reduceConfigsWithContext)({
+    initial: {},
+    config: alias,
+    ctx: { target }
   });
   for (const name of Object.keys(mergedAlias)) {
     const values = (0, import_shared30.castArray)(mergedAlias[name]);
@@ -4044,12 +4049,12 @@ var init_asset = __esm({
     pluginAsset = () => ({
       name: "rsbuild:asset",
       setup(api) {
-        api.modifyBundlerChain((chain, { isProd: isProd4, target }) => {
+        api.modifyBundlerChain((chain, { isProd: isProd5, target }) => {
           const config = api.getNormalizedConfig();
           const createAssetRule = (assetType, exts, emit2) => {
             const regExp = getRegExpForExts(exts);
             const distDir = (0, import_shared34.getDistPath)(config, assetType);
-            const filename = (0, import_shared34.getFilename)(config, assetType, isProd4);
+            const filename = (0, import_shared34.getFilename)(config, assetType, isProd5);
             const { dataUriLimit } = config.output;
             const maxSize = typeof dataUriLimit === "number" ? dataUriLimit : dataUriLimit[assetType];
             const rule = chain.module.rule(assetType).test(regExp);
@@ -4127,9 +4132,9 @@ var init_minimize = __esm({
       }
       return options;
     };
-    parseMinifyOptions = (config, isProd4 = true) => {
+    parseMinifyOptions = (config, isProd5 = true) => {
       const minify = config.output.minify;
-      if (minify === false || !isProd4) {
+      if (minify === false || !isProd5) {
         return {
           minifyJs: false,
           minifyCss: false,
@@ -4161,9 +4166,9 @@ var init_minimize = __esm({
         if (api.context.bundlerType === "webpack") {
           return;
         }
-        api.modifyBundlerChain(async (chain, { isProd: isProd4 }) => {
+        api.modifyBundlerChain(async (chain, { isProd: isProd5 }) => {
           const config = api.getNormalizedConfig();
-          const isMinimize = isProd4 && config.output.minify !== false;
+          const isMinimize = isProd5 && config.output.minify !== false;
           if (!isMinimize) {
             return;
           }
@@ -4366,10 +4371,17 @@ var init_HtmlBasicPlugin = __esm({
               addTitleTag(headTags, data.plugin.options?.title);
             }
             addFavicon(headTags, favicon);
-            const result = await this.modifyTagsFn({
-              headTags: headTags.map(formatBasicTag),
-              bodyTags: bodyTags.map(formatBasicTag)
-            });
+            const result = await this.modifyTagsFn(
+              {
+                headTags: headTags.map(formatBasicTag),
+                bodyTags: bodyTags.map(formatBasicTag)
+              },
+              {
+                compilation,
+                assetPrefix: data.publicPath,
+                filename: data.outputName
+              }
+            );
             Object.assign(data, {
               headTags: result.headTags.map(fromBasicTag),
               bodyTags: result.bodyTags.map(fromBasicTag)
@@ -4497,8 +4509,8 @@ function getTerserMinifyOptions(config) {
   const finalOptions = applyRemoveConsole(options, config);
   return finalOptions;
 }
-async function getHtmlMinifyOptions(isProd4, config) {
-  if (!isProd4 || !config.output.minify || !parseMinifyOptions(config).minifyHtml) {
+async function getHtmlMinifyOptions(isProd5, config) {
+  if (!isProd5 || !config.output.minify || !parseMinifyOptions(config).minifyHtml) {
     return false;
   }
   const minifyJS = getTerserMinifyOptions(config);
@@ -4519,29 +4531,25 @@ async function getHtmlMinifyOptions(isProd4, config) {
   return typeof htmlMinifyOptions === "object" ? (0, import_shared38.deepmerge)(htmlMinifyDefaultOptions, htmlMinifyOptions) : htmlMinifyDefaultOptions;
 }
 function getTitle(entryName, config) {
-  return (0, import_shared38.mergeChainedOptions)({
-    defaults: "",
-    options: config.html.title,
-    utils: { entryName },
-    useObjectParam: true
+  return (0, import_shared38.reduceConfigsMergeContext)({
+    initial: "",
+    config: config.html.title,
+    ctx: { entryName }
   });
 }
 function getInject(entryName, config) {
-  return (0, import_shared38.mergeChainedOptions)({
