vite-plugin-sri4 3.1.0 → 4.0.0

package/README.md

@@ -27,7 +27,7 @@ A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets dur
 - **Bypass Domains:** Option to specify domains to bypass SRI injection.
 - **Missing Asset Handling:** Configurable warning suppression for missing assets.
 - **Robust Content Support:** Handles various content types including strings, Buffer, and Uint8Array.
-- **Vite Compatibility:** Compatible with Vite 6.0 and 7.0.
+- **Vite Compatibility:** Compatible with Vite 7.0 and Vite 8.0 (including the Rolldown-based native build path).
 
 ## Installation
 
@@ -48,13 +48,13 @@ export default defineConfig({
   plugins: [
     sri({
       // Optional. The security hash algorithm. Defaults to "sha384".
-      algorithm: 'sha384',
+      hashAlgorithm: 'sha384',
       // Optional. Domains to bypass SRI injection.
       bypassDomains: ['example.com'],
       // Optional. Suppress warnings for missing assets.
       ignoreMissingAsset: false,
-      // Optional. Enable debug logging.
-      debug: false
+      // Optional. Log verbosity: 'silent' | 'error' | 'warn' | 'info' | 'debug'. Defaults to 'warn'.
+      logLevel: 'warn'
     })
   ]
 });
@@ -76,14 +76,14 @@ Output:
 
 ## Plugin Options
 
-* `algorithm` (string):
-  The hash algorithm used for computing SRI. Default is sha384. You may change it to other supported algorithms like sha256.
+* `hashAlgorithm` (string):
+  The hash algorithm used for computing SRI. Default is `sha384`. You may change it to other supported algorithms like `sha256` or `sha512`.
 * `bypassDomains` (Array<string>):
   Array of domain names where SRI injection should be skipped. This allows external resources from specified domains to be excluded from SRI checks (for example, when they may not support CORS).
 * `ignoreMissingAsset` (boolean):
-  When true, suppresses warnings for assets that are not found in the bundle. Default is false.
-* `debug` (boolean):
-  When true, enables detailed debug logging. Default is false.
+  When true, suppresses warnings for assets that are not found in the bundle. Default is `false`.
+* `logLevel` (string):
+  Log verbosity. One of `silent`, `error`, `warn`, `info`, `debug`. Default is `warn`. Use `debug` to see per-resource decisions during the build.
 
 ## Example Project
 
@@ -150,11 +150,11 @@ The example project shows:
 
 ### Debug Mode
 
-Enable debug mode to see detailed logs:
+Set `logLevel: 'debug'` to see detailed logs:
 
 ```javascript
 sri({
-  debug: true
+  logLevel: 'debug'
 })
 ```
 
@@ -163,6 +163,7 @@ This will show:
 - SRI hash computation
 - CORS checks
 - Missing asset warnings
+- Bundle-key fallback matches (when a URL is resolved via suffix match)
 
 ## Contributing
 

package/dist/index.cjs

@@ -2,8 +2,8 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var crypto = require('crypto');
-var path = require('path');
+var node_crypto = require('node:crypto');
+var path = require('node:path');
 var fetch = require('cross-fetch');
 
 /**
@@ -237,12 +237,18 @@ async function calculateIntegrity(
     const bundleItem = bundle[bundleKey];
 
     if (!bundleItem) {
-      // Try to find a matching item with more flexible matching
+      // Fall back to suffix match in either direction to absorb hashed
+      // filenames AND base-prefix mismatches (e.g. URL "/base/main.js" with
+      // bare bundle key "main.js"). A mismatch here just produces a wrong
+      // integrity hash, which the browser rejects — failure-closed.
       const possibleMatch = Object.keys(bundle).find(key =>
         key.endsWith(bundleKey) || bundleKey.endsWith(key)
       );
 
       if (possibleMatch) {
+        if (logger) {
+          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
+        }
         source = bundle[possibleMatch].type === 'chunk'
           ? bundle[possibleMatch].code
           : bundle[possibleMatch].source;
@@ -263,10 +269,10 @@ async function calculateIntegrity(
   if (!source) return null
 
   if (typeof source === 'string') {
-    return `${hashAlgorithm}-${crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
+    return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
   }
 
-  return `${hashAlgorithm}-${crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
+  return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
 }
 
 // Optimized regex patterns for better readability and efficiency
@@ -327,6 +333,7 @@ async function processMatch(
     return {
       integrity,
       position: end - endOffset,
+      tagStart: match.index,
       url // For logging
     }
   }
@@ -394,12 +401,21 @@ async function collectIntegrityChanges(
   return changes
 }
 
