feat: vendor all runtime CDN dependencies by shsteimer · Pull Request #282 · adobe/helix-tools-website

shsteimer · 2026-04-07T15:40:36Z

Summary

Replace all runtime CDN imports (esm.sh, unpkg, cdnjs, jsdelivr) with locally vendored browser-ready ES modules served from vendor/
Add scripts/vendor.mjs postinstall hook that copies or esbuild-bundles each dependency from node_modules/ into vendor/, with lockfile-hash idempotency
Configure dependabot with weekly schedule and semver-aware cooldown (major: 30d, minor: 7d, patch: 3d)
Remove https://esm.sh from CSP script-src in all optel pages
Centralize duplicate vendored diff.js copies, remove redundant sub-directory package.json files
Bump stylelint to 17.6.0 to match aem-boilerplate

See docs/rfc-vendor-cdn-deps.md for the full decision document covering all options evaluated, trade-offs, CDN comparison, and rationale.

Preview

https://feat-vendor-cdn-deps--helix-tools-website--adobe.aem.page/tools/optel/oversight/cwvperf.html

Test plan

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code

Replace all runtime CDN imports (esm.sh, unpkg, cdnjs, jsdelivr) with locally vendored browser-ready ES modules served from vendor/. A postinstall script (scripts/vendor.mjs) copies or esbuild-bundles each dependency from node_modules into vendor/, with lockfile-hash idempotency. Vendor files are committed to git as required by EDS. - Add chart.js, chartjs plugins, rum-distiller, echarts, yaml, diff, prismjs as npm dependencies with esbuild as dev dependency - Update all import maps in optel/error-analyzer HTML files to /vendor/ - Update dynamic imports (yaml) and loadScript calls (prismjs) in JS - Remove https://esm.sh from CSP script-src in optel pages - Centralize duplicate vendored diff.js into vendor/ - Remove redundant sub-directory package.json files in optel - Configure dependabot with weekly schedule and semver-aware cooldown - Bump stylelint to 17.6.0 to match aem-boilerplate - Update AGENTS.md with vendor documentation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aem-code-sync · 2026-04-07T15:40:40Z

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

Re-run PSI checks
Re-sync branch

Commits

8b5b502 ✅ (latest)
c2f5569 ✅
223ae71 ✅
70cd083 ✅
5bafa04 ✅

aem-code-sync · 2026-04-07T15:41:01Z

	Page	Scores	Audits	Google
📱	/tools/optel/oversight/cwvperf.html
🖥️	/tools/optel/oversight/cwvperf.html

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

trieloff · 2026-04-09T08:44:41Z

I'd use renovate.

trieloff · 2026-04-09T08:44:58Z

+
+## Options Considered
+
+### Option A: Full Vendoring (esbuild + postinstall) — SELECTED


Agree with this approach.

Replaces the runtime unpkg.com CDN import of `yaml` with a locally vendored copy managed via npm. Adds Renovate config with minimumReleaseAge cooldowns (3d patch / 7d minor / 30d major) and postUpgradeTasks to re-vendor on update. Closes #282 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

shsteimer · 2026-04-14T17:00:21Z

Superseded by #287, which implements the approach as a pilot on a single dependency (yaml) before rolling out more broadly. Switching to Renovate instead of Dependabot for equivalent cooldown support via minimumReleaseAge.