-    defaults: "head",
-    options: config.html.inject,
-    utils: { entryName },
-    useObjectParam: true,
-    isFalsy: import_shared38.isNil
+  return (0, import_shared38.reduceConfigsMergeContext)({
+    initial: "head",
+    config: config.html.inject,
+    ctx: { entryName }
   });
 }
 async function getTemplate(entryName, config, rootPath) {
   const DEFAULT_TEMPLATE = import_node_path20.default.resolve(STATIC_PATH, "template.html");
-  const templatePath = (0, import_shared38.mergeChainedOptions)({
-    defaults: DEFAULT_TEMPLATE,
-    options: config.html.template,
-    utils: { entryName },
-    useObjectParam: true
+  const templatePath = (0, import_shared38.reduceConfigsMergeContext)({
+    initial: DEFAULT_TEMPLATE,
+    config: config.html.template,
+    ctx: { entryName }
   });
   if (templatePath === DEFAULT_TEMPLATE) {
     return {
@@ -4566,19 +4574,17 @@ async function getTemplate(entryName, config, rootPath) {
   };
 }
 function getFavicon(entryName, config) {
-  return (0, import_shared38.mergeChainedOptions)({
-    defaults: "",
-    options: config.html.favicon,
-    utils: { entryName },
-    useObjectParam: true
+  return (0, import_shared38.reduceConfigsMergeContext)({
+    initial: "",
+    config: config.html.favicon,
+    ctx: { entryName }
   });
 }
 function getMetaTags(entryName, config, templateContent) {
-  const metaTags = (0, import_shared38.mergeChainedOptions)({
-    defaults: {},
-    options: config.html.meta,
-    utils: { entryName },
-    useObjectParam: true
+  const metaTags = (0, import_shared38.reduceConfigsMergeContext)({
+    initial: {},
+    config: config.html.meta,
+    ctx: { entryName }
   });
   if (templateContent && metaTags.charset) {
     const charsetRegExp = /<meta[^>]+charset=["'][^>]*>/i;
@@ -4603,10 +4609,10 @@ function getTemplateParameters(entryName, config, assetPrefix) {
         options: pluginOptions
       }
     };
-    return (0, import_shared38.mergeChainedOptions)({
-      defaults: defaultOptions2,
-      options: templateParameters,
-      utils: { entryName }
+    return (0, import_shared38.reduceConfigsWithContext)({
+      initial: defaultOptions2,
+      config: templateParameters,
+      ctx: { entryName }
     });
   };
 }
@@ -4655,12 +4661,12 @@ var init_html = __esm({
       name: "rsbuild:html",
       setup(api) {
         api.modifyBundlerChain(
-          async (chain, { HtmlPlugin, isProd: isProd4, CHAIN_ID: CHAIN_ID3, target }) => {
+          async (chain, { HtmlPlugin, isProd: isProd5, CHAIN_ID: CHAIN_ID3, target }) => {
             const config = api.getNormalizedConfig();
             if ((0, import_shared38.isHtmlDisabled)(config, target)) {
               return;
             }
-            const minify = await getHtmlMinifyOptions(isProd4, config);
+            const minify = await getHtmlMinifyOptions(isProd5, config);
             const assetPrefix = getPublicPathFromChain(chain, false);
             const entries = chain.entryPoints.entries() || {};
             const entryNames = Object.keys(entries);
@@ -4669,11 +4675,7 @@ var init_html = __esm({
             const finalOptions = await Promise.all(
               entryNames.map(async (entryName) => {
                 const entryValue = entries[entryName].values();
-                const chunks = getChunks(
-                  entryName,
-                  // EntryDescription type is different between webpack and Rspack
-                  entryValue
-                );
+                const chunks = getChunks(entryName, entryValue);
                 const inject = getInject(entryName, config);
                 const filename = htmlPaths[entryName];
                 const { templatePath, templateContent } = await getTemplate(
@@ -4719,13 +4721,10 @@ var init_html = __esm({
                     pluginOptions.favicon = favicon;
                   }
                 }
-                const finalOptions2 = (0, import_shared38.mergeChainedOptions)({
-                  defaults: pluginOptions,
-                  options: typeof config.tools.htmlPlugin === "boolean" ? {} : config.tools.htmlPlugin,
