When a script needs a library (GSAP, Swiper, a date picker), add it as a dependency instead of pasting another embed into Webflow. Cairn loads dependencies before your script runs.
Adding a library
Open Dependencies from the script editor and paste either a full <script> tag or a bare CDN URL. Cairn pulls out the URL and asks for:
- Name: a label, just for you (e.g.
GSAP).
- Global (optional): the global variable the library exposes (e.g.
gsap). Recording it documents what your script can rely on once the dependency has loaded.
The CDN allowlist
A dependency can point at any https link. Cairn recognizes the common package CDNs and loads them without comment (including subdomains):
Loading from other sources
You are not limited to that list. Some libraries live on their own domain rather than a package CDN. Vimeo’s player is a good example: you load it from https://player.vimeo.com/api/player.js, which is perfectly safe but isn’t one of the hosts above.
When you paste a source Cairn doesn’t recognize, you’ll see a small note rather than an error. It’s a nudge, not a block: the library still saves and loads. We show it because a dependency runs for every visitor on every matching page, so it’s worth a moment to confirm you trust where the file comes from. If it’s the library’s official site or a service you already use, you’re good to go.
Cairn only asks that the link is https. A plain http link is refused, because it won’t load on a secure site anyway.
Pin dependency versions in the URL (/gsap@3.12.5/) rather than using
@latest or an unversioned path. Unpinned URLs can change behavior on your
live site without any publish from you.
Imports inside your code
Neither the dependency list nor import statements in your own code are blocked by this check. It’s your code on your site. The editor simply flags when a source is untrusted (a host Cairn doesn’t recognize) or unpinned (no version), so you can decide with eyes open. See ES modules. 
