@rsbuild/core 0.7.2 → 0.7.3

package/dist/index.js

@@ -23,12 +23,12 @@ var __publicField = (obj, key, value) => {
   return value;
 };
 
-// ../../node_modules/.pnpm/@modern-js+module-tools@2.50.0_eslint@9.4.0_typescript@5.4.5/node_modules/@modern-js/module-tools/shims/esm.js
+// ../../node_modules/.pnpm/@modern-js+module-tools@2.51.0_eslint@9.4.0_typescript@5.4.5/node_modules/@modern-js/module-tools/shims/esm.js
 import { fileURLToPath } from "url";
 import path from "path";
 var getFilename, getDirname, __dirname, __filename;
 var init_esm = __esm({
-  "../../node_modules/.pnpm/@modern-js+module-tools@2.50.0_eslint@9.4.0_typescript@5.4.5/node_modules/@modern-js/module-tools/shims/esm.js"() {
+  "../../node_modules/.pnpm/@modern-js+module-tools@2.51.0_eslint@9.4.0_typescript@5.4.5/node_modules/@modern-js/module-tools/shims/esm.js"() {
     "use strict";
     getFilename = () => fileURLToPath(import.meta.url);
     getDirname = () => path.dirname(getFilename());
@@ -636,7 +636,10 @@ var init_config = __esm({
       scriptLoading: "defer"
     });
     getDefaultSecurityConfig = () => ({
-      nonce: ""
+      nonce: "",
+      sri: {
+        enable: false
+      }
     });
     getDefaultToolsConfig = () => ({
       cssExtract: {
@@ -757,8 +760,8 @@ var init_config = __esm({
 import fs2 from "fs";
 import { join as join3 } from "path";
 import { getNodeEnv as getNodeEnv2 } from "@rsbuild/shared";
-import { expand } from "../compiled/dotenv-expand/index.js";
 import { parse } from "../compiled/dotenv/index.js";
+import { expand } from "../compiled/dotenv-expand/index.js";
 function loadEnv({
   cwd = process.cwd(),
   mode = getNodeEnv2(),
@@ -889,17 +892,16 @@ import {
   castArray as castArray2,
   color as color4,
   createVirtualModule,
-  mergeChainedOptions
+  reduceConfigsMergeContext
 } from "@rsbuild/shared";
 function getEntryObject(config, target) {
   if (!config.source?.entry) {
     return {};
   }
-  return mergeChainedOptions({
-    defaults: {},
-    options: config.source?.entry,
-    utils: { target },
-    useObjectParam: true
+  return reduceConfigsMergeContext({
+    initial: {},
+    config: config.source?.entry,
+    ctx: { target }
   });
 }
 var pluginEntry;
@@ -967,7 +969,7 @@ async function createContextByConfig(options, bundlerType, config = {}) {
   return {
     entry: getEntryObject(config, "web"),
     targets: config.output?.targets || [],
-    version: "0.7.2",
+    version: "0.7.3",
     rootPath,
     distPath,
     cachePath,
@@ -1443,8 +1445,8 @@ import {
   chainToConfig,
   debug as debug2,
   getNodeEnv as getNodeEnv4,
-  mergeChainedOptions as mergeChainedOptions2,
-  modifyBundlerChain
+  modifyBundlerChain,
+  reduceConfigsAsyncWithContext
 } from "@rsbuild/shared";
 import { rspack as rspack2 } from "@rspack/core";
 async function modifyRspackConfig(context, rspackConfig, utils) {
@@ -1454,10 +1456,10 @@ async function modifyRspackConfig(context, rspackConfig, utils) {
     utils
   );
   if (context.config.tools?.rspack) {
-    modifiedConfig = mergeChainedOptions2({
-      defaults: modifiedConfig,
-      options: context.config.tools.rspack,
-      utils,
+    modifiedConfig = await reduceConfigsAsyncWithContext({
+      initial: modifiedConfig,
+      config: context.config.tools.rspack,
+      ctx: utils,
       mergeFn: utils.mergeConfig
     });
   }
@@ -3325,12 +3327,12 @@ var init_basic = __esm({
       name: "rsbuild:basic",
       setup(api) {
         api.modifyBundlerChain(
-          (chain, { env, isProd: isProd4, target, bundler, CHAIN_ID: CHAIN_ID3 }) => {
+          (chain, { env, isProd: isProd5, target, bundler, CHAIN_ID: CHAIN_ID3 }) => {
             const config = api.getNormalizedConfig();
             chain.name(TARGET_ID_MAP2[target]);
             chain.devtool(getJsSourceMap(config));
             chain.context(api.context.rootPath);
-            chain.mode(isProd4 ? "production" : "development");
+            chain.mode(isProd5 ? "production" : "development");
             chain.merge({
               infrastructureLogging: {
                 // Using `error` level to avoid `cache.PackFileCacheStrategy` logs
@@ -3343,9 +3345,9 @@ var init_basic = __esm({
                 exportsPresence: "error"
               }
             });
-            const isMinimize = isProd4 && config.output.minify !== false;
+            const isMinimize = isProd5 && config.output.minify !== false;
             chain.optimization.minimize(isMinimize);
-            const usingHMR = isUsingHMR(config, { target, isProd: isProd4 });
+            const usingHMR = isUsingHMR(config, { target, isProd: isProd5 });
             if (usingHMR) {
               chain.plugin(CHAIN_ID3.PLUGIN.HMR).use(bundler.HotModuleReplacementPlugin);
