polyfill.io Library is no longer considered safe to use

Created on 24 June 2024, 5 months ago
Updated 10 July 2024, 5 months ago

Problem/Motivation

The polyfill.io library has been sold to a chinese company named Funnull that is not considered trustworthy. We believe this poses a grave security threat and the library is now considered unsafe.

https://twitter.com/triblondon/status/1761852117579427975

Proposed resolution

Both Fastly and Cloudflare are offering a replacement for the polyfill.

https://community.fastly.com/t/new-options-for-polyfill-io-users/2540
https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo...

Remaining tasks

Replace the polyfill.io with a safe option from quicklink.libraries.yml:
https://git.drupalcode.org/project/quicklink/-/blob/2.0.x/quicklink.libr...

๐Ÿ“Œ Task
Status

Fixed

Version

2.0

Component

Code

Created by

๐Ÿ‡ซ๐Ÿ‡ฎFinland heikkiy Oulu

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupalโ€™s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the โ€œReport a security vulnerabilityโ€ link in the project pageโ€™s sidebar. See how to report a security issue for details.

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024