polyfill.io library is no longer considered safe to use

Created on 24 June 2024, 5 months ago
Updated 9 July 2024, 5 months ago

polyfill.io library is no longer considered safe to use

Problem/Motivation

The polyfill.io library has been sold to a Chinese company named Funnull that is not considered trustworthy. We believe this poses a grave security threat and the library is now considered unsafe.

https://twitter.com/triblondon/status/1761852117579427975

There is also evidence https://github.com/polyfillpolyfill/polyfill-service/issues/2873#issueco... that polyfill.io is used to serve malicious code.

Proposed resolution

Polyfill.io is used in the module libraries at https://git.drupalcode.org/project/testsuite/-/blob/3.0.x/modules/list_p.... It would be good to replace it with a safe option from Fastly or Cloudflare.

https://community.fastly.com/t/new-options-for-polyfill-io-users/2540
https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo...

๐Ÿ“Œ Task
Status

Fixed

Version

3.0

Component

Code

Created by

๐Ÿ‡ซ๐Ÿ‡ฎFinland heikkiy Oulu

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupalโ€™s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the โ€œReport a security vulnerabilityโ€ link in the project pageโ€™s sidebar. See how to report a security issue for details.

Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024