Three scripts from external CDNs (cdnjs.cloudflare.com, unpkg.com, jsdelivr.net), each marked defer to avoid W07, and none with the integrity attribute:
<script defer src="https://cdnjs.cloudflare.com/.../three.min.js"></script> <script defer src="https://unpkg.com/vue@3/..."></script> <script defer src="https://cdn.jsdelivr.net/.../chart.umd.js"></script>
Expected trigger in analyzer 025_https_mixed_content: