The inventory that opened the batch found jQuery in three versions, coming from four different hosts, and 161 CodeMirror tags scattered across seven files. Two jQuery versions on the same screen break plugins in a way that is hard to trace.
Libraries
c2f assets:vendor downloads the files declared in a central registry into the installation. Each library has a single version, and the code asks for the file by name.
- The download only accepts a valid certificate. Turning verification off would be worse than staying on the CDN.
- It only accepts a 200 response: an error page saved under a library name would be the hardest defect to find.
- The files are versioned in the repository: what runs in production is what was reviewed, with no network dependency at deploy time.
- Dependencies a library requests on its own, such as icon fonts, are part of the registry.
Fonts
A <link> to Google Fonts makes every visitor's browser hand Google the IP address and the page being read, before any consent. c2f assets:fonts finds the fonts the project declares, downloads the files and rewrites the references to the local path, keeping only the alphabets the site uses.
What was left out
The Tailwind compiler used inside the online editor still comes from outside: there is no viable local equivalent. It is a declared exception, not an oversight.
Source: Core · req-143 · BATCH-146, BATCH-148