Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

@strict-csp/builder package + middleware fixes for Vercel #69

Merged
merged 13 commits into from
Aug 5, 2022

Conversation

nibtime
Copy link
Owner

@nibtime nibtime commented Aug 5, 2022

first step of #66

  • CSP typings are maintained within @strict-csp/builder package
  • some hotfixes for bad middleware-related bugs that can break CSP (on Vercel only)

nibtime added 11 commits August 5, 2022 00:01
for all aspects like create, manipulate, merge, ... + typings
independent of any framework
test: run with --passWithNoTests

existing unit tests moved to builder package
include ws: and wss: scheme soruces for for Webpack HMR
to avoid excess script hashes when preemptively register loaders for ISR
(due to different async/defer true/false combinations)

Can be safely reduced by filtering out falsy attribute values before,
as just not setting the attribute means false

refactor:  move code to remove circular dependency

fix(rollup): get rid of rollup warnings

fix(rollup): list all external modules explicitly for each bundle
fix: avoid Promise.all.
- await manifest, cspbuilder and config and run finalize sequentially

fix: avoid module-level cache variable for global cache

- cache within memoize function scope
- on Vercel, sometimes a manifest of a different deployment got inserted!
Commit generated via `yarn stage`
has important routing bug fixes related to middleware, see #34 (comment)
@changeset-bot
Copy link

changeset-bot bot commented Aug 5, 2022

🦋 Changeset detected

Latest commit: 8283af8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@strict-csp/builder Minor
@next-safe/middleware Patch
docs Patch
e2e Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel
Copy link

vercel bot commented Aug 5, 2022

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
docs-next-safe-middleware ✅ Ready (Inspect) Visit Preview Aug 5, 2022 at 1:43PM (UTC)
e2e-next-safe-middleware ✅ Ready (Inspect) Visit Preview Aug 5, 2022 at 1:43PM (UTC)

@nibtime nibtime changed the title @strict-csp/builder package + fixes @strict-csp/builder package + middleware fixes for Vercel Aug 5, 2022
nibtime added 2 commits August 5, 2022 13:33
...and non-empty CSP. This led to a bug with on-demand ISR on Vercel,
where the styles overwrote the actual CSP from middleware with some styles
only.

refactor(document): remove unused file modules
@nibtime
Copy link
Owner Author

nibtime commented Aug 5, 2022

Manually tested the e2e app with a real iPad Pro device on Safari >=15.4 with strict-dynamic:

53db2380-d51f-4c64-993d-41255b5c5d22.mp1659709812286.mp4

Notes:

  • Safari only serves the report-uri directive and I can confirm that violation reports are received at /api/reporting. That's why it is important to always serve both reporting directives, even though report-uri is flagged deprecated.

  • Safari doesn't execute web worker inline test script with partytown

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant