From 765ac03f5144d65b5956bf7cacf584f47b55d4fd Mon Sep 17 00:00:00 2001 From: Mark Dumay <61946753+markdumay@users.noreply.github.com> Date: Sun, 5 Apr 2026 08:15:41 +0200 Subject: [PATCH] fix: skip comment-only JS bundles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hugo resource transformations are lazy — .Content after | minify | fingerprint still returns the pre-transformation string. A bundle that renders to comments only (e.g. googleanalytics.js with GA disabled) passes the len > 0 guard but produces a fingerprint of empty content while hugo server serves the unminified comment, causing an SRI/CSP integrity mismatch and a blocked script. Strip // and /* */ comments from .Content before checking whether a bundle contains actual code, and skip the