             }
@@ -3516,7 +3518,8 @@ import {
   getBrowserslistWithDefault as getBrowserslistWithDefault2,
   isFunction as isFunction5,
   isPlainObject as isPlainObject2,
-  mergeChainedOptions as mergeChainedOptions3
+  reduceConfigs,
+  reduceConfigsWithContext
 } from "@rsbuild/shared";
 async function loadUserPostcssrc(root) {
   const cached = userPostcssrcCache.get(root);
@@ -3540,7 +3543,7 @@ async function applyCSSRule({
   rule,
   config,
   context,
-  utils: { target, isProd: isProd4, CHAIN_ID: CHAIN_ID3 },
+  utils: { target, isProd: isProd5, CHAIN_ID: CHAIN_ID3 },
   importLoaders = 1
 }) {
   const browserslist = await getBrowserslistWithDefault2(
@@ -3549,7 +3552,7 @@ async function applyCSSRule({
     target
   );
   const enableExtractCSS = isUseCssExtract(config, target);
-  const localIdentName = getCSSModulesLocalIdentName(config, isProd4);
+  const localIdentName = getCSSModulesLocalIdentName(config, isProd5);
   const cssLoaderOptions = getCSSLoaderOptions({
     config,
     importLoaders,
@@ -3560,9 +3563,9 @@ async function applyCSSRule({
     if (enableExtractCSS) {
       rule.use(CHAIN_ID3.USE.MINI_CSS_EXTRACT).loader(getCssExtractPlugin().loader).options(config.tools.cssExtract.loaderOptions).end();
     } else {
-      const styleLoaderOptions = mergeChainedOptions3({
-        defaults: {},
-        options: config.tools.styleLoader
+      const styleLoaderOptions = reduceConfigs({
+        initial: {},
+        config: config.tools.styleLoader
       });
       rule.use(CHAIN_ID3.USE.STYLE).loader(getCompiledPath("style-loader")).options(styleLoaderOptions).end();
     }
@@ -3591,8 +3594,8 @@ var init_css = __esm({
     init_pluginHelper();
     enableNativeCss = (config) => !config.output.injectStyles;
     isUseCssExtract = (config, target) => !config.output.injectStyles && target !== "node" && target !== "web-worker";
-    getCSSModulesLocalIdentName = (config, isProd4) => config.output.cssModules.localIdentName || // Using shorter classname in production to reduce bundle size
-    (isProd4 ? "[local]-[hash:base64:6]" : "[path][name]__[local]-[hash:base64:6]");
+    getCSSModulesLocalIdentName = (config, isProd5) => config.output.cssModules.localIdentName || // Using shorter classname in production to reduce bundle size
+    (isProd5 ? "[local]-[hash:base64:6]" : "[path][name]__[local]-[hash:base64:6]");
     normalizeCssLoaderOptions = (options, exportOnlyLocals) => {
       if (options.modules && exportOnlyLocals) {
         let { modules } = options;
@@ -3629,12 +3632,12 @@ var init_css = __esm({
       });
       if (!hasAutoprefixer) {
         const { default: autoprefixer } = await import("@rsbuild/shared/autoprefixer");
-        const autoprefixerOptions = mergeChainedOptions3({
-          defaults: {
+        const autoprefixerOptions = reduceConfigs({
+          initial: {
             flexbox: "no-2009",
             overrideBrowserslist: browserslist
           },
-          options: config.tools.autoprefixer
+          config: config.tools.autoprefixer
         });
         pluginObjects.push(autoprefixer(autoprefixerOptions));
       }
@@ -3669,10 +3672,10 @@ var init_css = __esm({
         },
         sourceMap: config.output.sourceMap.css
       };
-      const mergedConfig = mergeChainedOptions3({
-        defaults: defaultPostcssConfig,
-        options: config.tools.postcss,
-        utils
+      const mergedConfig = reduceConfigsWithContext({
+        initial: defaultPostcssConfig,
+        config: config.tools.postcss,
+        ctx: utils
       });
       if (extraPlugins.length) {
         mergedConfig?.postcssOptions?.plugins.push(...extraPlugins);
@@ -3696,9 +3699,9 @@ var init_css = __esm({
         },
         sourceMap: config.output.sourceMap.css
       };
-      const mergedCssLoaderOptions = mergeChainedOptions3({
-        defaults: defaultOptions2,
-        options: config.tools.cssLoader,
+      const mergedCssLoaderOptions = reduceConfigs({
+        initial: defaultOptions2,
+        config: config.tools.cssLoader,
         mergeFn: deepmerge2
       });
       const cssLoaderOptions = normalizeCssLoaderOptions(
@@ -3748,13 +3751,13 @@ import {
 } from "@rsbuild/shared";
 import { rspack as rspack5 } from "@rspack/core";
 function getPublicPath({
-  isProd: isProd4,
+  isProd: isProd5,
   config,
   context
 }) {
   const { dev, output } = config;
   let publicPath = DEFAULT_ASSET_PREFIX3;
-  if (isProd4) {
+  if (isProd5) {
     if (typeof output.assetPrefix === "string") {
       publicPath = output.assetPrefix;
     }
@@ -3785,20 +3788,23 @@ var init_output = __esm({
       name: "rsbuild:output",
       setup(api) {
