> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truv.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pin a Bridge version

> Load a fixed, verifiable version of the Truv Bridge script

Load a fixed version of the Bridge script and verify it with [Subresource Integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity). Use version pinning when your security policy requires review of third-party script updates.

<Note>
  Truv recommends the default `https://cdn.truv.com/bridge.js` without a pinned version. It always serves the latest version, so you get fixes without changing your code. A pinned version requires you to [update it](#update-a-pinned-version) within 6 months of its release.
</Note>

Pin the version in a [`<script>` tag](#add-the-script) or with the [`@truv/bridge` and `@truv/react` packages](#use-the-npm-packages).

***

## Get the latest version

Every Bridge release publishes a manifest. Fetch the manifest of the latest release:

```bash theme={null}
curl https://cdn.truv.com/bridge/latest.json
```

The manifest contains everything you need for the script tag:

```json theme={null}
{
  "version": "vX.X.X",
  "url": "https://cdn.truv.com/bridge/vX.X.X/bridge.js",
  "integrity": "sha384-<hash>",
  "releasedAt": "YYYY-MM-DD"
}
```

| Field | Description |
| - | - |
| `version` | Bridge version |
| `url` | Script URL for this version. The file at this URL never changes. |
| `integrity` | Value for the `integrity` attribute of the script tag |
| `releasedAt` | Date the version was published, in UTC (`YYYY-MM-DD`) |

Each version also keeps its own manifest at `https://cdn.truv.com/bridge/vX.X.X/manifest.json`.

***

## Add the script

Copy `url` and `integrity` from the manifest into the script tag:

```html theme={null}
<script
  src="https://cdn.truv.com/bridge/vX.X.X/bridge.js"
  integrity="sha384-<hash>"
  crossorigin="anonymous"
></script>
```

<Warning>
  Always set `crossorigin="anonymous"` together with `integrity`, or the browser blocks the script. Never set `integrity` on `https://cdn.truv.com/bridge.js`: that URL serves the latest version, so its hash changes with every release.
</Warning>

Then call `TruvBridge.init()` as usual. See [Embedded Orders](/developers/integration/embedded-orders/overview) or [Widget-only](/developers/integration/bridge-widget/overview).

***

## Use the npm packages

<Info>
  Version pinning requires `@truv/bridge` 2.3.0 or later, or `@truv/react` 2.4.0 or later.
</Info>

[`@truv/bridge`](https://www.npmjs.com/package/@truv/bridge) and [`@truv/react`](https://www.npmjs.com/package/@truv/react) load the latest Bridge script as soon as you import them. To pin a version, import from `@truv/bridge/lazy` or `@truv/react/lazy` instead. Then pass `source: 'cdn'` with `version` and `integrity` from the manifest to `load()`:

```javascript theme={null}
import { init, load } from '@truv/bridge/lazy';

load({
  source: 'cdn',
  version: 'vX.X.X',
  integrity: 'sha384-<hash>',
});
```

`init()` and the React components wait until you call `load()`. Call it as early as possible, for example on app start. Only the first `load()` call takes effect. See the package documentation on npm for the React example and the full API.

<Warning>
  Never import `@truv/bridge` or `@truv/react` without `/lazy` in the same app. That import loads the latest version, and your pinned `version` and `integrity` are ignored.
</Warning>

### Use your own script tag

With `source: 'cdn'`, the package inserts the Bridge script into the page at runtime. If your Content Security Policy or another restriction blocks dynamically inserted scripts, add the [script tag](#add-the-script) to your HTML yourself. Then pass `source: 'window'` to `load()`. The package uses `window.TruvBridge` from your script tag and never loads the script itself:

```javascript theme={null}
import { init, load } from '@truv/bridge/lazy';

load({ source: 'window' });
```

Place the script tag without `async` before your app's script. `window.TruvBridge` must exist when you call `init()` or when a React component opens Bridge. Otherwise, Bridge doesn't open and logs an error to the browser console.

***

## Update a pinned version

Update to a newer version within 6 months of the pinned version's `releasedAt` date. The period starts at release, not when you pin the version.

<Steps>
  <Step title="Get the latest version">
    Fetch `https://cdn.truv.com/bridge/latest.json`.
  </Step>

  <Step title="Update your code">
    Replace `src` and `integrity` in the script tag, or `version` and `integrity` in the `load()` call. With `source: 'window'`, update only the script tag.
  </Step>

  <Step title="Test in sandbox">
    Create a bridge token on your backend with your sandbox API keys. Open Bridge with that token before you deploy to production.
  </Step>
</Steps>

<Note>
  Pinning locks the version of the Bridge script running on your page. The verification flow that Bridge opens is served by Truv and always runs the latest version.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.