docs(security): pin CDN integration examples to an immutable npm release instead of @main#26
Open
dmchaledev wants to merge 1 commit into
Open
docs(security): pin CDN integration examples to an immutable npm release instead of @main#26dmchaledev wants to merge 1 commit into
dmchaledev wants to merge 1 commit into
Conversation
The README integration examples (Plain HTML, Hugo, CDN, React, Vue) all loaded the script from jsDelivr via the mutable `gh/...@main` branch ref. For a widget embedded on third-party sites, that means any push to `main` (or a repo compromise) silently ships unreviewed code to every embedder. Pin all five examples to the immutable, provenance-signed npm release (`npm/@hailbytes/vulnerability-calculator@1.0.0`) and add a short note explaining why to pin a version rather than track a branch. Docs-only change; no source or behavior changes. All 65 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QmmE1BqPXoCj9wPA8rgmBX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every integration example in the README — Plain HTML, Hugo, CDN via jsDelivr, React, and Vue (5 occurrences) — loads the component from jsDelivr via a mutable branch ref:
@mainis not a version — it resolves to whatever is currently on themainbranch. jsDelivr serves that live. For a widget that's explicitly designed to be embedded on third-party marketing sites (Hugo, React, Vue, plain HTML — per the README's own pitch), this means:maininstantly changes the code running on every embedding page, with no review or opt-in on the embedder's side.This isn't covered by any open issue or PR (which focus on
calculate()input handling, DOM-free import, the test glob, and dead repo links).Fix
Pin all five examples to the immutable, provenance-signed npm release via jsDelivr's npm endpoint:
1.0.0is the currentlateston npm, and the publish workflow already ships it withnpm publish --provenance, so a pinned version is both immutable on jsDelivr and independently verifiable. Also added a short note in the CDN section explaining why to pin a version rather than track a branch, and how to opt into auto-patching with a@1range if desired (with the immutability tradeoff called out).Scope
README.md(5 URL pins + a security note) and aCHANGELOG.mdentry.npm test→ 65 passing, 0 failing.🤖 Generated with Claude Code
https://claude.ai/code/session_01QmmE1BqPXoCj9wPA8rgmBX
Generated by Claude Code