Registry / devops / vite-plugin-sri

vite-plugin-sri

library0.0.2jsnpmunverified

A Vite plugin that adds Subresource Integrity (SRI) hashes to script and stylesheet imports in index.html at build time. Version 0.0.2 is current. Forked from @small-tech/vite-plugin-sri to fix an issue where dynamic imports were not handled correctly. Unlike the original, this plugin processes assets after Vite's build transformation, ensuring correct integrity hashes for dynamically imported modules. Released under ISC license.

devops auth-security

npm install vite-plugin-sri

github ↗package ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-SRI

vite-plugin-sri

devopsjavascriptv0.0.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sri

✓ import sri from 'vite-plugin-sri'

✗ const sri = require('vite-plugin-sri')

ESM-only; no named export, default export only

defineConfig

✓ import { defineConfig } from 'vite'

Vite's utility for config, not part of this plugin but commonly used together

sri()

✓ plugins: [sri()]

✗ plugins: [new sri()]

sri is a function that returns a plugin object, not a class

Minimal Vite config to enable SRI hashing on all script and stylesheet imports.

// vite.config.js import { defineConfig } from 'vite'; import sri from 'vite-plugin-sri'; export default defineConfig({ plugins: [sri()] });

Debug

Known issues

gotchaOnly affects build output, not dev server. SRI hashes are only added during production builds.

fix

Run `npx vite build` to generate SRI-enabled output.

affects: >=0.0.0

gotchaPlugin may not work if Vite's renderBuiltUrl or other asset manipulation hooks alter script/src attributes after plugin runs.

fix

Ensure this plugin is placed after any plugins that modify script/style paths.

affects: >=0.0.0

gotchaIntegrity hashes are computed based on the final built file content; if files are served from a CDN, ensure the CDN serves the exact same file or the hash will mismatch.

fix

Use same build artifacts for both hash computation and deployment.

affects: >=0.0.0

Errors

Common errors & fixes

Error: The plugin 'vite-plugin-sri' requires Vite >=2.0.0

Installing plugin with an older Vite version that does not support the required hooks.

fix

Upgrade Vite to version 2.0.0 or later, or downgrade the plugin if possible.

TypeError: sri is not a function

Using named import instead of default import or using CommonJS require incorrectly.

fix

Use `import sri from 'vite-plugin-sri'` (default import).

Error: Integrity mismatch for 'app.js'

The computed hash does not match the integrity attribute in the HTML, likely due to content changes after build.

fix

Rebuild the project to regenerate hashes based on current file content.

Upgrade

Version history

0.0.2latest on npm

Audit

Dependencies

viterequiredpeer dependency required to function as a Vite plugin

Agent activity

24 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/JonathanLee-LX/vite-plugin-sri ↗

packagehttps://www.npmjs.com/package/vite-plugin-sri ↗