Open fulldecent opened 1 year ago
Also can I please get permissions back on this repo so I can triage issues again?
I don't have any knowledge of SRI, so maby I am seeing this wrong but https://cdn.jsdelivr.net/npm/chart.js@4.3.3/dist/chart.umd.js is already minified so if the minification is the issue this is the solution right?
Cool, thank you. I just tried running that file and it is working with SRI. The issue here might be we are not using the expected convention.
For example, on all versions up to 3.9.1 our main UMD file is detected. Example:
https://www.jsdelivr.com/package/npm/chart.js?tab=files&version=3.9.1
However, on more recent versions, our UMD file is not found. jsDelivr is taking it upon itself to "minify" this file for us because it cannot find the minified file.
https://www.jsdelivr.com/package/npm/chart.js?tab=files&version=4.3.3
Maybe the solution is we need to name the file differently or specify in package.json. I'm investigating now.
I see that we have specified it here:
https://github.com/chartjs/Chart.js/blob/v4.3.3/package.json#L13-L15
And in the past we did similarly:
https://github.com/chartjs/Chart.js/blob/v3.9.1/package.json#L7-L9
jsDelivr documentation on this is at: https://www.jsdelivr.com/documentation#id-configuring-a-default-file-in-packagejson
So the problem is that jsDelivr is expecting a minified JavaScript file will always have the extension *.min.js. Whereas we are publishing chart.umd.js.
I think the solution here is to follow established conventions and that we should publish this file as chart.umd.min.js.
This could even be a copy of the existing file if that makes publishing easier.
Agreed, it was a real pain to set up when using a CDN.
The minified file chart.umd.js
does not play well with CDN and other tools. It should be chart.umd.min.js
or chart.min.js
.
Feature Proposal
This is the last version of Chart.js which supports CDN with SRI:
https://cdn.jsdelivr.net/npm/chart.js@3.9.1/dist/chart.min.js
Currently, there is no upgrade path for this version.
Can we please again release minified CDN versions which can be safely delivered with SRI?
Possible Implementation
No response