Skip to content

fix(client): use CSP nonce when rendering error overlay #20791

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 18, 2025
Merged

fix(client): use CSP nonce when rendering error overlay #20791

merged 1 commit into from
Sep 18, 2025
+11 −9

Conversation

thatguystone
Copy link
Contributor

Description

The error overlay currently doesn't use the cspNonce from client, so when a strict CSP is enabled, the error overlay looks broken.

@thatguystone thatguystone changed the title Use CSP nonce when rendering error overlay fix(client): use CSP nonce when rendering error overlay Sep 17, 2025
@sapphi-red
Copy link
Member

/ecosystem-ci run

@sapphi-red sapphi-red added the p2-edge-case Bug, but has workaround or limited in scope (priority) label Sep 18, 2025
@pkg-pr-new pkg.pr.new
Copy link

pkg-pr-new bot commented Sep 18, 2025

Open in StackBlitz

npm i https://pkg.pr.new/vite@20791

commit: 15708a9

@vite-ecosystem-ci
Copy link

📝 Ran ecosystem CI on 15708a9: Open

suite result latest scheduled
laravel ❌ failure ❌ failure
unocss ❌ failure ❌ failure
sveltekit ❌ failure ✅ success

✅ analogjs, histoire, ladle, quasar, astro, marko, one, nuxt, rakkas, qwik, vike, react-router, vite-plugin-svelte, storybook, vitepress, vite-plugin-pwa, vite-plugin-react, vite-plugin-rsc, vite-plugin-vue, vite-plugin-cloudflare, vuepress, waku, vite-environment-examples, vitest, vite-setup-catalogue

@sapphi-red
Copy link
Member

sveltekit failed with main branch as well.
https://github.com/vitejs/vite-ecosystem-ci/actions/runs/17817427184/job/50653363205

sapphi-red
sapphi-red approved these changes Sep 18, 2025
View reviewed changes
Copy link
Member

@sapphi-red sapphi-red left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@sapphi-red sapphi-red merged commit 9bc9d12 into vitejs:main Sep 18, 2025
19 checks passed
renovate bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Sep 22, 2025
@renovate
Update dependency vite to v7.1.7
e741ee2 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 7.1.4 | 7.1.7 |


## [v7.1.7](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-717-2025-09-22-small)

##### Bug Fixes

- **build:** fix ssr environment `emitAssets: true` when `sharedConfigBuild: true` ([#20787](vitejs/vite#20787)) ([4c4583c](vitejs/vite@4c4583c))
- **client:** use CSP nonce when rendering error overlay ([#20791](vitejs/vite#20791)) ([9bc9d12](vitejs/vite@9bc9d12))
- **deps:** update all non-major dependencies ([#20811](vitejs/vite#20811)) ([9f2247c](vitejs/vite@9f2247c))
- **glob:** handle glob imports from folders starting with dot ([#20800](vitejs/vite#20800)) ([105abe8](vitejs/vite@105abe8))
- **hmr:** trigger prune event when import is removed from non hmr module ([#20768](vitejs/vite#20768)) ([9f32b1d](vitejs/vite@9f32b1d))
- **hmr:** wait for `import.meta.hot.prune` callbacks to complete before running other HMRs ([#20698](vitejs/vite#20698)) ([98a3484](vitejs/vite@98a3484))


## [v7.1.6](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-716-2025-09-18-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#20773](vitejs/vite#20773)) ([88af2ae](vitejs/vite@88af2ae))
- **esbuild:** inject esbuild helper functions with minified `$` variables correctly ([#20761](vitejs/vite#20761)) ([7e8e004](vitejs/vite@7e8e004))
- fallback terser to main thread when nameCache is provided ([#20750](vitejs/vite#20750)) ([a679a64](vitejs/vite@a679a64))
- **types:** strict env typings fail when `skipLibCheck` is `false` ([#20755](vitejs/vite#20755)) ([cc54e29](vitejs/vite@cc54e29))

##### Miscellaneous Chores

- **deps:** update rolldown-related dependencies ([#20675](vitejs/vite#20675)) ([a67bb5f](vitejs/vite@a67bb5f))
- **deps:** update rolldown-related dependencies ([#20772](vitejs/vite#20772)) ([d785e72](vitejs/vite@d785e72))


## [v7.1.5](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-715-2025-09-08-small)

##### Bug Fixes

- apply `fs.strict` check to HTML files ([#20736](vitejs/vite#20736)) ([14015d7](vitejs/vite@14015d7))
- **deps:** update all non-major dependencies ([#20732](vitejs/vite#20732)) ([122bfba](vitejs/vite@122bfba))
- upgrade sirv to 3.0.2 ([#20735](vitejs/vite#20735)) ([09f2b52](vitejs/vite@09f2b52))
renovate bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Sep 23, 2025
@renovate
Update dependency vite to v7.1.7
47be635 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 7.1.4 | 7.1.7 |