         api.modifyBundlerChain(
-          async (chain, { CHAIN_ID: CHAIN_ID3, target, isProd: isProd4, isServer, isServiceWorker }) => {
+          async (chain, { CHAIN_ID: CHAIN_ID3, target, isProd: isProd5, isServer, isServiceWorker }) => {
             const config = api.getNormalizedConfig();
             const publicPath = getPublicPath({
               config,
-              isProd: isProd4,
+              isProd: isProd5,
               context: api.context
             });
             const jsPath = getDistPath3(config, "js");
             const jsAsyncPath = getDistPath3(config, "jsAsync");
-            const jsFilename = getFilename2(config, "js", isProd4);
+            const jsFilename = getFilename2(config, "js", isProd5);
             chain.output.path(api.context.distPath).filename(posix.join(jsPath, jsFilename)).chunkFilename(posix.join(jsAsyncPath, jsFilename)).publicPath(publicPath).pathinfo(false).hashFunction("xxhash64");
             if (isServer) {
               const serverPath = getDistPath3(config, "server");
-              chain.output.path(posix.join(api.context.distPath, serverPath)).filename("[name].js").chunkFilename("[name].js").libraryTarget("commonjs2");
+              chain.output.path(posix.join(api.context.distPath, serverPath)).filename("[name].js").chunkFilename("[name].js").library({
+                ...chain.output.get("library") || {},
+                type: "commonjs2"
+              });
             }
             if (isServiceWorker) {
               const workerPath = getDistPath3(config, "worker");
@@ -3813,7 +3819,7 @@ var init_output = __esm({
             if (isUseCssExtract(config, target)) {
               const extractPluginOptions = config.tools.cssExtract.pluginOptions;
               const cssPath = getDistPath3(config, "css");
-              const cssFilename = getFilename2(config, "css", isProd4);
+              const cssFilename = getFilename2(config, "css", isProd5);
               const cssAsyncPath = getDistPath3(config, "cssAsync");
               chain.plugin(CHAIN_ID3.PLUGIN.MINI_CSS_EXTRACT).use(getCssExtractPlugin(), [
                 {
@@ -3837,7 +3843,7 @@ __export(resolve_exports, {
 });
 import {
   castArray as castArray4,
-  mergeChainedOptions as mergeChainedOptions4
+  reduceConfigsWithContext as reduceConfigsWithContext2
 } from "@rsbuild/shared";
 function applyFullySpecified({
   chain,
@@ -3867,10 +3873,10 @@ function applyAlias({
   if (!alias) {
     return;
   }
-  const mergedAlias = mergeChainedOptions4({
-    defaults: {},
-    options: alias,
-    utils: { target }
+  const mergedAlias = reduceConfigsWithContext2({
+    initial: {},
+    config: alias,
+    ctx: { target }
   });
   for (const name of Object.keys(mergedAlias)) {
     const values = castArray4(mergedAlias[name]);
@@ -4202,12 +4208,12 @@ var init_asset = __esm({
     pluginAsset = () => ({
       name: "rsbuild:asset",
       setup(api) {
-        api.modifyBundlerChain((chain, { isProd: isProd4, target }) => {
+        api.modifyBundlerChain((chain, { isProd: isProd5, target }) => {
           const config = api.getNormalizedConfig();
           const createAssetRule = (assetType, exts, emit2) => {
             const regExp = getRegExpForExts(exts);
             const distDir = getDistPath4(config, assetType);
-            const filename = getFilename3(config, assetType, isProd4);
+            const filename = getFilename3(config, assetType, isProd5);
             const { dataUriLimit } = config.output;
             const maxSize = typeof dataUriLimit === "number" ? dataUriLimit : dataUriLimit[assetType];
             const rule = chain.module.rule(assetType).test(regExp);
@@ -4290,9 +4296,9 @@ var init_minimize = __esm({
       }
       return options;
     };
-    parseMinifyOptions = (config, isProd4 = true) => {
+    parseMinifyOptions = (config, isProd5 = true) => {
       const minify = config.output.minify;
-      if (minify === false || !isProd4) {
+      if (minify === false || !isProd5) {
         return {
           minifyJs: false,
           minifyCss: false,
@@ -4324,9 +4330,9 @@ var init_minimize = __esm({
         if (api.context.bundlerType === "webpack") {
           return;
         }
-        api.modifyBundlerChain(async (chain, { isProd: isProd4 }) => {
+        api.modifyBundlerChain(async (chain, { isProd: isProd5 }) => {
           const config = api.getNormalizedConfig();
-          const isMinimize = isProd4 && config.output.minify !== false;
+          const isMinimize = isProd5 && config.output.minify !== false;
           if (!isMinimize) {
             return;
           }
@@ -4534,10 +4540,17 @@ var init_HtmlBasicPlugin = __esm({
               addTitleTag(headTags, data.plugin.options?.title);
