[{"data":1,"prerenderedAt":1595},["ShallowReactive",2],{"page:\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines":3,"all-docs-nav":1051},{"id":4,"title":5,"body":6,"breadcrumb":1026,"dateModified":1036,"datePublished":1036,"description":1037,"extension":1038,"faq":1039,"meta":1044,"navigation":1045,"path":1046,"seo":1047,"slug":12,"stem":1048,"type":1049,"__hash__":1050},"content\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines\u002Findex.md","Auditing npm Dependencies in SSG Pipelines",{"type":7,"value":8,"toc":1007},"minimark",[9,13,26,35,40,57,61,81,155,158,162,183,225,232,262,273,391,395,401,449,460,463,517,521,528,604,611,615,622,652,655,659,662,761,851,855,875,879,919,923,926,930,935,938,942,945,949,952,956,959,963,1003],[10,11,5],"h1",{"id":12},"auditing-npm-dependencies-in-ssg-pipelines",[14,15,16,17,21,22,25],"p",{},"A static site ships no server code, but its build is a program — and most of that program was written by strangers. A fresh Astro project installs around 350 packages; a Docusaurus site over 1,100; a Next.js site with a component library can pass 1,500. Every one of them runs during ",[18,19,20],"code",{},"npm install"," or ",[18,23,24],{},"npm run build",", with read access to the repository and the environment, and with the ability to write into the output that gets deployed to every reader. The npm ecosystem has seen maintainer account takeovers, typosquats and protestware repeatedly; a static site is exposed to all of it.",[14,27,28,29,34],{},"This guide sets up layered controls for a static site's build: deterministic installs, install-script restrictions, vulnerability audits that block what matters, provenance checks, and a review step for new dependencies. It is part of ",[30,31,33],"a",{"href":32},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002F","Security Headers and Hardening for Static Sites",".",[36,37,39],"h2",{"id":38},"prerequisites","Prerequisites",[41,42,43,47,50],"ul",{},[44,45,46],"li",{},"A static site built with npm, pnpm or Yarn, with a committed lockfile.",[44,48,49],{},"CI on GitHub Actions or similar.",[44,51,52,53,56],{},"Someone who owns dependency decisions — usually whoever reviews ",[18,54,55],{},"package.json"," changes.",[36,58,60],{"id":59},"step-1-make-installs-deterministic","Step 1: Make Installs Deterministic",[14,62,63,64,67,68,70,71,73,74,76,77,80],{},"A lockfile pins every transitive package to an exact version and records an integrity hash for its tarball. ",[18,65,66],{},"npm ci"," installs exactly what the lockfile says and fails if ",[18,69,55],{}," and the lockfile disagree; ",[18,72,20],{}," may resolve newer versions within ranges. In CI, always use ",[18,75,66],{}," (or ",[18,78,79],{},"pnpm install --frozen-lockfile",").",[82,83,88],"pre",{"className":84,"code":85,"language":86,"meta":87,"style":87},"language-yaml shiki shiki-themes github-light github-dark","- uses: actions\u002Fsetup-node@v4\n  with: { node-version: 20, cache: npm }\n- run: npm ci --ignore-scripts --no-audit --no-fund\n","yaml","",[18,89,90,110,142],{"__ignoreMap":87},[91,92,95,99,103,106],"span",{"class":93,"line":94},"line",1,[91,96,98],{"class":97},"sVt8B","- ",[91,100,102],{"class":101},"s9eBZ","uses",[91,104,105],{"class":97},": ",[91,107,109],{"class":108},"sZZnC","actions\u002Fsetup-node@v4\n",[91,111,113,116,119,122,124,128,131,134,136,139],{"class":93,"line":112},2,[91,114,115],{"class":101},"  with",[91,117,118],{"class":97},": { ",[91,120,121],{"class":101},"node-version",[91,123,105],{"class":97},[91,125,127],{"class":126},"sj4cs","20",[91,129,130],{"class":97},", ",[91,132,133],{"class":101},"cache",[91,135,105],{"class":97},[91,137,138],{"class":108},"npm",[91,140,141],{"class":97}," }\n",[91,143,145,147,150,152],{"class":93,"line":144},3,[91,146,98],{"class":97},[91,148,149],{"class":101},"run",[91,151,105],{"class":97},[91,153,154],{"class":108},"npm ci --ignore-scripts --no-audit --no-fund\n",[14,156,157],{},"This alone closes the most common attack path: a malicious new version of a transitive dependency cannot enter the build unless someone updates the lockfile, which is a reviewable change.",[36,159,161],{"id":160},"step-2-restrict-install-scripts","Step 2: Restrict Install Scripts",[14,163,164,130,167,170,171,174,175,178,179,182],{},[18,165,166],{},"preinstall",[18,168,169],{},"install"," and ",[18,172,173],{},"postinstall"," scripts run arbitrary code at install time. Most static-site dependencies do not need them. On the Astro site used here, 6 of 412 installed packages declared install scripts, and only 2 were needed (",[18,176,177],{},"sharp"," for image processing and ",[18,180,181],{},"esbuild"," for its platform binary).",[82,184,188],{"className":185,"code":186,"language":187,"meta":87,"style":87},"language-bash shiki shiki-themes github-light github-dark","# list packages with install scripts\nnpm query ':attr(scripts, [postinstall]), :attr(scripts, [install]), :attr(scripts, [preinstall])' \\\n  | jq -r '.[] | \"\\(.name)@\\(.version)\"'\n","bash",[18,189,190,196,210],{"__ignoreMap":87},[91,191,192],{"class":93,"line":94},[91,193,195],{"class":194},"sJ8bj","# list packages with install scripts\n",[91,197,198,201,204,207],{"class":93,"line":112},[91,199,138],{"class":200},"sScJk",[91,202,203],{"class":108}," query",[91,205,206],{"class":108}," ':attr(scripts, [postinstall]), :attr(scripts, [install]), :attr(scripts, [preinstall])'",[91,208,209],{"class":126}," \\\n",[91,211,212,216,219,222],{"class":93,"line":144},[91,213,215],{"class":214},"szBVR","  |",[91,217,218],{"class":200}," jq",[91,220,221],{"class":126}," -r",[91,223,224],{"class":108}," '.[] | \"\\(.name)@\\(.version)\"'\n",[14,226,227,228,231],{},"Install with ",[18,229,230],{},"--ignore-scripts",", then run the needed scripts explicitly:",[82,233,235],{"className":84,"code":234,"language":86,"meta":87,"style":87},"- run: npm ci --ignore-scripts\n- run: npm rebuild sharp esbuild     # the two that genuinely need install scripts\n",[18,236,237,248],{"__ignoreMap":87},[91,238,239,241,243,245],{"class":93,"line":94},[91,240,98],{"class":97},[91,242,149],{"class":101},[91,244,105],{"class":97},[91,246,247],{"class":108},"npm ci --ignore-scripts\n",[91,249,250,252,254,256,259],{"class":93,"line":112},[91,251,98],{"class":97},[91,253,149],{"class":101},[91,255,105],{"class":97},[91,257,258],{"class":108},"npm rebuild sharp esbuild",[91,260,261],{"class":194},"     # the two that genuinely need install scripts\n",[14,263,264,265,268,269,272],{},"pnpm makes this a configuration: ",[18,266,267],{},"onlyBuiltDependencies: [sharp, esbuild]"," in ",[18,270,271],{},"pnpm-workspace.yaml"," runs scripts only for listed packages, and pnpm 10 defaults to not running them at all.",[274,275,276,387],"figure",{},[277,278,285,286,285,290,285,294,285,301],"svg",{"viewBox":279,"role":280,"ariaLabelledBy":281,"xmlns":284},"0 0 760 280","img",[282,283],"npm-layers-title","npm-layers-desc","http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg","\n  ",[287,288,289],"title",{"id":282},"Layers of dependency controls",[291,292,293],"desc",{"id":283},"Five concentric layers. The outermost is review of new direct dependencies. Next, a lockfile with integrity hashes and npm ci. Then install