{"data":{"id":"magento2-39040","source":"github-pr","sourceRef":"magento/magento2#39040","title":"CSP issues combined with dev/css/use_css_critical_path","pr":{"number":39040,"url":"https://github.com/magento/magento2/pull/39040","author":"Mohamed-Asar","mergedAt":"2024-10-18T16:54:12Z","mergeCommit":"5c24c154cd8ec7eb38998aeb161c8992c82ea8cb","headCommit":"751f00e8a3beb4e38677823ee0cd6914dad12ea3","baseRef":"2.4-develop","diffSha256":"df5dc2c3b93317935a4b26a6032551fe88636bebf88b8de0fe3ae149eb64804c"},"issues":[{"number":39020,"url":"https://github.com/magento/magento2/issues/39020","title":"CSP issues combined with dev/css/use_css_critical_path","labels":["Area: Other Developer Tools","Component: Other","Issue: Confirmed","Priority: P2","Progress: done","Reported on 2.4.7-p1","Reproduced on 2.4.x"],"kind":"human"}],"fixedIn":"2.4.8","containingTags":["2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"reportedOn":"2.4.7-p1","codeMatch":{"2.4.6":"conflict","2.4.6-p1":"conflict","2.4.6-p2":"conflict","2.4.6-p3":"conflict","2.4.6-p4":"conflict","2.4.6-p5":"conflict","2.4.6-p6":"conflict","2.4.6-p7":"conflict","2.4.6-p8":"conflict","2.4.6-p9":"conflict","2.4.6-p10":"conflict","2.4.6-p11":"conflict","2.4.6-p12":"conflict","2.4.6-p13":"conflict","2.4.6-p14":"conflict","2.4.6-p15":"conflict","2.4.7":"conflict","2.4.7-p1":"conflict","2.4.7-p2":"conflict","2.4.7-p3":"conflict","2.4.7-p4":"conflict","2.4.7-p5":"conflict","2.4.7-p6":"conflict","2.4.7-p7":"conflict","2.4.7-p8":"conflict","2.4.7-p9":"conflict","2.4.7-p10":"conflict","2.4.8":"conflict","2.4.8-p1":"conflict","2.4.8-p2":"conflict","2.4.8-p3":"conflict","2.4.8-p4":"conflict","2.4.8-p5":"conflict","2.4.9":"conflict"},"affectedVersions":[],"components":["magento/module-theme"],"files":[{"path":"app/code/Magento/Theme/Controller/Result/AsyncCssPlugin.php","change":"modified","package":"magento/module-theme"},{"path":"app/code/Magento/Theme/composer.json","change":"modified","package":"magento/module-theme"},{"path":"app/code/Magento/Theme/etc/module.xml","change":"modified","package":"magento/module-theme"}],"stripped":{"tests":["app/code/Magento/Theme/Test/Unit/Controller/Result/AsyncCssPluginTest.php"],"docs":[],"outsideCode":[]},"linesChanged":29,"mergeBatched":false,"excluded":null,"sections":{"description":"Restricted CSP policy (introduced in 2.4.7 for checkout pages) prevents inline js to be executed so CSS files which were supposed to be loaded asynchronously are never loaded.","stepsToReproduce":"1. Enable `dev/css/use_css_critical_path` in order to facilitate critical CSS functionality\n2. Add some items to cart\n3. Visit checkout page","expectedResult":"Checkout pages are rendered with proper css styles","actualResult":"Restricted CSP policy (introduced in 2.4.7 for checkout pages) prevents inline js to be executed so CSS files which were supposed to be loaded asynchronously are never loaded.