DEV Community: Roman

What the new Office.js CDN endpoint actually changes

Roman — Tue, 20 Oct 2026 09:27:54 +0000

I run silentship, an independent monitor for changes on the Office.js CDN. This is a copy of the original note.

Since late September, Microsoft's docs list appsforoffice.microsoft.com as a legacy endpoint and recommend a new one:

	Legacy	New
Release	`appsforoffice.microsoft.com/lib/1/hosted/office.js`	`officeapis.public.onecdn.static.microsoft/1/office.js`
Preview	`appsforoffice.microsoft.com/lib/beta/hosted/office.js`	`officeapis.public.onecdn.static.microsoft/beta/office.js`

The docs say the new endpoint "serves the same current Office.js release, but it enables additional secure defaults", without saying which defaults. So we compared the two directly.

Short answer

Same build. Both endpoints serve 16.0.20606.15070.
Host files are byte-identical. excel-win32-16.01.js, word-win32-16.01.js, outlook-win32-16.02.js, powerpoint-web-16.00.js and the rest have the same SHA-256 on both. Every Office API your add-in calls comes from the same code.
Only office.js (the loader) differs, and only by two lines at the top:

isOsfSecurityDefaultsEnabled = true;
osfLoadMsAjax = false;

Everything else in the loader is identical. Both endpoints also sit behind the same Akamai + Azure Front Door setup, with the same caching headers.

What the two flags do

Reading the loader, the logic is:

If the <script> tag that loads office.js has a data-enable-trusted-types attribute, that attribute decides.
Otherwise, isOsfSecurityDefaultsEnabled decides.
If the result is "on", the loader does not load MicrosoftAjax and creates a Trusted Types policy named officejs.

On the legacy endpoint neither flag is set, so neither happens unless you opt in. On the new endpoint both happen by default.

Another detail: the loader decides where to fetch host files from based on its own src. An add-in that loads office.js from the new endpoint gets all of its Office.js files from there, not a mix.

Who can break when switching

Add-ins that use MicrosoftAjax without knowing it. The legacy loader quietly pulls in MicrosoftAjax.js, so its globals have always been there. Code (yours or a dependency's) that touches Sys.*, Type.registerNamespace, Function.createDelegate or $create works today and throws ReferenceError on the new endpoint. Search your bundle, not just your source:

grep -rnE "\bSys\.|Type\.registerNamespace|Function\.createDelegate|\$create\(" dist/

Pages with a strict CSP or Trusted Types. With require-trusted-types-for 'script', the officejs policy has to be allowed (trusted-types officejs …), and *.static.microsoft has to be allowed in script-src and in any corporate network allow list.

Microsoft's migration checklist also asks you to register every ExecuteFunction command handler with Office.actions.associate(...). The loader diff contains nothing beyond the two flags, so that requirement comes from code paths that behave differently once the flags are on, not from a separate switch.

Trying the new defaults without changing the URL

Because the decision starts with the data-enable-trusted-types attribute, you should be able to get the new endpoint's behaviour on the legacy URL:

<script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"
        data-enable-trusted-types="true"></script>

We read this from the loader and haven't tested it in every host. Treat it as a quick way to find MicrosoftAjax dependencies in a test build, not as a production setting.

The risk worth watching

Today the only difference between the endpoints is two flags in one file. Nothing stops the same two lines from appearing in the legacy loader one day. Microsoft ships loader updates the way it ships everything else on this CDN: without a changelog, edge by edge. If that happens, add-ins that still depend on MicrosoftAjax will start failing on a growing share of loads over a day or so, without a single line of their own code changing.

silentship now watches both endpoints. A change to either flag on any endpoint is treated as High, and subscribers are alerted as soon as it's confirmed on two runs. You can see both endpoints side by side on every rollout page.

Alerts: silentship.dev

Checked on 19 Oct 2026 against build 16.0.20606.15070. Microsoft's page: Referencing the Office JavaScript API library from its CDN. Thanks to the commenter on office-js#6513 who pointed out the new endpoint.

How finddax.com turns four spellings of one search into a single cache hit (Node + MongoDB)

Roman — Mon, 19 Oct 2026 14:19:54 +0000

If you cache search results, your cache key is probably the search query. That works right up until real people start typing.