@claude

…#287) * feat(vendor): pilot yaml dependency vendoring with Renovate cooldowns Replaces the runtime unpkg.com CDN import of `yaml` with a locally vendored copy managed via npm. Adds Renovate config with minimumReleaseAge cooldowns (3d patch / 7d minor / 30d major) and postUpgradeTasks to re-vendor on update. Closes #282 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): move vendor script to project root, ignore *.mjs in hlx vendor.mjs belongs alongside other root-level tooling (package.json, .eslintrc.js) rather than scripts/, which is reserved for browser-served AEM runtime code. Also adds *.mjs to .hlxignore so tooling scripts are not served by the AEM CDN. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): move vendor.mjs into vendor/ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): exclude vendor/vendor.mjs specifically in .hlxignore Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): pin yaml dep, centralize ensureYaml in index-admin - Pin yaml dependency to exact version 2.8.3 (drop ^ range) so vendored output is always reproducible across installs - Add ensureYaml() helper in index-admin to consolidate vendor import, replacing three inline YAML = YAML || await import(...) calls; also fixes stale unpkg CDN URL on the delete path - Un-ignore vendor/vendor.mjs in .eslintignore so the vendor script is linted alongside the rest of the codebase Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): switch to esbuild bundling with postinstall + hash guard - Add esbuild (0.28.0) as devDependency; use it to bundle yaml into a single vendor/yaml.js instead of copying ~80 individual files. This is the correct pattern for deps without a pre-built browser ESM and keeps the vendoring approach consistent for future additions. - Add postinstall script so vendor files are regenerated automatically on npm install, not just via Renovate postUpgradeTasks. - Add package-lock.json hash guard (vendor/.vendor-hash) so repeated installs skip the rebuild when nothing has changed. - Update ensureYaml() import paths in index-admin and sitemap-admin to point to vendor/yaml.js. - Remove legacy vendor/yaml/ directory tree (80 files → 1 file). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): explicitly hlxignore vendor/.vendor-hash Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Apply suggestion from @claude[bot] Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> * Apply suggestion from @shsteimer * chore(vendor): use fs/promises, declarative DEPS list, write hash eagerly - Switch all fs calls to fs/promises - Replace one-off bundle/cleanup calls with a DEPS array; adding a new dep is now a single line - Write hash file before bundling (optimistic) so it sits next to the hash compare rather than at the end of the script - Bundle steps run in parallel via Promise.all - Remove legacy vendor/yaml cleanup (migration complete) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(vendor): correct ensureYaml import paths in both tools index-admin had a wrong path (vendor/yaml/yaml.js) introduced during rebase; sitemap-admin was missing the eslint-disable comment. Both now consistently import from vendor/yaml.js. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): auto-discover deps from package.json dependencies Replace hardcoded DEPS array with automatic discovery from package.json `dependencies`. esbuild resolves each package's browser entry via its exports map, so no entry point overrides are needed. Adding a new runtime dep now requires only a package.json change — vendor.mjs needs no updates. Scoped package names (@scope/name) are normalized to name.js for the output filename. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): replace auto-discovery with explicit DEPS config array Reading from package.json proved insufficient — chart.js plugins require the external option to share a module instance, which can't be expressed per-package via auto-discovery. DEPS at the top of the script is the single place to update when adding deps. The build loop is generic and never needs changing. Commented-out entries document the chart.js/rum-distiller/echarts patterns for when the full rollout happens. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): scope output files to per-package subdirectories vendor/yaml.js → vendor/yaml/yaml.js. Each vendored package now lives in its own subdirectory, consistent with how the old cpSync approach laid things out and easier to reason about when multiple deps are present. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): enable esbuild minification EDS serves committed files directly — no CDN minification step exists. Minifying at vendor time halves the yaml bundle (209KB → 101KB) at negligible build cost. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * minor updates * chore(vendor): clean stale artifacts and write hash only on success Delete vendor subdirectories before rebuilding so removed DEPS entries don't leave orphaned files. Move hash file write to after all builds complete so a failed build forces a retry on next run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

