You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Thanks for following up here; I forgot to update. As explained in https://blog.cloudflare.com/cdnjs-dev-platform-migration/#how-we-re-built-it, updating this repository is no longer tenable. We are now using an R2 bucket as the source of truth for the CDN and are happy to provide read-only credentials for mirrors that wish to stay in sync with cdnjs. Please open an issue like #14307 + #14309 to request credentials!
I informally escalated this last weekend to no avail, this has now been formally escalated to Cloudflare in #01220256
FYI #14263 which is tracking the lack of new versions being processed -- this issue is just for syncing those versions from the CDN to the repository (the repository is not the source of truth).
Hey folks, same update as in #14263 (comment), I've just met with the team again and this is a known issue that is being worked on. It sounds like there'll be work done to flush the existing backlog of files into the repo, and then more wholistic work done to overhaul the entire package update process including writing to this repo.
For folks following along in this issue, waiting for updates to start flowing to this repo again (specifically the Git repo, not library updates generally), would you mind sharing your use cases to give the new team working on cdnjs some more context? My assumption has historically been folks using the repo as a source of truth for hosting cdnjs mirrors, but I don't know if that's still the main use case or not.
For folks following along in this issue, waiting for updates to start flowing to this repo again (specifically the Git repo, not library updates generally), would you mind sharing your use cases to give the new team working on cdnjs some more context? My assumption has historically been folks using the repo as a source of truth for hosting cdnjs mirrors, but I don't know if that's still the main use case or not.
Here is a use case that I’ve learned about:
Although Cloudflare provides global Anycast acceleration, the current version of cdnjs in use is not optimized for mainland China. This means that accessing target resources from this region often involves longer network paths. As is well known, China has limited international bandwidth and numerous network filtering strategies in place, resulting in a poor user experience. To address this, many websites in the region use cdnjs mirror sites with acceleration services within mainland China, which requires regular file synchronization from the original repository.
For folks following along in this issue, waiting for updates to start flowing to this repo again (specifically the Git repo, not library updates generally), would you mind sharing your use cases to give the new team working on cdnjs some more context? My assumption has historically been folks using the repo as a source of truth for hosting cdnjs mirrors, but I don't know if that's still the main use case or not.
My use-case is this one, which was kinda replaceable by https://github.com/cdnjs/SRIs (but it seems dead anyway).
The idea is to have the hashes of all the resources (with or without a newline at the end of the file), an use it in lookyloo to provide contextual information for the resources loaded on the pages.
And to be be totally 100% honest: I'd love to just be able to get the hashes (with and without the newline at the end of each file, it is sadly important) and not using 1Tb of SSD just for that.
👋 Hey folks, I've received an update from the Cloudflare folks working on rewriting all the automation here; they're getting close to having the new automation ready to go, which'll handle updating libraries and syncing with this repository. As a final step in that work, they've had to turn off the old automation again for a bit, likely for a few weeks, before the new automation is enabled and running. Apologies for the delays in library updates while this happens.
Hi, so the last sync was 6 months ago. Which means that projects using libraries from cdnjs are stuck on old, vulnerable versions. Is this project no longer maintained?
As I've explained in this thread further up, yes. Folks at Cloudflare are actively working on rebuilding the underlying systems that power cdnjs from the ground up, so that it can continue to operate and be maintained.
Is there any new progress?
so the last sync was 6 months ago.
Unfortunately, it seems that work is taking longer than expected. I meet with the team once a month to check in on things, and from what I've heard, there is still progress being made. I wish I could give further insight, but that's all I have to share, sorry.
While libraries aren't being updated still, cdnjs itself is operational, which is the main priority always -- websites using cdnjs can continue to load assets without issue, even while migration work is happening in the background to change how those assets are being served.
Appreciate the update 2 weeks ago, it would be really useful to get even a sense of whether we're a week away, a month, another 6 months?
