From 2ddff27fa8960d85692eba946f7b10987af6de19 Mon Sep 17 00:00:00 2001
From: Lena <lena@letsencrypt.org>
Date: Thu, 24 Sep 2026 12:12:07 -0700
Subject: [PATCH 1/4] all stats use same distribution url

---
 static/js/stats.js | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/static/js/stats.js b/static/js/stats.js
index e8d4993bd..abe1a59a5 100644
--- a/static/js/stats.js
+++ b/static/js/stats.js
@@ -322,17 +322,10 @@ function doPlot() {
   if ( location.hostname === "localhost" ) {
     path = "/js/"; // in dev, will use old data.
   } else {
-    path = "https://d4twhgtvn0ff5.cloudfront.net/";
+    path = "https://d1dfn7jg27m4cf.cloudfront.net/";
   }
 
-  var statsPath;
-  if ( location.hostname === "localhost" ) {
-    statsPath = "/js/"; // in dev, will use old data.
-  } else {
-    statsPath = "https://d1dfn7jg27m4cf.cloudfront.net/";
-  }
-
-  fetch(statsPath+"cert-daily-stats.tsv")
+  fetch(path+"cert-daily-stats.tsv")
   .then(response => {
     return response.text();
   }).then(tsvListener);

From ac8c6f9c4ace95e6498fd9cd17d3fb302176886a Mon Sep 17 00:00:00 2001
From: Lena <lena@letsencrypt.org>
Date: Thu, 24 Sep 2026 12:15:35 -0700
Subject: [PATCH 2/4] update last-update

---
 content/en/stats.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/en/stats.html b/content/en/stats.html
index eb738fbdf..d70cac7f5 100644
--- a/content/en/stats.html
+++ b/content/en/stats.html
@@ -3,7 +3,7 @@
 linkTitle: Statistics
 slug: stats
 excerpt: Let's Encrypt certificate statistics.
-lastmod: 2026-08-18
+lastmod: 2026-09-24
 menu:
   main:
     weight: 70

From 06916a028076a65bd102c3208883ed4f2ec34eb5 Mon Sep 17 00:00:00 2001
From: Lena <lena@letsencrypt.org>
Date: Thu, 24 Sep 2026 12:35:00 -0700
Subject: [PATCH 3/4] update test

---
 .github/workflows/test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index de10dbd4a..2ffc6b954 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -40,7 +40,7 @@ jobs:
       - run: npm run build
       - run: npm test
       - name: Install xmllint
-        run: sudo apt-get install -y libxml2-utils
+        run: sudo apt-get update && sudo apt-get install -y libxml2-utils
       - name: Validate RSS feed
         run: xmllint --noout public/feed.xml
       # - run: npm run test:html5validate

From 9f0949127f98d6f70cd63756789a4253266354c2 Mon Sep 17 00:00:00 2001
From: Lena <lena@letsencrypt.org>
Date: Thu, 24 Sep 2026 12:37:48 -0700
Subject: [PATCH 4/4] remove old distribution url

---
 config/_default/server.toml | 3 +--
 netlify.toml                | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/config/_default/server.toml b/config/_default/server.toml
index 1f7a6d0af..d4777c92f 100644
--- a/config/_default/server.toml
+++ b/config/_default/server.toml
@@ -18,7 +18,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
+# "connect-src https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -78,7 +78,6 @@ Content-Security-Policy = """
         https://widget.thegivingblock.com/
     ;
     connect-src 'self'
-        https://d4twhgtvn0ff5.cloudfront.net/
         https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com
diff --git a/netlify.toml b/netlify.toml
index 807b4047c..9dc4971e9 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -28,7 +28,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
+# "connect-src https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -88,7 +88,6 @@ Content-Security-Policy = """
         https://widget.thegivingblock.com/
     ;
     connect-src 'self'
-        https://d4twhgtvn0ff5.cloudfront.net/
         https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com