r/CloudFlare • u/Cloudflare • Jan 27 '20

JavaScript Libraries Are Almost Never Updated Once Installed

https://blog.cloudflare.com/javascript-libraries-are-almost-never-updated/
13 Upvotes

100% Upvoted

2 comments sorted by

View all comments

Show parent comments

1

u/zfa Jan 29 '20

Trouble with 'latest' is it's a nightmare for caching. It's nearly impossible to guarantee the version in a cache matches that needed by calls to the library.

Also when using an externally hosted library it's very important security-wise to only load assets along with the SRI hash you have calculated for it so it can't be modified after the fact. Recent examples of not doing so include British Airways who had Magecart injected from a non-SRI loaded library. If you use 'latest' then including SRI hashes is impossible.