Skip to content

fix: hash the manifest version with sha256 for FIPS hosts #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ScriptedAlchemy merged 1 commit into from
Sep 4, 2026
Merged

fix: hash the manifest version with sha256 for FIPS hosts #126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .changeset/fips-safe-manifest-hash.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
---
'rsbuild-plugin-react-router': patch
---

Hash the browser manifest version with sha256 instead of md5, which is
unavailable on FIPS-enabled machines and made builds fail there. The version
is a short content digest, so existing deployments only see the manifest file
name change once.
3 changes: 2 additions & 1 deletion src/manifest.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -609,7 +609,8 @@ function generateReactRouterManifestForDevEffect(
// compares the browser's manifest version with the pinned server build's,
// and a random per-compilation version made unchanged manifests differ
// whenever a web compilation completed without a new server pin.
const version = createHash('md5')
// sha256 rather than md5: md5 is unavailable on FIPS-enabled hosts (#124).
const version = createHash('sha256')
.update(JSON.stringify(fingerprintedValues))
.digest('hex')
.slice(0, 8);
Expand Down
Loading