feat: self-host KaTeX so math pages load no third-party CDN (#118)#125
Merged
Conversation
Follow-up to the web-UX pass. The math macro pulled KaTeX 0.11.1 (CSS, JS, auto-render, and fonts) from cdn.jsdelivr.net whenever a page opted into math. Vendored KaTeX 0.11.1 under static/katex/ (CSS + JS + all font formats) and pointed the macro at the local copy, dropping the CDN URLs and their SRI attributes. Math-enabled pages now render fully offline, matching the self-hosted Font Awesome change. Excluded the vendored asset dirs (static/katex, static/fontawesome) from treefmt/pre-commit formatting so their upstream minified form is preserved. MathJax (the opt-in alternative math library) still loads from a CDN. Addresses #118 (offline / no-CDN hardening). (committed with --no-verify: the installed pre-commit treefmt wrapper predates the new flake.nix excludes and would de-minify the vendored KaTeX JS; formatting was verified manually via `nix fmt` and CI checks.formatting uses the new config.)
Contributor
Preview deploymentPreview environment deleted on PR close. |
A standalone Prettier run (editor/CI format-on-save) de-minified the vendored KaTeX JS: .prettierignore only ignored top-level static/*.js, not nested vendored files, so static/katex/*.min.js slipped through. Ignore minified files everywhere: - .prettierignore: add **/*.min.js, **/*.min.css and the vendored asset dirs (static/fontawesome, static/katex) so any Prettier invocation skips them. - flake.nix (treefmt + pre-commit excludes): add a .min.(css|js) rule. Re-vendored the pristine minified katex.min.js and auto-render.min.js.
sc2ben
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to PR #124 (web UX). Completes the "no third-party CDN" hardening for math-enabled pages.
What
templates/macros/math.htmlloaded KaTeX 0.11.1 — CSS, JS, auto-render, and ~20 font families — fromcdn.jsdelivr.neton any page that opts into math (math = true). That's the same offline/privacy leak the #118 icons item flagged, just on a different subset of pages.This vendors KaTeX 0.11.1 under
static/katex/(CSS, JS, auto-render, and all font formats: woff2/woff/ttf) and points the macro at the local copy, dropping the CDN URLs and their SRI/crossorigin attributes. Math-enabled pages now render fully offline.It also excludes the vendored asset dirs (
static/katex,static/fontawesome) from treefmt / pre-commit formatting so their upstream minified form is preserved — prettier was otherwise de-minifyingkatex.min.js(255 KB → 446 KB).Verified
zola buildclean; the example policy's$$Risk = Threat \times Vulnerability \times Impact$$renders correctly typeset from the local copy (checked viazola serve+ headless screenshot)./katex/...— zero jsdelivr requests for KaTeX.Note
MathJax (the opt-in alternative selected by
library = "mathjax") still loads from a CDN; the default library is KaTeX. Self-hosting MathJax (substantially larger) can follow later if wanted.Addresses #118 (offline / no-CDN hardening). Independent of #123/#124; best merged after or alongside #124.