Which CDN, and why

Three providers serve almost everything, and they are not interchangeable. Each has a url shape, a strength, and a specific way it surprises people.

They do not agree about versions

cdnjs sometimes republishes packages under its own numbering — it lists Prism under a version that has never existed on npm. Taking a version number from one provider and pasting it into another’s url is one of the most common ways to produce a 404 that looks like a typo.

Only one of them gives you an SRI hash

cdnjs publishes a subresource-integrity hash for the files it hosts. The others do not, so using SRI with them means computing the hash yourself and updating it every time you change version. That single difference decides the choice for anything security-sensitive.

Questions

Which CDN should I use?

cdnjs if you want an SRI hash without computing one. jsDelivr if the package is on npm but not on cdnjs, or if you want a version range. unpkg if you need to reach one specific file inside a package. For anything real users will load, prefer the url you have actually fetched — which is why the last-checked date is on every one of them.

What is an SRI hash and do I need one?

Subresource integrity pins the exact bytes a browser will accept. If the file at that url ever changes, the browser refuses to run it instead of running something you did not review. Use one for anything on a page that handles user data. Only cdnjs publishes hashes, and only for the exact file they computed it from — attaching a hash to a different url blocks the script and looks exactly like the CDN being down.