{"id":42251,"library":"vite-plugin-sri4","title":"vite-plugin-sri4","description":"Vite plugin (v4.0.0) that automatically generates Subresource Integrity (SRI) hashes for JavaScript and CSS assets during build, injecting integrity and crossorigin attributes into HTML. Supports configurable hash algorithms (sha256/sha384/sha512), domain bypassing, and custom log levels. Compatible with Vite 7 and 8 (including Rolldown). Active development, MIT license. Differentiators: CORS support check for external resources, robust content type handling (string/Buffer/Uint8Array), and debug logging. Alternative to rollup-plugin-sri with tighter Vite integration.","status":"active","version":"4.0.0","language":"javascript","source_language":"en","source_url":"https://github.com/7a6163/vite-plugin-sri4","tags":["javascript","vite","plugin","sri","subresource integrity"],"install":[{"cmd":"npm install vite-plugin-sri4","lang":"bash","label":"npm"},{"cmd":"yarn add vite-plugin-sri4","lang":"bash","label":"yarn"},{"cmd":"pnpm add vite-plugin-sri4","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Peer dependency; plugin requires Vite 7 or 8","package":"vite","optional":false}],"imports":[{"note":"Default export; named import will result in undefined.","wrong":"import { sri } from 'vite-plugin-sri4'","symbol":"sri","correct":"import sri from 'vite-plugin-sri4'"},{"note":"CommonJS require with ESM default export; use .default.","wrong":"const sri = require('vite-plugin-sri4')","symbol":"default","correct":"const sri = require('vite-plugin-sri4').default"},{"note":"No named export 'VitePluginSRI'; use default import.","wrong":"import VitePluginSRI from 'vite-plugin-sri4'","symbol":"VitePluginSRI","correct":"import sri from 'vite-plugin-sri4'"}],"quickstart":{"code":"// vite.config.ts\nimport { defineConfig } from 'vite';\nimport sri from 'vite-plugin-sri4';\n\nconst SRI_KEY = process.env.SRI_KEY ?? ''; // placeholder for potential future auth\n\nexport default defineConfig({\n  plugins: [\n    sri({\n      hashAlgorithm: 'sha384',\n      bypassDomains: ['trusted-cdn.example.com'],\n      logLevel: 'warn'\n    })\n  ]\n});\n\n// Build will output integrity attributes on script/link tags","lang":"typescript","description":"Basic Vite configuration integrating vite-plugin-sri4 with SRI hash generation and domain bypass."},"warnings":[{"fix":"Upgrade Vite to >=7.0.0 or use vite-plugin-sri@2.x for older Vite versions.","message":"vite-plugin-sri4 v4 is incompatible with Vite versions below 7.0.0.","severity":"breaking","affected_versions":"<4.0.0"},{"fix":"Stick with 'sha384' unless a specific requirement exists.","message":"The 'hashAlgorithm' option defaults to 'sha384'; using 'sha256' or 'sha512' is valid, but 'sha384' is recommended for browser compatibility.","severity":"deprecated","affected_versions":">=4.0.0"},{"fix":"Use require('vite-plugin-sri4').default or switch to import syntax.","message":"CommonJS require() returns a module with default property; failing to use .default causes the plugin not to be loaded.","severity":"gotcha","affected_versions":">=4.0.0"},{"fix":"Add external domains to bypassDomains or ensure the server sends Access-Control-Allow-Origin.","message":"External resources that do not serve CORS headers will not get integrity attributes; plugin logs a warning unless bypassDomains is configured.","severity":"gotcha","affected_versions":">=4.0.0"},{"fix":"Ensure your HTML is part of the Vite build (e.g., using index.html as entry point).","message":"Plugin only affects HTML files processed by Vite; if you manually copy HTML outside Vite, SRI hashes won't be injected.","severity":"gotcha","affected_versions":">=4.0.0"}],"env_vars":null,"search_vec":"'7':43 '8':45 'activ':48 'algorithm':32 'altern':67 'asset':19 'attribut':26 'automat':9 'build':21 'bypass':35 'check':55 'compat':40 'configur':30 'content':60 'cor':53 'crossorigin':25 'css':18 'custom':37 'debug':65 'develop':49 'differenti':52 'domain':34 'extern':57 'generat':10 'handl':62 'hash':14,31 'html':28 'includ':46 'inject':22 'integr':12,23,76,82 'javascript':16,77 'level':39 'licens':51 'log':38,66 'mit':50 'plugin':3,6,71,79 'resourc':58 'robust':59 'rolldown':47 'rollup':70 'rollup-plugin-sri':69 'sha256/sha384/sha512':33 'sri':13,72,80 'sri4':4 'string/buffer/uint8array':63 'subresourc':11,81 'support':29,54 'tighter':74 'type':61 'v4.0.0':7 'vite':2,5,42,75,78 'vite-plugin-sri4':1","created_at":"2026-06-04T18:56:21.326483+00:00","updated_at":"2026-06-04T18:56:21.326483+00:00","problems":[{"fix":"Change to `import sri from 'vite-plugin-sri4'`.","cause":"Using import { sri } from 'vite-plugin-sri4' incorrectly (named import for default export).","error":"TypeError: sri is not a function"},{"fix":"Run `npm install vite-plugin-sri4 --save-dev`.","cause":"Package not installed or not in node_modules.","error":"Error: Cannot find module 'vite-plugin-sri4'"},{"fix":"Ensure plugin is invoked as `sri({...})` not just `sri`.","cause":"Plugin options incorrectly passed as a function (e.g., sri() missing parentheses).","error":"[vite] Internal server error: Unhandled plugin error during build: ... TypeError: Cannot read properties of undefined (reading 'hash')"},{"fix":"Use `const sri = require('vite-plugin-sri4').default`.","cause":"Using CommonJS require without .default.","error":"The package \"vite-plugin-sri4\" is not a valid Vite plugin, because \"default\" is not a plugin object."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/7a6163/vite-plugin-sri4#readme","github":"https://github.com/7a6163/vite-plugin-sri4","docs":null,"changelog":null,"pypi":null,"npm":"vite-plugin-sri4","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security","devops"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-04","next_check":"2026-09-02","install_tag":null}}