

Note also that if your care about security vulnerabilities, GitHub will scan your Gemfile.lock and package-lock.json if you enable scanning in repo settings, then you will get warnings and even automated PRs for you to review and merge, whenever a vulnerability comes up. The commit your package.json and lock file. Then you can upgrade it manually with npm install if you want to go from 4.5 to 4.8 or whatever without jumping to 5, you can do: npm update

Then when the site builds, your assets will go to _site/assets and you can load /assets/bs.css in your head tag. cp node_modules/bootstrap/bs.css assets/. But it should target an ignored directory so that you don’t commit the result to version control. npm install bootstrapĭo something like this. Maybe you have package.json file with Bootstrap and Anchorjs in it and that is part of your Jekyll site. I have Jekyll project as a demo of Bulma and Bootstrap from CDNs MichaelCurrin/css-frameworks-demo/blob/master/_includes/bootstrap-resources.html but that is dangerous because one day you have Bootstrap 5 and the next day 6 comes out and your site breaks and you didn’t even deploy anything.

There are ways to omit the version of 4.4.1 to get the latest always. And then you manually upgrade the version and test the site locally, then deploy the changes. One way to add JS libraries to the page is a CDN URL with a version. Here are some approaches which control for the risk CDN

Or at least stay within the latest Bootstrap 4 because Bootstrap 5 could have breaking changes. If you don’t need new features of a package, it is safer to stay on an old one. You also need to be careful of automating an upgrade of packages, because then your site would break on the frontend and you won’t know until you view the page. Jekyll just puts a script tag on the page from your HTML Jekyll itself doesn’t care about what JS you put on the page whether your own scripts or from a CDN or Node modules Can you elaborate? I have little context on how load the packages and your level of JS experience so just going to give a detailed answer on a few angles.
