[Gabriel Mongefranco (gabrielmongefranco)]

What this changes

The app loaded WebLLM from esm.run with no version, while every other library it loads from a CDN carried one. Each new WebLLM release therefore reached every user on the day it shipped, with no change in this repository. A bad release would have broken chat for everyone at once.

• WebLLM now loads from one constant, WEBLLM_URL, pinned to 0.2.85 on jsDelivr. As of 2026-10-08, 0.2.85 is the latest WebLLM release on npm. It is also the version the unpinned address served, so the app's behavior does not change. esm.run only redirected to jsDelivr, so the app now depends on one less host.
• A new test in tests/index-html.test.mjs fails on any CDN address in index.html that lacks an exact version. It rejects @latest, a major version alone such as @4, a range such as @^4.2.0, and a bare package name. It also checks that the scan still finds all six libraries, so a broken pattern cannot pass quietly.
• The test workflow now pins actions/checkout v7.0.1 and actions/setup-node v7.0.0, by commit hash as before. The old pins, v4.4.0 of each, run on Node 20, which GitHub is retiring for actions. The new ones run on Node 24.
• The fast suite now runs as node --test "tests/*.test.mjs". The workflow's first run failed because Node 22, which the workflow uses, does not accept the folder name tests/. The workflow, the developer guide, the plan's rules, and the project preferences use the new form.
• The runtime page now has a table of every library and its version. The developer guide has a new section with the steps for raising a version. It also explains what to do when a pull request shows no checks. The design change record and the project preferences are updated to match.
• A separate commit marks the issues implementation plan complete. Phase 4, the storage dialog, merged on 2026-09-29. Phase 5, Markdown in chats, stays deferred.

Closes #12.

Checks before pinning

• Release notes. The WebLLM 0.2.85 notes list fixes only. That version keeps the v0_2_84/base model libraries, which the storage dialog test already expects. The checkout and setup-node notes list nothing that affects this workflow. It uses no npm token and no fork-triggered events, and it sets its cache options explicitly. setup-node v7.1.0 was left out because it was released the same day.
• Advisories. The GitHub advisory database lists no advisories for @mlc-ai/web-llm.
• Models. All 11 chat models in MODEL_CTX appear in 0.2.85's prebuilt model list.
• The pinned address. It returns JavaScript with Access-Control-Allow-Origin: *, and its module exports CreateMLCEngine and prebuiltAppConfig. It imports nothing from other hosts.
• Action pins. Each new hash was resolved from the action repository's own release tag.

Testing

GitHub Actions now runs both jobs on this pull request, and both pass. Neither job reports a Node 20 deprecation warning.

Static checks:  tests 405, pass 400, fail 0, skipped 5
Model checks:   tests 321, pass 321, fail 0

The fast suite was also run locally on Node 22 and Node 26, with the same counts. The new pinning test failed on the old unpinned address before the fix, and passes after it.

Not tested in a browser. Headless Edge and Chrome both exited at launch on the test machine, so the app was not loaded with the pinned engine. Before merging, load the app in a WebGPU browser and check three things. A cached model loads. A model not yet downloaded loads. A prompt gets a reply.