## [v7.1.7](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-717-2025-09-22-small)

##### Bug Fixes

- **build:** fix ssr environment `emitAssets: true` when `sharedConfigBuild: true` ([#20787](vitejs/vite#20787)) ([4c4583c](vitejs/vite@4c4583c))
- **client:** use CSP nonce when rendering error overlay ([#20791](vitejs/vite#20791)) ([9bc9d12](vitejs/vite@9bc9d12))
- **deps:** update all non-major dependencies ([#20811](vitejs/vite#20811)) ([9f2247c](vitejs/vite@9f2247c))
- **glob:** handle glob imports from folders starting with dot ([#20800](vitejs/vite#20800)) ([105abe8](vitejs/vite@105abe8))
- **hmr:** trigger prune event when import is removed from non hmr module ([#20768](vitejs/vite#20768)) ([9f32b1d](vitejs/vite@9f32b1d))
- **hmr:** wait for `import.meta.hot.prune` callbacks to complete before running other HMRs ([#20698](vitejs/vite#20698)) ([98a3484](vitejs/vite@98a3484))


## [v7.1.6](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-716-2025-09-18-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#20773](vitejs/vite#20773)) ([88af2ae](vitejs/vite@88af2ae))
- **esbuild:** inject esbuild helper functions with minified `$` variables correctly ([#20761](vitejs/vite#20761)) ([7e8e004](vitejs/vite@7e8e004))
- fallback terser to main thread when nameCache is provided ([#20750](vitejs/vite#20750)) ([a679a64](vitejs/vite@a679a64))
- **types:** strict env typings fail when `skipLibCheck` is `false` ([#20755](vitejs/vite#20755)) ([cc54e29](vitejs/vite@cc54e29))

##### Miscellaneous Chores

- **deps:** update rolldown-related dependencies ([#20675](vitejs/vite#20675)) ([a67bb5f](vitejs/vite@a67bb5f))
- **deps:** update rolldown-related dependencies ([#20772](vitejs/vite#20772)) ([d785e72](vitejs/vite@d785e72))


## [v7.1.5](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-715-2025-09-08-small)

##### Bug Fixes

- apply `fs.strict` check to HTML files ([#20736](vitejs/vite#20736)) ([14015d7](vitejs/vite@14015d7))
- **deps:** update all non-major dependencies ([#20732](vitejs/vite#20732)) ([122bfba](vitejs/vite@122bfba))
- upgrade sirv to 3.0.2 ([#20735](vitejs/vite#20735)) ([09f2b52](vitejs/vite@09f2b52))
renovate bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Sep 25, 2025
@renovate
Update dependency vite to v7.1.7
a4a6a7f 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 7.1.4 | 7.1.7 |


## [v7.1.7](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-717-2025-09-22-small)

##### Bug Fixes

- **build:** fix ssr environment `emitAssets: true` when `sharedConfigBuild: true` ([#20787](vitejs/vite#20787)) ([4c4583c](vitejs/vite@4c4583c))
- **client:** use CSP nonce when rendering error overlay ([#20791](vitejs/vite#20791)) ([9bc9d12](vitejs/vite@9bc9d12))
- **deps:** update all non-major dependencies ([#20811](vitejs/vite#20811)) ([9f2247c](vitejs/vite@9f2247c))
- **glob:** handle glob imports from folders starting with dot ([#20800](vitejs/vite#20800)) ([105abe8](vitejs/vite@105abe8))
- **hmr:** trigger prune event when import is removed from non hmr module ([#20768](vitejs/vite#20768)) ([9f32b1d](vitejs/vite@9f32b1d))
- **hmr:** wait for `import.meta.hot.prune` callbacks to complete before running other HMRs ([#20698](vitejs/vite#20698)) ([98a3484](vitejs/vite@98a3484))


## [v7.1.6](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-716-2025-09-18-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#20773](vitejs/vite#20773)) ([88af2ae](vitejs/vite@88af2ae))
- **esbuild:** inject esbuild helper functions with minified `$` variables correctly ([#20761](vitejs/vite#20761)) ([7e8e004](vitejs/vite@7e8e004))
- fallback terser to main thread when nameCache is provided ([#20750](vitejs/vite#20750)) ([a679a64](vitejs/vite@a679a64))
- **types:** strict env typings fail when `skipLibCheck` is `false` ([#20755](vitejs/vite#20755)) ([cc54e29](vitejs/vite@cc54e29))

##### Miscellaneous Chores

- **deps:** update rolldown-related dependencies ([#20675](vitejs/vite#20675)) ([a67bb5f](vitejs/vite@a67bb5f))
- **deps:** update rolldown-related dependencies ([#20772](vitejs/vite#20772)) ([d785e72](vitejs/vite@d785e72))


## [v7.1.5](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-715-2025-09-08-small)

##### Bug Fixes

- apply `fs.strict` check to HTML files ([#20736](vitejs/vite#20736)) ([14015d7](vitejs/vite@14015d7))
- **deps:** update all non-major dependencies ([#20732](vitejs/vite#20732)) ([122bfba](vitejs/vite@122bfba))
- upgrade sirv to 3.0.2 ([#20735](vitejs/vite#20735)) ([09f2b52](vitejs/vite@09f2b52))
@fossabot fossabot bot mentioned this pull request Oct 2, 2025
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sapphi-red sapphi-red sapphi-red approved these changes

Assignees
No one assigned
Labels
p2-edge-case Bug, but has workaround or limited in scope (priority) trigger: preview
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@thatguystone @sapphi-red