Registry / web-framework / vite-plugin-sri-gen

vite-plugin-sri-gen

library1.4.1jsnpmunverified

A Vite plugin that auto-generates Subresource Integrity (SRI) hashes for built assets and injects integrity/crossorigin attributes into HTML output. Current stable version 1.4.1, requires Node ≥18 and Vite ≥4. Released monthly. Key differentiators: supports multiple hash algorithms (sha256, sha384, sha512), optional lazy-loaded chunk integrity via runtime patch, Vite manifest augmentation for SSR/backend-owned HTML, configurable include/exclude patterns, and in-memory HTTP cache. ESM-only, builds on parse5 for HTML parsing. Does not work for most SSR frameworks unless pre-rendering HTML or reading the augmented manifest.

web-framework serialization http-networking

npm install vite-plugin-sri-gen

github ↗package ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-SRI-GE

vite-plugin-sri-gen

web-frameworkjavascriptv1.4.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sriGen

✓ import { sriGen } from 'vite-plugin-sri-gen'

✗ const sriGen = require('vite-plugin-sri-gen'); const { sriGen } = require('vite-plugin-sri-gen')

ESM-only package; require() will fail. Named export only.

default

✓ import sriGen from 'vite-plugin-sri-gen'

✗ import { default as sriGen } from 'vite-plugin-sri-gen'

Default export is also available; both named and default work equivalently.

SRIOptions

✓ import type { SRIOptions } from 'vite-plugin-sri-gen'

✗ import { SRIOptions } from 'vite-plugin-sri-gen' (if types are used at runtime)

TypeScript users should import the type for config objects.

Shows basic setup of vite-plugin-sri-gen with custom algorithms, include/exclude patterns, and manifest enabled.

// vite.config.ts import { defineConfig } from 'vite'; import { sriGen } from 'vite-plugin-sri-gen'; export default defineConfig({ plugins: [ sriGen({ algorithms: ['sha384', 'sha512'], include: [/^\/assets\//], exclude: ['**/*.map'], verboseLogging: false, skipResources: [], enableManifest: true, handleSSR: false, runtimeInjection: false, }), ], });

Debug

Known issues

breakingVersion 1.2.0 replaced cheerio with parse5. This may break custom HTML transformations if you relied on cheerio-specific behavior.

fix

No action needed unless you extended the plugin; the public API is unchanged.

affects: >=1.2.0 <1.3.0

breakingVersion 1.3.0 reduced logging verbosity by default; verboseLogging must be explicitly set to true for detailed logs.

fix

Set verboseLogging: true in config if you rely on old logging output.

affects: >=1.3.0

deprecatedUsing require() to import this package is unsupported because the package is ESM-only.

fix

Use dynamic import() or switch to ESM in your project.

affects: >=1.0.0

gotchaThis plugin does not inject SRI into HTML for most SSR frameworks (e.g., SvelteKit, Nuxt) because HTML is not generated at build time. It only works with pre-rendered SSR output.

fix

Pre-render your SSR application (e.g., using vite-plugin-ssr pre-rendering) or use the manifest augmentation (enableManifest: true) to attach SRI server-side.

affects: >=1.0.0

gotchaWhen using absolute URLs in index.html (e.g., CDN scripts), the plugin may fail to match resources. Fixed in v1.3.2 for main script tags, but other absolute URLs might still be skipped.

fix

Update to v1.3.2 or later; for older versions, ensure resources use relative paths.

affects: >=1.0.0 <1.3.2

gotchaIf you enable enableManifest but don't also set build.manifest: true in your Vite config, the manifest won't be generated and the plugin will have no effect.

fix

Add build: { manifest: true } to your Vite config.

affects: >=1.4.0

Errors

Common errors & fixes

ERR_REQUIRE_ESM: require() of ES Module ... from ... not supported

The package is ESM-only and cannot be require()'d.

fix

Change to ESM: set "type": "module" in package.json or use dynamic import().

TypeError: sriGen is not a function

Default import was used when only named export exists (or vice versa).

fix

Use import { sriGen } from 'vite-plugin-sri-gen' or default import sriGen from 'vite-plugin-sri-gen'.

Error: No HTML files found in output directory. Skipping SRI injection.

The plugin expects HTML files in the build output, but none were generated (common in SSR without pre-rendering).

fix

Ensure your build produces HTML files, or enable enableManifest and set build.manifest: true to use the manifest approach.

Warning: [vite-plugin-sri-gen] Integrity hash mismatch for ... expected ... got ...

The resource content changed after the hash was computed (e.g., runtime injection after build).

fix

Ensure that no other plugins modify the resource content after sriGen runs; reorder plugins or disable conflicting transforms.

Upgrade

Version history

1.4.1latest on npm

Audit

Dependencies

viterequiredpeer dependency required for plugin integration

parse5requiredused for parsing and modifying HTML during build

Agent activity

36 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/rbonestell/vite-plugin-sri-gen ↗

packagehttps://www.npmjs.com/package/vite-plugin-sri-gen ↗