Skip to content

Inject style via constructable CSSStyleSheet and remove CSP entry #847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: 8.0
Choose a base branch
from

Conversation

kingyue737
Copy link
Member

@kingyue737 kingyue737 commented Jul 31, 2025

Edited

This PR replaces the previous CSP-specific import (vue-echarts/csp) by injecting component styles at runtime using the native CSSStyleSheet constructor (with a <style>-tag fallback). As a result:

  • No more separate vue-echarts/csp entry.
  • Styles are only injected on the client; SSR usage won't be broken.
  • A styles.css file is still published for manual inclusion in strict-CSP or legacy-browser projects.

Migration & Backward Compatibility

  • No more vue-echart/csp, use vue-echarts instead.
  • Strict-CSP setups & old browsers: manually include vue-echarts/styles.css as before.

For the full discussion and rationale, see the original comment


Old description

This PR aims to make vue-echarts/index.js not break in server-side rendering environments. Nuxt users don't need to use vue-charts/csp now.

Do we still need to rename vue-echarts/csp? If so, what about vue-echarts/unstyled or vue-echarts/no-css?

Copy link

vercel bot commented Jul 31, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
vue-echarts ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 3, 2025 1:56am

@Justineo
Copy link
Member

Justineo commented Jul 31, 2025

don’t think it’s necessary to add that runtime guard. We already ship a version without CSS injection so why not just use that? Since users need to include the CSS file manually anyway, they’re likely already aware of the caveat.

@kingyue737
Copy link
Member Author

Users only need to switch to 'vue-echarts/csp' in environments with strict CSP requirements. This change allows us to avoid introducing a breaking change by renaming the entry point.
SSR users can now use 'vue-echarts' without the need to manually import the CSS.

@kingyue737
Copy link
Member Author

SSR users can now use 'vue-echarts' without the need to manually import the CSS.

However, since styles are only applied on the client side, there’s a potential risk of layout mismatch between the server-rendered and client-rendered content.

@kingyue737
Copy link
Member Author

kingyue737 commented Jul 31, 2025

So let’s revert the above change and just rename ‘vue-echarts/csp’ to ‘vue-charts/unstyled’ ?

@Justineo
Copy link
Member

Justineo commented Aug 2, 2025

If we truly want to eliminate the extra import, we could proceed as follows:

  • Because the component is client-only, there’s no need to inject styles on the server. A purely client-side solution is sufficient.
  • Implement an injectStyle helper that first attempts to create a CSSStyleSheet (with feature detection) and falls back to inserting a <style> tag when the API isn’t supported. I think we can directly add it to the component source code instead of relying on a Vite plugin.
  • Still publish a styles.css file so that projects with strict CSP and legacy browsers can simply include it manually. This should cover most strict-CSP edge cases.
  • If browsers eventually apply CSP restrictions to CSSStyleSheet as well, developers can still fall back to the manual styles.css inclusion to stay compliant.

@kingyue737 kingyue737 changed the title Not inject inline CSS on server side Inject style via constructable CSSStyleSheet and remove CSP entry Aug 3, 2025
@@ -411,9 +411,11 @@ The slot props correspond to the first parameter of the callback function.

Static methods can be accessed from [`echarts` itself](https://echarts.apache.org/en/api.html#echarts).

## CSP: `style-src` or `style-src-elem`
## Style
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should still keep the previous title as only users requiring strict CSP need to know this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants