Pin unversioned third-party scripts to their current latest

Every page load fetched whatever these resolved to, so a bad or
compromised release would ship to all users with access to their keys.
Each pin serves byte-identical content to what the unpinned URL served.

- lucide@latest -> lucide@1.60.0
- cdn.tailwindcss.com -> 3.4.17
- cash-dom -> 8.1.5
- alpinejs -> 3.17.5
- markdown-it-mathjax3 (esm.sh) -> 5.2.0
- medv.io/codejar -> codejar@4.3.0 on jsDelivr (same file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-10-21 00:23:28 +00:00
co-authored by Claude Opus 5.5
parent 44b34d332a
commit 8f0a0e2780
4 changed files with 6 additions and 6 deletions
+1 -1
View File
@@ -1,4 +1,4 @@
import mathjax3 from 'https://esm.sh/markdown-it-mathjax3';
import mathjax3 from 'https://esm.sh/markdown-it-mathjax3@5.2.0';
import { copyToClipboard } from './utils.js';
export const md = window.md = window.markdownit({ html: false, linkify: true, typographer: true, breaks: true }).use(mathjax3);