scripts disabled except for an allow-list. Then an audit gate for high and critical advisories. The innermost is keeping deploy credentials out of the install and build steps entirely.",[295,296],"rect",{"x":297,"y":297,"width":298,"height":299,"fill":300},"0","760","280","#ffffff",[302,303,305,306,305,314,305,324,305,330,305,338,305,343,305,353,305,358,305,368,305,372,305,382,285],"g",{"style":304},"font-family:system-ui, sans-serif;font-size:12px","\n    ",[307,308,313],"text",{"x":309,"y":310,"fill":311,"style":312},"380","28","#1f2937","font-size:16px;font-weight:700;text-anchor:middle","Each layer catches what the one before it misses",[295,315],{"x":316,"y":317,"width":318,"height":319,"rx":320,"fill":321,"opacity":322,"stroke":321,"style":323},"40","46","680","214","16","#1982c4","0.06","stroke-width:1.5px",[307,325,329],{"x":326,"y":327,"fill":311,"style":328},"60","68","font-weight:700","review new direct dependencies",[295,331],{"x":332,"y":332,"width":333,"height":334,"rx":335,"fill":336,"opacity":337,"stroke":336,"style":323},"80","600","170","14","#6a4c93","0.07",[307,339,342],{"x":340,"y":341,"fill":311,"style":328},"100","102","lockfile + integrity hashes + npm ci",[295,344],{"x":345,"y":346,"width":347,"height":348,"rx":349,"fill":350,"opacity":351,"stroke":352,"style":323},"120","114","520","126","12","#ffca3a","0.12","#a97b00",[307,354,357],{"x":355,"y":356,"fill":311,"style":328},"140","136","install scripts off, allow-list of 2",[295,359],{"x":360,"y":361,"width":362,"height":363,"rx":364,"fill":365,"opacity":366,"stroke":367,"style":323},"160","148","440","82","10","#ff595e","0.08","#d83b41",[307,369,371],{"x":370,"y":334,"fill":311,"style":328},"180","audit gate: high\u002Fcritical in shipped code",[295,373],{"x":374,"y":375,"width":376,"height":377,"rx":378,"fill":379,"opacity":380,"stroke":381,"style":323},"200","182","360","38","8","#8ac926","0.2","#5a8a16",[307,383,386],{"x":309,"y":384,"fill":311,"style":385},"206","font-weight:700;text-anchor:middle","no deploy credentials during install\u002Fbuild",[388,389,390],"figcaption",{},"No single layer is sufficient; together they make a compromised package both less likely to arrive and less able to do harm if it does.",[36,392,394],{"id":393},"step-3-audit-and-block-on-what-matters","Step 3: Audit, and Block on What Matters",[14,396,397,400],{},[18,398,399],{},"npm audit"," compares installed versions with the GitHub advisory database. Run it in CI, but configure what blocks: a static build uses many packages only at build time, and an advisory about, say, a regular-expression denial of service in a dev server does not affect the generated site. Blocking on every finding teaches the team to ignore the check.",[82,402,404],{"className":84,"code":403,"language":86,"meta":87,"style":87},"- name: Audit production dependency tree\n  run: npm audit --omit=dev --audit-level=high\n- name: Audit everything (report only)\n  run: npm audit --audit-level=critical || true\n",[18,405,406,418,428,439],{"__ignoreMap":87},[91,407,408,410,413,415],{"class":93,"line":94},[91,409,98],{"class":97},[91,411,412],{"class":101},"name",[91,414,105],{"class":97},[91,416,417],{"class":108},"Audit production dependency tree\n",[91,419,420,423,425],{"class":93,"line":112},[91,421,422],{"class":101},"  run",[91,424,105],{"class":97},[91,426,427],{"class":108},"npm audit --omit=dev --audit-level=high\n",[91,429,430,432,434,436],{"class":93,"line":144},[91,431,98],{"class":97},[91,433,412],{"class":101},[91,435,105],{"class":97},[91,437,438],{"class":108},"Audit everything (report only)\n",[91,440,442,444,446],{"class":93,"line":441},4,[91,443,422],{"class":101},[91,445,105],{"class":97},[91,447,448],{"class":108},"npm audit --audit-level=critical || true\n",[14,450,451,452,455,456,459],{},"For static sites, \"production dependencies\" still means build-time code — the generator, its plugins and anything bundled into the output. Move tooling that never touches output (linters, test runners, formatters) into ",[18,453,454],{},"devDependencies"," so ",[18,457,458],{},"--omit=dev"," narrows the blocking audit to code that shapes what readers receive.",[14,461,462],{},"Supplement the advisory database with a tool that checks for signs of malice rather than known CVEs — install scripts that make network requests, obfuscated code, recently transferred ownership. GitHub's dependency review action does this for pull requests:",[82,464,466],{"className":84,"code":465,"language":86,"meta":87,"style":87},"- uses: actions\u002Fdependency-review-action@v4\n  with:\n    fail-on-severity: high\n    deny-licenses: GPL-3.0, AGPL-3.0\n    comment-summary-in-pr: always\n",[18,467,468,479,486,496,506],{"__ignoreMap":87},[91,469,470,472,474,476],{"class":93,"line":94},[91,471,98],{"class":97},[91,473,102],{"class":101},[91,475,105],{"class":97},[91,477,478],{"class":108},"actions\u002Fdependency-review-action@v4\n",[91,480,481,483],{"class":93,"line":112},[91,482,115],{"class":101},[91,484,485],{"class":97},":\n",[91,487,488,491,493],{"class":93,"line":144},[91,489,490],{"class":101},"    fail-on-severity",[91,492,105],{"class":97},[91,494,495],{"class":108},"high\n",[91,497,498,501,503],{"class":93,"line":441},[91,499,500],{"class":101},"    deny-licenses",[91,502,105],{"class":97},[91,504,505],{"class":108},"GPL-3.0, AGPL-3.0\n",[91,507,509,512,514],{"class":93,"line":508},5,[91,510,511],{"class":101},"    comment-summary-in-pr",[91,513,105],{"class":97},[91,515,516],{"class":108},"always\n",[36,518,520],{"id":519},"step-4-review-new-dependencies","Step 4: Review New Dependencies",[14,522,523,524,527],{},"Most risk enters through a new direct dependency, which brings its own transitive tree. Make adding one a deliberate decision with a short checklist in the pull request template: what does it do, could a few lines of our own code replace it, how many transitive packages does it add, is it maintained, does it declare install scripts. The dependency review action's comment shows the added tree size; on this site, a date-formatting library proposed for one component would have added 31 transitive packages, and ",[18,525,526],{},"Intl.DateTimeFormat"," did the job instead.",[274,529,530,601],{},[277,531,285,536,285,539,285,542,285,545],{"viewBox":532,"role":280,"ariaLabelledBy":533,"xmlns":284},"0 0 760 230",[534,535],"npm-age-title","npm-age-desc",[287,537,538],{"id":534},"Why a minimum release age helps",[291,540,541],{"id":535},"A timeline for a malicious package version. It is published on day 0, typically detected and unpublished within one to three days. An update bot with no delay opens a pull request on day 0, inside the danger window. A bot with a three-day minimum release age opens its pull request on day 3, after most malicious versions have already been removed.",[295,543],{"x":297,"y":297,"width":298,"height":544,"fill":300},"230",[302,546,305,547,305,550,305,554,305,561,305,566,305,570,305,575,305,578,305,585,305,588,305,593,305,597,285],{"style":304},[307,548,549],{"x":309,"y":310,"fill":311,"style":312},"Let the ecosystem vet a release before you install