vite-plugin-sri4

library4.0.0jsnpmunverified

Vite plugin (v4.0.0) that automatically generates Subresource Integrity (SRI) hashes for JavaScript and CSS assets during build, injecting integrity and crossorigin attributes into HTML. Supports configurable hash algorithms (sha256/sha384/sha512), domain bypassing, and custom log levels. Compatible with Vite 7 and 8 (including Rolldown). Active development, MIT license. Differentiators: CORS support check for external resources, robust content type handling (string/Buffer/Uint8Array), and debug logging. Alternative to rollup-plugin-sri with tighter Vite integration.

security devops

npm install vite-plugin-sri4

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-SRI4

vite-plugin-sri4

securityjavascriptv4.0.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sri

✓ import sri from 'vite-plugin-sri4'

✗ import { sri } from 'vite-plugin-sri4'

Default export; named import will result in undefined.

default

✓ const sri = require('vite-plugin-sri4').default

✗ const sri = require('vite-plugin-sri4')

CommonJS require with ESM default export; use .default.

VitePluginSRI

✓ import sri from 'vite-plugin-sri4'

✗ import VitePluginSRI from 'vite-plugin-sri4'

No named export 'VitePluginSRI'; use default import.

Basic Vite configuration integrating vite-plugin-sri4 with SRI hash generation and domain bypass.

// vite.config.ts import { defineConfig } from 'vite'; import sri from 'vite-plugin-sri4'; const SRI_KEY = process.env.SRI_KEY ?? ''; // placeholder for potential future auth export default defineConfig({ plugins: [ sri({ hashAlgorithm: 'sha384', bypassDomains: ['trusted-cdn.example.com'], logLevel: 'warn' }) ] }); // Build will output integrity attributes on script/link tags

Debug

Known issues

breakingvite-plugin-sri4 v4 is incompatible with Vite versions below 7.0.0.

fix

Upgrade Vite to >=7.0.0 or use vite-plugin-sri@2.x for older Vite versions.

affects: <4.0.0

deprecatedThe 'hashAlgorithm' option defaults to 'sha384'; using 'sha256' or 'sha512' is valid, but 'sha384' is recommended for browser compatibility.

fix

Stick with 'sha384' unless a specific requirement exists.

affects: >=4.0.0

gotchaCommonJS require() returns a module with default property; failing to use .default causes the plugin not to be loaded.

fix

Use require('vite-plugin-sri4').default or switch to import syntax.

affects: >=4.0.0

gotchaExternal resources that do not serve CORS headers will not get integrity attributes; plugin logs a warning unless bypassDomains is configured.

fix

Add external domains to bypassDomains or ensure the server sends Access-Control-Allow-Origin.

affects: >=4.0.0

gotchaPlugin only affects HTML files processed by Vite; if you manually copy HTML outside Vite, SRI hashes won't be injected.

fix

Ensure your HTML is part of the Vite build (e.g., using index.html as entry point).

affects: >=4.0.0

Errors

Common errors & fixes

TypeError: sri is not a function

Using import { sri } from 'vite-plugin-sri4' incorrectly (named import for default export).

fix

Change to `import sri from 'vite-plugin-sri4'`.

Error: Cannot find module 'vite-plugin-sri4'

Package not installed or not in node_modules.

fix

Run `npm install vite-plugin-sri4 --save-dev`.

[vite] Internal server error: Unhandled plugin error during build: ... TypeError: Cannot read properties of undefined (reading 'hash')

Plugin options incorrectly passed as a function (e.g., sri() missing parentheses).

fix

Ensure plugin is invoked as `sri({...})` not just `sri`.

The package "vite-plugin-sri4" is not a valid Vite plugin, because "default" is not a plugin object.

Using CommonJS require without .default.

fix

Use `const sri = require('vite-plugin-sri4').default`.

Upgrade

Version history

4.0.0latest on npm

Audit

Dependencies

viterequiredPeer dependency; plugin requires Vite 7 or 8

Agent activity

26 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/7a6163/vite-plugin-sri4 ↗

packagevite-plugin-sri4 ↗

homepagehttps://github.com/7a6163/vite-plugin-sri4#readme ↗