-                  utils: {
-                    entryName,
-                    entryValue
-                  }
+                const finalOptions2 = (0, import_shared38.reduceConfigsWithContext)({
+                  initial: pluginOptions,
+                  config: typeof config.tools.htmlPlugin === "boolean" ? {} : config.tools.htmlPlugin,
+                  ctx: { entryName, entryValue }
                 });
                 return finalOptions2;
               })
@@ -4750,52 +4749,21 @@ var init_html = __esm({
             }
           }
         );
-        api.onAfterCreateCompiler(({ compiler }) => {
-          const { nonce } = api.getNormalizedConfig().security;
-          if (!nonce) {
-            return;
-          }
-          (0, import_shared38.applyToCompiler)(compiler, (compiler2) => {
-            const { plugins } = compiler2.options;
-            const hasHTML = plugins.some(
-              (plugin) => plugin && plugin.constructor.name === "HtmlBasicPlugin"
-            );
-            if (!hasHTML) {
-              return;
-            }
-            const injectCode = (0, import_shared38.createVirtualModule)(
-              `__webpack_nonce__ = "${nonce}";`
-            );
-            new compiler2.webpack.EntryPlugin(compiler2.context, injectCode, {
-              name: void 0
-            }).apply(compiler2);
-          });
-        });
         api.modifyHTMLTags({
           // ensure `crossorigin` and `nonce` can be applied to all tags
           order: "post",
           handler: ({ headTags, bodyTags }) => {
             const config = api.getNormalizedConfig();
             const { crossorigin } = config.html;
-            const { nonce } = config.security;
             const allTags = [...headTags, ...bodyTags];
             if (crossorigin) {
               const formattedCrossorigin = crossorigin === true ? "anonymous" : crossorigin;
               for (const tag of allTags) {
                 if (tag.tag === "script" && tag.attrs?.src || tag.tag === "link" && tag.attrs?.rel === "stylesheet") {
-                  tag.attrs ||= {};
                   tag.attrs.crossorigin ??= formattedCrossorigin;
                 }
               }
             }
-            if (nonce) {
-              for (const tag of allTags) {
-                if (tag.tag === "script" || tag.tag === "style") {
-                  tag.attrs ??= {};
-                  tag.attrs.nonce = nonce;
-                }
-              }
-            }
             return { headTags, bodyTags };
           }
         });
@@ -5096,9 +5064,9 @@ var init_swc = __esm({
                 await applyCoreJs(swcConfig, chain, polyfillMode);
               }
             }
-            const mergedSwcConfig = (0, import_shared42.mergeChainedOptions)({
-              defaults: swcConfig,
-              options: config.tools.swc,
+            const mergedSwcConfig = (0, import_shared42.reduceConfigs)({
+              initial: swcConfig,
+              config: config.tools.swc,
               mergeFn: import_shared42.deepmerge
             });
             rule.use(CHAIN_ID3.USE.SWC).loader(builtinSwcLoaderName).options(mergedSwcConfig);
@@ -6541,8 +6509,8 @@ var init_lazyCompilation = __esm({
     pluginLazyCompilation = () => ({
       name: "rsbuild:lazy-compilation",
       setup(api) {
-        api.modifyBundlerChain((chain, { isProd: isProd4, target }) => {
-          if (isProd4 || target !== "web") {
+        api.modifyBundlerChain((chain, { isProd: isProd5, target }) => {
+          if (isProd5 || target !== "web") {
             return;
           }
           const config = api.getNormalizedConfig();
@@ -6602,6 +6570,222 @@ var init_lazyCompilation = __esm({
   }
 });
 
+// src/plugins/sri.ts
+var sri_exports = {};
+__export(sri_exports, {
+  pluginSri: () => pluginSri
+});
+var import_node_crypto2, import_shared57, getAssetName, pluginSri;
+var init_sri = __esm({
+  "src/plugins/sri.ts"() {
+    "use strict";
+    import_node_crypto2 = __toESM(require("crypto"));
+    import_shared57 = require("@rsbuild/shared");
+    init_constants();
+    getAssetName = (url2, assetPrefix) => {
