NEW326340
importmap integrity key is broken in Safari 
https://bugs.webkit.org/show_bug.cgi?id=326340
Summary importmap integrity key is broken in Safari
johannes
Reported 2026-10-05 06:22:36 PDT
Created attachment 481671 [details] code sample to reproduce the error Greetings from the Django community! While working on DEP0021 (Django's support for SRI), I found a bug in Safari. With "Integrity-Policy: blocked-destinations=(script)", Safari blocks each module that a script imports through an import map. This also occurs when the import map has the integrity hash of that module. Steps to Reproduce: 1. Save repro.py (this directory) and run "python3 repro.py". 2. Open http://127.0.0.1:8000/ in Safari 26.6. The page stays blank. Console shows an error. 3. Open the same URL in Chrome 154 or Firefox. The page shows "ran". Subresource Integrity (SRI) and importmaps are both considered "widely-available", which is why I submitted this as a blocker. It goes to show how low real-life adoption is. However, the Django community hopes to close that gap. Hope, you have a lovely day! -Joe
Attachments
code sample to reproduce the error (1.53 KB, text/x-python-script)
2026-10-05 06:22 PDT, johannes 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Tim Nguyen (:ntim)
Comment 1 2026-10-05 08:50:53 PDT
*** Bug 326341 has been marked as a duplicate of this bug. ***
Alexey Proskuryakov
Comment 2 2026-10-05 18:00:55 PDT
Thank you for the report! This reproduces in STP 253, too.
Radar WebKit Bug Importer
Comment 3 2026-10-12 06:23:14 PDT
<rdar://problem/189808062>
Note You need to log in before you can comment on or make changes to this bug.