Astro Info

Astro                    v6.0.0-beta.19
Node                     v24.11.0
System                   Windows (x64)
Package Manager          pnpm
Output                   static
Adapter                  none
Integrations             @astrojs/sitemap
                         astro-robots
                         astro-compressor

If this issue only occurs in one browser, which browser is a problem?

all

Describe the Bug

As of Astro v6, CSP is no longer considered experimental. This mostly works great, except when an SVG file with <style></style> tags is imported as a component.

It looks like these style tags are not being hashed, and so browsers are complaining of a CSP violation. The workaround at the moment is to add the hash manually under styleDirective: { hashes: [...] }, but when svg components are imported as components, I think the expectation is that they will be included in any relevant features like this.

Note that unsafe-hashes is not required as long as the svg is using classes and <style> tags. These just need to be hashed.

What's the expected result?

No CSP errors should show when building a project with imported SVGs that have embedded style tags.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-ysa8w4hg?file=src%2Fpages%2Findex.astro

Participation

• I am willing to submit a pull request for this issue.