+      if (url2.startsWith(assetPrefix)) {
+        return (0, import_shared57.removeLeadingSlash)(url2.replace(assetPrefix, ""));
+      }
+      return (0, import_shared57.removeLeadingSlash)(url2);
+    };
+    pluginSri = () => ({
+      name: "rsbuild:sri",
+      setup(api) {
+        const placeholder = "RSBUILD_INTEGRITY_PLACEHOLDER:";
+        const getAlgorithm = () => {
+          const config = api.getNormalizedConfig();
+          const { sri } = config.security;
+          const enable = sri.enable === "auto" ? (0, import_shared57.isProd)() : sri.enable;
+          if (!enable) {
+            return null;
+          }
+          const { algorithm = "sha384" } = sri;
+          return algorithm;
+        };
+        api.modifyHTMLTags({
+          // ensure `sri` can be applied to all tags
+          order: "post",
+          handler(tags, { assetPrefix }) {
+            const algorithm = getAlgorithm();
+            if (!algorithm) {
+              return tags;
+            }
+            const allTags = [...tags.headTags, ...tags.bodyTags];
+            for (const tag of allTags) {
+              let url2 = "";
+              if (!tag.attrs) {
+                continue;
+              }
+              if (tag.tag === "script" && typeof tag.attrs.src === "string") {
+                url2 = tag.attrs.src;
+              } else if (tag.tag === "link" && tag.attrs.rel === "stylesheet" && typeof tag.attrs.href === "string") {
+                url2 = tag.attrs.href;
+              }
+              if (!url2) {
+                continue;
+              }
+              const assetName = getAssetName(url2, assetPrefix);
+              if (!assetName) {
+                continue;
+              }
+              tag.attrs.integrity ??= `${placeholder}${assetName}`;
+            }
+            return tags;
+          }
+        });
+        const replaceIntegrity = (htmlContent, assets, algorithm, integrityCache) => {
+          const regex = /integrity="RSBUILD_INTEGRITY_PLACEHOLDER:([^"]+)"/g;
+          const matches = htmlContent.matchAll(regex);
+          let replacedHtml = htmlContent;
+          const calcIntegrity = (algorithm2, assetName, data) => {
+            if (integrityCache.has(assetName)) {
+              return integrityCache.get(assetName);
+            }
+            const hash = import_node_crypto2.default.createHash(algorithm2).update(data).digest().toString("base64");
+            const integrity = `${algorithm2}-${hash}`;
+            integrityCache.set(assetName, integrity);
+            return integrity;
+          };
+          for (const match of matches) {
+            const assetName = match[1];
+            if (!assetName) {
+              continue;
+            }
+            if (assets[assetName]) {
+              const integrity = calcIntegrity(
+                algorithm,
+                assetName,
+                assets[assetName].buffer()
+              );
+              replacedHtml = replacedHtml.replaceAll(
+                `integrity="${placeholder}${assetName}"`,
+                `integrity="${integrity}"`
+              );
+            } else {
+              import_shared57.logger.debug(
+                `[rsbuild:sri] failed to generate integrity for ${assetName}.`
+              );
+              replacedHtml = replacedHtml.replace(
+                `integrity="${placeholder}${assetName}"`,
+                ""
+              );
+            }
+          }
+          return replacedHtml;
+        };
+        class SriReplaceIntegrityPlugin {
+          constructor(algorithm) {
+            __publicField(this, "algorithm");
+            this.algorithm = algorithm;
+          }
+          apply(compiler) {
+            compiler.hooks.compilation.tap(
+              "SriReplaceIntegrityPlugin",
+              (compilation) => {
+                compilation.hooks.processAssets.tapPromise(
+                  {
+                    name: "SriReplaceIntegrityPlugin",
+                    // use to final stage to get the final asset content
+                    stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+                  },
