Notification when plausible.js gets updated

[cyann]

I must use Cross-Origin Resource Sharing (CORS) / Subresource Integrity (SRI) and when plausible.js gets updated I must download, verify, re-hash, and update the integrity attribute.

A while ago, this how I loaded plausible.js:

<script
	defer
	data-domain="example.com"
	src="https://plausible.io/js/plausible.js"
	crossorigin="anonymous"
	integrity="sha384-0tX/C66trbqI1ludXxeZmlfZv7n7W+SsSI45FPLHoK49MIpj6t7dyZ7CalV7x2pk">
</script>

This was running fine, and I did not notice that the script had changed since ~10 days (a test site with low single-digit monthly visits).

Today's integrity hash is:

% curl -s https://plausible.io/js/plausible.js | openssl dgst -sha384 -binary | openssl base64
jGlDcM8H7SHi1NFpOcMtlFZ9qhagBGVNCtsA9pv7R2dV4g6BP+kYXLiPaRzO5X/3

Is there a way to get a notification (email) when plausible.js gets updated?

Ideally a page with all the past and current versions (with direct download links), the release dates, and the sha384 hashes would be excellent.

[ukutaht]

Yes, I agree that this would be a great feature to add

[witalijx]

I would like to see this too, as I can't constantly keep looking up if plausible has got an update. Would be awesome if this was implemented as an alert on the self hosted dashboard.

[willfarrell]

My approach has been to self-host the plausible.js file and subscribe to release updated for this repo. Since you mention the script changed recently, this makes me wonder if changes to the script are included in the releases or not.

[sandstrom]

Even better, they publish a script via NPM. So you can simply import that script yourself.

https://github.com/plausible/plausible-tracker

If you add it to your website payload, you can also optionally add the integrity hash by computing it yourself (but integrity is mostly for third-party hosted JS).

[LucGosso]

+1

Or version it as a complement to the static link => https://plausible.io/js/script.js

Example "https://plausible.io/js/**2.2.1**/script.js" then it wont break until you manually upgrade to latest script with new integrity hash