it",[93,551],{"x1":326,"y1":334,"x2":552,"y2":334,"stroke":553,"style":323},"720","#556071",[295,555],{"x":332,"y":556,"width":557,"height":316,"rx":558,"fill":365,"opacity":559,"stroke":367,"style":560},"70","240","6","0.14","stroke-width:1px",[307,562,565],{"x":374,"y":563,"fill":564,"style":385},"95","#b32b30","typical detection window, days 0–3",[567,568],"circle",{"cx":332,"cy":334,"r":569,"fill":365,"stroke":367,"style":323},"7",[307,571,574],{"x":332,"y":572,"fill":553,"style":573},"192","font-size:11px;text-anchor:middle","publish",[567,576],{"cx":577,"cy":355,"r":569,"fill":350,"stroke":352,"style":323},"90",[307,579,584],{"x":580,"y":581,"fill":582,"style":583},"104","144","#8a6d0f","font-size:11px;font-weight:700","bot, no delay",[567,586],{"cx":587,"cy":355,"r":569,"fill":379,"stroke":381,"style":323},"330",[307,589,592],{"x":590,"y":581,"fill":591,"style":583},"344","#3f6410","bot, 3-day minimum age",[307,594,596],{"x":595,"y":572,"fill":553,"style":573},"320","day 3",[307,598,600],{"x":599,"y":572,"fill":553,"style":573},"700","day 14",[388,602,603],{},"Three days of patience costs almost nothing for a documentation site and skips the riskiest part of a release's life.",[14,605,606,607,610],{},"Delay routine updates slightly. Most malicious versions are detected and unpublished within days. Configuring the update bot with a minimum release age (Renovate's ",[18,608,609],{},"minimumReleaseAge: \"3 days\"",") means the site rarely installs a version in its first, most dangerous window.",[36,612,614],{"id":613},"step-5-check-provenance-where-available","Step 5: Check Provenance Where Available",[14,616,617,618,621],{},"npm packages published from GitHub Actions can carry signed provenance attestations linking the tarball to the source commit and workflow that built it. ",[18,619,620],{},"npm audit signatures"," verifies registry signatures and provenance for installed packages:",[82,623,625],{"className":185,"code":624,"language":187,"meta":87,"style":87},"npm audit signatures\n# audited 412 packages in 3s\n# 412 packages have verified registry signatures\n# 118 packages have verified attestations\n",[18,626,627,637,642,647],{"__ignoreMap":87},[91,628,629,631,634],{"class":93,"line":94},[91,630,138],{"class":200},[91,632,633],{"class":108}," audit",[91,635,636],{"class":108}," signatures\n",[91,638,639],{"class":93,"line":112},[91,640,641],{"class":194},"# audited 412 packages in 3s\n",[91,643,644],{"class":93,"line":144},[91,645,646],{"class":194},"# 412 packages have verified registry signatures\n",[91,648,649],{"class":93,"line":441},[91,650,651],{"class":194},"# 118 packages have verified attestations\n",[14,653,654],{},"Provenance does not make a package trustworthy, but it makes certain attacks — a tarball published from a stolen token rather than from the project's CI — visible. Track the count over time and investigate when a previously attested package publishes a version without attestation.",[36,656,658],{"id":657},"measured-impact","Measured Impact",[14,660,661],{},"The Astro documentation site after applying all five steps, compared with its state before:",[663,664,665,681],"table",{},[666,667,668],"thead",{},[669,670,671,675,678],"tr",{},[672,673,674],"th",{},"Measure",[672,676,677],{},"Before",[672,679,680],{},"After",[682,683,684,700,710,719,729,740,750],"tbody",{},[669,685,686,690,694],{},[687,688,689],"td",{},"Install command in CI",[687,691,692],{},[18,693,20],{},[687,695,696,699],{},[18,697,698],{},"npm ci --ignore-scripts"," + 2 rebuilds",[669,701,702,705,707],{},[687,703,704],{},"Packages allowed to run install scripts",[687,706,558],{},[687,708,709],{},"2",[669,711,712,715,717],{},[687,713,714],{},"Blocking audit findings (high\u002Fcritical, shipped code)",[687,716,569],{},[687,718,297],{},[669,720,721,724,726],{},[687,722,723],{},"Direct dependencies",[687,725,377],{},[687,727,728],{},"29",[669,730,731,734,737],{},[687,732,733],{},"Total installed packages",[687,735,736],{},"412",[687,738,739],{},"331",[669,741,742,745,747],{},[687,743,744],{},"Deploy tokens present during install\u002Fbuild",[687,746,709],{},[687,748,749],{},"0 (see OIDC)",[669,751,752,755,758],{},[687,753,754],{},"CI time added by checks",[687,756,757],{},"—",[687,759,760],{},"14 s",[274,762,763,848],{},[277,764,285,769,285,772,285,775,285,778],{"viewBox":765,"role":280,"ariaLabelledBy":766,"xmlns":284},"0 0 760 260",[767,768],"npm-tree-title","npm-tree-desc",[287,770,771],{"id":767},"Dependency tree size before and after review",[291,773,774],{"id":768},"Bars showing direct dependencies falling from 38 to 29 and total installed packages from 412 to 331 after removing unused and replaceable dependencies. Packages with install scripts fell from 6 to 2.",[295,776],{"x":297,"y":297,"width":298,"height":777,"fill":300},"260",[302,779,305,780,305,783,305,788,305,793,305,797,305,801,305,805,305,808,305,812,305,816,305,820,305,824,305,828,305,831,305,836,305,840,305,844,285],{"style":304},[307,781,782],{"x":309,"y":310,"fill":311,"style":312},"Less code in the build is less code to trust",[307,784,787],{"x":785,"y":786,"fill":311,"style":328},"30","76","Total packages",[295,789],{"x":790,"y":326,"width":736,"height":127,"rx":791,"fill":365,"opacity":792,"stroke":367,"style":560},"210","4","0.25",[307,794,736],{"x":795,"y":796,"fill":311},"630","75",[295,798],{"x":790,"y":799,"width":739,"height":127,"rx":791,"fill":379,"opacity":800,"stroke":381,"style":560},"84","0.35",[307,802,739],{"x":803,"y":804,"fill":591,"style":328},"549","99",[307,806,723],{"x":785,"y":807,"fill":311,"style":328},"146",[295,809],{"x":790,"y":810,"width":811,"height":127,"rx":791,"fill":365,"opacity":792,"stroke":367,"style":560},"130","152",[307,813,377],{"x":814,"y":815,"fill":311},"370","145",[295,817],{"x":790,"y":818,"width":819,"height":127,"rx":791,"fill":379,"opacity":800,"stroke":381,"style":560},"154","116",[307,821,728],{"x":822,"y":823,"fill":591,"style":328},"334","169",[307,825,827],{"x":785,"y":826,"fill":311,"style":328},"216","With install scripts",[295,829],{"x":790,"y":374,"width":830,"height":127,"rx":791,"fill":365,"opacity":792,"stroke":367,"style":560},"24",[307,832,835],{"x":833,"y":834,"fill":311},"242","215","6 →",[295,837],{"x":838,"y":374,"width":378,"height":127,"rx":709,"fill":379,"opacity":839,"stroke":381,"style":560},"270","0.5",[307,841,843],{"x":842,"y":834,"fill":591,"style":328},"286","2 allowed",[307,845,847],{"x":309,"y":846,"fill":553,"style":573},"248","npm ls --all, before and after a dependency review of the Astro docs site",[388,849,850],{},"Nine removed direct dependencies took 81 transitive packages with them — the cheapest security improvement in the whole exercise.",[36,852,854],{"id":853},"where-the-build-can-reach","Where the Build Can Reach",[14,856,857,858,862,863,866,867,870,871,874],{},"The final control is about blast radius rather than detection. Even with every check above, assume a malicious package might one day run in the build. What can it reach? If the deploy token sits in the job's environment from the first step, the answer is \"every page on the site\". Moving credentials so they exist only in a separate deploy job — one that installs nothing and runs no third-party code — limits a compromised build to producing a bad artifact, which review, smoke tests and rollback can catch. That separation is the subject