leaflet geojson is broken

[pazz]

Have you checked that your issue isn't already filed?

• I read through FAQ and searched through the past issues, none of which addressed my issue.
• Yes, I have checked that this issue isn't already filed.

Bug description

It appears that the hashes in the used libraries are out of date.

How to reproduce the bug

Just use the fenced geojson as described.

Here is my (live) page for debugging.
https://cgi.csc.liv.ac.uk/~patrick/location/

Thanks

Error messages and logs

Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet.min.css' with computed SHA-256 integrity 'QZFpF9DkpabUBLoCc7fQJVCmtag/LaVAfAkUJSfuNyY='. The resource has been blocked.

location/marker-shadow.png:1 
 GET https://cgi.csc.liv.ac.uk/~patrick/location/marker-shadow.png net::ERR_EMPTY_RESPONSE
location/marker-icon-2x.png:1 
 GET https://cgi.csc.liv.ac.uk/~patrick/location/marker-icon-2x.png net::ERR_EMPTY_RESPONSE


What operating system are you using?

Not applicable (e.g. you're using GitHub Pages or other hosting)

Where are you seeing the problem on?

Deployed site

More info

No response

[george-gca]

Apparently your integrity hash was wrong and you fixed it.

[pazz]

Yes, I patched this up but am not sure that this is sufficient in general.
My local patch is this:

--- a/_config.yml
+++ b/_config.yml
@@ -480,7 +480,7 @@ third_party_libraries:
     version: "3.6.0"
   leaflet:
     integrity:
-      css: "sha256-q9ba7o845pMPFU+zcAll8rv+gC+
+      css: "sha256-QZFpF9DkpabUBLoCc7fQJVCmtag
       js: "sha256-MgH13bFTTNqsnuEoqNPBLDaqxjGH
       js_map: "sha256-YAoQ3FzREN4GmVENMir8vgHH
     local:

This adjusts the css integrity string but not the other two, which I am not sure about.
I am pretty sure the issue still persists upstream, see here.

Thanks

[george-gca]

Actually here the upstream is working fine, see

and the console displays no error. Maybe your network is blocking the download of this asset somehow?

[pazz]

It behaves irrationally for me. Today, on Chrome, I can confirm it looks as you have shown.
On qutebrowser (QT) I see something like this, which I also get on chrome for my own page if I do not apply the patch.

the console error reads:

Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdn.jsdelivr.net/npm/leaflet@1.9.4/dist/leaflet.min.css' with computed SHA-256 integrity 'QZFpF9DkpabUBLoCc7fQJVCmtag/LaVAfAkUJSfuNyY='. The resource has been blocked.

[JorgeGT]

I have the same issue with the upstream:

Did you manage to troubleshoot the problem?

[pazz]

Did you manage to troubleshoot the problem?

Well, the problem goes away if you replace the hard-coded SHA hash in the config with the one your browser reports. I suspect that the library has simply been updated.

[george-gca]

Indeed, the library was updated. And now I realized that I handled it wrong when creating the download code. Will fix that.

[sim642]

The library wasn't updated, but it was re-minified by jsDelivr. This is an instance of a more general issue: #3288.