docs: pin CDN examples to immutable npm version instead of @main branch#36
Open
dmchaledev wants to merge 1 commit into
Open
docs: pin CDN examples to immutable npm version instead of @main branch#36dmchaledev wants to merge 1 commit into
dmchaledev wants to merge 1 commit into
Conversation
The README told every CDN/Hugo/React/Vue embedder to load the component from `cdn.jsdelivr.net/gh/HailBytes/vulnerability-calculator@main/...`. Loading `@main` is problematic for production embeds: - Unpinned: every push to main instantly changes the deployed widget for all embedders, with no rollback and no way to SRI-pin a moving target. - Poorly cached: jsDelivr caches branch refs for only ~12h, versus permanently caching immutable version tags. - The package is already published to npm (v1.0.0) — an immutable, versioned artifact the docs never pointed at. Switch all 5 CDN references to the npm-pinned jsDelivr path (`@1`), which auto-tracks patch/minor releases within the major while keeping each resolved version immutable and permanently cached. Add a note documenting the pinning strategy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017CHCPxQmCRx9zozfEPzWm9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The README's integration examples (CDN, Hugo, React, Vue) tell every embedder to load the component from a branch URL:
Loading
@mainin production is risky and slow:maininstantly changes the deployed widget for all embedders. A bad commit breaks every embedding site at once, with no version to roll back to and no stable hash to SRI-pin.v1.0.0), but none of the docs pointed at it.Change
Switch all 5 CDN references to the npm-pinned jsDelivr path:
The
@1major-version pin auto-tracks patch/minor releases while keeping each resolved version immutable and permanently cacheable. Added a short note documenting the pinning strategy (and how to lock to an exact version with@1.0.0).Docs-only — no code or behavior changes.
Verification
@mainreferences replaced;grepconfirms zero remain.hailbytes-vuln-calculator.js) is the packagemainand is included in the published tarball'sfilesarray, so the npm CDN path resolves to the same module.🤖 Generated with Claude Code
https://claude.ai/code/session_017CHCPxQmCRx9zozfEPzWm9
Generated by Claude Code