of ",[30,859,861],{"href":860},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc\u002F","Securing Deploy Credentials with GitHub OIDC",". The build job's ",[18,864,865],{},"permissions"," block should also be minimal — ",[18,868,869],{},"contents: read"," — so the ",[18,872,873],{},"GITHUB_TOKEN"," cannot push commits or create releases.",[36,876,878],{"id":877},"pitfalls-rollback","Pitfalls & Rollback",[41,880,881,892,898,904,910],{},[44,882,883,889,890,34],{},[884,885,886,888],"strong",{},[18,887,20],{}," in CI."," It can resolve versions the lockfile never recorded. Use ",[18,891,66],{},[44,893,894,897],{},[884,895,896],{},"Blocking on every advisory."," Dev-only and unreachable findings create alert fatigue. Block on high and critical in shipped code; report the rest.",[44,899,900,903],{},[884,901,902],{},"Auto-merging updates on release day."," Add a minimum release age so new versions have time to be vetted.",[44,905,906,909],{},[884,907,908],{},"Secrets in the build job."," An install-time compromise can read them. Keep credentials in a separate deploy job.",[44,911,912,915,916,918],{},[884,913,914],{},"Rollback:"," each control is a CI step or a config line. Removing ",[18,917,230],{}," or the audit step restores previous behaviour instantly; the lockfile itself should never be rolled back to an unpinned state.",[36,920,922],{"id":921},"conclusion","Conclusion",[14,924,925],{},"A static site's build is the part of the stack an attacker can actually reach, and it runs hundreds of packages nobody on the team wrote. Deterministic installs, an allow-list for install scripts, an audit gate focused on shipped code, provenance checks, a review step for new dependencies and credentials kept out of the build together turn that risk from open-ended into bounded. On this site the controls added 14 seconds to CI, removed 81 packages from the tree and left no long-lived secret within reach of third-party code.",[36,927,929],{"id":928},"faq","FAQ",[931,932,934],"h3",{"id":933},"why-do-static-sites-need-dependency-auditing","Why do static sites need dependency auditing?",[14,936,937],{},"Because the build runs hundreds of third-party packages with access to the repository, the environment and often deploy credentials. A compromised package can inject code into every generated page or steal a token, even though nothing runs on a server afterwards.",[931,939,941],{"id":940},"does-npm-audit-catch-malicious-packages","Does npm audit catch malicious packages?",[14,943,944],{},"Only after they are reported and added to the advisory database. It catches known vulnerabilities well but cannot detect a freshly published malicious version. Lockfiles, delayed updates and install-script restrictions cover that gap.",[931,946,948],{"id":947},"should-i-disable-install-scripts-entirely","Should I disable install scripts entirely?",[14,950,951],{},"Where possible, yes. Run npm ci with --ignore-scripts and allow scripts only for the few packages that genuinely need them, such as native image tools. Most static site dependencies need no install scripts at all.",[931,953,955],{"id":954},"how-many-audit-findings-should-block-a-build","How many audit findings should block a build?",[14,957,958],{},"Block on high and critical advisories that affect code which actually runs, and on any new dependency that has not been reviewed. Many advisories in build-only tooling are not exploitable in a static build; triage those rather than letting them block every merge.",[36,960,962],{"id":961},"related","Related",[41,964,965,974,979,989,996],{},[44,966,967,970,971,973],{},[884,968,969],{},"Parent:"," ",[30,972,33],{"href":32}," — the edge and pipeline controls together.",[44,975,976,978],{},[30,977,861],{"href":860}," — limiting what a compromised build can reach.",[44,980,981,985,986,988],{},[30,982,984],{"href":983},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fcaching-node-modules-in-github-actions-for-faster-ssg-builds\u002F","Caching node_modules in GitHub Actions for Faster SSG Builds"," — keeping ",[18,987,66],{}," fast.",[44,990,991,995],{},[30,992,994],{"href":993},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fupgrading-jekyll-and-ruby-versions-safely\u002F","Upgrading Jekyll and Ruby Versions Safely"," — the same discipline for Ruby gems.",[44,997,998,1002],{},[30,999,1001],{"href":1000},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Ftracking-bundle-size-per-pull-request\u002F","Tracking Bundle Size per Pull Request"," — another reason to question each new dependency.",[1004,1005,1006],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}",{"title":87,"searchDepth":112,"depth":112,"links":1008},[1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1025],{"id":38,"depth":112,"text":39},{"id":59,"depth":112,"text":60},{"id":160,"depth":112,"text":161},{"id":393,"depth":112,"text":394},{"id":519,"depth":112,"text":520},{"id":613,"depth":112,"text":614},{"id":657,"depth":112,"text":658},{"id":853,"depth":112,"text":854},{"id":877,"depth":112,"text":878},{"id":921,"depth":112,"text":922},{"id":928,"depth":112,"text":929,"children":1020},[1021,1022,1023,1024],{"id":933,"depth":144,"text":934},{"id":940,"depth":144,"text":941},{"id":947,"depth":144,"text":948},{"id":954,"depth":144,"text":955},{"id":961,"depth":112,"text":962},[1027,1030,1033,1034],{"name":1028,"item":1029},"Home","\u002F",{"name":1031,"item":1032},"Production-Ready Deployment & CI\u002FCD Workflows","\u002Fproduction-ready-deployment-cicd-workflows\u002F",{"name":33,"item":32},{"name":5,"item":1035},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines\u002F","2026-09-18","Reduce supply-chain risk in a static site build: lockfiles, npm ci, install-script controls, audit gates, provenance checks and a review step for new packages.","md",[1040,1041,1042,1043],{"q":934,"a":937},{"q":941,"a":944},{"q":948,"a":951},{"q":955,"a":958},{},true,"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines",{"title":5,"description":1037},"production-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines\u002Findex","article","R_QiU965iIDy9TW0C5gkJ1zd8fwzA4mSLolSGmJ-Sro",[1052,1055,1058,1061,1064,1067,1070,1073,1076,1079,1082,1085,1088,1091,1094,1097,1100,1103,1106,1109,1112,1115,1118,1121,1124,1127,1129,1132,1135,1138,1141,1144,1147,1150,1153,1156,1159,1162,1165,1168,1171,1174,1177,1180,1183,1186,1189,1192,1195,1198,1201,1204,1207,1210,1213,1216,1219,1222,1225,1228,1231,1234,1237,1240,1243,1246,1249,1252,1255,1258,1261,1264,1267,1270,1273,1276,1279,1282,1285,1288,1291,1294,1297,1300,1303,1306,1309,1312,1315,1318,1321,1324,1327,1330,1333,1336,1339,1342,1345,1347,1350,1353,1356,1359,1362,1365,1368,1371,1374,1377,1380,1383,1386,1389,1392,1395,1398,1401,1404,1407,1410,1413,1416,1419,1422,1425,1428,1431,1434,1437,1440,1443,1446,1449,1452,1455,1458,1461,1464,1467,1470,1473,1476,1479,1482,1485,1488,1491,1494,1497,1500,1503,1506,1509,1512,1515,1518,1521,1524,1527,1530,1533,1536,1539,1540,1543,1546,1548,1550,1553,1556,1559,1562,1565,1568,1571,1574,1577,1580,1583,1586,1589,1592],{"path":1053,"title":1054},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fastro-vs-eleventy-build-times-at-10000-pages","Astro vs Eleventy Build Times at 10,000 