\n\nDev Console gives such output:\n<img width=\"1682\" alt=\"Screenshot 2024-08-07 at 14 50 21\" src=\"https://github.com/user-attachments/assets/27b5e8ef-e09f-4719-a3a6-e7a7569fbbca\">\n\nFor following elements:\n<img width=\"1319\" alt=\"Screenshot 2024-08-07 at 14 55 20\" src=\"https://github.com/user-attachments/assets/85c1349f-211a-4cd1-b011-064e7c2ebdec\">","source":"issue"},"signatures":[],"labels":{"area":["Other Developer Tools"],"component":["Other"],"priority":"P2","severity":null,"reportedOn":["2.4.7-p1"]},"categories":["Other"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"20b39c1a65870ed50f87e335b682318703a9f3396039f8a979e11341fa29f576","isBugfix":0.9689,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9351,"feature":0.0143,"refactor":0.0206,"tests_only":0.0125,"docs_only":0.0065,"dependency":0.011},"confidence":0.8504},"scope":{"score":0.7364,"probabilities":{"0":0.4172,"1":0.4291,"2":0.1537},"confidence":0.0728},"risk":{"score":0.8295,"probabilities":{"0":0.4169,"1":0.3367,"2":0.2464},"confidence":0.0218},"area":{"choice":"frontend","probabilities":{"catalog":0.0073,"checkout":0.1482,"customer":0.0067,"admin":0.0126,"graphql_api":0.0051,"framework":0.0374,"frontend":0.7487,"other":0.034},"confidence":0.5262},"securityRelevant":0.596,"reportedVersion":{"choice":"2.4.7-p1","probabilities":{"2.4.0":0.0027,"2.4.0-p1":0.0028,"2.4.1":0.0026,"2.4.1-p1":0.0029,"2.4.2":0.0026,"2.4.2-p1":0.0031,"2.4.2-p2":0.0032,"2.4.3":0.0029,"2.4.3-p1":0.0036,"2.4.3-p2":0.004,"2.4.3-p3":0.0032,"2.4.4":0.0028,"2.4.4-p1":0.0031,"2.4.4-p10":0.0038,"2.4.4-p11":0.0041,"2.4.4-p12":0.0039,"2.4.4-p13":0.0041,"2.4.4-p14":0.0045,"2.4.4-p15":0.0036,"2.4.4-p16":0.0038,"2.4.4-p17":0.0037,"2.4.4-p18":0.0032,"2.4.4-p2":0.0027,"2.4.4-p3":0.0028,"2.4.4-p4":0.003,"2.4.4-p5":0.0034,"2.4.4-p6":0.0033,"2.4.4-p7":0.0035,"2.4.4-p8":0.0031,"2.4.4-p9":0.0033,"2.4.5":0.0028,"2.4.5-p1":0.003,"2.4.5-p10":0.0029,"2.4.5-p11":0.0035,"2.4.5-p12":0.004,"2.4.5-p13":0.0033,"2.4.5-p14":0.0042,"2.4.5-p15":0.0032,"2.4.5-p16":0.0035,"2.4.5-p17":0.0033,"2.4.5-p2":0.0028,"2.4.5-p3":0.0029,"2.4.5-p4":0.0031,"2.4.5-p5":0.0031,"2.4.5-p6":0.0035,"2.4.5-p7":0.0035,"2.4.5-p8":0.0034,"2.4.5-p9":0.0028,"2.4.6":0.0054,"2.4.6-p1":0.0089,"2.4.6-p10":0.0045,"2.4.6-p11":0.0047,"2.4.6-p12":0.0052,"2.4.6-p13":0.0049,"2.4.6-p14":0.0045,"2.4.6-p15":0.004,"2.4.6-p2":0.0032,"2.4.6-p3":0.0036,"2.4.6-p4":0.0042,"2.4.6-p5":0.0041,"2.4.6-p6":0.0046,"2.4.6-p7":0.0063,"2.4.6-p8":0.0039,"2.4.6-p9":0.0034,"2.4.7":0.0614,"2.4.7-p1":0.5854,"2.4.7-p10":0.0054,"2.4.7-p2":0.0117,"2.4.7-p3":0.0086,"2.4.7-p4":0.0089,"2.4.7-p5":0.01,"2.4.7-p6":0.0093,"2.4.7-p7":0.0081,"2.4.7-p8":0.0063,"2.4.7-p9":0.0048,"2.4.8":0.0053,"2.4.8-p1":0.0061,"2.4.8-p2":0.0064,"2.4.8-p3":0.0074,"2.4.8-p4":0.0069,"2.4.8-p5":0.006,"2.4.9":0.0053,"unspecified":0.0032},"confidence":0.3403},"backportWorthy":{"score":1.2852,"probabilities":{"0":0.2252,"1":0.2644,"2":0.5104},"confidence":0.0717}},"curated":{"title":"Fixes async CSS never loading on checkout pages with critical CSS path enabled","description":"With dev/css/use_css_critical_path enabled, the restricted CSP policy on checkout pages prevents inline js to be executed, so CSS files which were supposed to be loaded asynchronously are never loaded. AsyncCssPlugin in Theme now renders the onload event of each stylesheet link via the Csp InlineUtilInterface renderEventListener.","categories":["Other"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-39040 details"}