Skip to content

Update OneDollarStats script handling #698

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leoisadev1 merged 3 commits into from
Mar 10, 2026
Merged

Update OneDollarStats script handling #698

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
13d683b
Fix one dollar stats tracking
leoisadev1 Mar 10, 2026
13efa21
chore: restore configurable web dev script
leoisadev1 Mar 10, 2026
d9764d7
fix: avoid stale analytics SRI pinning
leoisadev1 Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/web/src/routes/__root.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ const SITE_URL = "https://osschat.dev";
const SITE_NAME = "osschat";
const SITE_DESCRIPTION = "Open source AI chat with 350+ models. Access GPT-4, Claude, Gemini, and more through one beautiful interface. Free tier available, no API key required.";
const SITE_TAGLINE = "One interface. Every AI model.";
const ONEDOLLARSTATS_SCRIPT_SRC = "https://assets.onedollarstats.com/stonks.js";

@greptile-apps greptile-apps Bot Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description claims ONEDOLLARSTATS_SCRIPT_INTEGRITY was also extracted — it wasn't

The PR summary states:

expose the OneDollarStats script URL and integrity hash as constants

And the auto-generated cubic summary echoes:

extracting ONEDOLLARSTATS_SCRIPT_SRC and ONEDOLLARSTATS_SCRIPT_INTEGRITY constants

However, the diff only adds ONEDOLLARSTATS_SCRIPT_SRC. The integrity attribute was removed entirely rather than being extracted to a named constant. If the intent was truly to make the hash easy to update in one place, the constant should have been created and wired back in — otherwise the description misrepresents the change.

If the intent was to drop SRI entirely (a valid decision, discussed in the previous thread), the PR description should be updated to reflect that.

Confidence: 3/5 — the description / code mismatch is real, but the behaviour itself (removing SRI) may be intentional even if the words say otherwise.


export const Route = createRootRoute({
beforeLoad: async () => {
Expand Down Expand Up @@ -158,10 +159,9 @@ export const Route = createRootRoute({
},
// Analytics
{
src: "https://assets.onedollarstats.com/stonks.js",
src: ONEDOLLARSTATS_SCRIPT_SRC,
defer: true,
crossOrigin: "anonymous",
integrity: "sha384-JKNAwAZy8iZWcJrexWvQf3rNcosuH0th/rwqZoiM84ea7fMGTt2eq8ddZb//nd9H",
},
Comment on lines +162 to 165

@greptile-apps greptile-apps Bot Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

crossOrigin: "anonymous" serves no purpose without integrity

The crossOrigin: "anonymous" attribute is primarily meaningful in combination with SRI (integrity). Its role is to tell the browser to make a CORS request so the response can be verified against the hash. Now that the integrity attribute has been removed, this attribute does nothing useful for a plain <script src> tag from a CDN — browsers already fetch cross-origin scripts without needing crossOrigin: "anonymous" set explicitly.

Confidence this is worth changing: 2/5 — it's harmless in practice, but keeping it is misleading and suggests SRI is still in play.

Suggested change
src: ONEDOLLARSTATS_SCRIPT_SRC,
defer: true,
crossOrigin: "anonymous",
integrity: "sha384-JKNAwAZy8iZWcJrexWvQf3rNcosuH0th/rwqZoiM84ea7fMGTt2eq8ddZb//nd9H",
},
src: ONEDOLLARSTATS_SCRIPT_SRC,
defer: true,

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

],
}),
Expand Down
Loading