From 08eb82579fb1c6c42486db6fc6636b56fe52e497 Mon Sep 17 00:00:00 2001
From: Klaus Hartl <klaus.hartl@gmail.com>
Date: Sun, 23 Apr 2023 11:40:58 +0200
Subject: [PATCH] Stop distribution via GitHub releases

This counteracts the additional supply-chain security we've just
introduced via package provenance; GitHub releases are not immutable.
---
 .release-it.json |  1 -
 README.md        | 36 +-----------------------------------
 2 files changed, 1 insertion(+), 36 deletions(-)

diff --git a/.release-it.json b/.release-it.json
index 3ac5aeed..a9a403da 100644
--- a/.release-it.json
+++ b/.release-it.json
@@ -6,7 +6,6 @@
     "tagName": "v${version}"
   },
   "github": {
-    "assets": ["dist/*.mjs", "dist/*.js"],
     "draft": true,
     "release": true,
     "releaseName": "v${version}"
diff --git a/README.md b/README.md
index a144aafb..e397e514 100644
--- a/README.md
+++ b/README.md
@@ -32,45 +32,11 @@ npm i js-cookie
 
 The npm package has a `module` field pointing to an ES module variant of the library, mainly to provide support for ES module aware bundlers, whereas its `browser` field points to an UMD module for full backward compatibility.
 
-### Direct download
-
-Starting with version 3 [releases](https://github.com/js-cookie/js-cookie/releases) are distributed with two variants of this library, an ES module as well as an UMD module.
-
-Note the different extensions: `.mjs` denotes the ES module, whereas `.js` is the UMD one.
-
-Example for how to load the ES module in a browser:
-
-```html
-<script type="module" src="/path/to/js.cookie.mjs"></script>
-<script type="module">
-  import Cookies from '/path/to/js.cookie.mjs'
-
-  Cookies.set('foo', 'bar')
-</script>
-```
-
 _Not all browsers support ES modules natively yet_. For this reason the npm package/release provides both the ES and UMD module variant and you may want to include the ES module along with the UMD fallback to account for this:
 
-```html
-<script type="module" src="/path/to/js.cookie.mjs"></script>
-<script nomodule defer src="/path/to/js.cookie.js"></script>
-```
-
-Here we're loading the nomodule script in a deferred fashion, because ES modules are deferred by default. This may not be strictly necessary depending on how you're using the library.
-
 ### CDN
 
-Alternatively, include it via [jsDelivr CDN](https://www.jsdelivr.com/package/npm/js-cookie).
-
-## ES Module
-
-Example for how to import the ES module from another module:
-
-```javascript
-import Cookies from 'js-cookie'
-
-Cookies.set('foo', 'bar')
-```
+Alternatively, include js-cookie via [jsDelivr CDN](https://www.jsdelivr.com/package/npm/js-cookie).
 
 ## Basic Usage