Fingerprint does not update when content changed after webpack update

[fsmanuel]

We had an incident after updating webpack. Turns out that the webpack update changed the content of vendor-${fingerprint}.js but did not update the fingerprint. We also use ember-cli-sri that adds integrity SHA in index.html which correctly updated. Users opening the site in a new tab got the new index.html with the right integrity SHA and the browsers served the old vendor-1234.js from cache. That resulted in the following error:

Failed to find a valid digest in the 'integrity' attribute for resource
'https://example.com/assets/vendor-1234.js' with computed SHA-512 integrity '03...Ugg=='.
The reosuce has been blocked.

Somehow the order seems to be wrong and the fingerprinting should run after webpack finished its work.

I first thought that renaming this addon from ember-cli-uglify to ember-cli-terser in https://github.com/ember-cli/ember-cli-terser/pull/230 caused it because ember-cli-sri still refers to ember-cli-uglify here. Then I saw that this addon has its own order infos here introduced in https://github.com/ember-cli/ember-cli-terser/pull/266.

If broccoli-asset-rev does the fingerprinting this addon should run before broccoli-asset-rev also mentioned in https://github.com/ember-cli/ember-cli-terser/pull/298

~~Is the only solution to fix this, to pin ember-cli-terser to 4.0.1?~~

Edit: Pinning ember-cli-terser to 4.0.1 will not work because it's missing "before": "ember-cli-sri", 😞
Edit: I found the same issue for ember-cli-autoprefixer with the expected fix.

@NullVoxPopuli @mike-engel