Published artifacts can now load Google Fonts, the one external host allowed.
What's wrong with this entry?
The guidance for published artifacts dropped its blanket ban on external hosts and names Google Fonts as the one allowed exception, so generated pages can use real webfonts.
- The prototype and artifact-design skills were updated to match: link the stylesheet directly, keep a genuine fallback font stack, and inline everything else.
- Everything other than fonts is still blocked by the strict content security policy on published artifacts.
strict CSP blocks requests to external hosts
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.