Hacker News Reader

Comment by huskyr | Hacker News Reader

For the most-common use case (people using code.jquery.com/jquery.js), this won't work. That URL always links to the latest version, which updates with every new release, hence invalidating the hash (and the developer's website).

You could argue that a well-educated developer should know that and only use this for tagged releases though.

View on HN

That file is probably going to stay at v1.11.1 forever now: http://blog.jquery.com/2014/07/03/dont-use-jquery-latest-js/

(The blog post talks about /jquery-latest.js, but I'd imagine the same goes for all the version-number-free urls.)

If the jquery version changed, their site could break anyway due to changes in how the library worked.

Could, yes. But in practice this happens very rarely. Breaking the site because a new version is released with an old hash will happen.

Very rarely being every single release? You should not be using a changing library in any production code, you're just asking for problems.

If all you're using jQuery for is a document.querySelectorAll polyfill + the most primitive event handling, you're possibly safe, as those don't change terribly often...but at that point, you should probably be using a different library or a custom build of jQuery.

Unfortunately, it's the people least qualified to assess the safety of using an always-changing version who are most likely to do so.

Reply on news.ycombinator.com