3 ms·

Why is it removing integrity?

• URfejk 6y ago
  "... remove crossorigin and integrity attributes of script and stylesheet tags to increase replacements ..."
  • im3w1l 6y ago
    Yeah but I don't understand why that would be needed. It sounds dangerous.
    • u566 6y ago
      With these things you can't replace anything. The website has to be whitelisted or you live with the fact that the libraries can't be replaced and the site is broken.
• 3np 6y ago
  Indeed - integrity should be dependent on the content, not the URI. It looks like they do it to allow "replacements" (e.g. serve package version x.y.z-1 if it can't find x.y.z). This sounds like a horrible idea.
• xtanx 6y ago
  It seems that it is "upgrading" libraries. If you look at the graph it replaces jQuery 3.3.1 with 3.4.1.
• jorams 6y ago
  Two reasons: 1. It deliberately replaces some versions of libraries with different versions. That's a feature I could do without. 2. The use of integrity hashes on cross-origin resources breaks Decentraleyes[0], and it's not fixable without browser changes.[1] [0]: https://git.synz.io/Synzvato/decentraleyes/-/issues/16 https://git.synz.io/Synzvato/decentraleyes/-/issues/16 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1419459 https://bugzilla.mozilla.org/show_bug.cgi?id=1419459