             }
             addFavicon(headTags, favicon);
-            const result = await this.modifyTagsFn({
-              headTags: headTags.map(formatBasicTag),
-              bodyTags: bodyTags.map(formatBasicTag)
-            });
+            const result = await this.modifyTagsFn(
+              {
+                headTags: headTags.map(formatBasicTag),
+                bodyTags: bodyTags.map(formatBasicTag)
+              },
+              {
+                compilation,
+                assetPrefix: data.publicPath,
+                filename: data.outputName
+              }
+            );
             Object.assign(data, {
               headTags: result.headTags.map(fromBasicTag),
               bodyTags: result.bodyTags.map(fromBasicTag)
@@ -4636,18 +4649,16 @@ __export(html_exports, {
 });
 import path9, { isAbsolute as isAbsolute6 } from "path";
 import {
-  applyToCompiler as applyToCompiler2,
   castArray as castArray5,
   color as color11,
-  createVirtualModule as createVirtualModule2,
   deepmerge as deepmerge4,
   fse as fse5,
   getDistPath as getDistPath5,
   isHtmlDisabled,
-  isNil,
   isPlainObject as isPlainObject3,
   isURL,
-  mergeChainedOptions as mergeChainedOptions5
+  reduceConfigsMergeContext as reduceConfigsMergeContext2,
+  reduceConfigsWithContext as reduceConfigsWithContext3
 } from "@rsbuild/shared";
 function applyRemoveConsole(options, config) {
   const { removeConsole } = config.performance;
@@ -4681,8 +4692,8 @@ function getTerserMinifyOptions(config) {
   const finalOptions = applyRemoveConsole(options, config);
   return finalOptions;
 }
-async function getHtmlMinifyOptions(isProd4, config) {
-  if (!isProd4 || !config.output.minify || !parseMinifyOptions(config).minifyHtml) {
+async function getHtmlMinifyOptions(isProd5, config) {
+  if (!isProd5 || !config.output.minify || !parseMinifyOptions(config).minifyHtml) {
     return false;
   }
   const minifyJS = getTerserMinifyOptions(config);
@@ -4703,29 +4714,25 @@ async function getHtmlMinifyOptions(isProd4, config) {
   return typeof htmlMinifyOptions === "object" ? deepmerge4(htmlMinifyDefaultOptions, htmlMinifyOptions) : htmlMinifyDefaultOptions;
 }
 function getTitle(entryName, config) {
-  return mergeChainedOptions5({
-    defaults: "",
-    options: config.html.title,
-    utils: { entryName },
-    useObjectParam: true
+  return reduceConfigsMergeContext2({
+    initial: "",
+    config: config.html.title,
+    ctx: { entryName }
   });
 }
 function getInject(entryName, config) {
-  return mergeChainedOptions5({
-    defaults: "head",
-    options: config.html.inject,
-    utils: { entryName },
-    useObjectParam: true,
-    isFalsy: isNil
+  return reduceConfigsMergeContext2({
+    initial: "head",
+    config: config.html.inject,
+    ctx: { entryName }
   });
 }
 async function getTemplate(entryName, config, rootPath) {
   const DEFAULT_TEMPLATE = path9.resolve(STATIC_PATH, "template.html");
-  const templatePath = mergeChainedOptions5({
-    defaults: DEFAULT_TEMPLATE,
-    options: config.html.template,
-    utils: { entryName },
-    useObjectParam: true
+  const templatePath = reduceConfigsMergeContext2({
+    initial: DEFAULT_TEMPLATE,
+    config: config.html.template,
+    ctx: { entryName }
   });
   if (templatePath === DEFAULT_TEMPLATE) {
     return {
@@ -4750,19 +4757,17 @@ async function getTemplate(entryName, config, rootPath) {
   };
 }
 function getFavicon(entryName, config) {
-  return mergeChainedOptions5({
-    defaults: "",
-    options: config.html.favicon,
-    utils: { entryName },
-    useObjectParam: true
+  return reduceConfigsMergeContext2({
+    initial: "",
+    config: config.html.favicon,
+    ctx: { entryName }
   });
 }
 function getMetaTags(entryName, config, templateContent) {
-  const metaTags = mergeChainedOptions5({
-    defaults: {},
-    options: config.html.meta,
-    utils: { entryName },
-    useObjectParam: true
+  const metaTags = reduceConfigsMergeContext2({
+    initial: {},
+    config: config.html.meta,
+    ctx: { entryName }
   });
   if (templateContent && metaTags.charset) {
     const charsetRegExp = /<meta[^>]+charset=["'][^>]*>/i;
@@ -4787,10 +4792,10 @@ function getTemplateParameters(entryName, config, assetPrefix) {
         options: pluginOptions
       }
     };
-    return mergeChainedOptions5({
-      defaults: defaultOptions2,
-      options: templateParameters,
-      utils: { entryName }
+    return reduceConfigsWithContext3({
+      initial: defaultOptions2,
+      config: templateParameters,
+      ctx: { entryName }
     });
   };
 }
@@ -4838,12 +4843,12 @@ var init_html = __esm({
       name: "rsbuild:html",
       setup(api) {
