You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
New FeaturesKind: in v2.1.248,
What probably matters to youSection of the release
What
Artifacts you publish are no longer required to be fully self-contained. Scripts may load from cdnjs.cloudflare.com (preferred), cdn.jsdelivr.net/npm/, cdn.tailwindcss.com and code.jquery.com; stylesheets only from fonts.googleapis.com and fonts.gstatic.com. Everything else, including unpkg, esm.sh and any non-script request even to an allowed CDN, is blocked silently by the content security policy. Available to anyone using artifact publishing on this build.
Details
Guidance now asks for pinned UMD builds placed before inline scripts.
Mermaid diagrams stay native: "no library needed, don't load one".
Previously the same text said self-contained only, with Google Fonts as the sole exception.
Evidence
External resources — CDN allowlist (CSP-enforced)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
