Registry / web-framework / vite-plugin-sri3

vite-plugin-sri3

library2.0.0jsnpmunverified

vite-plugin-sri3 (v2.0.0) is a zero-dependency Vite plugin that automatically adds Subresource Integrity (SRI) hashes to script and link tags in your built HTML. It supports Vite 3 through 8, Node >=18, and ships TypeScript types. Unlike its predecessors (rollup-plugin-sri and @small-tech/vite-plugin-sri), this plugin works correctly with Vite 4/5+ and offers features like ignoreMissingAsset for legacy chunk compatibility and a skip-sri attribute to exclude specific tags. It is actively maintained with a changelog and comprehensive test coverage including unit tests, end-to-end Playwright tests for tamper detection, and integration fixtures ensuring deterministic sha384 hashes.

web-framework auth-security serialization

npm install vite-plugin-sri3

github ↗package ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-SRI3

vite-plugin-sri3

web-frameworkjavascriptv2.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sri

✓ import { sri } from 'vite-plugin-sri3'

✗ const sri = require('vite-plugin-sri3')

ESM-only; CommonJS require() will fail. Package has no default export.

sri (React/Vue component approach)

✓ // In vite.config.ts import { sri } from 'vite-plugin-sri3'

✗ import sri from 'vite-plugin-sri3'

Named export only; default import is undefined.

SRI options type

✓ import { SRIOptions } from 'vite-plugin-sri3'

TypeScript users can import SRIOptions for type checks; it is re-exported from the package.

Basic setup: import the named `sri` export, add it to your Vite plugins list, and build to get SRI hashes injected into HTML tags.

// vite.config.ts import { defineConfig } from 'vite' import { sri } from 'vite-plugin-sri3' export default defineConfig({ plugins: [ // Place at the end to ensure final asset content is captured // If using vite-plugin-compression2, place sri() before it. sri({ ignoreMissingAsset: false }), ], }) // Build your project, and the generated HTML will have integrity attributes: // <script type="module" src="/assets/index-abc123.js" integrity="sha384-..."></script>

Debug

Known issues

gotchaPlugin ordering matters: sri() should be placed at the end of the plugins array to capture final asset content, unless you use vite-plugin-compression2, in which case sri() should come before it.

fix

Reorder plugins: usually list sri() last. If using compression2, list sri() before it.

affects: >=1.0.0

gotchaignoreMissingAsset option is required when using @vitejs/plugin-legacy, as legacy chunks may be missed.

fix

Enable sri({ ignoreMissingAsset: true }) when using @vitejs/plugin-legacy.

affects: >=1.0.0

deprecatedAll versions are ESM-only; CommonJS require() fails with ERR_REQUIRE_ESM.

fix

Use import { sri } from 'vite-plugin-sri3' instead of require().

affects: >=1.0.0

gotchaThe skip-sri attribute must be added directly to the <script> or <link> tag in your HTML, not to the plugin config.

fix

Add skip-sri attribute to specific tags to exclude them from integrity injection.

affects: >=1.0.0

breakingMinimum Vite version is now 3 (was undefined in earlier unpublished versions). Node requirement is >=18.

fix

Upgrade Vite >=3 and Node >=18.

affects: >=2.0.0

Errors

Common errors & fixes

ERR_REQUIRE_ESM

Using CommonJS require() to import an ESM-only package.

fix

Replace require('vite-plugin-sri3') with import { sri } from 'vite-plugin-sri3' in your vite.config.(js|ts|mjs|mts) file.

TypeError: sri is not a function

Default import used instead of named import.

fix

Change import sri from 'vite-plugin-sri3' to import { sri } from 'vite-plugin-sri3'.

Failed to resolve plugin: vite-plugin-sri3

Package not installed or wrong Vite version (e.g., Vite 2 unsupported).

fix

Run npm i -D vite-plugin-sri3 and ensure Vite >=3 is installed.

SRI hash mismatch: expected sha384-... but got sha384-...

Asset has been tampered with after build or file content changed without rebuild.

fix

Rebuild the project; if issue persists, verify no other plugins modify assets after sri() runs.

Upgrade

Version history

2.0.0latest on npm

Audit

Dependencies

viterequiredpeer dependency required to run the plugin; supports versions 3 to 8

Agent activity

32 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/yoyo930021/vite-plugin-sri3 ↗

packagehttps://www.npmjs.com/package/vite-plugin-sri3 ↗