Skip to content

test(sri): verify served asset integrity with entry import maps - #762

Open
ka2umaz wants to merge 1 commit into
Baroshem:mainfrom
ka2umaz:investigation/657-importmap-sri
Open

ka2umaz wants to merge 1 commit into
Baroshem:mainfrom
ka2umaz:investigation/657-importmap-sri

Conversation

@ka2umaz

@ka2umaz ka2umaz commented Oct 18, 2026

Copy link
Copy Markdown

Types of changes

Test coverage only; no runtime behavior changes.

  • Bug fix
  • New feature
  • Breaking change

Description

The existing SRI assertions count integrity attributes but do not compare them with the served asset bytes. This adds three cases for /, /asset, and /public that fetch external JavaScript and CSS and independently verify their SHA-384 integrity values. The fixture explicitly enables the entry import map, and the assertions require it to be present.

Related: #657. This strengthens test coverage; it does not resolve every configuration reported in that issue.

The separate Nuxt CSS-dependent chunk filename fix is available as a public fork commit. That implementation is not included in this PR.

Validation

Local validation on Node.js 24.17.0:

  • yarn test --maxWorkers=1: 18 test files passed; 157 tests passed and one existing test was skipped.
  • yarn lint and yarn prepack: passed.
  • A temporary incorrect-digest negative control was detected by the new tests while the existing attribute-count tests passed. The runtime source was restored afterward.

The implementation and local validation were performed with AI assistance.

Checklist

  • Documentation changes required
  • Documentation updated
  • Tests added

Documentation changes are not required for this test-only change.

Implementation and tests prepared by an AI agent at the user's direction.
Human code review and understanding have not been confirmed.
No human certification or sign-off is asserted.
@vercel

vercel Bot commented Oct 18, 2026

Copy link
Copy Markdown

@ka2umaz is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant