feat(bundling): add automatic SRI integrity hash generation

[harlan-zw]

🔗 Linked issue

❓ Type of change

• 📖 Documentation (updates to the documentation or readme)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

Adds automatic Subresource Integrity (SRI) hash generation for bundled scripts.

What it does:

• Calculates SHA hash at build time when scripts are downloaded/bundled
• Injects integrity attribute into script tags
• Automatically adds crossorigin="anonymous" (required by browsers for SRI)
• Caches integrity hash in build metadata for reuse
• Supports sha256, sha384 (default), and sha512 algorithms

Configuration:

// nuxt.config.ts
export default defineNuxtConfig({
  scripts: {
    assets: {
      integrity: true, // Uses sha384 by default
      // integrity: 'sha256' | 'sha384' | 'sha512'
    }
  }
})

Output:

<script src="/_scripts/abc123.js"
        integrity="sha384-oqVuAfXRKap..."
        crossorigin="anonymous"></script>

Security benefits:

• Tamper detection: Browser refuses to execute scripts if hash doesn't match
• CDN compromise protection: Modified scripts won't execute even if CDN is compromised
• Build-time verification: Hash calculated from actual downloaded content

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
scripts-docs	Error		Jan 15, 2026 3:14pm
scripts-playground	Ready	Preview, Comment	Jan 15, 2026 3:14pm

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nuxt/scripts/@nuxt/scripts@575

commit: 4b2695d