+                  async (assets) => {
+                    const integrityCache = /* @__PURE__ */ new Map();
+                    for (const asset of Object.keys(assets)) {
+                      if (!HTML_REGEX.test(asset)) {
+                        continue;
+                      }
+                      const htmlContent = assets[asset].source();
+                      if (!htmlContent.includes(placeholder)) {
+                        continue;
+                      }
+                      assets[asset] = new compiler.webpack.sources.RawSource(
+                        replaceIntegrity(
+                          htmlContent,
+                          assets,
+                          this.algorithm,
+                          integrityCache
+                        )
+                      );
+                    }
+                  }
+                );
+              }
+            );
+          }
+        }
+        api.modifyBundlerChain((chain, { target }) => {
+          const config = api.getNormalizedConfig();
+          if ((0, import_shared57.isHtmlDisabled)(config, target)) {
+            return;
+          }
+          const algorithm = getAlgorithm();
+          if (!algorithm) {
+            return;
+          }
+          chain.plugin("rsbuild-sri-replace").use(SriReplaceIntegrityPlugin, [algorithm]);
+        });
+      }
+    });
+  }
+});
+
+// src/plugins/nonce.ts
+var nonce_exports = {};
+__export(nonce_exports, {
+  pluginNonce: () => pluginNonce
+});
+var import_shared58, pluginNonce;
+var init_nonce = __esm({
+  "src/plugins/nonce.ts"() {
+    "use strict";
+    import_shared58 = require("@rsbuild/shared");
+    pluginNonce = () => ({
+      name: "rsbuild:nonce",
+      setup(api) {
+        api.onAfterCreateCompiler(({ compiler }) => {
+          const { nonce } = api.getNormalizedConfig().security;
+          if (!nonce) {
+            return;
+          }
+          (0, import_shared58.applyToCompiler)(compiler, (compiler2) => {
+            const { plugins } = compiler2.options;
+            const hasHTML = plugins.some(
+              (plugin) => plugin && plugin.constructor.name === "HtmlBasicPlugin"
+            );
+            if (!hasHTML) {
+              return;
+            }
+            const injectCode = (0, import_shared58.createVirtualModule)(
+              `__webpack_nonce__ = "${nonce}";`
+            );
+            new compiler2.webpack.EntryPlugin(compiler2.context, injectCode, {
+              name: void 0
+            }).apply(compiler2);
+          });
+        });
+        api.modifyHTMLTags({
+          // ensure `nonce` can be applied to all tags
+          order: "post",
+          handler: ({ headTags, bodyTags }) => {
+            const config = api.getNormalizedConfig();
+            const { nonce } = config.security;
+            const allTags = [...headTags, ...bodyTags];
+            if (nonce) {
+              for (const tag of allTags) {
+                if (tag.tag === "script" || tag.tag === "style") {
+                  tag.attrs ??= {};
+                  tag.attrs.nonce = nonce;
+                }
+              }
+            }
+            return { headTags, bodyTags };
+          }
+        });
+      }
+    });
+  }
+});
+
 // src/createRsbuild.ts
 var createRsbuild_exports = {};
 __export(createRsbuild_exports, {
@@ -6640,6 +6824,8 @@ async function applyDefaultPlugins(pluginManager, context) {
   const { pluginModuleFederation: pluginModuleFederation2 } = await Promise.resolve().then(() => (init_moduleFederation(), moduleFederation_exports));
   const { pluginRspackProfile: pluginRspackProfile2 } = await Promise.resolve().then(() => (init_rspackProfile(), rspackProfile_exports));
   const { pluginLazyCompilation: pluginLazyCompilation2 } = await Promise.resolve().then(() => (init_lazyCompilation(), lazyCompilation_exports));
+  const { pluginSri: pluginSri2 } = await Promise.resolve().then(() => (init_sri(), sri_exports));
+  const { pluginNonce: pluginNonce2 } = await Promise.resolve().then(() => (init_nonce(), nonce_exports));
   pluginManager.addPlugins([
     pluginBasic2(),
