[untog]

> the only-case scenario is that all the sites you have pulling from that CDN break until you recompute the hash

Until you recompute the hash and communicate that new hash to them and they implement it on their site. It’s not nothing from an implementation point of view.

[sterkekoffie]

I'm not sure who "you" and "they" are in this scenario so I apologize if this isn't what you're getting at: the failure -> fallback -> threat evaluation-> remediation process can be entirely automated except the evaluation part. I'm not a web developer so I don't know the incidence rate of using unstable builds in production and having to patch stable builds, so maybe having to manually evaluate threats in this way /would/ be annoying, but the actual devops seems pretty trivial.