CDN scripts pinned to @latest / unpinned major version — no SRI, no lockstep
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 84/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript, tailwindcss
Research direction
Inspect the CDN script tags in docs/index.html and templates/plan-template.html, then compare docs/index.html line 9 for the existing Font Awesome integrity pattern. Check src/index.js and its TRUSTED_CDN_ORIGINS allowlist for context. Done means both scripts use an exact version and include matching integrity and crossorigin attributes.
Written by the indexing model from the issue text.
Description
`docs/index.html` and `templates/plan-template.html` both load:
- `https://unpkg.com/lucide@latest\` — fully unpinned, can change under you at any time with no warning.
- `https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4\` — pinned to major `4` only, minor/patch can shift.
Neither has a Subresource Integrity (`integrity=`) hash (Font Awesome's `` does have one, so there's already a precedent in the codebase — see `docs/index.html` line 9). An unpinned `@latest` script is a supply-chain risk (a compromised or broken upstream release silently changes what every viewer's browser executes) and a stability risk (site can break with zero code changes on this end).
Also relevant to `src/index.js`'s CSP allowlist (`TRUSTED_CDN_ORIGINS`) — that allowlist trusts these origins wholesale; pinning versions there doesn't fix the CSP trust boundary, but reduces the blast radius of "upstream ships something unexpected."
Ask: pin `lucide` to an exact version (e.g. `lucide@0.474.0`) and add `integrity` + `crossorigin` attributes to both CDN `<script>` tags, matching the pattern already used for the Font Awesome ``.
— filed by Claude
- Dominant language
- JavaScript
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dkritarth/FreeFlow
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
All issues in dkritarth/FreeFlow
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·
-
client-controller-update ta-bot-triage team-money-movement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
MetaMask/metamask-mobile#36594 ·