guide
guide copied to clipboard
Pin dependencies and add integrity checks
Linked dependencies, as in <script src="//cdn.jsdelivr.net/npm/docsify/lib/plugins/search.min.js"></script>
don't have a version in their URL, meaning they will always point to the latest version. (Side note: why do these dependencies start with //
instead of https://
?). This has two risks:
- A new version might break the guide (through a bug or a changed API)
- A version with malicious code might be used
If you take off the last part of the path of these dependcies (e.g. https://cdn.jsdelivr.net/npm/docsify/lib/plugins/), you can navigate through the versions.
Furthermore, we should use integrity checks to ensure that the loaded code has not been altered with.