         api.modifyBundlerChain(
-          async (chain, { HtmlPlugin, isProd: isProd4, CHAIN_ID: CHAIN_ID3, target }) => {
+          async (chain, { HtmlPlugin, isProd: isProd5, CHAIN_ID: CHAIN_ID3, target }) => {
             const config = api.getNormalizedConfig();
             if (isHtmlDisabled(config, target)) {
               return;
             }
-            const minify = await getHtmlMinifyOptions(isProd4, config);
+            const minify = await getHtmlMinifyOptions(isProd5, config);
             const assetPrefix = getPublicPathFromChain(chain, false);
             const entries = chain.entryPoints.entries() || {};
             const entryNames = Object.keys(entries);
@@ -4852,11 +4857,7 @@ var init_html = __esm({
             const finalOptions = await Promise.all(
               entryNames.map(async (entryName) => {
                 const entryValue = entries[entryName].values();
-                const chunks = getChunks(
-                  entryName,
-                  // EntryDescription type is different between webpack and Rspack
-                  entryValue
-                );
+                const chunks = getChunks(entryName, entryValue);
                 const inject = getInject(entryName, config);
                 const filename = htmlPaths[entryName];
                 const { templatePath, templateContent } = await getTemplate(
@@ -4902,13 +4903,10 @@ var init_html = __esm({
                     pluginOptions.favicon = favicon;
                   }
                 }
-                const finalOptions2 = mergeChainedOptions5({
-                  defaults: pluginOptions,
-                  options: typeof config.tools.htmlPlugin === "boolean" ? {} : config.tools.htmlPlugin,
-                  utils: {
-                    entryName,
-                    entryValue
-                  }
+                const finalOptions2 = reduceConfigsWithContext3({
+                  initial: pluginOptions,
+                  config: typeof config.tools.htmlPlugin === "boolean" ? {} : config.tools.htmlPlugin,
+                  ctx: { entryName, entryValue }
                 });
                 return finalOptions2;
               })
@@ -4933,52 +4931,21 @@ var init_html = __esm({
             }
           }
         );
-        api.onAfterCreateCompiler(({ compiler }) => {
-          const { nonce } = api.getNormalizedConfig().security;
-          if (!nonce) {
-            return;
-          }
-          applyToCompiler2(compiler, (compiler2) => {
-            const { plugins } = compiler2.options;
-            const hasHTML = plugins.some(
-              (plugin) => plugin && plugin.constructor.name === "HtmlBasicPlugin"
-            );
-            if (!hasHTML) {
-              return;
-            }
-            const injectCode = createVirtualModule2(
-              `__webpack_nonce__ = "${nonce}";`
-            );
-            new compiler2.webpack.EntryPlugin(compiler2.context, injectCode, {
-              name: void 0
-            }).apply(compiler2);
-          });
-        });
         api.modifyHTMLTags({
           // ensure `crossorigin` and `nonce` can be applied to all tags
           order: "post",
           handler: ({ headTags, bodyTags }) => {
             const config = api.getNormalizedConfig();
             const { crossorigin } = config.html;
-            const { nonce } = config.security;
             const allTags = [...headTags, ...bodyTags];
             if (crossorigin) {
               const formattedCrossorigin = crossorigin === true ? "anonymous" : crossorigin;
               for (const tag of allTags) {
                 if (tag.tag === "script" && tag.attrs?.src || tag.tag === "link" && tag.attrs?.rel === "stylesheet") {
-                  tag.attrs ||= {};
                   tag.attrs.crossorigin ??= formattedCrossorigin;
                 }
               }
             }
-            if (nonce) {
-              for (const tag of allTags) {
-                if (tag.tag === "script" || tag.tag === "style") {
-                  tag.attrs ??= {};
-                  tag.attrs.nonce = nonce;
-                }
-              }
-            }
             return { headTags, bodyTags };
           }
         });
@@ -5188,7 +5155,7 @@ import {
   getBrowserslistWithDefault as getBrowserslistWithDefault3,
   getCoreJsVersion,
   isWebTarget,
-  mergeChainedOptions as mergeChainedOptions6
+  reduceConfigs as reduceConfigs2
 } from "@rsbuild/shared";
 async function getDefaultSwcConfig(config, rootPath, target) {
   return {
@@ -5294,9 +5261,9 @@ var init_swc = __esm({
                 await applyCoreJs(swcConfig, chain, polyfillMode);
               }
             }
-            const mergedSwcConfig = mergeChainedOptions6({