Pages",{"path":1056,"title":1057},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fchoosing-between-astro-and-eleventy-for-large-docs","Astro vs Eleventy for Large Docs (1000+ Pages)",{"path":1059,"title":1060},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fcontent-collections-vs-eleventy-data-cascade","Content Collections vs the Eleventy Data Cascade",{"path":1062,"title":1063},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites","Astro vs Eleventy for Documentation Sites",{"path":1065,"title":1066},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fshortcodes-vs-components-for-docs-authors","Shortcodes vs Components for Docs Authors",{"path":1068,"title":1069},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fsidebar-navigation-in-astro-and-eleventy","Sidebar Navigation in Astro and Eleventy",{"path":1071,"title":1072},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fcustomizing-starlight-without-forking-the-theme","Customizing Starlight Without Forking the Theme",{"path":1074,"title":1075},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fdocusaurus-vs-starlight-for-product-documentation","Docusaurus vs Starlight for Product Documentation",{"path":1077,"title":1078},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress","Docs Frameworks: Docusaurus, Starlight and VitePress",{"path":1080,"title":1081},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmdx-vs-markdoc-for-docs-content","MDX vs Markdoc for Docs Content",{"path":1083,"title":1084},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmigrating-from-mkdocs-to-starlight","Migrating from MkDocs to Starlight",{"path":1086,"title":1087},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fversioned-documentation-with-docusaurus","Versioned Documentation with Docusaurus",{"path":1089,"title":1090},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fvitepress-for-library-documentation","VitePress for Library Documentation",{"path":1092,"title":1093},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhow-to-benchmark-hugo-vs-astro-build-speeds","How to Benchmark Hugo vs Astro Build Speeds",{"path":1095,"title":1096},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhugo-partialcached-for-faster-builds","Hugo partialCached for Faster Builds",{"path":1098,"title":1099},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories","Hugo Build Times for Large Repositories",{"path":1101,"title":1102},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fprofiling-hugo-templates-with-template-metrics","Profiling Hugo Templates With Template Metrics",{"path":1104,"title":1105},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Freducing-hugo-memory-usage-on-ci-runners","Reducing Hugo Memory Usage on CI Runners",{"path":1107,"title":1108},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fspeeding-up-hugo-builds-with-render-hooks-and-caching","Speeding Up Hugo Builds with Render Hooks & Caching",{"path":1110,"title":1111},"\u002Fchoosing-the-right-static-site-generator-for-production","Choosing the Right Static Site Generator for Production",{"path":1113,"title":1114},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Feleventy-vs-jekyll-for-markdown-heavy-blogs","Eleventy vs Jekyll for Markdown-Heavy Blogs",{"path":1116,"title":1117},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem","Jekyll Plugin Ecosystem",{"path":1119,"title":1120},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Freplacing-jekyll-plugins-when-migrating-to-eleventy","Replacing Jekyll Plugins When Migrating to Eleventy",{"path":1122,"title":1123},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Frunning-jekyll-on-github-pages-without-plugins","Running Jekyll on GitHub Pages Without Plugins",{"path":1125,"title":1126},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fspeeding-up-slow-jekyll-builds","Speeding Up Slow Jekyll Builds",{"path":1128,"title":994},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fupgrading-jekyll-and-ruby-versions-safely",{"path":1130,"title":1131},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fconverting-front-matter-at-scale-during-migration","Converting Front Matter at Scale During Migration",{"path":1133,"title":1134},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators","Migrating Between Static Site Generators",{"path":1136,"title":1137},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fkeeping-redirects-working-after-an-ssg-migration","Keeping Redirects Working After an SSG Migration",{"path":1139,"title":1140},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-a-docs-site-from-jekyll-to-hugo","Migrating a Docs Site From Jekyll to Hugo",{"path":1142,"title":1143},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-gatsby-to-astro","Migrating from Gatsby to Astro",{"path":1145,"title":1146},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-hugo-to-astro-without-breaking-urls","Migrating From Hugo to Astro Without Breaking URLs",{"path":1148,"title":1149},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-wordpress-to-a-static-site-generator","Migrating WordPress to a Static Site Generator",{"path":1151,"title":1152},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fporting-shortcodes-and-includes-between-generators","Porting Shortcodes and Includes Between Generators",{"path":1154,"title":1155},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fhandling-dynamic-routes-in-nextjs-static-export","Handling Dynamic Routes in Next.js Static Export",{"path":1157,"title":1158},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites","Next.js Static Export for Content Sites",{"path":1160,"title":1161},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fmigrating-from-gatsby-to-nextjs-static-export","Migrating from Gatsby to Next.js Static Export",{"path":1163,"title":1164},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-app-router-static-export-limitations","Next.js App Router Static Export Limitations",{"path":1166,"title":1167},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-static-export-vs-astro-for-marketing-sites","Next.js Static Export vs Astro for Marketing",{"path":1169,"title":1170},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Foptimizing-images-in-nextjs-static-export","Optimizing Images in Next.js Static Export",{"path":1172,"title":1173},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fadding-pagefind-to-an-astro-site","Adding Pagefind to an Astro Site",{"path":1175,"title":1176},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fbuilding-a-lunr-index-at-build-time-in-eleventy","Building a Lunr Index at Build Time in Eleventy",{"path":1178,"title":1179},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites","Search for Static Sites",{"path":1181,"title":1182},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Findexing-hugo-sites-with-pagefind","Indexing Hugo Sites with Pagefind",{"path":1184,"title":1185},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fmultilingual-search-on-static-sites","Multilingual Search on Static Sites",{"path":1187,"title":1188},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fpagefind-vs-algolia-docsearch","Pagefind vs Algolia DocSearch",{"path":1190,"title":1191},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fsearch-index-size-budgets-for-large-docs","Search