next.js

8b037a67 - Add CSP nonce to script tags of loading and template files (#98398)

Add CSP nonce to script tags of loading and template files (#98398) Recreation of https://github.com/vercel/next.js/pull/98152 so that deployment test credentials are available in CI Closes #98152 Closes https://github.com/vercel/next.js/pull/92803 Original description: > `createComponentStylesAndScripts` renders the script tags for a segment's loading, error, and templatefound files, but unlike getLayerAssets it did not pass `ctx.nonce`. When such a file has a chunk that no layout or client reference has already loaded, the tag is served without a nonce and a nonce-based Content-Security-Policy blocks it. ### What? Patches a bug we encountered while using [nonces](https://nextjs.org/docs/app/guides/content-security-policy#nonces) for a CSP with `strict-dynamic`, as in the docs example. In Turbopack, when a `loading.tsx` (or `error` or `template`) file has a chunk that isn’t already loaded by a layout or client component on the page, Next renders a `<script>` tag for that chunk with no `nonce`. (the same chunk script would’ve gotten a `nonce` if it were emitted for a layout or page). Supersedes #92803; this is the same fix but with a new test included. ### Why? While building out our `loading.tsx` pages, we encountered browsers blocking a script and reporting CSP violations, because chunk scripts did not properly carry a `nonce`. ### How? One-line change to bring `createComponentStylesAndScripts` to parity with `getLayerAssets`. --------- Co-authored-by: Luke Taylor <luket@anthropic.com>