@liran_tal That URL means accepting that you
always get the latest release, which is what you never want in production.

So @pikapkg CDN and others could an URL with a hash:
https://cdn.skypack.dev/canvas-confetti#<sha256> where the checksum is
for the entire dependency tree of the library.