Skip to content

Conversation

@jjallaire
Copy link
Collaborator

This PR replaces the use of cdnjs.cloudflare.com and unpkg.com with cdn.jsdelivr.net for jupyter widgets. The motivation is to bring more uniformity to JS CDN's for people defining content security policies for quarto websites. Since we already use jsdelivr for MathJax, Katex, and Algolia this brings Juptyer Widgets in line with those uses.

This PR replaces the use of cdnjs.cloudflare.com and unpkg.com with cdn.jsdelivr.net for jupyter widgets. The motivation is to bring more uniformity to JS CDN's for people defining content security policies for quarto websites. Since we already use jsdelivr for MathJax, Katex, and Algolia this brings Juptyer Widgets in line with those uses.
@posit-snyk-bot
Copy link
Collaborator

posit-snyk-bot commented Jul 2, 2025

🎉 Snyk checks have passed. No issues have been found so far.

security/snyk check is complete. No issues have been found. (View Details)

license/snyk check is complete. No issues have been found. (View Details)

@cscheid
Copy link
Collaborator

cscheid commented Jul 2, 2025

I like this, and we should make a note on the changelog.

I think we should inventory the locations we potentially grab content from as well.

@cscheid
Copy link
Collaborator

cscheid commented Jul 2, 2025

After a full review of quarto-cli, this is what I found:

  • If google analytics support is enabled, src/project/types/website/website-analytics.ts:
    • www.googletagmanager.com
    • www.google-analytics.com
  • If webtex is chosen to be the default math method, src/command/render/pandoc.ts:
    • latex.codecogs.com
  • If revealjs multiplex is enabled: src/format/reveal/format-reveal-multiplex.ts (we will definitely need to fix this one, because glitch is going away)
    • reveal-multiplex.glitch.me
  • For a number of revealjs and bootswatch themes:
    • fonts.googleapis.com
  • Our internal debugging tools:
    • esm.sh
    • cdn.skypack.dev
  • giscus support:
    • giscus.app
  • placeholder shortcode:
    • svg2png.deno.dev
  • video shortcode:
    • www.youtube.com
    • youtu.be
    • www.youtube-nocookie.com
    • players.brightcove.net
    • vimeo.com
  • OJS support:
    • cdn.observableusercontent.com (when importing from OJS notebooks)
    • unpkg.com
    • cdn.jsdelivr.net
    • static.observableusercontent.com

@cscheid
Copy link
Collaborator

cscheid commented Jul 2, 2025

Doc PR is up.

@cscheid cscheid merged commit 4e4be86 into main Jul 2, 2025
49 checks passed
@cscheid cscheid deleted the feature/jupyter-widgets-jsdelivr branch July 2, 2025 14:49
cderv added a commit that referenced this pull request Jul 18, 2025
This follows change in #13026 to bring uniformity to cdn used.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants