Registry / auth-security / webpack-subresource-integrity

webpack-subresource-integrity

library5.2.0-rc.1jsnpmunverified

Webpack plugin for enabling Subresource Integrity (SRI) to protect against compromised CDN resources. Current stable version is 5.1.0, with release candidate 5.2.0-rc.1 available. The plugin supports Webpack 5.12+ and html-webpack-plugin 5+, and now provides an ES module distribution alongside CommonJS. Key differentiators include integration with html-webpack-plugin for automatic integrity injection, lazy hash loading option for larger projects, and TypeScript type definitions.

auth-security devops

npm install webpack-subresource-integrity

github ↗package ↗

INSTALL

IMPORT

SIG · WEBPACK-SUBRESOURC

webpack-subresource-integrity

auth-securityjavascriptv5.2.0-rc.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SubresourceIntegrityPlugin

✓ import { SubresourceIntegrityPlugin } from 'webpack-subresource-integrity'

✗ const SubresourceIntegrityPlugin = require('webpack-subresource-integrity').default

Since v5, only named export is available; default export removed. For CommonJS, use const { SubresourceIntegrityPlugin } = require('webpack-subresource-integrity').

SubresourceIntegrityPlugin

✓ const { SubresourceIntegrityPlugin } = require('webpack-subresource-integrity')

✗ const SubresourceIntegrityPlugin = require('webpack-subresource-integrity')

CommonJS: destructure the named export; direct require returns an object with SubresourceIntegrityPlugin property.

SubresourceIntegrityPlugin

✓ new SubresourceIntegrityPlugin({ hashFuncNames: ['sha384'], enabled: 'auto' })

✗ new SubresourceIntegrityPlugin({ hashFuncNames: ['sha512'], enabled: true })

enabled option defaults to 'auto' since v5; setting it to true can cause issues in development mode.

Minimal webpack config to enable SRI for all scripts and styles, with cross-origin loading and content hashing.

const { SubresourceIntegrityPlugin } = require('webpack-subresource-integrity'); const HtmlWebpackPlugin = require('html-webpack-plugin'); module.exports = { entry: './src/index.js', output: { path: path.resolve(__dirname, 'dist'), filename: '[name].[contenthash].js', crossOriginLoading: 'anonymous', }, plugins: [ new HtmlWebpackPlugin(), new SubresourceIntegrityPlugin({ hashFuncNames: ['sha384'], enabled: 'auto', }), ], };

Debug

Known issues

breakingv5 drops default export; use named export SubresourceIntegrityPlugin instead.

fix

Change import from default to named import: import { SubresourceIntegrityPlugin } from 'webpack-subresource-integrity'.

affects: >=5.0.0

gotchaThe 'enabled' option now defaults to 'auto', which disables the plugin in development mode. If you explicitly set enabled: true, it will run in dev mode and may cause unexpected behavior.

fix

Use enabled: 'auto' (default) or omit the option to avoid issues in development.

affects: >=5.0.0

deprecatedPrevious versions (v1) used a default export and supported Webpack 4. Migration to v5 requires updating Webpack and html-webpack-plugin peer dependencies.

fix

Upgrade to v5 and follow migration guide in MIGRATE-v1-to-v5.md.

affects: >=1.0.0 <5.0.0

gotchaIf an asset's integrity cannot be determined (e.g., external resources not processed by webpack), the plugin emits an error since v5. Previously it only warned.

fix

Ensure all assets are processed by webpack or handle errors appropriately.

affects: >=5.0.0

breakingPlugin now requires Node >=12 and Webpack >=5.12.0.

fix

Upgrade to supported versions.

affects: >=5.0.0

gotchaLazy hash loading (hashLoading: 'lazy') can cause hash duplication. Ensure it's suitable for your project's chunk structure.

fix

Test with your project; if hash duplication is not acceptable, use default hash loading.

affects: >=5.1.0

Errors

Common errors & fixes

TypeError: SubresourceIntegrityPlugin is not a constructor

Using default import instead of named import in v5.

fix

Replace 'const SubresourceIntegrityPlugin = require("webpack-subresource-integrity")' with 'const { SubresourceIntegrityPlugin } = require("webpack-subresource-integrity")'.

Error: No html-webpack-plugin, can't inject integrity attributes.

Missing or incompatible version of html-webpack-plugin.

fix

Install html-webpack-plugin >=5.0.0-beta.1 and add it to webpack plugins.

Error: Asset '...' has no integrity hash.

The asset is not a JavaScript or CSS file, or it's an external resource not processed by webpack.

fix

Ensure all assets are processed by webpack loaders, or exclude non-SRI assets using plugin options.

Webpack build fails with 'Cannot read property 'hooks' of undefined'

Using plugin with Webpack 4 or older version of Webpack 5.

fix

Upgrade to Webpack >=5.12.0 and html-webpack-plugin >=5.0.0-beta.1.

Upgrade

Version history

5.2.0-rc.1latest on npm

Audit

Dependencies

html-webpack-pluginrequiredPeer dependency for automatic injection of integrity attributes into HTML tags

webpackrequiredPeer dependency required for plugin integration

Agent activity

28 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/waysact/webpack-subresource-integrity ↗

packagehttps://www.npmjs.com/package/webpack-subresource-integrity ↗