Index Size Budgets for Large Docs",{"path":1193,"title":1194},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fbest-ssg-for-technical-writers-without-coding-experience","Best SSG for Non-Developer Technical Writers",{"path":1196,"title":1197},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fchoosing-an-ssg-for-api-reference-documentation","Choosing an SSG for API Reference Documentation",{"path":1199,"title":1200},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fevaluating-ssg-accessibility-defaults","Evaluating SSG Accessibility Defaults",{"path":1202,"title":1203},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix","SSG Framework Selection Matrix",{"path":1205,"title":1206},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fpicking-an-ssg-for-a-multi-language-documentation-site","Picking an SSG for a Multi-Language Docs Site",{"path":1208,"title":1209},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fssg-selection-checklist-for-engineering-teams","SSG Selection Checklist for Engineering Teams",{"path":1211,"title":1212},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Ftotal-cost-of-ownership-for-static-site-generators","Total Cost of Ownership for Static Site Generators",{"path":1214,"title":1215},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fcache-busting-with-content-hashed-filenames","Cache Busting with Content-Hashed Filenames",{"path":1217,"title":1218},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs","CDN Caching Rules for SSGs",{"path":1220,"title":1221},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fpurging-the-cdn-cache-after-a-static-deploy","Purging the CDN Cache After a Static Deploy",{"path":1223,"title":1224},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-cache-control-headers-on-cloudflare-pages","Cache-Control Headers on Cloudflare Pages",{"path":1226,"title":1227},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-up-proper-cache-headers-on-netlify","Proper Cache Headers on Netlify for SSGs",{"path":1229,"title":1230},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fstale-while-revalidate-for-static-html","Stale-While-Revalidate for Static HTML",{"path":1232,"title":1233},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Feliminating-layout-shift-from-web-fonts","Eliminating Layout Shift From Web Fonts",{"path":1235,"title":1236},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-cookie-banners","Fixing CLS from Cookie Banners",{"path":1238,"title":1239},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-late-loading-embeds","Fixing CLS From Late-Loading Embeds",{"path":1241,"title":1242},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-sticky-headers-and-anchor-links","Fixing CLS from Sticky Headers and Anchor Links",{"path":1244,"title":1245},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites","Cumulative Layout Shift Fixes for Static Sites",{"path":1247,"title":1248},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Fmeasuring-cls-in-the-field-with-web-vitals-js","Measuring CLS in the Field With web-vitals.js",{"path":1250,"title":1251},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Freserving-space-for-images-and-embeds-to-stop-layout-shift","Reserving Space for Images and Embeds",{"path":1253,"title":1254},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Ffont-display-optional-vs-swap","font-display: optional vs swap",{"path":1256,"title":1257},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites","Font Loading Strategies for Static Sites",{"path":1259,"title":1260},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fmetric-matched-fallback-fonts-with-size-adjust","Metric-Matched Fallback Fonts with size-adjust",{"path":1262,"title":1263},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fpreloading-fonts-without-double-downloads","Preloading Fonts Without Double Downloads",{"path":1265,"title":1266},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fself-hosting-google-fonts-to-eliminate-layout-shift","Self-Host Google Fonts to Eliminate Layout Shift",{"path":1268,"title":1269},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fsubsetting-variable-fonts-for-faster-first-render","Subsetting Variable Fonts for Faster First Render",{"path":1271,"title":1272},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fbuilding-an-image-cdn-pipeline-for-static-sites","Building an Image CDN Pipeline for Static Sites",{"path":1274,"title":1275},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fgenerating-open-graph-images-at-build-time","Generating Open Graph Images at Build Time",{"path":1277,"title":1278},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro","Image Optimization Pipelines in Astro",{"path":1280,"title":1281},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Flazy-loading-images-without-hurting-lcp","Lazy-Loading Images Without Hurting LCP",{"path":1283,"title":1284},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Foptimizing-webp-images-in-hugo-without-plugins","Optimizing WebP Images in Hugo Without Plugins",{"path":1286,"title":1287},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fresponsive-images-with-srcset-in-eleventy","Responsive Images with srcset in Eleventy",{"path":1289,"title":1290},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fserving-avif-with-fallbacks-on-static-sites","Serving AVIF With Fallbacks on Static Sites",{"path":1292,"title":1293},"\u002Fperformance-optimization-core-web-vitals-for-ssgs","Core Web Vitals Optimization for SSGs",{"path":1295,"title":1296},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fastro-islands-vs-full-hydration-performance","Astro Islands vs Full Hydration Performance",{"path":1298,"title":1299},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fdeferring-hydration-with-client-visible-in-astro","Deferring Hydration with client:visible in Astro",{"path":1301,"title":1302},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fhow-to-reduce-bundle-size-in-eleventy-builds","How to Reduce Bundle Size in Eleventy Builds",{"path":1304,"title":1305},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering","JavaScript Hydration & Partial Rendering",{"path":1307,"title":1308},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fmeasuring-inp-on-static-sites-with-real-user-monitoring","Measuring INP on Static Sites with RUM",{"path":1310,"title":1311},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Freplacing-react-islands-with-web-components","Replacing React Islands with Web Components",{"path":1313,"title":1314},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Feliminating-render-blocking-css-on-static-sites","Eliminating Render-Blocking CSS on Static Sites",{"path":1316,"title":1317},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Ffixing-lcp-on-text-heavy-documentation-pages","Fixing LCP on Text-Heavy Documentation Pages",{"path":1319,"title":1320},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites","Largest Contentful Paint Optimization for Static Sites",{"path":1322,"title":1323},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Fmeasuring-lcp-subparts-with-devtools","Measuring LCP Subparts with