{"version":"2.1.248","anchor":"published-artifacts-can-now-load-a-fixed-list-of-cdns","canonical_anchor":"published-artifacts-can-now-load-a-fixed-list-of-cdns","heading":"Published artifacts can now load a fixed list of CDNs","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/published-artifacts-can-now-load-a-fixed-list-of-cdns","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Published artifacts can now load a fixed list of CDNs\n\nPublished artifacts may now load scripts and fonts from a fixed short list of CDNs.\n\n**What**\n\nArtifacts you publish are no longer required to be fully self-contained. Scripts may load from cdnjs.cloudflare.com (preferred), cdn.jsdelivr.net\/npm\/, cdn.tailwindcss.com and code.jquery.com; stylesheets only from fonts.googleapis.com and fonts.gstatic.com. Everything else, including unpkg, esm.sh and any non-script request even to an allowed CDN, is blocked silently by the content security policy. Available to anyone using artifact publishing on this build.\n\n**Details**\n\n- Guidance now asks for pinned UMD builds placed before inline scripts.\n- Mermaid diagrams stay native: \"no library needed, don't load one\".\n- Previously the same text said self-contained only, with Google Fonts as the sole exception.\n\n**Evidence**\n\n`**External resources \u2014 CDN allowlist (CSP-enforced)**`\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 4\/5"}