From 8f0a0e27808e27ca09afa760bd9d319c03c3bf4c Mon Sep 17 00:00:00 2001
From: "planetrenox@protonmail.com" <planetrenox@protonmail.com>
Date: Wed, 21 Oct 2026 00:23:28 +0000
Subject: [PATCH] Pin unversioned third-party scripts to their current latest

Every page load fetched whatever these resolved to, so a bad or
compromised release would ship to all users with access to their keys.
Each pin serves byte-identical content to what the unpinned URL served.

- lucide@latest -> lucide@1.60.0
- cdn.tailwindcss.com -> 3.4.17
- cash-dom -> 8.1.5
- alpinejs -> 3.17.5
- markdown-it-mathjax3 (esm.sh) -> 5.2.0
- medv.io/codejar -> codejar@4.3.0 on jsDelivr (same file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 index.html          | 2 +-
 src/main.js         | 2 +-
 src/markdown.js     | 2 +-
 src/parts/head.html | 6 +++---
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/index.html b/index.html
index b0d4c18..175a8ac 100644
--- a/index.html
+++ b/index.html
@@ -11,7 +11,7 @@
 </div>
 <load src="/src/parts/sidebars.html" />
 <load src="/src/parts/modals.html" />
-<script src="https://unpkg.com/lucide@latest"></script>
+<script src="https://unpkg.com/lucide@1.60.0/dist/umd/lucide.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/markdown-it@15.0.1/dist/browser/markdown-it.umd.min.js"></script>
 <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.12.0/build/highlight.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/localforage@1.10.0/dist/localforage.min.js"></script>
diff --git a/src/main.js b/src/main.js
index 51a69b4..32b7cf0 100644
--- a/src/main.js
+++ b/src/main.js
@@ -146,7 +146,7 @@ $(el.composer).on('submit',async e=>{e.preventDefault();if(state.busy||sending||
 let jars={html:null,extension:null};
 const ensureJars=async()=>{
   if(jars.html&&jars.extension)return jars;
-  const mod=await import('https://medv.io/codejar/codejar.js'),CodeJar=mod.CodeJar||mod.default;
+  const mod=await import('https://cdn.jsdelivr.net/npm/codejar@4.3.0/dist/codejar.js'),CodeJar=mod.CodeJar||mod.default;
   const hl=e=>{
     const code=e.innerText;
     e.innerHTML=hljs.highlight(code,{language:'xml'}).value;
diff --git a/src/markdown.js b/src/markdown.js
index de588e9..2a52aec 100644
--- a/src/markdown.js
+++ b/src/markdown.js
@@ -1,4 +1,4 @@
-import mathjax3 from 'https://esm.sh/markdown-it-mathjax3';
+import mathjax3 from 'https://esm.sh/markdown-it-mathjax3@5.2.0';
 import { copyToClipboard } from './utils.js';
 
 export const md = window.md = window.markdownit({ html: false, linkify: true, typographer: true, breaks: true }).use(mathjax3);
diff --git a/src/parts/head.html b/src/parts/head.html
index 2ccab6d..6b08535 100644
--- a/src/parts/head.html
+++ b/src/parts/head.html
@@ -2,11 +2,11 @@
 <title>Sune</title>
 <link rel="icon" type="image/avif" href="https://sune.planetrenox.com/✺.avif"/>
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/>
-<script src="https://cdn.tailwindcss.com"></script>
+<script src="https://cdn.tailwindcss.com/3.4.17"></script>
 <script src="https://cdn.jsdelivr.net/npm/tiny-ripple@0.2.0"></script>
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@5.9.0/github-markdown-light.min.css"/>
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.12.0/build/styles/github.min.css"/>
 <link rel="stylesheet" href="/src/style.css"/>
-<script defer src="https://cdn.jsdelivr.net/npm/cash-dom/dist/cash.min.js"></script>
-<script defer src="//unpkg.com/alpinejs"></script>
+<script defer src="https://cdn.jsdelivr.net/npm/cash-dom@8.1.5/dist/cash.min.js"></script>
+<script defer src="https://unpkg.com/alpinejs@3.17.5/dist/cdn.min.js"></script>