DevTools",{"path":1325,"title":1326},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Foptimizing-lcp-on-astro-with-priority-hints","Optimizing LCP on Astro with Priority Hints",{"path":1328,"title":1329},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Freducing-lcp-from-hero-images-on-static-sites","Reducing LCP from Hero Images on Static Sites",{"path":1331,"title":1332},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fcomparing-lab-and-field-data-with-crux","Comparing Lab and Field Data with CrUX",{"path":1334,"title":1335},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci","Performance Budgets and Lighthouse CI",{"path":1337,"title":1338},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Freducing-lighthouse-score-variance-in-ci","Reducing Lighthouse Score Variance in CI",{"path":1340,"title":1341},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Frunning-webpagetest-scripts-against-preview-deploys","Running WebPageTest Scripts Against Preview Deploys",{"path":1343,"title":1344},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fsetting-up-lighthouse-ci-for-a-static-site","Setting Up Lighthouse CI for a Static Site",{"path":1346,"title":1001},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Ftracking-bundle-size-per-pull-request",{"path":1348,"title":1349},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fwriting-a-performance-budget-that-fails-builds","Writing a Performance Budget That Fails Builds",{"path":1351,"title":1352},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fauditing-unused-preloads","Auditing Unused Preloads",{"path":1354,"title":1355},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed","Resource Hints and Navigation Speed",{"path":1357,"title":1358},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Finstant-navigation-with-speculation-rules","Instant Navigation with Speculation Rules",{"path":1360,"title":1361},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fpreconnect-vs-dns-prefetch-on-static-sites","Preconnect vs DNS-Prefetch on Static Sites",{"path":1363,"title":1364},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fprefetching-links-in-astro","Prefetching Links in Astro",{"path":1366,"title":1367},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fview-transitions-on-multi-page-static-sites","View Transitions on Multi-Page Static Sites",{"path":1369,"title":1370},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fauditing-third-party-scripts-with-lighthouse","Auditing Third-Party Scripts With Lighthouse",{"path":1372,"title":1373},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites","Third-Party Script Performance on Static Sites",{"path":1375,"title":1376},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Flazy-loading-youtube-embeds-on-static-sites","Lazy-Loading YouTube Embeds on Static Sites",{"path":1378,"title":1379},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Floading-google-tag-manager-without-hurting-inp","Loading Google Tag Manager Without Hurting INP",{"path":1381,"title":1382},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Frunning-third-party-scripts-in-a-web-worker-with-partytown","Running Third-Party Scripts in a Web Worker with Partytown",{"path":1384,"title":1385},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fself-hosting-analytics-to-cut-third-party-requests","Self-Hosting Analytics to Cut Third-Party Requests",{"path":1387,"title":1388},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fautomating-eleventy-deployments-with-cloudflare-pages","Automating Eleventy Deployments on Cloudflare Pages",{"path":1390,"title":1391},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fconfiguring-redirects-on-cloudflare-pages","Configuring Redirects on Cloudflare Pages",{"path":1393,"title":1394},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fcustom-domains-and-tls-on-cloudflare-pages","Custom Domains and TLS on Cloudflare Pages",{"path":1396,"title":1397},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fdeploying-hugo-to-cloudflare-pages-and-workers","Deploying Hugo to Cloudflare Pages and Workers",{"path":1399,"title":1400},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup","Cloudflare Pages Edge Caching Setup",{"path":1402,"title":1403},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fmigrating-from-cloudflare-pages-to-workers-static-assets","Migrating from Cloudflare Pages to Workers Static Assets",{"path":1405,"title":1406},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fchecking-links-in-pull-requests","Checking Links in Pull Requests",{"path":1408,"title":1409},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fdocs-as-code-review-workflow-for-writers","Docs-as-Code Review Workflow for Writers",{"path":1411,"title":1412},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Feditorial-checks-with-vale-in-ci","Editorial Checks with Vale in CI",{"path":1414,"title":1415},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams","Content Workflows for Documentation Teams",{"path":1417,"title":1418},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fscheduling-content-publication-with-cron-triggered-builds","Scheduling Content Publication With Cron-Triggered Builds",{"path":1420,"title":1421},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fwiring-a-headless-cms-to-a-static-build","Wiring a Headless CMS to a Static Build",{"path":1423,"title":1424},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fbuilding-astro-sites-with-github-actions","Building Astro Sites with GitHub Actions",{"path":1426,"title":1427},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fcaching-node-modules-in-github-actions-for-faster-ssg-builds","Caching node_modules in GitHub Actions",{"path":1429,"title":1430},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-github-pages-with-actions","Deploying to GitHub Pages with Actions",{"path":1432,"title":1433},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-multiple-environments-from-one-workflow","Deploying to Multiple Environments From One Workflow",{"path":1435,"title":1436},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fhow-to-set-up-github-actions-for-hugo-deployments","GitHub Actions for Hugo Deployments",{"path":1438,"title":1439},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds","GitHub Actions for Automated SSG Builds",{"path":1441,"title":1442},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fmatrix-builds-for-multi-site-monorepos","Matrix Builds for Multi-Site Monorepos",{"path":1444,"title":1445},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fcaching-hugo-builds-in-github-actions","Caching Hugo Builds in GitHub Actions",{"path":1447,"title":1448},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fenabling-incremental-builds-in-eleventy","Enabling Incremental Builds in Eleventy",{"path":1450,"title":1451},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fincremental-builds-in-astro-with-the-content-layer","Incremental Builds in Astro with the Content Layer",{"path":1453,"title":1454},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs","Incremental Builds and Build Caching for SSGs",{"path":1456,"title":1457},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fmeasuring-build-time-regressions-in-ci","Measuring