@smoothtml/vite-plugin-sri

Vite plugin that adds Subresource Integrity (SRI) hashes to scripts and stylesheets in built HTML.

Status: early release (0.x). SRI injection works during vite build, but the API may still change before 1.0.

Install

pnpm add -D @smoothtml/vite-plugin-sri

Requires Vite ^8.0.0 as a peer dependency.

Usage

// vite.config.ts
import { defineConfig } from "vite";
import sri from "@smoothtml/vite-plugin-sri";

export default defineConfig({
  plugins: [sri()],
});

The plugin only runs during vite build (no-op during vite serve).

Options

• hashAlgorithm - "sha256" | "sha384" | "sha512", default "sha384" (follows the W3C SRI specification's recommended baseline).

Acknowledgments

This plugin includes code adapted from Vite (© 2019-present, VoidZero Inc. and Vite contributors, MIT-licensed). Specifically, src/html.ts and src/utils.ts are derived from packages/vite/src/node/plugins/html.ts and packages/vite/src/node/utils.ts respectively. See the SPDX headers in those files and THIRD-PARTY-NOTICES.txt for details.

License

Apache-2.0