> have it checked by a vuln scanner This is kinda sad. For introducing new dependencies, a vuln scanner makes sense (don't download viruses just because they c

> have it checked by a vuln scanner This is kinda sad. For introducing new dependencies, a vuln scanner makes sense (don't download viruses just because they came from a source checkout!), but we could have kept CDNs if we'd used signatures. EDIT: Never mind, been out of the game for a bit! I see there is SRI now... https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...