Svelte 5 SSR writes an inline `onerror="this.__e=event"` on `<img>`, and a strict CSP silently blocks it

CCRTA's map pages show a static map image first and switch to the interactive Google map if that image fails to load. The switch is an onerror handler on the <img>. Under the site's Content Security Policy, an image that failed before hydration never triggered the fallback, and the page itself showed nothing wrong.

The cause is how Svelte 5 server-renders load and error events. In Svelte 5.56.4, the server compiler (compiler/phases/3-transform/server/visitors/shared/element.js) writes the literal attribute onerror="this.__e=event", and the same for onload, on elements such as img, iframe, link and script when the component sets those handlers, spreads attributes, or uses an action. The event can fire before hydration, so the inline handler saves it on the element. During hydration, replay_events removes both attributes and dispatches the saved event to the real handler. CCRTA's script-src uses a nonce and hashes with no 'unsafe-inline', so the browser refused to run the inline handler. The early error was never saved, so hydration had nothing to replay and the fallback never ran.

The fix allows exactly that handler text. script-src gained 'unsafe-hashes' and 'sha256-7dQwUgLau1NFCCGjfn9FsYptB6ZtWxJin6VohGIu20I=', which is the SHA-256 of this.__e=event. 'unsafe-hashes' only permits inline event handlers whose exact text matches a listed hash, so every other inline handler stays blocked.

If a server-rendered Svelte 5 page relies on onerror or onload for an image or other load-error element under a strict CSP, add this hash. Without it, any such event that fires before hydration is lost.

Receipt: CCRTA Website commit e09c3f7 (vercel.ts; svelte 5.56.4 compiler/phases/3-transform/server/visitors/shared/element.js and internal/client/dom/elements/events.js).