Recognised package-CDN stylesheet has no integrity attribute
ShipReady found a supported public package-CDN stylesheet link without an integrity attribute.
Why it matters
A missing integrity attribute is a static supply-chain review signal, not a demonstration that a resource was altered.
How ShipReady detects it
What it inspects
ShipReady inspects static link tags whose rel includes stylesheet and whose source host is in its maintained package-CDN list.
What triggers a finding
A supported package-CDN stylesheet has no integrity attribute; preload-only links are excluded.
What the evidence shows
The inspected HTML references a supported package-CDN stylesheet without an integrity attribute.
Limits of this check
ShipReady does not fetch or apply the stylesheet, test browser enforcement, or prove a resource was altered or that form data was exposed.
How to fix it
Review whether the stylesheet can be pinned with SRI
Confirm that the recognised package CDN publishes a stable integrity value for the exact stylesheet URL before adding SRI. If it does, add the documented integrity value and any required crossorigin setting to the deployed stylesheet link.
How to verify the change
Inspect the deployed stylesheet link
Fetch the affected page and confirm the recognised package-CDN stylesheet link has the intended non-empty integrity attribute. Test the page’s styling separately after any pinning change.
Expected: The returned HTML contains the intended stylesheet integrity attribute.