I'm building Finddax. It's a tool for freelancers and small agencies who sell websites to local businesses. You type a city and a category, say "plumbers in Chicago", and finddax.com returns businesses on Google Maps that have good ratings and reviews but no website. One click then generates a working site for that business, plus a short pitch to send the owner. So you're not cold-calling with "do you want a website?", you're sending "here's your website, take a look."

Every search on Finddax goes through a shared cache. If two users look for "barbershop New York" in the same week, only the first one triggers a Google Maps lookup. The second one is served from MongoDB in milliseconds. That cache is the reason the free tier can exist at all.

The problem is obvious once you think about real input:

Junk removal
junk removal (trailing space)
junk removal (two spaces)
junk remooooval (somebody held a key)

Same search, same results. Use the raw string as the cache key and that's four keys and three misses you didn't need.

Here's what I ended up with in the Finddax backend, step by step.

Step 1: the boring normalization

const REPEATED_CHARS = /(.)\1{2,}/gu

function baseNormalize(text) {
  return text
    .toString()
    .trim()
    .toLowerCase()
    .replace(/\s+/g, ' ')
    .replace(REPEATED_CHARS, '$1')
}

The first four steps are obvious. The last one is the interesting one: it collapses three or more identical characters into one.

Why three and not two? Because doubled letters are everywhere in real words: co*ffee, pizza, grass, ball*room. Stretched typos look like remooooval or coffeeee. No real word has the same letter three times in a row. So {2,} after the capture group fixes the stretched typos and never touches a correct spelling.

It's a one-character decision, and it's the line I'd most want a reviewer to look at.

Step 2: Levenshtein, with a threshold that scales

Normalization handles whitespace and stretched letters. It doesn't handle junk remval, which has a letter missing. For that, Finddax compares the input against existing canonical terms by edit distance:

function clusterThreshold(length) {
  return Math.min(3, Math.max(1, Math.floor(length * 0.25)))
}

That's roughly one allowed edit per four characters, clamped to 1–3:

Term length	Allowed edits
1–7	1
8–11	2
12+	3

The low clamp matters: without it, anything shorter than 4 characters would get a threshold of 0 and never cluster. The high clamp stops long queries from swallowing genuinely different searches just because they share most of their letters.

The two steps work together. Take coffeeee:

Normalization collapses eeee into e and gives coffe.
coffe is distance 1 from coffee, and the threshold for 5 characters is 1.
Same cluster, same cache bucket.

And junk remooooval: normalization turns it into junk removal, an exact match, no Levenshtein needed. All four spellings from the list above resolve to the same set of placeIds.

Step 3: don't run Levenshtein against the whole table

The naive version loads every term and runs the distance function against each one, on every search. That's fine with 50 terms and silly with 50,000.

The trick: edit distance is never smaller than the difference in lengths. If the input has 12 characters and the threshold is 3, a 20-character term can't possibly match. So that filter goes into Mongo:

const candidates = await SearchTerm.find({
  type,
  mergedInto: null,
  $expr: {
    $lte: [
      { $abs: { $subtract: [{ $strLenCP: '$canonical' }, normalized.length] } },
      threshold,
    ],
  },
})
  .select('canonical')
  .lean()

Use $strLenCP (code points), not $strLenBytes. Search terms can contain café, Zürich or Kraków, and the UI also ships in Ukrainian, where every letter is 2 bytes in UTF-8. $strLenBytes would make those terms look longer than they are and quietly drop valid candidates. JavaScript's .length isn't strictly code points either, but for the BMP characters people type into a search box it agrees with $strLenCP.

The result is identical to the naive version. I just load a small slice of the registry.

Step 4: the synonyms Levenshtein can't see

junk removal and trash hauling are the same business. cleaning service and maid service mostly are too. The edit distance between them is basically the whole string, so no string metric will catch that.

So once a week a Finddax job sends the list of canonical terms to an LLM (DeepSeek) and asks which ones mean the same thing. It sends only the term strings: no business data, no user data. The model returns pairs, and the job marks one term in each pair with mergedInto: <other canonical>.

At lookup time the chain is followed to the end:

async function followMergeChain(term) {
  let current = term
  const seen = new Set([current.canonical])
  while (current.mergedInto && !seen.has(current.mergedInto)) {
    seen.add(current.mergedInto)
    const next = await SearchTerm.findOne({ type: current.type, canonical: current.mergedInto })
    if (!next) break
    current = next
  }
  return current
}

The seen set is there because an LLM will eventually return both A→B and B→A in the same week, and I'd rather not find out what an infinite loop in a request handler looks like in production.