     pluginEntry2(),
@@ -6651,8 +6837,8 @@ async function applyDefaultPlugins(pluginManager, context) {
     // cleanOutput plugin should before the html plugin
     pluginCleanOutput2(),
     pluginAsset2(),
-    pluginHtml2(async (tags) => {
-      const result = await context.hooks.modifyHTMLTags.call(tags);
+    pluginHtml2(async (...args) => {
+      const result = await context.hooks.modifyHTMLTags.call(...args);
       return result[0];
     }),
     pluginWasm2(),
@@ -6675,7 +6861,9 @@ async function applyDefaultPlugins(pluginManager, context) {
     pluginManifest2(),
     pluginModuleFederation2(),
     pluginRspackProfile2(),
-    pluginLazyCompilation2()
+    pluginLazyCompilation2(),
+    pluginSri2(),
+    pluginNonce2()
   ]);
 }
 async function createRsbuild(options = {}) {
@@ -6693,9 +6881,9 @@ async function createRsbuild(options = {}) {
   );
   const pluginAPI = getPluginAPI({ context, pluginManager });
   context.pluginAPI = pluginAPI;
-  (0, import_shared57.debug)("add default plugins");
+  (0, import_shared59.debug)("add default plugins");
   await applyDefaultPlugins(pluginManager, context);
-  (0, import_shared57.debug)("add default plugins done");
+  (0, import_shared59.debug)("add default plugins done");
   const provider = rsbuildConfig.provider || await getRspackProvider();
   const providerInstance = await provider({
     context,
@@ -6704,13 +6892,13 @@ async function createRsbuild(options = {}) {
     setCssExtractPlugin
   });
   const rsbuild = {
-    ...(0, import_shared57.pick)(pluginManager, [
+    ...(0, import_shared59.pick)(pluginManager, [
       "addPlugins",
       "getPlugins",
       "removePlugins",
       "isPluginExists"
     ]),
-    ...(0, import_shared57.pick)(pluginAPI, [
+    ...(0, import_shared59.pick)(pluginAPI, [
       "onBeforeBuild",
       "onBeforeCreateCompiler",
       "onBeforeStartDevServer",
@@ -6726,7 +6914,7 @@ async function createRsbuild(options = {}) {
       "getRsbuildConfig",
       "getNormalizedConfig"
     ]),
-    ...(0, import_shared57.pick)(providerInstance, [
+    ...(0, import_shared59.pick)(providerInstance, [
       "build",
       "preview",
       "initConfigs",
@@ -6743,11 +6931,11 @@ async function createRsbuild(options = {}) {
   }
   return rsbuild;
 }
-var import_shared57, getRspackProvider, pickRsbuildConfig;
+var import_shared59, getRspackProvider, pickRsbuildConfig;
 var init_createRsbuild = __esm({
   "src/createRsbuild.ts"() {
     "use strict";
-    import_shared57 = require("@rsbuild/shared");
+    import_shared59 = require("@rsbuild/shared");
     init_createContext();
     init_initPlugins();
     init_pluginHelper();
@@ -6769,7 +6957,7 @@ var init_createRsbuild = __esm({
         "moduleFederation",
         "_privateMeta"
       ];
-      return (0, import_shared57.pick)(rsbuildConfig, keys);
+      return (0, import_shared59.pick)(rsbuildConfig, keys);
     };
   }
 });
@@ -6788,7 +6976,7 @@ async function init({
       cwd: root,
       mode: cliOptions?.envMode
     });
-    if ((0, import_shared58.isDev)()) {
+    if ((0, import_shared60.isDev)()) {
       onBeforeRestartServer(envs.cleanup);
     }
     const { content: config, filePath: configFilePath } = await loadConfig({
@@ -6828,17 +7016,17 @@ async function init({
     });
   } catch (err) {
     if (isRestart) {
-      import_shared58.logger.error(err);
+      import_shared60.logger.error(err);
     } else {
       throw err;
     }
   }
 }
-var import_shared58, commonOpts;
+var import_shared60, commonOpts;
 var init_init = __esm({
   "src/cli/init.ts"() {
     "use strict";
-    import_shared58 = require("@rsbuild/shared");
+    import_shared60 = require("@rsbuild/shared");
     init_config();
     init_loadEnv();
     init_restart();
@@ -6856,7 +7044,7 @@ __export(src_exports, {
   defineConfig: () => defineConfig,
   loadConfig: () => loadConfig,
   loadEnv: () => loadEnv,
-  logger: () => import_shared61.logger,
+  logger: () => import_shared63.logger,
   mergeRsbuildConfig: () => mergeRsbuildConfig,
   rspack: () => import_core10.rspack,
   version: () => version
@@ -6888,7 +7076,7 @@ __export(internal_exports, {
