A buildless app still has a build step: 41 pinned URLs and a sed pass that missed two

The sed pass failed in the way that never wakes anyone up. A pinned CDN URL that still resolves is indistinguishable to the loader from the one you meant to write, so the two stragglers kept fetching the advisory-affected build, according to the dev.to account ^[14], and the page kept working. Two misses out of forty-one sites is under five per cent of the import statements in that repo ^[16], small enough to clear review and precisely the thing the bump existed to remove ^[13].

Nothing in the browser was positioned to catch it. The module spec allows a browser to resolve a full URL or a specifier beginning with /, ./ or ../, and nothing else ^[4]. A bare name like "lodash" throws before a request is made ^[5]. Filling that gap has always taken either a bundler rewriting specifiers at build time or a resolution algorithm of the kind Node has and browsers do not, since a page has no node_modules to walk ^[6].

An import map is the third route, and the only one the browser honours by itself: a JSON block stating what a bare specifier resolves to, consulted by every import statement on the page, which puts the version in one location and turns a bump into a one-line diff ^[1]. It also has its own version of the subpath blind spot. A key ending in a slash is a prefix mapping, and the value has to end in one too or the browser refuses to register the mapping at all ^[7]. Leave the slash off the key and you have mapped the exact string "lodash-es" and nothing more, so every "lodash-es/debounce" in the codebase is back to being an unresolvable bare specifier ^[8]. That is the same class of error as the sed miss, relocated to one file where it fails on first load instead of hiding in two modules nobody opened.

The scoped form is keyed by the path of the importing module and is checked ahead of the top-level imports, so modules under /admin/ can hold at 4.17.19 while the rest of the app moves to 4.17.22 ^[9]; where a specifier matches more than one scope path, the longest wins ^[10]. Then count the copies again. One map per document ^[2] and inline only outside Chrome ^[3] means 41 per-module string literals become one block per HTML entry point ^[15]. That is a genuine reduction if your server renders the head from a template, and close to a lateral move if your pages are static and hand-edited. The block also has to appear above the first module script that depends on it, or it is JSON that does nothing ^[11].