All committers have signed the CLA.

✅ Deploy Preview for rspack canceled.

Built without sensitive environment variables

@pgoldberg can you help explain more how the project relys on SHA-256 content hashes?

@pgoldberg can you help explain more how the project relys on SHA-256 content hashes?

Sure! I use a content-addressable storage model for serving static files from many bundles, where files from these bundles are all accessible via the same route (e.g. /assets/<SHA256>.js). This comes with the benefit of sharing a browser cache between bundles, while removing a layer of separation that would exist if we also included a bundle name in the route (e.g. /assets/<bundle-name>/<file-hash>.js).

Using a cryptographic hash, like SHA256, has made the security model of this solution easier to reason about in the event these bundles may come from several sources, because it removes the possibility of a dev constructing an intentional hash collision that allowed a file from one bundle to be injected into a different bundle. The two options provided by Rspack today, md4 and xxhash64, are both non-cryptographic hashes where it's easy to find/manufacture collisions.

CodSpeed Performance Report

Merging #10553 will not alter performance

_{Comparing pgoldberg:sha256-support (8d1b855) with main (97ce9e7)}

Summary

✅ 16 untouched benchmarks

@hardfist Just wanted to nudge this one – I'm hoping to get this in for a project I'm working on. I'm happy to clarify any questions you might have about it!

@pgoldberg thanks for your contribution, LGTM

@pgoldberg you also need to update the api snapshot by running ./x ae update

@hardfist Thank you – just pushed that up!

@pgoldberg i tried to fix the CI and merged main branch.
If this make you confused, sorry for that.