Published artifacts may now load scripts and fonts from a fixed short list of CDNs.
What's wrong with this entry?
Artifacts you publish are no longer required to be fully self-contained. Scripts may load from cdnjs.cloudflare.com (preferred), cdn.jsdelivr.net/npm/, cdn.tailwindcss.com and code.jquery.com; stylesheets only from fonts.googleapis.com and fonts.gstatic.com. Everything else, including unpkg, esm.sh and any non-script request even to an allowed CDN, is blocked silently by the content security policy. Available to anyone using artifact publishing on this build.
- Guidance now asks for pinned UMD builds placed before inline scripts.
- Mermaid diagrams stay native: "no library needed, don't load one".
- Previously the same text said self-contained only, with Google Fonts as the sole exception.
External resources — CDN allowlist (CSP-enforced)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.