The bug that was waiting for exactly this

The first version of the lookup did this:

Find a near match among live terms (mergedInto: null).
If there's none, create() a new term.

Now imagine someone types the exact canonical of a term that was merged last week. Step 1 skips it, because it isn't live. Step 2 tries to create it and hits the unique index on {type, canonical}, because the merged term still exists under that canonical. 500.

The fix was to check for an exact match first, merged or not, with one indexed lookup, before any clustering. Merged terms then resolve through the chain like everything else.

New terms are also created with an upsert ($setOnInsert) instead of create(). Two users searching for a brand-new term in the same second is rare, but "rare" in a request handler means "eventually".

What this can and can't do

A few things I know are wrong, or at least questionable:

Short words are risky. At 3 characters the threshold is 1, so spa and spar would land in the same cluster. Short terms probably need a threshold of 0 plus an explicit synonym list.
The first typo wins. Whoever searches a term first defines its canonical form. If the very first search is barbeershop (only two e's, so normalization keeps it), that becomes the canonical, and the autocomplete label is the first raw variant. Electing the most frequent variant would fix it. I haven't done that yet.
Terms have no language field. Finddax ships in English and Ukrainian, and the term registry is shared. For autocomplete I filter by script: English users see Latin-script terms, Ukrainian users see Cyrillic ones. It works only because the two languages don't share an alphabet, and it would break the day I add Spanish next to English.

The part I didn't expect

The same SearchTerm table that normalizes cache keys became the autocomplete. Every search increments a count atomically ($inc, so concurrent searches don't lose updates), and suggestions are a prefix regex sorted by that count. Start typing in the search box on finddax.com and the suggestions you see are just this table. I never designed a "popular searches" feature. It fell out of keeping cache keys consistent.

The cache window is 7 days now (it started at 1). Businesses on maps change slowly, and a cache miss is the slowest and most expensive request in the app.

The same cache also feeds the public businesses without a website pages on Finddax. Once a month the backend scans a set of cities through the exact same cache-first path users hit, and a static page per city gets rebuilt from the results. Every user search makes those pages a little fresher for free.

Try it

The product: finddax.com. Sign in with Google and you get 15 free credits, no card. A search costs 1 credit and a generated website costs 10.
City lists: finddax.com/en/businesses-without-website
The technique: one service of under 200 lines plus one Mongo $expr. No Elasticsearch, no trigram index, no Redis.

If you sell websites to local businesses, I'd really like to know whether Finddax finds leads you'd actually contact. And if you've run fuzzy cache keys at a larger scale: at what point did you give up on Levenshtein for trigrams or embeddings? Has anyone found a clean way to pick the canonical spelling other than "most frequent wins"?

A 33-hour Office.js rollout that changed four bytes

Roman — Sat, 17 Oct 2026 10:41:52 +0000

If you build Office add-ins, you load Office.js from one fixed URL:

https://appsforoffice.microsoft.com/lib/1/hosted/office.js

There is no version in that URL, no changelog for what it serves, and no Subresource Integrity hash you could pin. Microsoft ships new code behind it whenever it decides to, and your add-in picks it up the next time Office loads it. In February, 233 developers discussed exactly this in an open letter on the office-js repo: add-ins breaking with no warning, no record of what changed, and no way to tell whether a bug is theirs or Microsoft's.

I wanted to see what one of those silent updates actually looks like from the outside. So I built a small monitor, silentship, and caught a full rollout from (almost) start to finish.

How the monitor works

The loader tells you which files exist. office.js is only a bootstrapper. It contains a map of every host and platform (excel-win32-16.01.js, outlook-web-16.01.js, …), so the crawler builds its file list from the loader itself.
Every file carries its own build stamp. There isn't one "Office.js version". PowerPoint and OneNote files have a // host: 16.0\16.0.x header, Excel and Word embed hostJSVersion, and Outlook lives on a separate build line entirely (osfweb version: 16.0.20410.x when I looked).
Sampling, not polling. Every 10 minutes each file is requested 8 times, each on a fresh TLS connection, so the CDN spreads the requests across different edge servers. Requests are conditional on the stable version's Last-Modified: edges still serving the old file answer 304 with no body, so only a new version costs bandwidth. The share of samples that return the new build is the "rollout %".
API diff by reflection. New versions are executed in a locked-down sandbox (separate process, empty environment, Node permission model) and the public API surface (Office.*, Excel.*, Word.*, …) is walked and diffed against the previous build. API status (GA, preview, undocumented) comes from Microsoft's own @types/office-js and @types/office-js-preview.
No Microsoft code is published. The site shows metadata and API-surface diffs only.