Build-Time Regressions in CI",{"path":1459,"title":1460},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fremote-caching-with-turborepo-for-ssg-monorepos","Remote Caching with Turborepo for SSG Monorepos",{"path":1462,"title":1463},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fsharing-build-cache-across-ci-runners","Sharing Build Cache Across CI Runners",{"path":1465,"title":1466},"\u002Fproduction-ready-deployment-cicd-workflows","Production-Ready Deployment & CI\u002FCD for SSGs",{"path":1468,"title":1469},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Falerting-on-cache-hit-ratio-drops","Alerting on Cache Hit Ratio Drops",{"path":1471,"title":1472},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fbuilding-a-core-web-vitals-dashboard-from-rum-data","Building a Core Web Vitals Dashboard from RUM Data",{"path":1474,"title":1475},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fcrawling-for-broken-links-on-a-schedule","Crawling for Broken Links on a Schedule",{"path":1477,"title":1478},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production","Monitoring Static Sites in Production",{"path":1480,"title":1481},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Flogging-404s-at-the-edge","Logging 404s at the Edge",{"path":1483,"title":1484},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fuptime-and-synthetic-checks-for-static-sites","Uptime and Synthetic Checks for Static Sites",{"path":1486,"title":1487},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fconfiguring-vercel-for-hugo-and-eleventy","Configuring Vercel for Hugo and Eleventy",{"path":1489,"title":1490},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies","Netlify vs Vercel Deployment Strategies",{"path":1492,"title":1493},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-build-hooks-for-content-updates","Netlify Build Hooks for Content Updates",{"path":1495,"title":1496},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-redirects-and-rewrites-for-static-sites","Netlify Redirects and Rewrites for Static Sites",{"path":1498,"title":1499},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fsetting-up-deploy-previews-on-netlify-for-every-pull-request","Netlify Deploy Previews for Every Pull Request",{"path":1501,"title":1502},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fvercel-isr-vs-static-generation-for-ssgs","Vercel ISR vs Static Generation for SSGs",{"path":1504,"title":1505},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fautomating-preview-deploy-pipelines-with-github-actions","Automating Preview Deploy Pipelines with GitHub Actions",{"path":1507,"title":1508},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fcleaning-up-stale-preview-deployments","Cleaning Up Stale Preview Deployments",{"path":1510,"title":1511},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests","Preview Environments for Pull Requests",{"path":1513,"title":1514},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpassword-protecting-preview-deployments","Password-Protecting Preview Deployments",{"path":1516,"title":1517},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpreviewing-headless-cms-drafts","Previewing Headless CMS Drafts",{"path":1519,"title":1520},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fvisual-regression-testing-on-preview-deploys","Visual Regression Testing on Preview Deploys",{"path":1522,"title":1523},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fatomic-deploys-vs-incremental-uploads","Atomic Deploys vs Incremental Uploads",{"path":1525,"title":1526},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fcanary-releases-for-static-sites","Canary Releases for Static Sites",{"path":1528,"title":1529},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Ffeature-flags-on-static-sites","Feature Flags on Static Sites",{"path":1531,"title":1532},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites","Rollbacks and Deploy Safety for Static Sites",{"path":1534,"title":1535},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frolling-back-a-bad-static-deploy-in-under-a-minute","Rolling Back a Bad Static Deploy in Under a Minute",{"path":1537,"title":1538},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frunning-smoke-tests-against-a-preview-url","Running Smoke Tests Against a Preview URL",{"path":1046,"title":5},{"path":1541,"title":1542},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely","Enabling HSTS and Preload Safely",{"path":1544,"title":1545},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fhash-based-csp-for-inline-scripts-in-astro","Hash-Based CSP for Inline Scripts in Astro",{"path":1547,"title":33},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites",{"path":1549,"title":861},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc",{"path":1551,"title":1552},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsubresource-integrity-for-third-party-assets","Subresource Integrity for Third-Party Assets",{"path":1554,"title":1555},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fwriting-a-content-security-policy-for-a-static-site","Writing a Content Security Policy for a Static Site",{"path":1557,"title":1558},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fclean-urls-and-trailing-slashes-on-s3","Clean URLs and Trailing Slashes on S3",{"path":1560,"title":1561},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fcloudfront-functions-for-redirects","CloudFront Functions for Redirects",{"path":1563,"title":1564},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fdeploying-a-static-site-to-s3-and-cloudfront","Deploying a Static Site to S3 and CloudFront",{"path":1566,"title":1567},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites","Self-Hosting Static Sites on S3, Nginx and Caddy",{"path":1569,"title":1570},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-caddy","Serving a Static Site with Caddy",{"path":1572,"title":1573},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-nginx","Serving a Static Site with Nginx",{"path":1575,"title":1576},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fzero-downtime-deploys-with-symlink-swaps","Zero-Downtime Deploys with Symlink Swaps",{"path":1578,"title":1579},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fadding-a-contact-form-with-cloudflare-workers","Adding a Contact Form with Cloudflare Workers",{"path":1581,"title":1582},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fhandling-form-submissions-on-a-static-site","Handling Form Submissions on a Static Site",{"path":1584,"title":1585},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites","Serverless Functions for Static Sites",{"path":1587,"title":1588},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fnetlify-functions-vs-cloudflare-workers","Netlify Functions vs Cloudflare Workers",{"path":1590,"title":1591},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fprotecting-a-static-site-behind-authentication","Protecting a Static Site Behind Authentication",{"path":1593,"title":1594},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fproxying-third-party-apis-from-an-edge-function","Proxying Third-Party APIs from an Edge Function",1789722847311]