Could Cloudflare not temporarily turn the old automation back on whilst they are still working on whatever the new system is due to be. Really feels like this is being mothballed as websites that load assets from cdnjs and potentially use it to drive their update cycles won't be seeing potential security updates for their libraries unless they look elsewhere.
Reacted by Kamil Vavra, Paul Meserve, Snrat and Heptazhou
FYI, while the auto-update automation is now running (#14263 (comment)), this does not include the syncing of this repository. We're still looking into what the future looks like for this, but it seems likely that we won't continue updating the repository at this point, as it is proving to be too much of a headache (both for us and for GitHub, who have previously had to make changes specifically to support this repository existing). If that is the direction we ultimately decide to go with, we'll make sure we provide an alternative way for folks to access all the files on the CDN for operating mirrors. I'll update here when I know more.
FYI, while the auto-update automation is now running (#14263 (comment)), this does not include the syncing of this repository. We're still looking into what the future looks like for this, but it seems likely that we won't continue updating the repository at this point, as it is proving to be too much of a headache (both for us and for GitHub, who have previously had to make changes specifically to support this repository existing). If that is the direction we ultimately decide to go with, we'll make sure we provide an alternative way for folks to access all the files on the CDN for operating mirrors. I'll update here when I know more.
Thanks for the update.
I’d also like to ask about the longer-term plan for resource synchronization. If keeping the GitHub repository in sync is no longer feasible, or if the current repository syncing mechanism is not expected to be restored, are there any plans to provide an alternative way for downstream users to synchronize or mirror the complete cdnjs asset set?
For example, this could be an API, object-storage endpoint, periodic snapshot, or another machine-friendly synchronization mechanism.
Our main concern is having a reliable way to keep a downstream mirror of cdnjs resources up to date without having to individually discover and download every asset from the public CDN.
Thanks for following up here; I forgot to update. As explained in https://blog.cloudflare.com/cdnjs-dev-platform-migration/#how-we-re-built-it, updating this repository is no longer tenable. We are now using an R2 bucket as the source of truth for the CDN and are happy to provide read-only credentials for mirrors that wish to stay in sync with cdnjs. Please open an issue like #14307 + #14309 to request credentials!
Activity
MattIPv4 commentedon Sep 25, 2024
@xtuc can you take a look at what's happening here? It looks like it is trying to commit an empty version of a library? https://github.com/cdnjs/cdnjs/actions/runs/11034627409/job/30648644706#step:4:251
MattIPv4 commentedon Oct 6, 2024
I informally escalated this last weekend to no avail, this has now been formally escalated to Cloudflare in #01220256
FYI #14263 which is tracking the lack of new versions being processed -- this issue is just for syncing those versions from the CDN to the repository (the repository is not the source of truth).
jacomyal commentedon Oct 7, 2024
Thanks for the update!
[-]No update since 8 September[/-][+]Repository syncing not working[/+]MattIPv4 commentedon Mar 12, 2025
Hey folks, same update as in #14263 (comment), I've just met with the team again and this is a known issue that is being worked on. It sounds like there'll be work done to flush the existing backlog of files into the repo, and then more wholistic work done to overhaul the entire package update process including writing to this repo.
MattIPv4 commentedon Mar 13, 2025
For folks following along in this issue, waiting for updates to start flowing to this repo again (specifically the Git repo, not library updates generally), would you mind sharing your use cases to give the new team working on cdnjs some more context? My assumption has historically been folks using the repo as a source of truth for hosting cdnjs mirrors, but I don't know if that's still the main use case or not.
Snrat commentedon Mar 21, 2025
Here is a use case that I’ve learned about:
Although Cloudflare provides global Anycast acceleration, the current version of cdnjs in use is not optimized for mainland China. This means that accessing target resources from this region often involves longer network paths. As is well known, China has limited international bandwidth and numerous network filtering strategies in place, resulting in a poor user experience. To address this, many websites in the region use cdnjs mirror sites with acceleration services within mainland China, which requires regular file synchronization from the original repository.