The rollout: 16.0.20528 → 16.0.20606

	Production	Beta
First seen	Oct 14, 20:06 UTC	Oct 14, 20:07 UTC
Complete (100% for 3 runs)	Oct 16, 04:50 UTC	Oct 16, 04:50 UTC
Duration (observed)	~33 h	~33 h
Host files	22	20
Public API changes	0 (only the build stamp changed)	44, in 12 types

A few things surprised me.

It was already moving when I first looked. On the very first run some files were well past the start line: beta excel-web was on 87.5% of samples, production excel-winrt on 75%. So "20:06" is an upper bound for the start, not the start.

Hosts don't move together. In production, visio-web and excel-winrt were complete within the first hour. word-win32 was the very last file in both channels, about 32 hours later.

There's a long plateau. For roughly 20 hours the overall share sat between 40% and 60% and went up and down: the same edge would serve the new build on one run and the old one on the next. Then, between midnight and 02:00 UTC on Oct 16, it jumped from ~55% to ~95% and finished a few hours later.

In practice, that plateau is the part that hurts. For most of a day, two users of the same add-in, on the same host, could load different Office.js builds, depending only on which edge answered. If you ever had a bug report that you couldn't reproduce and that "fixed itself" the next day, this is one way that happens.

What actually changed: four bytes (in production)

The API diff for production came back empty, so I compared the files themselves. For 21 of the 22 production files, 20606 is byte-for-byte identical to 20528 except for the embedded build stamp. In excel-win32-16.01.js, the whole 33-hour rollout changed exactly four bytes: hostJSVersion="16.0.20528…" became "16.0.20606…".

So in production this was a version bump, not a code change. Nothing about it could break your add-in. But for a day and a half your users were still loading two "different" builds of the same code, and from the outside you can't tell which kind of rollout you're in until you diff it. The next one may not be a no-op.

What changed in the API (beta)

Beta is where the real changes went: 44 changes across Excel and PowerPoint files, grouping into 12 types. Almost all of it is preview API, which Microsoft serves only from the beta CDN:

Removed (preview): Excel.SensitivityLabelAbacAttribute, Excel.SensitivityLabelAbacAttributeValue, and their PowerPoint counterparts.
Renamed (preview): SensitivityLabelUpdateResult → SensitivityLabelUpdateStatus in both Excel and PowerPoint.
Added (not in Microsoft's type definitions yet): Excel.AllowedUrls, Excel.Copilot.allowedUrls, a pivotTableEdit value on Excel.UserActivityType.
Enum value added: tabs on Excel.EntityCardLayoutType, which Microsoft's types list as GA (ExcelApi 1.19). It isn't on the production CDN yet: production doesn't even have the array value that beta already shipped.

None of this should break a production add-in; preview APIs come with an explicit "do not use in production" warning. But if you were experimenting with sensitivity labels on the beta CDN, your code started throwing TypeError: Excel.SensitivityLabelAbacAttribute is not a constructor sometime on Oct 14–15, gradually, on a growing share of loads. Each changed type has its own page with the exact error messages, e.g. Excel.SensitivityLabelAbacAttribute.

What this can and can't see

Only the JavaScript layer. Plenty of add-in breakage comes from the native hosts (Outlook classic vs. new Outlook, Excel on Windows vs. web), and that never touches the CDN. If your add-in broke and nothing shows up here, that's useful information too: it's probably not the CDN.
One vantage point. All samples come from a European server. Other regions may see the same rollout at a different pace.
8 samples per file means a single run moves in 12.5% steps; the site smooths over the last hour.

Try it

Live status and every rollout: silentship.dev
RSS feed of new builds
Email alerts are optional, and only for builds that change the public API

I'd love to hear from people who maintain add-ins in production: did this rollout line up with anything you saw? And what would make this actually useful to you: per-API watchlists, a webhook into your CI, something else?