That will still break your site if the CDN updates the file because it won't load anymore. The point the author made was that people use libraries distributed b

That will still break your site if the CDN updates the file because it won't load anymore. The point the author made was that people use libraries distributed by CDNs to get auto-updates and fixes, sadly that won't work in combination with CSP as you'll still have to update the integrity tag manually. We deliver integrity tags for our CDN files as well btw (https://github.com/kiprotect/klaro/blob/master/releases.yml https://github.com/kiprotect/klaro/blob/master/releases.yml), that doesn't solve the auto-updating problem though.