Turbopack: support Subresource Integrity by mischnic · Pull Request #90152 · vercel/next.js

mischnic · 2026-02-18T17:40:44Z

A spinoff from #90045

The SRI test is failing for unrelated reasons (hardcoded chunk name matching)
Somehow, the hashes are wrong

mischnic · 2026-02-18T17:41:04Z

Turbopack: support Subresource Integrity #90152 👈 (View in Graphite)
canary

This stack of pull requests is managed by Graphite. Learn more about stacking.

vercel

Additional Suggestion:

Missing required sriEnabled parameter in TurbopackManifestLoader constructor call in the dev hot-reloader causes a TypeScript compilation error.

codspeed-hq · 2026-02-18T17:55:21Z

Merging this PR will not alter performance

✅ 17 untouched benchmarks
⏩ 3 skipped benchmarks¹

_{Comparing mischnic/turbopack-sri (e98fb97) with canary (e17b115)}

3 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

vercel · 2026-02-18T17:58:52Z

crates/next-api/src/paths.rs

+                    }
+                    HashAlgorithm::Sha256 => {
+                        let mut hasher = ShaHasher::new_sha256();
+                        hasher.write_ref(file);


SRI hash computation includes file metadata and Rope length prefix, producing hashes that don't match browser-computed hashes over raw file content.

nextjs-bot · 2026-02-18T18:03:57Z

Failing test suites

Commit: e98fb97 | About building and testing Next.js

pnpm test-start test/production/app-dir/subresource-integrity/subresource-integrity.test.ts (job)

Subresource Integrity > with edge runtime > includes an integrity attribute on scripts (DD)
Subresource Integrity > with node runtime > includes an integrity attribute on scripts (DD)

Expand output

● Subresource Integrity › with node runtime › includes an integrity attribute on scripts

expect(received).toBe(expected) // Object.is equality

Expected: 1
Received: 0

  184 |           `head script[src^="/_next/static/chunks/main-app"]`
  185 |         )
> 186 |         expect(mainScript.length).toBe(1)
      |                                   ^
  187 |         assertHasIntegrity(mainScript.get(0))
  188 |
  189 |         const polyfillsScript = $(

  at Object.toBe (production/app-dir/subresource-integrity/subresource-integrity.test.ts:186:35)

● Subresource Integrity › with edge runtime › includes an integrity attribute on scripts

expect(received).toBe(expected) // Object.is equality

Expected: 1
Received: 0

  184 |           `head script[src^="/_next/static/chunks/main-app"]`
  185 |         )
> 186 |         expect(mainScript.length).toBe(1)
      |                                   ^
  187 |         assertHasIntegrity(mainScript.get(0))
  188 |
  189 |         const polyfillsScript = $(

  at Object.toBe (production/app-dir/subresource-integrity/subresource-integrity.test.ts:186:35)

nextjs-bot · 2026-02-18T18:19:25Z

Stats from current PR

✅ No significant changes detected

📊 All Metrics

📖 Metrics Glossary

Dev Server Metrics:

Listen = TCP port starts accepting connections
First Request = HTTP server returns successful response
Cold = Fresh build (no cache)
Warm = With cached build artifacts

Build Metrics:

Fresh = Clean build (no .next directory)
Cached = With existing .next directory

Change Thresholds:

Time: Changes < 50ms AND < 10%, OR < 2% are insignificant
Size: Changes < 1KB AND < 1% are insignificant
All other changes are flagged to catch regressions

⚡ Dev Server

Metric	Canary	PR	Change	Trend
Cold (Listen)	455ms	455ms	✓	▁▇▁▁▁
Cold (Ready in log)	435ms	436ms	✓	▁▇▁▁▁
Cold (First Request)	1.251s	1.261s	✓	▃▇▃▁▃
Warm (Listen)	456ms	456ms	✓	▁▇▁▁▁
Warm (Ready in log)	439ms	439ms	✓	▁▇▁▁▁
Warm (First Request)	343ms	341ms	✓	▁▆▁▂▂

📦 Dev Server (Webpack) (Legacy)

📦 Dev Server (Webpack)

Metric	Canary	PR	Change	Trend
Cold (Listen)	456ms	457ms	✓	▁▁▁▁█
Cold (Ready in log)	439ms	439ms	✓	▅▆▅▁█
Cold (First Request)	1.893s	1.887s	✓	▄▃▃▁▅
Warm (Listen)	455ms	456ms	✓	▁▁▁▁█
Warm (Ready in log)	439ms	437ms	✓	▅▅▅▃▆
Warm (First Request)	1.882s	1.893s	✓	▄▃▃▁▄

⚡ Production Builds

Metric	Canary	PR	Change	Trend
Fresh Build	3.961s	3.962s	✓	▁▇▁▁▁
Cached Build	4.048s	4.017s	✓	▁▇▁▁▁

📦 Production Builds (Webpack) (Legacy)

