Content Security Policy and SRI

It injects two style tags, so pass their nonce, and the large cursor is a data: SVG image. Leave out the CDN host when you bundle the package. CI runs the widget under default-src 'none' with Trusted Types and fails on any violation.

Content-Security-Policy: script-src 'self' https://cdn.jsdelivr.net;
  style-src 'self' 'nonce-RANDOM'; img-src 'self' data:; require-trusted-types-for 'script'

A11yWidget.init({ nonce: "RANDOM" }); // the same per-response nonce as in the header

@1 on the CDN follows every 1.x release, so it can't carry an integrity hash. For production, pin an exact version with its hash: the browser refuses the file if the CDN ever serves something else. Compute the hash yourself or copy it from the file's page on jsdelivr.com, and update both when you upgrade.

<script src="https://cdn.jsdelivr.net/npm/open-accessibility-widget@1.4.1/dist/open-accessibility-widget.global.js"
        integrity="sha384-dO9rT4vwimvvXQt0APugeYB/UVAs+WxY4DskABQA/kETXVreihc0vfYY0S0lSW9G" crossorigin="anonymous"></script>

curl -s https://cdn.jsdelivr.net/npm/open-accessibility-widget@<version>/dist/open-accessibility-widget.global.js \
  | openssl dgst -sha384 -binary | openssl base64 -A

The widget builds its interface with createElement and never assigns HTML strings, so it works under require-trusted-types-for 'script' with no policy of its own.