+const CROSSORIGIN_ATTR_RE = /\bcrossorigin\s*=/i;
+const INTEGRITY_ATTR_RE = /\bintegrity\s*=/i;
+
+/**
+ * Check if integrity attribute already exists in the same tag
+ */
+function hasExistingIntegrity(html, tagStart, position) {
+  return INTEGRITY_ATTR_RE.test(html.slice(tagStart, position))
+}
+
 /**
- * Check if integrity attribute already exists in HTML segment
+ * Check if crossorigin attribute already exists in the same tag
  */
-function hasExistingIntegrity(html, position, integrity) {
-  const segment = html.slice(Math.max(0, position - 100), position + 100);
-  return segment.includes(`integrity="${integrity}"`)
+function hasExistingCrossorigin(html, tagStart, position) {
+  return CROSSORIGIN_ATTR_RE.test(html.slice(tagStart, position))
 }
 
 /**
@@ -409,13 +425,16 @@ function applyIntegrityChanges(html, changes, logger) {
   // Sort by position in descending order to insert from back to front
   changes.sort((a, b) => b.position - a.position);
 
-  for (const { integrity, position, url } of changes) {
-    // Skip if integrity attribute already exists
-    if (hasExistingIntegrity(html, position, integrity)) {
+  for (const { integrity, position, tagStart, url } of changes) {
+    // Skip if integrity attribute already exists on this tag
+    if (hasExistingIntegrity(html, tagStart, position)) {
       continue
     }
 
-    const insertText = ` integrity="${integrity}"`;
+    let insertText = ` integrity="${integrity}"`;
+    if (!hasExistingCrossorigin(html, tagStart, position)) {
+      insertText += ' crossorigin="anonymous"';
+    }
     html = html.slice(0, position) + insertText + html.slice(position);
     logger.debug(`Added integrity for: ${url}`);
   }
@@ -539,7 +558,12 @@ class Logger {
 }
 
 // Constants definition
-const VITE_INTERNAL_ANALYSIS_PLUGIN = 'vite:build-import-analysis';
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
+// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+const VITE_INTERNAL_ANALYSIS_PLUGINS = [
+  'vite:build-import-analysis',
+  'native:import-analysis-build'
+];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
 
@@ -603,23 +627,31 @@ function sri(options = {}) {
         );
       };
 
-      const plugin = config.plugins.find(p => p.name === VITE_INTERNAL_ANALYSIS_PLUGIN);
-      if (!plugin) {
-        throw new Error(`[${DEFAULT_PLUGIN_NAME}] requires Vite 2.0.0 or higher`)
+      const targets = config.plugins.filter(
+        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
+      );
+      if (targets.length === 0) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
+          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
+          `Requires Vite 6.0.0 or higher.`
+        )
       }
 
-      if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-        const originalHandler = plugin.generateBundle.handler;
-        plugin.generateBundle.handler = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
-      } else if (typeof plugin.generateBundle === 'function') {
-        const originalHandler = plugin.generateBundle;
-        plugin.generateBundle = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
+      for (const plugin of targets) {
+        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
+          const originalHandler = plugin.generateBundle.handler;
+          plugin.generateBundle.handler = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        } else if (typeof plugin.generateBundle === 'function') {
+          const originalHandler = plugin.generateBundle;
+          plugin.generateBundle = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        }
       }
     }
   }

package/dist/index.js

@@ -1,5 +1,5 @@
-import { createHash } from 'crypto';
-import path from 'path';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
 import fetch from 'cross-fetch';
 
 /**
@@ -233,12 +233,18 @@ async function calculateIntegrity(
     const bundleItem = bundle[bundleKey];
 
     if (!bundleItem) {
-      // Try to find a matching item with more flexible matching
+      // Fall back to suffix match in either direction to absorb hashed
+      // filenames AND base-prefix mismatches (e.g. URL "/base/main.js" with
+      // bare bundle key "main.js"). A mismatch here just produces a wrong
+      // integrity hash, which the browser rejects — failure-closed.
       const possibleMatch = Object.keys(bundle).find(key =>
         key.endsWith(bundleKey) || bundleKey.endsWith(key)
       );
 
       if (possibleMatch) {
+        if (logger) {
+          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
+        }
         source = bundle[possibleMatch].type === 'chunk'
           ? bundle[possibleMatch].code
           : bundle[possibleMatch].source;
@@ -323,6 +329,7 @@ async function processMatch(
     return {
       integrity,
       position: end - endOffset,
+      tagStart: match.index,
       url // For logging
     }
   }
@@ -390,12 +397,21 @@ async function collectIntegrityChanges(
   return changes
 }
 
