fix: use jsdelivr when npm has a truncated readme

[lukeocodes]

Summary

Large READMEs are being cut off because the npm registry silently truncates the readme field in packument responses at exactly 65,536 characters. For example, vue-data-ui has an 80KB README but only 64K makes it through.

This switches the README handler to fetch the actual file from jsDelivr CDN (which serves from the npm tarball without truncation) as the primary source, keeping the packument readme field as a fallback for packages where jsDelivr doesn't have the file.

Closes #1458

Test plan

• Verified locally with vue-data-ui — full README now renders
• Spot check other packages with large READMEs
• Confirm packages with non-standard readme filenames still render correctly (fallback to packument)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Feb 13, 2026 9:43am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Feb 13, 2026 9:43am
npmx-lunaria	Ignored		Feb 13, 2026 9:43am

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR computes a resolvedVersion (from an explicit version or dist-tag) and adopts a jsDelivr-first strategy to fetch README content for that resolvedVersion (pkg@version). It removes reliance on version-specific readme fields and readmeFilename from the npm packument. If jsDelivr yields no content, it falls back to the packument readme — preferring the versioned packument readme when a specific version was requested, otherwise the top-level packument readme — and excludes sentinel missing values. If no readmeContent is obtained, it returns the packageName, version, and undefined markdown/repoInfo.

Possibly related PRs

• perf: load markdown source code on copy instead of on main request #1386: Modifies the same README loading and resolution code paths, introducing/adjusting jsDelivr-first fetching and packument fallback logic.

Suggested reviewers

• danielroe

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Merge Conflict Detection	⚠️ Warning	❌ Merge conflicts detected (22 files): ⚔️ app/app.vue (content) ⚔️ app/components/AppFooter.vue (content) ⚔️ app/components/AppHeader.vue (content) ⚔️ app/components/Link/Base.vue (content) ⚔️ app/components/Package/TrendsChart.vue (content) ⚔️ app/components/Package/VersionDistribution.vue (content) ⚔️ app/components/Package/Versions.vue (content) ⚔️ app/utils/versions.ts (content) ⚔️ i18n/locales/en.json (content) ⚔️ i18n/locales/fr-FR.json (content) ⚔️ i18n/schema.json (content) ⚔️ lunaria/files/en-GB.json (content) ⚔️ lunaria/files/en-US.json (content) ⚔️ lunaria/files/fr-FR.json (content) ⚔️ package.json (content) ⚔️ pnpm-lock.yaml (content) ⚔️ server/utils/readme-loaders.ts (content) ⚔️ shared/utils/constants.ts (content) ⚔️ test/nuxt/components/PackageVersions.spec.ts (content) ⚔️ test/unit/app/utils/versions.spec.ts (content) ⚔️ test/unit/server/utils/readme-loaders.spec.ts (content) ⚔️ test/unit/shared/utils/package-analysis.spec.ts (content) These conflicts must be resolved before merging into main.	Resolve conflicts locally and push changes to this branch.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The pull request description clearly explains the problem (npm truncation at 65,536 chars), the solution (jsDelivr-first approach), and includes test verification.
Linked Issues check	✅ Passed	The pull request implementation aligns with issue #1458 requirements: it prioritises jsDelivr CDN for README fetching and maintains packument fallback for non-standard filenames.
Out of Scope Changes check	✅ Passed	All changes are focused on the README loading mechanism to resolve the truncation issue; no unrelated modifications to other functionality are present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

test/unit/server/utils/readme-loaders.spec.ts (1)

186-207: Consider adding a test for when packageData.versions is undefined.

All current tests provide versions: {} or with specific entries. Adding a test where versions is omitted entirely would help catch potential TypeError regressions when falling back to packument readme for a specific version.

🧪 Suggested test case

it('handles undefined versions gracefully when falling back', async () => {
  fetchNpmPackageMock.mockResolvedValue({
    'readme': '# Top-level readme',
    'repository': undefined,
    // versions intentionally omitted
    'dist-tags': { latest: '1.0.0' },
  })
  parseRepositoryInfoMock.mockReturnValue(undefined)
  const fetchMock = vi.fn().mockResolvedValue({ ok: false })
  vi.stubGlobal('fetch', fetchMock)

  const result = await resolvePackageReadmeSource('pkg/v/1.0.0')

  expect(result).toMatchObject({
    packageName: 'pkg',
    version: '1.0.0',
    markdown: undefined, // falls through since versions?.['1.0.0'] is undefined
  })
})

[danielroe]

👌

[github-actions]

Thanks for your first contribution, @lukeocodes! ⭐

We'd love to welcome you to the npmx community. Come and say hi on Discord! And once you've joined, visit npmx.wamellow.com to claim the contributor role.