Provide a way to disable the hardcoded Google Fonts @import (breaks offline / air-gapped / strict-CSP deployments)

[Aston13]

Summary

Both the prebuilt CSS bundles and the SCSS source hardcode an @import for Google Fonts with no way to opt out. It's the first line applied by the stylesheet, so in offline / air-gapped / OT networks (where the outbound request is silently dropped rather than refused) the browser blocks for ~30s waiting for the connection to time out before it finishes applying the stylesheet. It also trips strict Content-Security-Policy setups that don't allow fonts.googleapis.com.

Where it lives

The import is line 1 of scss/_global.scss:

@import url('https://fonts.googleapis.com/css2?family=Source+Sans+Pro:wght@400;600;700&display=swap');
...
font-family: 'Source Sans Pro', sans-serif;

Every theme pulls it in unconditionally via @import './global', so it ends up in all prebuilt bundles:

• @vueform/vueform/dist/*.css (all theme + .nodark variants)
• @vueform/builder/{vueform,index,tailwind}.css

Because it's a literal line rather than a guarded @if, even compiling from the ./scss/* source still emits it.

Why the current workarounds are poor

• Editing the vendored CSS — wiped on every npm install / CI run.
• Compiling from SCSS — _global.scss still @imports the CDN font.
• Patching (pnpm patch / patch-package) — fragile across version bumps.
• Build-time strip plugin — what we ended up doing (a Vite generateBundle hook that removes the @import), but that's the consumer papering over a library default.

Requested change (any one of these)

1. A SCSS flag, e.g. $vf-load-google-fonts: true !default; guarding the @import, so consumers can set it to false before importing.
2. A "no-fonts" CSS variant alongside the existing .nodark bundles (e.g. vueform.nofonts.css), leaving font-family: 'Source Sans Pro', sans-serif intact so self-hosted fonts still apply.
3. At minimum, document that the font is bundled and how to self-host it, so offline deployments know to strip/replace it.

Self-hosting the font (or falling back to the sans-serif stack already in the declaration) covers the offline use case cleanly — the only blocker is that the CDN @import can't be turned off.

Environment

• @vueform/vueform 1.13.11
• @vueform/builder 1.12.12
• Vite build, fonts self-hosted by the host application

[adamberecz]

Thanks for reporting this – it's a valid concern. It got addressed in @vueform/builder 1.12.15 patch which is now released, so you can do:

@use '@vueform/builder/scss/vueform.scss' with ($vfb-import-google-font: false);