All these comments on GitHub are amazing to me. How do you let a new build of your project with a new version of a such a fundamental dependency get deployed to _production_ without being tested first, manually or otherwise?
Not pinning and not testing is egregious enough but to use a CDN for a web-based cross-platform app? Absurd.
If it would be a private CDN which points only to the content they explicitly published as part of a build&release process they wouldn't have the problem.
If you rely on public artifacts that others published, all your availability and security guarantees are gone.
Many of these products are likely commercial based on their comments