SRI hashes changed on multiple libraries yesterday and some SRI hashes are wrong #14210

Yesterday (2023-07-31), I noticed that the SRI hash for https://cdnjs.cloudflare.com/ajax/libs/vue/3.3.2/vue.global.min.js (https://cdnjs.com/libraries/vue/3.3.2) changed. It used to be sha512-6mO8pNkTyFMzOwbajocp9NbJzQUVV+zBFPZW8pKpIKnjhHYY19ez+tISSNkkvaBsj/nHq/E2FANyg6YlB7A+dQ==. Now it's sha512-twbmYKE2H3LPbArlkbjDppF/XJ+GVTM/RvEceYhFMEl6xi1PF1Q5004mNU8BFp3WKatWanAFKU2SQbdk4PdjXg==.

Also, I noticed that the SRI hash for https://cdnjs.cloudflare.com/ajax/libs/vue/3.3.4/vue.global.prod.min.js is wrong. https://cdnjs.com/libraries/vue/3.3.4 says it should be sha512-pHXx64U1UkFexsKz00jfapuz0FgKq+a+5dBTuitirYVcJzaxPqTbNbCWsUiFyTYVYmHMiql9zLCeod+IpAJUew==. However, https://www.srihash.org/ says it should be sha512-39BSQXI5q1XlvVhLfFRidKG8KM6Tr6VS/XSnNo6N/A0ZXexHCeoUI/s+ulujQy3UREjoLNrMnFat8VI0mMugWA==.

I did some debugging and found these logs:

• Processing logs: cdnjs/logs@cb82d2b
• KV Publish logs: cdnjs/logs@1feb270

From that, it looks like version 3.3.2 was published on 5/12, but was updated yesterday at 12:07:49. You can also see that the SRI hashes changed. I'm not sure if it's normal that old packages will be regenerated periodically.

Based on comparing an old copy of vue.global.min.js with the new one, it seems like something changed in the minification process, so different variable names were used.

I searched commits in https://github.com/cdnjs/logs for "update kv-publish". From that, I found several other libraries updated yesterday where the SRI tags changed:

• cdnjs/logs@10c27fa
• cdnjs/logs@c1d8d7c
• cdnjs/logs@8a46240
• cdnjs/logs@b7606ff

From them, it definitely seems like the issue is that:

1. Existing versions were regenerated.
2. If those versions had minified versions, those ended up with their SRI hash changing.

I still don't know if that explains why vue/3.3.4/vue.global.prod.min.js is wrong.