dunglas / mercure / 36005236628

90%

master: 93%

push

github

fix(debugger): vendor its dependencies with npm (#1405)

The debugger runs on the hub origin, where users paste access tokens, and
loaded fetch-event-source and its fonts from floating major versions on
jsDelivr. Bundle fetch-event-source from a pinned npm package into
public/vendor/, use the system fonts, and drop the CDN from the CSP.

CI checks that the bundle matches the lockfile, a weekly workflow opens a pull
request when a dependency has a release older than a week, and release.sh
refuses to release a stale or outdated bundle.

Also escape the playground's self Link target, mark generated and vendored
files for Linguist.

21 of 21 new or added lines in 2 files covered. (100.0%)

2321 of 2611 relevant lines covered (88.89%)

450.06 hits per line