 // src/cli/commands.ts
 var import_node_fs5 = require("fs");
 var import_node_path28 = require("path");
-var import_shared59 = require("@rsbuild/shared");
+var import_shared61 = require("@rsbuild/shared");
 var import_commander = require("../compiled/commander/index.js");
 init_helpers();
 init_init();
@@ -6905,7 +7093,7 @@ var applyServerOptions = (command) => {
   command.option("-o --open [url]", "open the page in browser on startup").option("--port <port>", "specify a port number for server to listen").option("--host <host>", "specify the host that the server listens to");
 };
 function runCli() {
-  import_commander.program.name("rsbuild").usage("<command> [options]").version("0.7.2");
+  import_commander.program.name("rsbuild").usage("<command> [options]").version("0.7.3");
   const devCommand = import_commander.program.command("dev");
   const buildCommand = import_commander.program.command("build");
   const previewCommand = import_commander.program.command("preview");
@@ -6919,8 +7107,8 @@ function runCli() {
       const rsbuild = await init({ cliOptions: options });
       await rsbuild?.startDevServer();
     } catch (err) {
-      import_shared59.logger.error("Failed to start dev server.");
-      import_shared59.logger.error(err);
+      import_shared61.logger.error("Failed to start dev server.");
+      import_shared61.logger.error(err);
       process.exit(1);
     }
   });
@@ -6931,8 +7119,8 @@ function runCli() {
         watch: options.watch
       });
     } catch (err) {
-      import_shared59.logger.error("Failed to build.");
-      import_shared59.logger.error(err);
+      import_shared61.logger.error("Failed to build.");
+      import_shared61.logger.error(err);
       process.exit(1);
     }
   });
@@ -6943,14 +7131,14 @@ function runCli() {
         const { distPath } = rsbuild.context;
         if (!(0, import_node_fs5.existsSync)(distPath)) {
           throw new Error(
-            `The output directory ${import_shared59.color.yellow(
+            `The output directory ${import_shared61.color.yellow(
               distPath
             )} does not exist, please build the project before previewing.`
           );
         }
         if (isEmptyDir(distPath)) {
           throw new Error(
-            `The output directory ${import_shared59.color.yellow(
+            `The output directory ${import_shared61.color.yellow(
               distPath
             )} is empty, please build the project before previewing.`
           );
@@ -6958,8 +7146,8 @@ function runCli() {
       }
       await rsbuild?.preview();
     } catch (err) {
-      import_shared59.logger.error("Failed to start preview server.");
-      import_shared59.logger.error(err);
+      import_shared61.logger.error("Failed to start preview server.");
+      import_shared61.logger.error(err);
       process.exit(1);
     }
   });
@@ -6973,8 +7161,8 @@ function runCli() {
         writeToDisk: true
       });
     } catch (err) {
-      import_shared59.logger.error("Failed to inspect config.");
-      import_shared59.logger.error(err);
+      import_shared61.logger.error("Failed to inspect config.");
+      import_shared61.logger.error(err);
       process.exit(1);
     }
   });
@@ -6982,7 +7170,7 @@ function runCli() {
 }
 
 // src/cli/prepare.ts
-var import_shared60 = require("@rsbuild/shared");
+var import_shared62 = require("@rsbuild/shared");
 function initNodeEnv() {
   if (!process.env.NODE_ENV) {
     const command = process.argv[2];
@@ -6995,7 +7183,7 @@ function prepareCli() {
   if (!npm_execpath || npm_execpath.includes("npx-cli.js") || npm_execpath.includes(".bun")) {
     console.log();
   }
-  import_shared60.logger.greet(`  ${`Rsbuild v${"0.7.2"}`}
+  import_shared62.logger.greet(`  ${`Rsbuild v${"0.7.3"}`}
 `);
 }
 
@@ -7018,10 +7206,10 @@ init_prodServer();
 init_loadEnv();
 init_createRsbuild();
 init_config();
-var import_shared61 = require("@rsbuild/shared");
+var import_shared63 = require("@rsbuild/shared");
 init_mergeConfig();
 init_constants();
-var version = "0.7.2";
+var version = "0.7.3";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PLUGIN_CSS_NAME,