Fix webpack-subresource-integrity v5 named export handling by justin808 · Pull Request #978 · shakacode/shakapacker

justin808 · 2026-03-15T10:10:30Z

Summary

support both export styles from webpack-subresource-integrity in webpack plugins:
- default export constructor (older versions)
- named SubresourceIntegrityPlugin export (v5.1+)
keep runtime behavior unchanged for existing setups
add regression tests covering both module shapes

Testing

yarn test test/package/plugins/webpackSubresourceIntegrity.test.js --runInBand
yarn lint
yarn prettier --check package/plugins/webpack.ts test/package/plugins/webpackSubresourceIntegrity.test.js

Closes #972.

Note

Low Risk
Low risk: small compatibility tweak to plugin loading plus focused unit tests; behavior should be unchanged except preventing runtime breakage with newer webpack-subresource-integrity exports.

Overview
Updates the webpack plugin setup to support both webpack-subresource-integrity module shapes by using the named SubresourceIntegrityPlugin export when present and falling back to the default export.

Adds regression tests that mock each export style to ensure the plugin is instantiated with the expected SRI options.

^{Written by Cursor Bugbot for commit 0a5972f. Configure here.}

coderabbitai · 2026-03-15T10:10:40Z

Warning

Rate limit exceeded

@justin808 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 7 minutes and 10 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2b4eac71-4c9f-4b70-974f-372f902824bd

📥 Commits

Reviewing files that changed from the base of the PR and between b259a0e and a6b4bbb.

📒 Files selected for processing (2)

package/plugins/webpack.ts
test/package/plugins/webpackSubresourceIntegrity.test.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch jg-codex/issue-972-sri-plugin-export

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

greptile-apps · 2026-03-15T10:13:41Z

Greptile Summary

This PR fixes compatibility with webpack-subresource-integrity v5+ which changed from a default export to a named SubresourceIntegrityPlugin export. The fix uses the same "PropertyName" in module detection pattern already established in this codebase for WebpackAssetsManifest, keeping the approach consistent.

Adds runtime detection in package/plugins/webpack.ts to handle both default export (v1.x) and named export (v5+) from webpack-subresource-integrity
Adds regression tests covering both module export shapes using jest.isolateModules for proper isolation
No behavioral changes for existing setups; the plugin constructor invocation and options remain identical

Confidence Score: 5/5

This PR is safe to merge — it's a small, well-tested compatibility fix following an established pattern in the codebase.
The change is minimal (5 lines of production code), follows the identical pattern already used for WebpackAssetsManifest in the same file, includes comprehensive regression tests covering both code paths, and has no risk of breaking existing setups since the fallback preserves the original behavior.
No files require special attention.

Important Files Changed

Filename	Overview
package/plugins/webpack.ts	Adds runtime detection of `webpack-subresource-integrity` v5 named export vs older default export, following the same `in` operator pattern already used for `WebpackAssetsManifest`. Minor version inaccuracy in comment (says >=5.1, should be v5+).
test/package/plugins/webpackSubresourceIntegrity.test.js	New regression tests covering both module export shapes (named export for v5+ and default export for v1.x). Uses `jest.isolateModules` for proper module isolation. Correctly mocks all dependencies including top-level requires.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["require('webpack-subresource-integrity')"] --> B{"'SubresourceIntegrityPlugin' in module?"}
    B -->|Yes v5+| C["Use module.SubresourceIntegrityPlugin"]
    B -->|No v1.x| D["Use module directly as constructor"]
    C --> E["new SubresourceIntegrityPlugin(options)"]
    D --> E
    E --> F["Push to plugins array"]

_{Last reviewed commit: 0a5972f}

claude · 2026-03-15T10:14:09Z

Review

The fix is correct and well-structured. Using "SubresourceIntegrityPlugin" in subresourceIntegrityModule mirrors the existing WebpackAssetsManifest pattern (lines 17–21) exactly, which is the right approach for consistency.

Two minor observations (see inline comments):

Version in comment — the >=5.1 annotation looks inaccurate; the named export landed in v5.0.0. Either drop the version or cite the exact one.
Redundant jest.resetModules() — jest.isolateModules() already gives each test an isolated registry, so the resetModules() call in afterEach is a no-op. Only clearAllMocks() is needed there.

Otherwise this looks good to merge.

claude · 2026-03-15T10:27:42Z

Review (follow-up)

The current state of this PR looks good. The implementation is correct and the tests are clean.

Verified:

The named-export detection uses the in operator, which works correctly on both plain objects and functions (functions are objects in JS), covering both the v5.1+ named-export shape and the older default-export shape.
The pattern mirrors the existing WebpackAssetsManifest handling in the same file (lines 18–21), keeping things consistent.
afterEach only calls jest.clearAllMocks() — no redundant resetModules() call.
Tests properly exercise both code paths via jest.isolateModules.

One remaining minor nit (non-blocking):
The inline comment says v5+ while the PR description says v5.1+. Worth pinning to the exact version where the named export was introduced so future readers can verify the changelog. Either way it doesn't affect correctness.

Ready to merge.

