Skip to content

Repository navigation

New font-awesome versions have broken assets #14305

Closed
Closed
New font-awesome versions have broken assets#14305

Description

@martincostello
martincostello
opened on Jul 13, 2026

New versions of font-awesome flowed into my renovate automation today having been stuck on 7.0.1 for a while, but once deployed I noticed that the icons are broken in my sites using it. For example:

Image

All the font-awesome icons are rendered as squares. Looking in Chrome at DevTools shows the following warnings:

Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
Failed to decode downloaded font: <URL>
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-brands-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
(index):1 Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-regular-400.woff2
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT

This is how it should look (from reverting to 7.0.1):

Image

I asked Claude Code to investigate, and assuming it's correct, it appears to be caused by a 1 byte truncation on the files. It sounds plausible that there's some unintended new-line normalization going on in the new ingestion and publishing process, but I can't verify whether that's the case.

I've included the output from Claude below.

Diagnosis

The Font Awesome icons on the site are broken because cdnjs is serving corrupt (truncated) Font Awesome webfont files — this is not caused by the website code or the CSS itself.

What's actually happening

  1. The <link> in src/Website/Slices/_StylesBody.cshtml loads all.min.css from cdnjs with an SRI integrity hash. That hash is correct — it matches cdnjs exactly, and the CSS file is fine (the @font-face blocks are byte-identical across 7.0.1 → 7.3.0).
  2. But SRI only protects the CSS file. The .woff2 webfonts it references (../webfonts/fa-solid-900.woff2, etc.) have no integrity check.
  3. cdnjs's copies of those webfonts for 7.3.0 are each truncated by exactly 1 byte vs. the genuine files. They still download with HTTP 200 and a valid wOF2 magic header, so nothing errors on the network — but the WOFF2 header declares a length longer than the actual bytes, so Chrome's OpenType Sanitizer rejects them: 
    Failed to decode downloaded font: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.3.0/webfonts/fa-solid-900.woff2
OTS parsing error: Failed to convert WOFF 2.0 font to SFNT
    No glyphs load, so the icons render as blank/broken boxes.

The proof

Comparing cdnjs against jsDelivr (which serves the same files straight from npm):

Version cdnjs vs jsDelivr Notes
7.0.1 ✅ byte-identical (same SHA-256) last-good
7.1.0 ❌ all fonts 1 byte short broken
7.2.0 ❌ all fonts 1 byte short broken
7.3.0 ❌ all fonts 1 byte short broken

cdnjs's 7.3.0 solid font is an exact prefix of the real file (prefix SHA-256 matches), missing only the final trailing byte:

  • jsDelivr tail: … bf de f0 83 18 03 00 00
  • cdnjs tail:   … cc bf de f0 83 18 03 00 ← dropped the last 00

Which version caused the break?

The upgrade to 7.3.0 is what broke the live site, but it's not specific to 7.3.0's contents. The corruption on cdnjs starts at 7.1.0 — every version from 7.1.0 onward is truncated there, and 7.0.1 was the last version cdnjs served intact. So bumping from 7.0.1 to any 7.1.0+ version via cdnjs would have broken the icons identically. Renovate just happened to skip straight to 7.3.0.

Activity

  1. MattIPv4 commented on Jul 13, 2026

    @MattIPv4
    MattIPv4
    on Jul 13, 2026
    Member

    👀 @simonabadoiu could you take a look at this?

  2. MattIPv4 commented on Jul 13, 2026

    @MattIPv4
    MattIPv4
    on Jul 13, 2026
    Member

    @martincostello just to check, are you seeing the correct bytes on older WOFF2 files from before we re-enabled updated? That would help pinpoint it to the new auto-update process, rather than the CDN architecture switch.

  3. martincostello commented on Jul 13, 2026

    @martincostello
    martincostello
    on Jul 13, 2026
    Author

    The icons were all fine with 7.0.1. I haven't explicitly changed anything other than the font-awesome version and the SRI hashes (e.g. martincostello/benchmarks-dashboard#758).

    I assumed it was related to the update process as I suddenly got a bunch of updates today for 7.3.0 which was published three weeks ago, so I would have expected to have gotten it within a 3 days if it had been ~immediately uploaded to cdnjs after publishing.

  4. martincostello commented on Jul 13, 2026

    @martincostello
    martincostello
    on Jul 13, 2026
    Author

    FWIW I also looked in the font-awesome repo and couldn't see any issues related to this either when I first noticed the broken icons. As it's been 3 weeks since it was released, I would have thought someone would have already noticed if it was an issue with their actual release.

  5. simonabadoiu commented on Jul 14, 2026

    @simonabadoiu
    simonabadoiu
    on Jul 14, 2026

    Thanks for flagging! The tar parser cdnjs-bot uses (trotar) has a bug that strips the last byte of every file entry. Every version cdnjs-bot has published is 1 byte short of upstream; most of the time the last byte is a trailing newline so nothing breaks, but for .woff2/.wasm/.svg/minified .css/JSON where the last byte is meaningful, the published files are broken.

    Will update once the fix is out and font-awesome 7.1.0+ have been re-published.

  6. xtuc
    added a commit that references this issue on Jul 14, 2026

    fix: preserve last byte of file entries

    62d7219

  7. simonabadoiu commented on Jul 17, 2026

    @simonabadoiu
    simonabadoiu
    on Jul 17, 2026

    Hi, this should be fixed for font-awesome 7.1.0, 7.2.0, 7.3.0 Feel free to reopen if anything's still off.

  8. simonabadoiu
    closed this as completedon Jul 17, 2026

  9. martincostello commented on Jul 17, 2026

    @martincostello
    martincostello
    on Jul 17, 2026
    Author

    Looking good now, thanks!

  10. simonabadoiu commented on Jul 17, 2026

    @simonabadoiu
    simonabadoiu
    on Jul 17, 2026

    thanks again for raising the issue 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions