#cdn 16 articles

• For license information please see … leads to a 404 — the publish step left the bundle's .LICENSE.txt behindgotchas / toolingwebpack moves third-party license comments into .js.LICENSE.txt and leaves only a pointer in the bundle; a publish step that copies *.js, or an allowlist .gitignore, ships the code without the texts MIT and BSD…
• git rm -r leaves the directory behind, so a tool reading the filesystem reports a version nobody servesgotchas / toolingUntracked build leftovers keep a removed version folder alive on disk, so anything listing versions with readdirSync offers a build the site no longer serves; read published content from git ls-tree and fail closed…
• A CDN-hosted extension bundle may only import modules its App Catalog manifest declaresgotchas / spfxReplacing an extension's stable-named bundle on the CDN without a new .sppkg works only while its define([...]) lists modules already in the installed manifest's scriptResources — one new value import and the extension…
• A CDN-hosted SPFx bundle still needs a new .sppkggotchas / spfxincludeClientSideAssets: false moves assets, not versioning; the manifest pins a content-hashed filename, so old packages never request the new bundle
• A GitHub Pages CDN without .nojekyll freezes on its last good buildgotchas / toolingBranch builds run Jekyll unless .nojekyll exists; a growing bundle host ended in a bare "Page build failed." while the site kept serving the old build — read /pages/builds before pushing again
• A library component loaded from your own manifest fetches its lazy chunks from that manifest's foldergotchas / spfxSPComponentLoader.loadComponent + a relocated manifest: without the chunk.* files next to the bundle every import() 404s on first use, which an open-the-app smoke test never exercises
• A retention window computed from git history deletes the file you overwrite in placegotchas / toolingA stable loader keeps its add date and drifts out of "the last N releases"; protect by shape (no content hash), and remember the hard 1 GB Pages limit counts the published tree
• An overwritten script with a stable name keeps serving the old codegotchas / spfxmax-age=600 on GitHub Pages, a memory cache shared by same-site tabs and SharePoint's service worker; keep stable files thin, test with cache: 'reload' and every tab closed, and don't read transferSize of a…
• An SPFx chunk's file name is not its content — realContentHash is offgotchas / spfxSPFx builds with realContentHash: false, so a byte-identical chunk can get a new name (measured) and nothing rules out the reverse; deduplicate by bytes or git blob and never overwrite a published file
• Cache-Control on a dynamic endpoint is an edge layer you can't invalidategotchas / azure-functionsmax-age on a live aggregate lets a shared cache hold the response keyed by URL; neither an app restart nor deleting the underlying data clears it, only expiry — serve dynamic data no-store, cache server-side, and have…
• CDN pruning deleted the extension bundle the deployed .sppkg still referencedgotchas / spfxWith includeClientSideAssets: false the catalog pins hashed names for customizers and command sets too; a "keep N newest" prune evicts the referenced hash and the extension 404s for days — protect extension bundles by…
• List and library pages run a stale extension bundle from Cache Storage for daysgotchas / spfxStable (unhashed) bundle URL = list and library pages can run a days-old copy from the Lists app's own Cache Storage (Lists-odsp-web-prod_*), whatever Cache-Control says; keep the stable file a tiny loader and load…
• Manifest SRI does not cover scripts your SPFx bundle loads itself (pdf.js, tesseract.js, workers)gotchas / spfxPinning the loader in the .sppkg and giving every manifest path and webpack chunk an integrity hash still leaves a hole – third-party libraries your own code injects with a script tag, fetches for a worker or that a…
• Moving a static CDN off GitHub Pages without breaking the apps that load from itgotchas / toolingUpload git blobs, not a Windows working tree (CRLF breaks SRI); allow the new CA in CAA; missing files must stay 404, not 403; Azure static website has no CORS and Front Door ignores the query string by default…
• Polling the manifest proves nothing — a static host serves the small file firstgotchas / spfxA static host publishes the small manifest before the large entry bundle, so the component loads nothing and logs nothing; and an A/B against the previously deployed version compares deploy age, not code (+ a 503 on…
• SPFx adds Subresource Integrity to a script when the manifest path is { path, integrity }gotchas / spfxA component manifest you pass to SPComponentLoader.loadComponent can carry an SRI hash per script resource as path { path, integrity }; SharePoint then emits script integrity crossorigin=anonymous and the browser…