fix: pin Swagger UI CDN assets with SRI

[ardatan]

Summary

• Pin swagger-ui-dist to 5.11.0 and load CSS/JS with real Subresource Integrity hashes
• Switch stylesheets from @import to <link> so integrity is enforceable
• Also cover the dark-theme CSS CDN asset

Supersedes #3807 (that PR pinned the version but used a placeholder integrity value that would break Swagger UI in browsers).

Test plan

• Downloaded each CDN URL and verified sha384 digests match the HTML attributes
• CI green

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
fets	0.8.9-alpha-20260807162236-5c8cf7279b6063c2f7c2ed84cf76e15c6992798d	npm ↗︎ unpkg ↗︎

[github-actions]

💻 Website Preview

The latest changes are available as preview in: https://pr-4082.fets-3ku.pages.dev

[github-actions]

✅ Benchmark Results

     ✓ no_errors{server:node-http,mode:no-schema}
     ✓ expected_result{server:node-http,mode:no-schema}
     ✓ no_errors{server:node-http,mode:json-schema}
     ✓ expected_result{server:node-http,mode:json-schema}
     ✓ no_errors{server:uWebSockets,mode:no-schema}
     ✓ expected_result{server:uWebSockets,mode:no-schema}
     ✓ no_errors{server:uWebSockets,mode:json-schema}
     ✓ expected_result{server:uWebSockets,mode:json-schema}

     checks......................................: 100.00% ✓ 888132      ✗ 0     
     data_received...............................: 81 MB   672 kB/s
     data_sent...................................: 56 MB   470 kB/s
     http_req_blocked............................: avg=1.44µs   min=681ns    med=1.26µs   max=277.94µs p(90)=1.76µs   p(95)=2.27µs  
     http_req_connecting.........................: avg=1ns      min=0s       med=0s       max=177.09µs p(90)=0s       p(95)=0s      
     http_req_duration...........................: avg=193.03µs min=124.23µs med=183.96µs max=9.68ms   p(90)=211.74µs p(95)=220.59µs
       { expected_response:true }................: avg=193.03µs min=124.23µs med=183.96µs max=9.68ms   p(90)=211.74µs p(95)=220.59µs
     ✓ { server:node-http,mode:json-schema }.....: avg=201.92µs min=143.71µs med=192.19µs max=8.18ms   p(90)=219.63µs p(95)=227.57µs
     ✓ { server:node-http,mode:no-schema }.......: avg=196.03µs min=131.51µs med=183.59µs max=9.68ms   p(90)=213.99µs p(95)=225.51µs
     ✓ { server:uWebSockets,mode:json-schema }...: avg=190.98µs min=132.86µs med=183.96µs max=8.49ms   p(90)=208.3µs  p(95)=214.96µs
     ✓ { server:uWebSockets,mode:no-schema }.....: avg=183.91µs min=124.23µs med=176.9µs  max=7.65ms   p(90)=201.25µs p(95)=208.48µs
     http_req_failed.............................: 0.00%   ✓ 0           ✗ 444066
     http_req_receiving..........................: avg=24.77µs  min=9.58µs   med=24.08µs  max=3.16ms   p(90)=31.29µs  p(95)=33.18µs 
     http_req_sending............................: avg=8.27µs   min=4.36µs   med=7.67µs   max=2.66ms   p(90)=11.36µs  p(95)=12.52µs 
     http_req_tls_handshaking....................: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting............................: avg=159.99µs min=97.28µs  med=150.94µs max=9.56ms   p(90)=176.33µs p(95)=184.08µs
     http_reqs...................................: 444066  3700.462548/s
     iteration_duration..........................: avg=265.34µs min=185.89µs med=255.37µs max=9.89ms   p(90)=288.49µs p(95)=299.89µs
     iterations..................................: 444066  3700.462548/s
     vus.........................................: 1       min=1         max=1   
     vus_max.....................................: 2       min=2         max=2   

[Copilot]

Pull request overview

This PR hardens the Swagger UI HTML template by switching CDN-loaded Swagger UI assets to version-pinned URLs and adding Subresource Integrity (SRI) + crossorigin attributes so browsers can verify the fetched bytes.

Changes:

• Replace CSS @import with <link> tags so SRI can be enforced for stylesheets.
• Pin swagger-ui-dist CDN URLs to @5.11.0 and add sha384 integrity hashes for CSS and JS.
• Add a changeset documenting the security hardening.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/fets/src/swagger-ui.html	Pins Swagger UI assets and adds SRI/crossorigin; moves theme CSS from @import to <link>.
.changeset/swagger-ui-sri.md	Documents the SRI/pinning change as a patch release note.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.