> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cairnscript.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependencies

> Attach CDN-hosted libraries to a script and load them before your code runs.

When a script needs a library (GSAP, Swiper, a date picker), add it as a **dependency** instead of pasting another embed into Webflow. Cairn loads dependencies before your script runs.

## Adding a library

Open **Dependencies** from the script editor and paste either a full `<script>` tag or a bare CDN URL. Cairn pulls out the URL and asks for:

* **Name**: a label, just for you (e.g. `GSAP`).
* **Global** (optional): the global variable the library exposes (e.g. `gsap`). Recording it documents what your script can rely on once the dependency has loaded.

## The CDN allowlist

A dependency can point at any `https` link. Cairn recognizes the common package CDNs and loads them without comment (including subdomains):

| Host                                         | Typical use                |
| -------------------------------------------- | -------------------------- |
| `jsdelivr.net`                               | npm & GitHub packages      |
| `unpkg.com`                                  | npm packages               |
| `esm.sh`                                     | npm packages as ES modules |
| `cdnjs.cloudflare.com`                       | popular libraries          |
| `skypack.dev`                                | npm packages as ES modules |
| `jspm.io`                                    | npm packages as ES modules |
| `code.jquery.com`                            | jQuery                     |
| `fonts.googleapis.com` / `fonts.gstatic.com` | Google Fonts               |
| `ajax.googleapis.com`                        | Google-hosted libraries    |

### Loading from other sources

You are not limited to that list. Some libraries live on their own domain rather than a package CDN. Vimeo's player is a good example: you load it from `https://player.vimeo.com/api/player.js`, which is perfectly safe but isn't one of the hosts above.

When you paste a source Cairn doesn't recognize, you'll see a small note rather than an error. It's a nudge, not a block: the library still saves and loads. We show it because a dependency runs for every visitor on every matching page, so it's worth a moment to confirm you trust where the file comes from. If it's the library's official site or a service you already use, you're good to go.

Cairn only asks that the link is `https`. A plain `http` link is refused, because it won't load on a secure site anyway.

<Tip>
  Pin dependency versions in the URL (`/gsap@3.12.5/`) rather than using
  `@latest` or an unversioned path. Unpinned URLs can change behavior on your
  live site without any publish from you.
</Tip>

## Imports inside your code

Neither the dependency list nor `import` statements in your own code are blocked by this check. It's your code on your site. The editor simply flags when a source is **untrusted** (a host Cairn doesn't recognize) or **unpinned** (no version), so you can decide with eyes open. See [ES modules](/essentials/modules#runtime-import-warnings).