Subresource Integrity (SRI) not working on Next.js with Turbopack

[masterjanic]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

10.50.0

Framework Version

Next 16.2.4

Link to Sentry event

No response

Reproduction Example/SDK Setup

Default Sentry setup with Next.js and Turbopack, with SRI enabled.

const nextConfig: NextConfig = {
  experimental: {
    sri: {
      algorithm: "sha384",
    },
  },
}

Steps to Reproduce

1. Create a Next.js App with latest Sentry SDK
2. Enable Subresource Integrity (SRI) flag
3. Create a production build with interactive elements such as a button or link that redirects to another page and see that the scripts are not loading, because the integrity is invalid. See browser console for details.

Expected Result

Enabling Subresource Integrity (SRI) should work normally with Turbopack.

Actual Result

Scripts are not loaded because the generated script files are modified after the integrity hash was generated.

Additional Context

Last known version to work for me was 10.43.0 after which #19814 was introduced. This is likely a bug introduced by this pull request.

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}

[linear-code]

JS-2357

[chargome]

Hey @masterjanic thanks for flagging this, we'll take a look.