Rafiot commentedon Mar 31, 2025
My use-case is this one, which was kinda replaceable by https://github.com/cdnjs/SRIs (but it seems dead anyway).
The idea is to have the hashes of all the resources (with or without a newline at the end of the file), an use it in lookyloo to provide contextual information for the resources loaded on the pages.
And to be be totally 100% honest: I'd love to just be able to get the hashes (with and without the newline at the end of each file, it is sadly important) and not using 1Tb of SSD just for that.
MattIPv4 commentedon Sep 30, 2025
👋 Hey folks, I've received an update from the Cloudflare folks working on rewriting all the automation here; they're getting close to having the new automation ready to go, which'll handle updating libraries and syncing with this repository. As a final step in that work, they've had to turn off the old automation again for a bit, likely for a few weeks, before the new automation is enabled and running. Apologies for the delays in library updates while this happens.
xiaochunjimmy commentedon Mar 24, 2026
Is there any new progress?
vavkamil commentedon Mar 28, 2026
Hi, so the last sync was 6 months ago. Which means that projects using libraries from
cdnjsare stuck on old, vulnerable versions. Is this project no longer maintained?MattIPv4 commentedon Mar 28, 2026
As I've explained in this thread further up, yes. Folks at Cloudflare are actively working on rebuilding the underlying systems that power cdnjs from the ground up, so that it can continue to operate and be maintained.
Unfortunately, it seems that work is taking longer than expected. I meet with the team once a month to check in on things, and from what I've heard, there is still progress being made. I wish I could give further insight, but that's all I have to share, sorry.
While libraries aren't being updated still, cdnjs itself is operational, which is the main priority always -- websites using cdnjs can continue to load assets without issue, even while migration work is happening in the background to change how those assets are being served.
milkyjoe90 commentedon Apr 14, 2026
Appreciate the update 2 weeks ago, it would be really useful to get even a sense of whether we're a week away, a month, another 6 months?
Could Cloudflare not temporarily turn the old automation back on whilst they are still working on whatever the new system is due to be. Really feels like this is being mothballed as websites that load assets from cdnjs and potentially use it to drive their update cycles won't be seeing potential security updates for their libraries unless they look elsewhere.
Huaian666 commentedon Jun 5, 2026
switched our team over from the other thing last month. zero regrets. this just works without the constant fighting.
MattIPv4 commentedon Jun 23, 2026
FYI, while the auto-update automation is now running (#14263 (comment)), this does not include the syncing of this repository. We're still looking into what the future looks like for this, but it seems likely that we won't continue updating the repository at this point, as it is proving to be too much of a headache (both for us and for GitHub, who have previously had to make changes specifically to support this repository existing). If that is the direction we ultimately decide to go with, we'll make sure we provide an alternative way for folks to access all the files on the CDN for operating mirrors. I'll update here when I know more.
Snrat commentedon Aug 25, 2026
Thanks for the update.
I’d also like to ask about the longer-term plan for resource synchronization. If keeping the GitHub repository in sync is no longer feasible, or if the current repository syncing mechanism is not expected to be restored, are there any plans to provide an alternative way for downstream users to synchronize or mirror the complete cdnjs asset set?
For example, this could be an API, object-storage endpoint, periodic snapshot, or another machine-friendly synchronization mechanism.
Our main concern is having a reliable way to keep a downstream mirror of cdnjs resources up to date without having to individually discover and download every asset from the public CDN.
Thanks!
MattIPv4 commentedon Aug 25, 2026
Thanks for following up here; I forgot to update. As explained in https://blog.cloudflare.com/cdnjs-dev-platform-migration/#how-we-re-built-it, updating this repository is no longer tenable. We are now using an R2 bucket as the source of truth for the CDN and are happy to provide read-only credentials for mirrors that wish to stay in sync with cdnjs. Please open an issue like #14307 + #14309 to request credentials!