-              defaults: swcConfig,
-              options: config.tools.swc,
+            const mergedSwcConfig = reduceConfigs2({
+              initial: swcConfig,
+              config: config.tools.swc,
               mergeFn: deepmerge5
             });
             rule.use(CHAIN_ID3.USE.SWC).loader(builtinSwcLoaderName).options(mergedSwcConfig);
@@ -6782,8 +6749,8 @@ var init_lazyCompilation = __esm({
     pluginLazyCompilation = () => ({
       name: "rsbuild:lazy-compilation",
       setup(api) {
-        api.modifyBundlerChain((chain, { isProd: isProd4, target }) => {
-          if (isProd4 || target !== "web") {
+        api.modifyBundlerChain((chain, { isProd: isProd5, target }) => {
+          if (isProd5 || target !== "web") {
             return;
           }
           const config = api.getNormalizedConfig();
@@ -6843,6 +6810,229 @@ var init_lazyCompilation = __esm({
   }
 });
 
+// src/plugins/sri.ts
+var sri_exports = {};
+__export(sri_exports, {
+  pluginSri: () => pluginSri
+});
+import crypto2 from "crypto";
+import {
+  isHtmlDisabled as isHtmlDisabled4,
+  isProd as isProd4,
+  logger as logger16,
+  removeLeadingSlash as removeLeadingSlash2
+} from "@rsbuild/shared";
+var getAssetName, pluginSri;
+var init_sri = __esm({
+  "src/plugins/sri.ts"() {
+    "use strict";
+    init_esm();
+    init_constants();
+    getAssetName = (url2, assetPrefix) => {
+      if (url2.startsWith(assetPrefix)) {
+        return removeLeadingSlash2(url2.replace(assetPrefix, ""));
+      }
+      return removeLeadingSlash2(url2);
+    };
+    pluginSri = () => ({
+      name: "rsbuild:sri",
+      setup(api) {
+        const placeholder = "RSBUILD_INTEGRITY_PLACEHOLDER:";
+        const getAlgorithm = () => {
+          const config = api.getNormalizedConfig();
+          const { sri } = config.security;
+          const enable = sri.enable === "auto" ? isProd4() : sri.enable;
+          if (!enable) {
+            return null;
+          }
+          const { algorithm = "sha384" } = sri;
+          return algorithm;
+        };
+        api.modifyHTMLTags({
+          // ensure `sri` can be applied to all tags
+          order: "post",
+          handler(tags, { assetPrefix }) {
+            const algorithm = getAlgorithm();
+            if (!algorithm) {
+              return tags;
+            }
+            const allTags = [...tags.headTags, ...tags.bodyTags];
+            for (const tag of allTags) {
+              let url2 = "";
+              if (!tag.attrs) {
+                continue;
+              }
+              if (tag.tag === "script" && typeof tag.attrs.src === "string") {
+                url2 = tag.attrs.src;
+              } else if (tag.tag === "link" && tag.attrs.rel === "stylesheet" && typeof tag.attrs.href === "string") {
+                url2 = tag.attrs.href;
+              }
+              if (!url2) {
+                continue;
+              }
+              const assetName = getAssetName(url2, assetPrefix);
+              if (!assetName) {
+                continue;
+              }
+              tag.attrs.integrity ??= `${placeholder}${assetName}`;
+            }
+            return tags;
+          }
+        });
+        const replaceIntegrity = (htmlContent, assets, algorithm, integrityCache) => {
+          const regex = /integrity="RSBUILD_INTEGRITY_PLACEHOLDER:([^"]+)"/g;
+          const matches = htmlContent.matchAll(regex);
+          let replacedHtml = htmlContent;
+          const calcIntegrity = (algorithm2, assetName, data) => {
+            if (integrityCache.has(assetName)) {
+              return integrityCache.get(assetName);
+            }
+            const hash = crypto2.createHash(algorithm2).update(data).digest().toString("base64");
+            const integrity = `${algorithm2}-${hash}`;
+            integrityCache.set(assetName, integrity);
+            return integrity;
+          };
+          for (const match of matches) {
+            const assetName = match[1];
+            if (!assetName) {
+              continue;
+            }
+            if (assets[assetName]) {
+              const integrity = calcIntegrity(
+                algorithm,
+                assetName,
+                assets[assetName].buffer()
+              );
+              replacedHtml = replacedHtml.replaceAll(
+                `integrity="${placeholder}${assetName}"`,
+                `integrity="${integrity}"`
+              );
+            } else {
+              logger16.debug(
+                `[rsbuild:sri] failed to generate integrity for ${assetName}.`
+              );
+              replacedHtml = replacedHtml.replace(
+                `integrity="${placeholder}${assetName}"`,
