chore: add SRI and security attributes to CDN assets

j4y · j4y · commit 74f282eed4d2 · 2025-12-26T11:45:29.000-05:00
- remove deprecated X-UA-Compatible meta tag
- add integrity, crossorigin, and referrerpolicy to GitHub ribbon CSS
- add integrity, crossorigin, and referrerpolicy to jQuery CDN script
- modernize external resource loading for improved security and CodeQL compliance
diff --git a/_includes/head.html b/_includes/head.html
@@ -1,6 +1,5 @@
 <head>
   <meta charset="utf-8" />
-  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="author" content="Jay Prall" />
   <meta name="robots" content="follow" />
@@ -11,8 +10,18 @@
   <link rel="stylesheet" href="{{ "/css/main.css" | prepend: site.baseurl }}">
   <link rel="canonical" href="{{ page.url | replace:'index.html','' | prepend: site.baseurl | prepend: site.url }}">
   <link rel="alternate" type="application/rss+xml" title="{{ site.title }}" href="{{ "/feed.xml" | prepend: site.baseurl | prepend: site.url }}" />
-  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/github-fork-ribbon-css/0.2.3/gh-fork-ribbon.min.css" />
 
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js" type="text/javascript"></script>
+  <link
+    rel="stylesheet"
+    href="https://cdnjs.cloudflare.com/ajax/libs/github-fork-ribbon-css/0.2.3/gh-fork-ribbon.min.css"
+    integrity="sha512-1JtYwcmBHQYaWV7k/akdUSHhDuD1ynjUTduVdJN9WewtG/XAIN5e8wZsM+dAf5BgU984wgKLF6ig84yYI6FzPA=="
+    crossorigin="anonymous"
+    referrerpolicy="no-referrer"
+  />
+  <script
+    src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js"
+    integrity="sha512-3gJwYp8pG+YkYgPp0tY6Yv3tQYVt8i1Cdm42Hcps225y7sY9qsK0kGugHgdGXN53BJ38qJjPR9U1FVLtZLkYBg=="
+    crossorigin="anonymous"
+    referrerpolicy="no-referrer"></script>
   <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
 </head>