Promote v9.7.0-rc.0 to v9.7.0 stable and add missing PR #978 (webpack-subresource-integrity v5 named export fix). Co-Authored-By: Claude Opus 4.6 <[email protected]>

### Summary Adds the v9.7.0 changelog section with release notes for all user-visible changes since v9.6.1: - **Added**: rspack v2 support (PR #975) - **Fixed**: Config exporter path traversal and annotation format validation (PR #914) - **Fixed**: `webpack-subresource-integrity` v5 named export handling (PR #978, fixes #972) Version diff links at the bottom of the file are updated accordingly. ### Pull Request checklist - [x] ~Add/update test to cover these changes~ - [x] ~Update documentation~ - [x] Update CHANGELOG file ### Other Information Non-user-visible PRs (#920, #965, #970, #971, #977, #979, #981, #982) were intentionally excluded per changelog policy.  --- > [!NOTE] > **Low Risk** > Documentation-only change updating `CHANGELOG.md`; no runtime code or dependency changes are introduced in this PR. > > **Overview** > Adds a new `v9.7.0` section to `CHANGELOG.md` documenting user-visible changes (rspack v2 support and two fixes around config export security/validation and `webpack-subresource-integrity` v5 exports). > > Updates the compare links at the bottom so `[Unreleased]` now compares from `v9.7.0`, and adds the new `[v9.7.0]` tag link. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 8942a43. Configure [here](https://cursor.com/dashboard?tab=bugbot).   ## Summary by CodeRabbit * **New Features** * Added rspack v2 support * **Bug Fixes** * Improved security and validation handling  --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

## Summary - support both export styles from `webpack-subresource-integrity` in webpack plugins: - default export constructor (older versions) - named `SubresourceIntegrityPlugin` export (v5.1+) - keep runtime behavior unchanged for existing setups - add regression tests covering both module shapes ## Testing - `yarn test test/package/plugins/webpackSubresourceIntegrity.test.js --runInBand` - `yarn lint` - `yarn prettier --check package/plugins/webpack.ts test/package/plugins/webpackSubresourceIntegrity.test.js` Closes #972.  --- > [!NOTE] > **Low Risk** > Low risk: small compatibility tweak to plugin loading plus focused unit tests; behavior should be unchanged except preventing runtime breakage with newer `webpack-subresource-integrity` exports. > > **Overview** > Updates the webpack plugin setup to support both `webpack-subresource-integrity` module shapes by using the named `SubresourceIntegrityPlugin` export when present and falling back to the default export. > > Adds regression tests that mock each export style to ensure the plugin is instantiated with the expected SRI options. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 0a5972f. Configure [here](https://cursor.com/dashboard?tab=bugbot).

### Summary Adds the v9.7.0 changelog section with release notes for all user-visible changes since v9.6.1: - **Added**: rspack v2 support (PR #975) - **Fixed**: Config exporter path traversal and annotation format validation (PR #914) - **Fixed**: `webpack-subresource-integrity` v5 named export handling (PR #978, fixes #972) Version diff links at the bottom of the file are updated accordingly. ### Pull Request checklist - [x] ~Add/update test to cover these changes~ - [x] ~Update documentation~ - [x] Update CHANGELOG file ### Other Information Non-user-visible PRs (#920, #965, #970, #971, #977, #979, #981, #982) were intentionally excluded per changelog policy.  --- > [!NOTE] > **Low Risk** > Documentation-only change updating `CHANGELOG.md`; no runtime code or dependency changes are introduced in this PR. > > **Overview** > Adds a new `v9.7.0` section to `CHANGELOG.md` documenting user-visible changes (rspack v2 support and two fixes around config export security/validation and `webpack-subresource-integrity` v5 exports). > > Updates the compare links at the bottom so `[Unreleased]` now compares from `v9.7.0`, and adds the new `[v9.7.0]` tag link. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 8942a43. Configure [here](https://cursor.com/dashboard?tab=bugbot).   ## Summary by CodeRabbit * **New Features** * Added rspack v2 support * **Bug Fixes** * Improved security and validation handling  --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

Support webpack-subresource-integrity named export in webpack plugin

0a5972f

greptile-apps Bot reviewed Mar 15, 2026

View reviewed changes

Comment thread package/plugins/webpack.ts Outdated

claude Bot reviewed Mar 15, 2026

View reviewed changes

Comment thread package/plugins/webpack.ts Outdated

claude Bot reviewed Mar 15, 2026

View reviewed changes

Comment thread test/package/plugins/webpackSubresourceIntegrity.test.js

Polish sri plugin compatibility review follow-ups

a6b4bbb

coderabbitai Bot approved these changes Mar 15, 2026

View reviewed changes

justin808 merged commit 5d55b9a into main Mar 16, 2026
63 checks passed

justin808 deleted the jg-codex/issue-972-sri-plugin-export branch March 16, 2026 04:48

justin808 added a commit that referenced this pull request Mar 17, 2026

Update CHANGELOG for v9.7.0 release

8942a43

Promote v9.7.0-rc.0 to v9.7.0 stable and add missing PR #978 (webpack-subresource-integrity v5 named export fix). Co-Authored-By: Claude Opus 4.6 <[email protected]>

justin808 mentioned this pull request Mar 17, 2026

Add v9.7.0 release notes to CHANGELOG #985

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix webpack-subresource-integrity v5 named export handling#978

Fix webpack-subresource-integrity v5 named export handling#978
justin808 merged 2 commits intomainfrom
jg-codex/issue-972-sri-plugin-export

justin808 commented Mar 15, 2026 •

edited by cursor Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 15, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

greptile-apps Bot commented Mar 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Mar 15, 2026

Uh oh!

claude Bot commented Mar 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

justin808 commented Mar 15, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

coderabbitai Bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

greptile-apps Bot commented Mar 15, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Mar 15, 2026

Review

Uh oh!

claude Bot commented Mar 15, 2026

Review (follow-up)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

justin808 commented Mar 15, 2026 •

edited by cursor Bot

Loading

coderabbitai Bot commented Mar 15, 2026 •

edited

Loading