@claude

…#287) * feat(vendor): pilot yaml dependency vendoring with Renovate cooldowns Replaces the runtime unpkg.com CDN import of `yaml` with a locally vendored copy managed via npm. Adds Renovate config with minimumReleaseAge cooldowns (3d patch / 7d minor / 30d major) and postUpgradeTasks to re-vendor on update. Closes #282 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): move vendor script to project root, ignore *.mjs in hlx vendor.mjs belongs alongside other root-level tooling (package.json, .eslintrc.js) rather than scripts/, which is reserved for browser-served AEM runtime code. Also adds *.mjs to .hlxignore so tooling scripts are not served by the AEM CDN. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): move vendor.mjs into vendor/ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): exclude vendor/vendor.mjs specifically in .hlxignore Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): pin yaml dep, centralize ensureYaml in index-admin - Pin yaml dependency to exact version 2.8.3 (drop ^ range) so vendored output is always reproducible across installs - Add ensureYaml() helper in index-admin to consolidate vendor import, replacing three inline YAML = YAML || await import(...) calls; also fixes stale unpkg CDN URL on the delete path - Un-ignore vendor/vendor.mjs in .eslintignore so the vendor script is linted alongside the rest of the codebase Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): switch to esbuild bundling with postinstall + hash guard - Add esbuild (0.28.0) as devDependency; use it to bundle yaml into a single vendor/yaml.js instead of copying ~80 individual files. This is the correct pattern for deps without a pre-built browser ESM and keeps the vendoring approach consistent for future additions. - Add postinstall script so vendor files are regenerated automatically on npm install, not just via Renovate postUpgradeTasks. - Add package-lock.json hash guard (vendor/.vendor-hash) so repeated installs skip the rebuild when nothing has changed. - Update ensureYaml() import paths in index-admin and sitemap-admin to point to vendor/yaml.js. - Remove legacy vendor/yaml/ directory tree (80 files → 1 file). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): explicitly hlxignore vendor/.vendor-hash Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Apply suggestion from @claude[bot] Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> * Apply suggestion from @shsteimer * chore(vendor): use fs/promises, declarative DEPS list, write hash eagerly - Switch all fs calls to fs/promises - Replace one-off bundle/cleanup calls with a DEPS array; adding a new dep is now a single line - Write hash file before bundling (optimistic) so it sits next to the hash compare rather than at the end of the script - Bundle steps run in parallel via Promise.all - Remove legacy vendor/yaml cleanup (migration complete) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(vendor): correct ensureYaml import paths in both tools index-admin had a wrong path (vendor/yaml/yaml.js) introduced during rebase; sitemap-admin was missing the eslint-disable comment. Both now consistently import from vendor/yaml.js. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): auto-discover deps from package.json dependencies Replace hardcoded DEPS array with automatic discovery from package.json `dependencies`. esbuild resolves each package's browser entry via its exports map, so no entry point overrides are needed. Adding a new runtime dep now requires only a package.json change — vendor.mjs needs no updates. Scoped package names (@scope/name) are normalized to name.js for the output filename. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): replace auto-discovery with explicit DEPS config array Reading from package.json proved insufficient — chart.js plugins require the external option to share a module instance, which can't be expressed per-package via auto-discovery. DEPS at the top of the script is the single place to update when adding deps. The build loop is generic and never needs changing. Commented-out entries document the chart.js/rum-distiller/echarts patterns for when the full rollout happens. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): scope output files to per-package subdirectories vendor/yaml.js → vendor/yaml/yaml.js. Each vendored package now lives in its own subdirectory, consistent with how the old cpSync approach laid things out and easier to reason about when multiple deps are present. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(vendor): enable esbuild minification EDS serves committed files directly — no CDN minification step exists. Minifying at vendor time halves the yaml bundle (209KB → 101KB) at negligible build cost. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * minor updates * chore(vendor): clean stale artifacts and write hash only on success Delete vendor subdirectories before rebuilding so removed DEPS entries don't leave orphaned files. Move hash file write to after all builds complete so a failed build forces a retry on next run. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

docs: remove download-esm option from RFC

70cd083

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aem-code-sync bot temporarily deployed to feat/vendor-cdn-deps April 7, 2026 15:43 Inactive

docs: clarify SRI relevance for same-origin vendored files

223ae71

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aem-code-sync bot temporarily deployed to feat/vendor-cdn-deps April 7, 2026 15:59 Inactive

docs: simplify SRI explanation for vendored files

c2f5569

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aem-code-sync bot temporarily deployed to feat/vendor-cdn-deps April 7, 2026 16:04 Inactive

docs: revise SRI section — note vendored files enable future hardening

8b5b502

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aem-code-sync bot deployed to feat/vendor-cdn-deps April 7, 2026 16:08 View deployment

trieloff approved these changes Apr 9, 2026

View reviewed changes

shsteimer mentioned this pull request Apr 14, 2026

feat(vendor): pilot yaml dependency vendoring with Renovate cooldowns #287

Merged

4 tasks

shsteimer closed this Apr 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: vendor all runtime CDN dependencies#282

feat: vendor all runtime CDN dependencies#282
shsteimer wants to merge 5 commits intomainfrom
feat/vendor-cdn-deps

shsteimer commented Apr 7, 2026

Uh oh!

aem-code-sync bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

aem-code-sync bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

trieloff Apr 9, 2026

Uh oh!

trieloff Apr 9, 2026

Uh oh!

shsteimer commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		## Options Considered

		### Option A: Full Vendoring (esbuild + postinstall) — SELECTED

Conversation

shsteimer commented Apr 7, 2026

Summary

Preview

Test plan

Uh oh!

aem-code-sync bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aem-code-sync bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

trieloff Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

trieloff Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

shsteimer commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aem-code-sync bot commented Apr 7, 2026 •

edited

Loading

aem-code-sync bot commented Apr 7, 2026 •

edited

Loading