{"id":22847,"library":"vite-plugin-sri3","title":"vite-plugin-sri3","description":"vite-plugin-sri3 (v2.0.0) is a zero-dependency Vite plugin that automatically adds Subresource Integrity (SRI) hashes to script and link tags in your built HTML. It supports Vite 3 through 8, Node >=18, and ships TypeScript types. Unlike its predecessors (rollup-plugin-sri and @small-tech/vite-plugin-sri), this plugin works correctly with Vite 4/5+ and offers features like ignoreMissingAsset for legacy chunk compatibility and a skip-sri attribute to exclude specific tags. It is actively maintained with a changelog and comprehensive test coverage including unit tests, end-to-end Playwright tests for tamper detection, and integration fixtures ensuring deterministic sha384 hashes.","status":"active","version":"2.0.0","language":"javascript","source_language":"en","source_url":"https://github.com/yoyo930021/vite-plugin-sri3","tags":["javascript","vite-plugin","vite","sri","integrity","typescript"],"install":[{"cmd":"npm install vite-plugin-sri3","lang":"bash","label":"npm"},{"cmd":"yarn add vite-plugin-sri3","lang":"bash","label":"yarn"},{"cmd":"pnpm add vite-plugin-sri3","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency required to run the plugin; supports versions 3 to 8","package":"vite","optional":false}],"imports":[{"note":"ESM-only; CommonJS require() will fail. Package has no default export.","wrong":"const sri = require('vite-plugin-sri3')","symbol":"sri","correct":"import { sri } from 'vite-plugin-sri3'"},{"note":"Named export only; default import is undefined.","wrong":"import sri from 'vite-plugin-sri3'","symbol":"sri (React/Vue component approach)","correct":"// In vite.config.ts\nimport { sri } from 'vite-plugin-sri3'"},{"note":"TypeScript users can import SRIOptions for type checks; it is re-exported from the package.","wrong":"","symbol":"SRI options type","correct":"import { SRIOptions } from 'vite-plugin-sri3'"}],"quickstart":{"code":"// vite.config.ts\nimport { defineConfig } from 'vite'\nimport { sri } from 'vite-plugin-sri3'\n\nexport default defineConfig({\n  plugins: [\n    // Place at the end to ensure final asset content is captured\n    // If using vite-plugin-compression2, place sri() before it.\n    sri({ ignoreMissingAsset: false }),\n  ],\n})\n\n// Build your project, and the generated HTML will have integrity attributes:\n// <script type=\"module\" src=\"/assets/index-abc123.js\" integrity=\"sha384-...\"></script>","lang":"typescript","description":"Basic setup: import the named `sri` export, add it to your Vite plugins list, and build to get SRI hashes injected into HTML tags."},"warnings":[{"fix":"Reorder plugins: usually list sri() last. If using compression2, list sri() before it.","message":"Plugin ordering matters: sri() should be placed at the end of the plugins array to capture final asset content, unless you use vite-plugin-compression2, in which case sri() should come before it.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Enable sri({ ignoreMissingAsset: true }) when using @vitejs/plugin-legacy.","message":"ignoreMissingAsset option is required when using @vitejs/plugin-legacy, as legacy chunks may be missed.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Use import { sri } from 'vite-plugin-sri3' instead of require().","message":"All versions are ESM-only; CommonJS require() fails with ERR_REQUIRE_ESM.","severity":"deprecated","affected_versions":">=1.0.0"},{"fix":"Add skip-sri attribute to specific tags to exclude them from integrity injection.","message":"The skip-sri attribute must be added directly to the <script> or <link> tag in your HTML, not to the plugin config.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Upgrade Vite >=3 and Node >=18.","message":"Minimum Vite version is now 3 (was undefined in earlier unpublished versions). Node requirement is >=18.","severity":"breaking","affected_versions":">=2.0.0"}],"env_vars":null,"last_verified":"2026-04-27T00:00:00.000Z","next_check":"2026-07-26T00:00:00.000Z","problems":[{"fix":"Replace require('vite-plugin-sri3') with import { sri } from 'vite-plugin-sri3' in your vite.config.(js|ts|mjs|mts) file.","cause":"Using CommonJS require() to import an ESM-only package.","error":"ERR_REQUIRE_ESM"},{"fix":"Change import sri from 'vite-plugin-sri3' to import { sri } from 'vite-plugin-sri3'.","cause":"Default import used instead of named import.","error":"TypeError: sri is not a function"},{"fix":"Run npm i -D vite-plugin-sri3 and ensure Vite >=3 is installed.","cause":"Package not installed or wrong Vite version (e.g., Vite 2 unsupported).","error":"Failed to resolve plugin: vite-plugin-sri3"},{"fix":"Rebuild the project; if issue persists, verify no other plugins modify assets after sri() runs.","cause":"Asset has been tampered with after build or file content changed without rebuild.","error":"SRI hash mismatch: expected sha384-... but got sha384-..."}],"ecosystem":"npm","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}