📦 Production Builds (Webpack)

Metric	Canary	PR	Change	Trend
Fresh Build	14.025s	14.028s	✓	▃▁▁▁▃
Cached Build	14.159s	14.096s	✓	▄▁▁▁▃
node_modules Size	472 MB	473 MB	✓	▁▁▁▁▁

📦 Bundle Sizes

Bundle Sizes

⚡ Turbopack

Client

Main Bundles: **398 kB** → **398 kB** ⚠️ +13 B

80 files with content-based hashes (individual files not comparable between builds)

Server

Middleware

	Canary	PR	Change
middleware-b..fest.js gzip	761 B	768 B	✓
Total	761 B	768 B	⚠️ +7 B

Build Details

Build Manifests

	Canary	PR	Change
_buildManifest.js gzip	452 B	451 B	✓
Total	452 B	451 B	✅ -1 B

📦 Webpack

Client

Main Bundles

	Canary	PR	Change
5528-HASH.js gzip	5.47 kB	N/A	-
6280-HASH.js gzip	57 kB	N/A	-
6335.HASH.js gzip	169 B	N/A	-
912-HASH.js gzip	4.53 kB	N/A	-
e8aec2e4-HASH.js gzip	62.6 kB	N/A	-
framework-HASH.js gzip	59.7 kB	59.7 kB	✓
main-app-HASH.js gzip	256 B	254 B	✓
main-HASH.js gzip	39.1 kB	39.1 kB	✓
webpack-HASH.js gzip	1.68 kB	1.68 kB	✓
262-HASH.js gzip	N/A	4.53 kB	-
2889.HASH.js gzip	N/A	169 B	-
5602-HASH.js gzip	N/A	5.48 kB	-
6948ada0-HASH.js gzip	N/A	62.6 kB	-
9544-HASH.js gzip	N/A	57.8 kB	-
Total	231 kB	231 kB	⚠️ +726 B

Polyfills

	Canary	PR	Change
polyfills-HASH.js gzip	39.4 kB	39.4 kB	✓
Total	39.4 kB	39.4 kB	✓

Pages

	Canary	PR	Change
_app-HASH.js gzip	194 B	194 B	✓
_error-HASH.js gzip	183 B	180 B	🟢 3 B (-2%)
css-HASH.js gzip	331 B	330 B	✓
dynamic-HASH.js gzip	1.81 kB	1.81 kB	✓
edge-ssr-HASH.js gzip	256 B	256 B	✓
head-HASH.js gzip	351 B	352 B	✓
hooks-HASH.js gzip	384 B	383 B	✓
image-HASH.js gzip	580 B	581 B	✓
index-HASH.js gzip	260 B	260 B	✓
link-HASH.js gzip	2.5 kB	2.5 kB	✓
routerDirect..HASH.js gzip	320 B	319 B	✓
script-HASH.js gzip	386 B	386 B	✓
withRouter-HASH.js gzip	315 B	315 B	✓
1afbb74e6ecf..834.css gzip	106 B	106 B	✓
Total	7.97 kB	7.97 kB	✅ -2 B

Server

Edge SSR

	Canary	PR	Change
edge-ssr.js gzip	126 kB	125 kB	✓
page.js gzip	250 kB	251 kB	✓
Total	376 kB	376 kB	⚠️ +337 B

Middleware

	Canary	PR	Change
middleware-b..fest.js gzip	618 B	613 B	✓
middleware-r..fest.js gzip	156 B	155 B	✓
middleware.js gzip	43.4 kB	43.7 kB	✓
edge-runtime..pack.js gzip	842 B	842 B	✓
Total	45 kB	45.3 kB	⚠️ +331 B

Build Details

Build Manifests

	Canary	PR	Change
_buildManifest.js gzip	715 B	718 B	✓
Total	715 B	718 B	⚠️ +3 B

Build Cache

	Canary	PR	Change
0.pack gzip	3.9 MB	3.91 MB	🔴 +6.58 kB (+0%)
index.pack gzip	104 kB	103 kB	✓
index.pack.old gzip	104 kB	103 kB	✓
Total	4.11 MB	4.12 MB	⚠️ +5.38 kB

🔄 Shared (bundler-independent)

