feat: add support for same-origin SRI allowing use of strict Integrit…

[willfarrell]

Clone of #15435, redone to be based off version 3 (main)

Summary

Adds opt-in Subresource Integrity (SRI) support to SvelteKit. When enabled, SvelteKit adds integrity hashes to the scripts and stylesheets it emits, so apps can use a strict Integrity-Policy header. Without this, a strict Integrity-Policy blocks SvelteKit's own assets because they have no integrity metadata.

What this does

New config option (in the sveltekit() plugin options, alongside csp/csrf):

• subresourceIntegrity: false | 'sha256' | 'sha384' | 'sha512' (default false)

Build (exports/vite/build/index.js):

• After the client build, hashes each emitted client chunk on disk with node:crypto and stores the result in build_data.client.integrity. Inlined chunks are skipped.

Rendering (runtime/server/page/render.js):

• Adds integrity and crossorigin="anonymous" to <link rel="stylesheet"> and <link rel="modulepreload"> tags emitted during SSR.
• A Link header can't carry integrity, so preloads that have a hash are always emitted as tags instead of headers.

Tests: the options test app enables sha384 and checks that every emitted hash matches the bytes actually served.

AI disclosure: Implemented by Claude Opus 5.5. Reviewed and tested by human.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
  • None
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.
  • When using the cli, it asks Which packages should have a major bump?, but doesn't let me set it as a minor version.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from db2328e:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/db2328e83f8cc456a7a8590e3b720fc98d842d6b

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17399

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: db2328e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR