8000 @strict-csp/builder package + middleware fixes for Vercel by nibtime · Pull Request #69 · nibtime/next-safe-middleware · GitHub
[go: up one dir, main page]

Skip to content

Conversation

nibtime
Copy link
Owner
@nibtime nibtime commented Aug 5, 2022

first step of #66

  • CSP typings are maintained within @strict-csp/builder package
  • some hotfixes for bad middleware-related bugs that can break CSP (on Vercel only)

nibtime added 11 commits August 5, 2022 00:01
for all aspects like create, manipulate, merge, ... + typings
independent of any framework
test: run with --passWithNoTests

existing unit tests moved to builder package
include ws: and wss: scheme soruces for for Webpack HMR
to avoid excess script hashes when preemptively register loaders for ISR
(due to different async/defer true/false combinations)

Can be safely reduced by filtering out falsy attribute values before,
as just not setting the attribute means false

refactor:  move code to remove circular dependency

fix(rollup): get rid of rollup warnings

fix(rollup): list all external modules explicitly for each bundle
fix: avoid Promise.all.
- await manifest, cspbuilder and config and run finalize sequentially

fix: avoid module-level cache variable for global cache

- cache within memoize function scope
- on Vercel, sometimes a manifest of a different deployment got inserted!
Commit generated via `yarn stage`
has important routing bug fixes related to middleware, see #34 (comment)
@changeset-bot
Copy link
changeset-bot bot commented Aug 5, 2022

🦋 Changeset detected

Latest commit: 8283af8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@strict-csp/builder Minor
@next-safe/middleware Patch
docs Patch
e2e Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel
Copy link
vercel bot commented Aug 5, 2022

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
docs-next-safe-middleware ✅ Ready (Inspect) Visit Preview Aug 5, 2022 at 1:43PM (UTC)
e2e-next-safe-middleware ✅ Ready (Inspect) Visit Preview Aug 5, 2022 at 1:43PM (UTC)

@nibtime nibtime changed the title @strict-csp/builder package + fixes @strict-csp/builder package + middleware fixes for Vercel Aug 5, 2022
nibtime added 2 commits August 5, 2022 13:33
...and non-empty CSP. This led to a bug with on-demand ISR on Vercel,
where the styles overwrote the actual CSP from middleware with some styles
only.

refactor(document): remove unused file modules
@nibtime
Copy link
Owner Author
nibtime commented Aug 5, 2022

Manually tested the e2e app with a real iPad Pro device on Safari >=15.4 with strict-dynamic:

53db2380-d51f-4c64-993d-41255b5c5d22.mp1659709812286.mp4

Notes:

  • Safari only serves the report-uri directive and I can confirm that violation reports are received at /api/reporting. That's why it is important to always serve both reporting directives, even though report-uri is flagged deprecated.

  • Safari doesn't execute web worker inline test script with partytown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0