From 857201af7e94383cd049554ee315879be6239ea9 Mon Sep 17 00:00:00 2001 From: Ofri Peretz Date: Mon, 24 Aug 2026 20:57:13 -0500 Subject: [PATCH 1/2] Add subresource integrity to CDN assets in the GraphiQL and error pages The GraphiQL page loads five assets from jsdelivr and the theme error page one from unpkg. Three of them carry no integrity attribute, including graphiql.min.js, three megabytes of script the page executes. react and react-dom already carry hashes but their URLs float on @17, so the hash and the URL disagree: the day jsdelivr resolves 17.0.3 the hash stops matching and the script silently does not load. The pinned hashes match 17.0.2 exactly, so pinning the URLs to 17.0.2 changes nothing today and removes that failure mode. --- .changeset/graphiql-cdn-integrity.md | 6 ++++++ .../node/graphiql/templates/graphiql.tsx | 20 +++++++++++++++---- .../node/graphiql/templates/unauthorized.tsx | 7 ++++++- .../hot-reload/error-page.ts | 9 ++++++++- 4 files changed, 36 insertions(+), 6 deletions(-) create mode 100644 .changeset/graphiql-cdn-integrity.md diff --git a/.changeset/graphiql-cdn-integrity.md b/.changeset/graphiql-cdn-integrity.md new file mode 100644 index 00000000000..c8a5ca5f4f5 --- /dev/null +++ b/.changeset/graphiql-cdn-integrity.md @@ -0,0 +1,6 @@ +--- +'@shopify/cli-kit': patch +'@shopify/theme': patch +--- + +Add subresource integrity to the CDN assets used by the GraphiQL and theme error pages, and pin the React CDN URLs to the exact version their existing hashes describe diff --git a/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx b/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx index 36ee7cbedb4..f6caa5493c9 100644 --- a/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx +++ b/packages/cli-kit/src/public/node/graphiql/templates/graphiql.tsx @@ -73,7 +73,12 @@ export function graphiqlTemplate({ GraphiQL - + - +
@@ -243,6 +253,8 @@ export function graphiqlTemplate({