By alexpott on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
8.9.x
Introduced in version: 
8.9.8
Issue links: 
https://www.drupal.org/node/2716115
Description: 

Library declarations for external CSS assets now support attributes. You can now use integrity hashes to ensure the css file is as you expect.

For example:

# MODULE.libraries.yml or THEME.libraries.yml
bootstrap.cdn:
  header: true
  remote: https://github.com/twbs/bootstrap
  version: '3.3.6'
  license:
    name: MIT
    url: https://github.com/twbs/bootstrap/blob/master/LICENSE
	 	gpl-compatible: true
  css:
    component:
      'https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css': { type: external, attributes: { integrity: sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7, crossorigin: anonymous }, minified: true }
  js:
    'https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js': { type: external, attributes: { integrity: sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS, crossorigin: anonymous }, minified: true }
  dependencies:
    - core/jquery

Previously if you have defined attributes on CSS components they would have been ignored. Therefore in 8.9.4 you must check that any existing integrity hash is correct.

Impacts: 
Module developers
Themers