+const CROSSORIGIN_ATTR_RE = /\bcrossorigin\s*=/i;
+const INTEGRITY_ATTR_RE = /\bintegrity\s*=/i;
+
+/**
+ * Check if integrity attribute already exists in the same tag
+ */
+function hasExistingIntegrity(html, tagStart, position) {
+  return INTEGRITY_ATTR_RE.test(html.slice(tagStart, position))
+}
+
 /**
- * Check if integrity attribute already exists in HTML segment
+ * Check if crossorigin attribute already exists in the same tag
  */
-function hasExistingIntegrity(html, position, integrity) {
-  const segment = html.slice(Math.max(0, position - 100), position + 100);
-  return segment.includes(`integrity="${integrity}"`)
+function hasExistingCrossorigin(html, tagStart, position) {
+  return CROSSORIGIN_ATTR_RE.test(html.slice(tagStart, position))
 }
 
 /**
@@ -405,13 +421,16 @@ function applyIntegrityChanges(html, changes, logger) {
   // Sort by position in descending order to insert from back to front
   changes.sort((a, b) => b.position - a.position);
 
-  for (const { integrity, position, url } of changes) {
-    // Skip if integrity attribute already exists
-    if (hasExistingIntegrity(html, position, integrity)) {
+  for (const { integrity, position, tagStart, url } of changes) {
+    // Skip if integrity attribute already exists on this tag
+    if (hasExistingIntegrity(html, tagStart, position)) {
       continue
     }
 
-    const insertText = ` integrity="${integrity}"`;
+    let insertText = ` integrity="${integrity}"`;
+    if (!hasExistingCrossorigin(html, tagStart, position)) {
+      insertText += ' crossorigin="anonymous"';
+    }
     html = html.slice(0, position) + insertText + html.slice(position);
     logger.debug(`Added integrity for: ${url}`);
   }
@@ -535,7 +554,12 @@ class Logger {
 }
 
 // Constants definition
-const VITE_INTERNAL_ANALYSIS_PLUGIN = 'vite:build-import-analysis';
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
+// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+const VITE_INTERNAL_ANALYSIS_PLUGINS = [
+  'vite:build-import-analysis',
+  'native:import-analysis-build'
+];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
 
@@ -599,23 +623,31 @@ function sri(options = {}) {
         );
       };
 
-      const plugin = config.plugins.find(p => p.name === VITE_INTERNAL_ANALYSIS_PLUGIN);
-      if (!plugin) {
-        throw new Error(`[${DEFAULT_PLUGIN_NAME}] requires Vite 2.0.0 or higher`)
+      const targets = config.plugins.filter(
+        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
+      );
+      if (targets.length === 0) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
+          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
+          `Requires Vite 6.0.0 or higher.`
+        )
       }
 
-      if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-        const originalHandler = plugin.generateBundle.handler;
-        plugin.generateBundle.handler = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
-      } else if (typeof plugin.generateBundle === 'function') {
-        const originalHandler = plugin.generateBundle;
-        plugin.generateBundle = async function(...args) {
-          await originalHandler.apply(this, args);
-          await generateBundle.apply(this, args);
-        };
+      for (const plugin of targets) {
+        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
+          const originalHandler = plugin.generateBundle.handler;
+          plugin.generateBundle.handler = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        } else if (typeof plugin.generateBundle === 'function') {
+          const originalHandler = plugin.generateBundle;
+          plugin.generateBundle = async function(...args) {
+            await originalHandler.apply(this, args);
+            await generateBundle.apply(this, args);
+          };
+        }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -23,20 +23,18 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "cheerio": "^1.0.0",
     "cross-fetch": "^4.1.0"
   },
   "peerDependencies": {
-    "vite": "^6.0.0 || ^7.0.0"
+    "vite": "^7.0.0 || ^8.0.0"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^25.0.7",
     "@rollup/plugin-node-resolve": "^15.2.3",
     "@vitest/coverage-v8": "^3.2.4",
-    "cross-fetch": "^4.0.0",
     "memfs": "^4.6.0",
     "rollup": "^4.9.6",
-    "vite": "^7.0.0",
+    "vite": "^8.0.0",
     "vitest": "^3.2.4"
   },
   "keywords": [