+                ""
+              );
+            }
+          }
+          return replacedHtml;
+        };
+        class SriReplaceIntegrityPlugin {
+          constructor(algorithm) {
+            __publicField(this, "algorithm");
+            this.algorithm = algorithm;
+          }
+          apply(compiler) {
+            compiler.hooks.compilation.tap(
+              "SriReplaceIntegrityPlugin",
+              (compilation) => {
+                compilation.hooks.processAssets.tapPromise(
+                  {
+                    name: "SriReplaceIntegrityPlugin",
+                    // use to final stage to get the final asset content
+                    stage: compiler.webpack.Compilation.PROCESS_ASSETS_STAGE_REPORT
+                  },
+                  async (assets) => {
+                    const integrityCache = /* @__PURE__ */ new Map();
+                    for (const asset of Object.keys(assets)) {
+                      if (!HTML_REGEX.test(asset)) {
+                        continue;
+                      }
+                      const htmlContent = assets[asset].source();
+                      if (!htmlContent.includes(placeholder)) {
+                        continue;
+                      }
+                      assets[asset] = new compiler.webpack.sources.RawSource(
+                        replaceIntegrity(
+                          htmlContent,
+                          assets,
+                          this.algorithm,
+                          integrityCache
+                        )
+                      );
+                    }
+                  }
+                );
+              }
+            );
+          }
+        }
+        api.modifyBundlerChain((chain, { target }) => {
+          const config = api.getNormalizedConfig();
+          if (isHtmlDisabled4(config, target)) {
+            return;
+          }
+          const algorithm = getAlgorithm();
+          if (!algorithm) {
+            return;
+          }
+          chain.plugin("rsbuild-sri-replace").use(SriReplaceIntegrityPlugin, [algorithm]);
+        });
+      }
+    });
+  }
+});
+
+// src/plugins/nonce.ts
+var nonce_exports = {};
+__export(nonce_exports, {
+  pluginNonce: () => pluginNonce
+});
+import { applyToCompiler as applyToCompiler2, createVirtualModule as createVirtualModule2 } from "@rsbuild/shared";
+var pluginNonce;
+var init_nonce = __esm({
+  "src/plugins/nonce.ts"() {
+    "use strict";
+    init_esm();
+    pluginNonce = () => ({
+      name: "rsbuild:nonce",
+      setup(api) {
+        api.onAfterCreateCompiler(({ compiler }) => {
+          const { nonce } = api.getNormalizedConfig().security;
+          if (!nonce) {
+            return;
+          }
+          applyToCompiler2(compiler, (compiler2) => {
+            const { plugins } = compiler2.options;
+            const hasHTML = plugins.some(
+              (plugin) => plugin && plugin.constructor.name === "HtmlBasicPlugin"
+            );
+            if (!hasHTML) {
+              return;
+            }
+            const injectCode = createVirtualModule2(
+              `__webpack_nonce__ = "${nonce}";`
+            );
+            new compiler2.webpack.EntryPlugin(compiler2.context, injectCode, {
+              name: void 0
+            }).apply(compiler2);
+          });
+        });
+        api.modifyHTMLTags({
+          // ensure `nonce` can be applied to all tags
+          order: "post",
+          handler: ({ headTags, bodyTags }) => {
+            const config = api.getNormalizedConfig();
+            const { nonce } = config.security;
+            const allTags = [...headTags, ...bodyTags];
+            if (nonce) {
+              for (const tag of allTags) {
+                if (tag.tag === "script" || tag.tag === "style") {
+                  tag.attrs ??= {};
+                  tag.attrs.nonce = nonce;
+                }
+              }
+            }
+            return { headTags, bodyTags };
+          }
+        });
+      }
+    });
+  }
+});
+
 // src/createRsbuild.ts
 var createRsbuild_exports = {};
 __export(createRsbuild_exports, {
@@ -6882,6 +7072,8 @@ async function applyDefaultPlugins(pluginManager, context) {
   const { pluginModuleFederation: pluginModuleFederation2 } = await Promise.resolve().then(() => (init_moduleFederation(), moduleFederation_exports));
   const { pluginRspackProfile: pluginRspackProfile2 } = await Promise.resolve().then(() => (init_rspackProfile(), rspackProfile_exports));
   const { pluginLazyCompilation: pluginLazyCompilation2 } = await Promise.resolve().then(() => (init_lazyCompilation(), lazyCompilation_exports));
+  const { pluginSri: pluginSri2 } = await Promise.resolve().then(() => (init_sri(), sri_exports));