Runtimes

	Canary	PR	Change
app-page-exp...dev.js gzip	316 kB	316 kB	✓
app-page-exp..prod.js gzip	168 kB	168 kB	✓
app-page-tur...dev.js gzip	316 kB	316 kB	✓
app-page-tur..prod.js gzip	168 kB	168 kB	✓
app-page-tur...dev.js gzip	312 kB	312 kB	✓
app-page-tur..prod.js gzip	166 kB	166 kB	✓
app-page.run...dev.js gzip	313 kB	313 kB	✓
app-page.run..prod.js gzip	166 kB	166 kB	✓
app-route-ex...dev.js gzip	70.5 kB	70.5 kB	✓
app-route-ex..prod.js gzip	49.1 kB	49.1 kB	✓
app-route-tu...dev.js gzip	70.6 kB	70.6 kB	✓
app-route-tu..prod.js gzip	49.1 kB	49.1 kB	✓
app-route-tu...dev.js gzip	70.1 kB	70.1 kB	✓
app-route-tu..prod.js gzip	48.9 kB	48.9 kB	✓
app-route.ru...dev.js gzip	70.1 kB	70.1 kB	✓
app-route.ru..prod.js gzip	48.8 kB	48.8 kB	✓
dist_client_...dev.js gzip	324 B	324 B	✓
dist_client_...dev.js gzip	326 B	326 B	✓
dist_client_...dev.js gzip	318 B	318 B	✓
dist_client_...dev.js gzip	317 B	317 B	✓
pages-api-tu...dev.js gzip	43.2 kB	43.2 kB	✓
pages-api-tu..prod.js gzip	32.9 kB	32.9 kB	✓
pages-api.ru...dev.js gzip	43.2 kB	43.2 kB	✓
pages-api.ru..prod.js gzip	32.8 kB	32.8 kB	✓
pages-turbo....dev.js gzip	52.5 kB	52.5 kB	✓
pages-turbo...prod.js gzip	38.4 kB	38.4 kB	✓
pages.runtim...dev.js gzip	52.5 kB	52.5 kB	✓
pages.runtim..prod.js gzip	38.4 kB	38.4 kB	✓
server.runti..prod.js gzip	63.6 kB	63.6 kB	✓
Total	2.8 MB	2.8 MB	✅ -2 B

nextjs-bot added created-by: Turbopack team PRs by the Turbopack team. tests Turbopack Related to Turbopack with Next.js. type: next labels Feb 18, 2026

This was referenced Feb 18, 2026

Turbopack: experimental.immutableAssetToken #88607

Draft

Adapter: STATIC_FILE.immutable #90045

Draft

mischnic mentioned this pull request Feb 18, 2026

Turbopack: use file_content.hash() consistently #90078

Merged

rename to AssetPaths

c4b76df

mischnic changed the title ~~turbopack: write sri manifests~~ Turbopack: support Feb 18, 2026

mischnic changed the title ~~Turbopack: support~~ Turbopack: support Subresource Integrity Feb 18, 2026

mischnic marked this pull request as ready for review February 18, 2026 17:44

mischnic marked this pull request as draft February 18, 2026 17:44

mischnic added 2 commits February 18, 2026 18:45

AssetHashesManifestAsset

276fc2d

turbopack: write sri manifests

3f38bb3

vercel bot reviewed Feb 18, 2026

View reviewed changes

mischnic added 2 commits February 18, 2026 18:52

merge manifests

1b4484d

enable

e98fb97

mischnic changed the base branch from mischnic/adapter-immutable to graphite-base/90152 February 18, 2026 17:54

mischnic force-pushed the mischnic/turbopack-sri branch from d08b634 to e98fb97 Compare February 18, 2026 17:54

mischnic force-pushed the graphite-base/90152 branch from 6c1cc30 to e17b115 Compare February 18, 2026 17:54

mischnic changed the base branch from graphite-base/90152 to canary February 18, 2026 17:54

vercel bot reviewed Feb 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Turbopack: support Subresource Integrity #90152

Turbopack: support Subresource Integrity #90152
mischnic wants to merge 5 commits intocanaryfrom
mischnic/turbopack-sri

mischnic commented Feb 18, 2026 •

edited

Loading

Uh oh!

mischnic commented Feb 18, 2026 •

edited

Loading

Uh oh!

vercel bot left a comment

Uh oh!

codspeed-hq bot commented Feb 18, 2026 •

edited

Loading

Uh oh!

vercel bot Feb 18, 2026

Uh oh!

nextjs-bot commented Feb 18, 2026

Uh oh!

nextjs-bot commented Feb 18, 2026

⚡ Dev Server

📦 Dev Server (Webpack)

⚡ Production Builds

📦 Production Builds (Webpack)

Bundle Sizes

⚡ Turbopack

📦 Webpack

🔄 Shared (bundler-independent)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

mischnic commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mischnic commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot left a comment

Choose a reason for hiding this comment

Uh oh!

codspeed-hq bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

vercel bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

nextjs-bot commented Feb 18, 2026

Failing test suites

Uh oh!

nextjs-bot commented Feb 18, 2026

Stats from current PR

✅ No significant changes detected

⚡ Dev Server

📦 Dev Server (Webpack)

⚡ Production Builds

📦 Production Builds (Webpack)

Bundle Sizes

⚡ Turbopack

📦 Webpack

🔄 Shared (bundler-independent)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

mischnic commented Feb 18, 2026 •

edited

Loading

mischnic commented Feb 18, 2026 •

edited

Loading

codspeed-hq bot commented Feb 18, 2026 •

edited

Loading