replacement of cdn npm use

[HoppC]

heyho to everyone :),

one of our customers is having an issue with the cdn npm use of JavaScript files (dynamic integration of Flatpickr location files). We understand the reason for the implementation, that not all location js are stored locally, but we also understand also our customer's security concerns following the recent npm compromises. Are there any ideas or plans to resolve such cdn "dependencies"?

We can, of course, make a change in the source code ourselves, but perhaps a general solution would be more useful, and possibly it affects other places where a cdn is used.

Thanks for your time.
Christian

[engram-design]

What version are you on? We should no longer be using a CDN

[HoppC]

Hello Josh,

thanks for your answer. We have in this case a craft4 project with formie version 2.2.3.

Best regards,
Christian

[engram-design]

Ah, so the only instance where we load from a CDN is if the site language is non-English.

There's actually a JS event you can use modifyScriptUrl to change the URL that resolves to these CDN links.

[HoppC]

yes, that's exactly what we were talking about :). If it's not in English, it's reloaded via cdn. We've already used this method to subsequently set the link to a local path and written a workaround where we offer language X, Y, and Z locally and then have all other languages ​​refer to the local integrated English – not a great solution – but we couldn't think of a better one.

[engram-design]

Gotcha. So we indeed want to improve this, by having these resources available locally.