+  const { pluginNonce: pluginNonce2 } = await Promise.resolve().then(() => (init_nonce(), nonce_exports));
   pluginManager.addPlugins([
     pluginBasic2(),
     pluginEntry2(),
@@ -6893,8 +7085,8 @@ async function applyDefaultPlugins(pluginManager, context) {
     // cleanOutput plugin should before the html plugin
     pluginCleanOutput2(),
     pluginAsset2(),
-    pluginHtml2(async (tags) => {
-      const result = await context.hooks.modifyHTMLTags.call(tags);
+    pluginHtml2(async (...args) => {
+      const result = await context.hooks.modifyHTMLTags.call(...args);
       return result[0];
     }),
     pluginWasm2(),
@@ -6917,7 +7109,9 @@ async function applyDefaultPlugins(pluginManager, context) {
     pluginManifest2(),
     pluginModuleFederation2(),
     pluginRspackProfile2(),
-    pluginLazyCompilation2()
+    pluginLazyCompilation2(),
+    pluginSri2(),
+    pluginNonce2()
   ]);
 }
 async function createRsbuild(options = {}) {
@@ -7017,7 +7211,7 @@ var init_createRsbuild = __esm({
 });
 
 // src/cli/init.ts
-import { isDev as isDev2, logger as logger16 } from "@rsbuild/shared";
+import { isDev as isDev2, logger as logger17 } from "@rsbuild/shared";
 async function init({
   cliOptions,
   isRestart
@@ -7071,7 +7265,7 @@ async function init({
     });
   } catch (err) {
     if (isRestart) {
-      logger16.error(err);
+      logger17.error(err);
     } else {
       throw err;
     }
@@ -7121,7 +7315,7 @@ init_helpers();
 init_init();
 import { existsSync } from "fs";
 import { join as join12 } from "path";
-import { color as color13, logger as logger17 } from "@rsbuild/shared";
+import { color as color13, logger as logger18 } from "@rsbuild/shared";
 import { program } from "../compiled/commander/index.js";
 var applyCommonOptions = (command) => {
   command.option(
@@ -7136,7 +7330,7 @@ var applyServerOptions = (command) => {
   command.option("-o --open [url]", "open the page in browser on startup").option("--port <port>", "specify a port number for server to listen").option("--host <host>", "specify the host that the server listens to");
 };
 function runCli() {
-  program.name("rsbuild").usage("<command> [options]").version("0.7.2");
+  program.name("rsbuild").usage("<command> [options]").version("0.7.3");
   const devCommand = program.command("dev");
   const buildCommand = program.command("build");
   const previewCommand = program.command("preview");
@@ -7150,8 +7344,8 @@ function runCli() {
       const rsbuild = await init({ cliOptions: options });
       await rsbuild?.startDevServer();
     } catch (err) {
-      logger17.error("Failed to start dev server.");
-      logger17.error(err);
+      logger18.error("Failed to start dev server.");
+      logger18.error(err);
       process.exit(1);
     }
   });
@@ -7162,8 +7356,8 @@ function runCli() {
         watch: options.watch
       });
     } catch (err) {
-      logger17.error("Failed to build.");
-      logger17.error(err);
+      logger18.error("Failed to build.");
+      logger18.error(err);
       process.exit(1);
     }
   });
@@ -7189,8 +7383,8 @@ function runCli() {
       }
       await rsbuild?.preview();
     } catch (err) {
-      logger17.error("Failed to start preview server.");
-      logger17.error(err);
+      logger18.error("Failed to start preview server.");
+      logger18.error(err);
       process.exit(1);
     }
   });
@@ -7204,8 +7398,8 @@ function runCli() {
         writeToDisk: true
       });
     } catch (err) {
-      logger17.error("Failed to inspect config.");
-      logger17.error(err);
+      logger18.error("Failed to inspect config.");
+      logger18.error(err);
       process.exit(1);
     }
   });
@@ -7214,7 +7408,7 @@ function runCli() {
 
 // src/cli/prepare.ts
 init_esm();
-import { logger as logger18 } from "@rsbuild/shared";
+import { logger as logger19 } from "@rsbuild/shared";
 function initNodeEnv() {
   if (!process.env.NODE_ENV) {
     const command = process.argv[2];
@@ -7227,7 +7421,7 @@ function prepareCli() {
   if (!npm_execpath || npm_execpath.includes("npx-cli.js") || npm_execpath.includes(".bun")) {
     console.log();
   }
-  logger18.greet(`  ${`Rsbuild v${"0.7.2"}`}
+  logger19.greet(`  ${`Rsbuild v${"0.7.3"}`}
 `);
 }
 
@@ -7253,8 +7447,8 @@ init_createRsbuild();
 init_config();
 init_mergeConfig();
 init_constants();
-import { logger as logger19 } from "@rsbuild/shared";
-var version = "0.7.2";
+import { logger as logger20 } from "@rsbuild/shared";
+var version = "0.7.3";
 export {
   PLUGIN_CSS_NAME,
   PLUGIN_SWC_NAME,
@@ -7263,7 +7457,7 @@ export {
   defineConfig,
   loadConfig,
   loadEnv,
-  logger19 as logger,
+  logger20 as logger,
   mergeRsbuildConfig,
   rspack10 as rspack,
   version