jsDelivr is a free content delivery network (CDN) for files distributed by open-source software projects. It integrates with npm and GitHub, making published packages and repository files accessible through a shared delivery service. Although particularly associated with JavaScript and CSS, its scope includes other web assets. The service is supported by sponsors and provides its public CDN without bandwidth charges or paid feature tiers. (jsdelivr.com)
History
Dmitriy Akulov founded jsDelivr in May 2012. Its development progressively shifted toward automated distribution: fully automated npm and GitHub proxies launched in May 2017, followed by a redesigned website supporting those integrations in August. This model reduced the need to maintain a separate, manually curated library catalog. (jsdelivr.com)
In 2020, jsDelivr expanded into additional parts of the software-distribution ecosystem. CocoaPods began using its delivery infrastructure in May; BootstrapCDN became part of jsDelivr in October; and the project introduced esm.run that same month to support JavaScript modules. RawGit CDN became part of jsDelivr in May 2021. (jsdelivr.com)
File delivery and addressing
The service uses predictable paths that identify an upstream source, a project, a version, and a file. Its principal path formats are:
/npm/package@version/file
/gh/user/repository@version/file
For npm, the source is a published package in the public registry. For GitHub, the version identifier can designate a release, commit, or branch. Files become available without a separate publication step to jsDelivr. (github.com)
An npm request can specify an exact version or a version range. For example, the following paths distinguish a fixed release from a major-version alias:
/npm/jquery@3.6.4/dist/jquery.min.js
/npm/jquery@3/dist/jquery.min.js
Omitting the version selects the latest release. These forms have different stability properties: an exact version identifies a particular release, whereas an alias can resolve to newer releases over time. The project documentation warns against unrestricted latest-version requests in production because upgrades can introduce breaking changes. (jsdelivr.com)
The service also provides directory listings and default-file selection when a file path is omitted. It can generate minified JavaScript and CSS files on demand, supply source maps, and combine several files into a single response. These features allow delivery-time optimization without requiring every package author to publish all optimized variants separately. (jsdelivr.com)
Multi-CDN architecture
jsDelivr operates as a delivery layer across several CDN providers rather than relying on one provider’s network. Its published network description lists Cloudflare, Fastly, Bunny, and Gcore, supplemented by custom servers in locations with limited CDN coverage. A load-balancing system selects providers using recent performance and availability measurements. Selection can change geographically: degraded performance in one region need not remove a provider from service elsewhere. (jsdelivr.com)
Redundancy extends beyond edge delivery. The architecture includes multiple DNS providers and origin servers in separate data centers. Monitoring combines real-user measurements with synthetic tests, allowing unhealthy delivery providers or origin servers to be bypassed. These mechanisms are designed to limit the effects of individual component failures, rather than making the service independent of its underlying infrastructure. (jsdelivr.com)
Storage and cache behavior
Permanent storage separates continued delivery from continued upstream availability. Once retrieved and stored, a file can remain available even if its package or repository is subsequently deleted upstream. Exact-version files and commit-addressed files are treated as immutable; purging an edge cache does not replace their permanently stored contents. (github.com)
Version aliases and branch paths behave differently because their targets can change. The documented default cache periods are seven days for version aliases, including latest, and twelve hours for branches. Cache purging can accelerate alias updates, but does not delete permanent stored files. For version-range requests, a fallback mechanism can serve an earlier release when the requested file is missing from the newest matching release. (github.com)
JavaScript module support
Alongside ordinary file delivery, jsDelivr supports on-demand builds for ECMAScript modules (ESM). Its module endpoint uses a +esm suffix, while esm.run provides shorter addresses that redirect to the main CDN. The module transformation system resolves dependencies and rewrites imports to delivery URLs; generated files are minified and retained in permanent storage. This differs from simply returning a package’s original source file unchanged. (github.com)
The ESM delivery service advertises support for modern web browsers, Node.js, and Deno. Delivery optimizations include HTTP/2 and HTTP/3, Brotli compression, caching, and dependency preloading. The project distinguishes esm.run’s convenient prototype addresses from its main delivery domain. (jsdelivr.com)
Metadata and usage statistics
A public application programming interface exposes package versions, tags, file information, and entry-point metadata. It also provides download statistics at project, version, and file levels, alongside network-wide statistics. Entry-point identification combines package metadata with observed usage to help identify suitable JavaScript and CSS files. (jsdelivr.com)
Restrictions and security
jsDelivr is not an unrestricted website-hosting service. Its documentation specifies default package and GitHub file-size limits, and HTML files are served as plain text for security reasons. Upstream deletion alone does not normally trigger removal from permanent storage, although content may be restricted for substantiated serious security or legal reasons. (github.com)
Third-party script delivery introduces an integrity boundary between a website and its resource provider. Subresource Integrity addresses this boundary by allowing a page to specify a cryptographic digest for a script or stylesheet. The browser checks the retrieved bytes against that digest before using the resource. This detects unexpected content changes; it does not establish that the expected code is free of vulnerabilities or malicious behavior. (w3.org)
References
- About - jsDelivrjsdelivr.com
- Our History - jsDelivrjsdelivr.com
- GitHub - jsdelivr/jsdelivr: A free, fast, and reliable Open Source CDN for npm, GitHub, Javascript, and ESMgithub.com
- jsDelivr - A free, fast, and reliable CDN for JS and open sourcejsdelivr.com
- Our Network - jsDelivrjsdelivr.com
- Introducing esm.run - A New-Age CDN for JavaScript modulesgithub.com
- esm.run by jsDelivr - A New-Age CDN for JavaScript modulesjsdelivr.com
- Subresource Integrityw3.org