Repository navigation
Promote edge to stable: clients serve their libraries from our own build - #3044
Merged
Merged
Conversation
The report, admin and legacy participation pages fetched code, styles, fonts and images from CDNs on every load. When one of those hosts was unreachable the page broke (the report reads window.d3 from d3js.org), and every load told those hosts who was viewing. Each dependency now comes from a pinned npm package and is served from the client's own build, at the version the page was already loading: - report: d3 4.13.0, d3-scale-chromatic 1.5.0 and Plotly 2.27.0 are copied byte for byte into the build and loaded by the same script tags, in the same order, from our host; the unused Font Awesome 4.4.0 stylesheet (no element uses its classes) is removed. - admin: the Space Mono font comes from @fontsource/space-mono 5.3.0 (the same font version and glyphs as Google Fonts serves); the fifteen Twemoji 14.0.2 images the pages draw are shipped as client assets. - legacy participation: window.jwt_decode is jwt-decode 3.1.2, the version the jsdelivr @latest link resolved to. Simple Analytics, Google Analytics (only when configured), the login provider and the deliberate embeds are unchanged. A Cypress check blocks every non-local host, clears and disables the browser cache, and loads every report view (including topic and collective statement views), both participation clients and the admin pages; it fails on any third-party request other than Simple Analytics, any page error, or any of our own assets failing to load. The report browser proof blocks non-local hosts the same way. Unit tests in each client pin the templates and versions. Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Report, admin and participation pages load d3, d3-scale-chromatic, Plotly, Space Mono, Twemoji and jwt-decode from our build at identical bytes instead of public CDNs; a Cypress guard blocks non-local hosts. No schema change.