Starlight ships five inline scripts that a strict CSP blocks

Packaging @astrojs/starlight@0.41.7 against a script-src 'self' policy with no nonce and no hash, five components carry is:inline scripts and every one of them is blocked.

The failure is graded rather than uniform. ThemeProvider sets data-theme before paint, so blocking it leaves the attribute unset and the stylesheet falls through to its dark defaults: the site renders permanently dark with an inert toggle. SidebarPersister loses scroll position, Tabs loses synced state, and the Search inline script is cosmetic — it swaps the modifier-key glyph in the shortcut hint, while the functional search is a bundled module that survives.

What this does not show

This was measured against one policy on one version. It says nothing about other documentation frameworks, and nothing about whether any of it affects how a page is retrieved or cited. The worker requirement for Pagefind is stated in its documentation but was not verified here: the pagefind package ships a binary downloader, and the browser runtime is generated at build time.