Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: replace polyfill.io #3033

Merged
merged 2 commits into from
Mar 28, 2024
Merged

Conversation

SukkaW
Copy link
Contributor

@SukkaW SukkaW commented Mar 7, 2024

Issue(s) Resolved

N/A

Test Plan

N/A

Screenshots (if applicable)

N/A

Optional

Notes/Context/Gotchas

polyfill.io was acquired by a China-based CDN company "Funnull", see the announcement from the polyfill.io domain owner's Twitter and https://github.com/polyfillpolyfill/polyfill-service/issues/2834. Despite Funnull's claims of operating in the United States, the predominance of Simplified Chinese on its website suggests otherwise, and it turns out that "Funnull" is notorious for providing service for the betting and pornography industries.

The original creator of the polyfill.io has voiced his concern on Twitter. And since the acquisition, numerous issues have emerged (polyfillpolyfill/polyfill-service#2835, polyfillpolyfill/polyfill-service#2838, alist-org/alist#6100), rendering the polyfill.io service extremely unstable. Since then, Fastly (Announcement) and Cloudflare (Announcement) has hosted their own instances of polyfill.io service.

Supporting Docs

N/A

@gabestein
Copy link
Member

Thanks for this!

@gabestein
Copy link
Member

Let's go with fastly over cloudflare

@SukkaW
Copy link
Contributor Author

SukkaW commented Mar 12, 2024

@gabestein I've replaced cdnjs.cloudflare.com with fastly-polyfill.io and I've also rebased the PR. It is ready for review now.

@tefkah
Copy link
Collaborator

tefkah commented Mar 28, 2024

I've changed the url slightly, but the fastly one works great!

@tefkah
Copy link
Collaborator

tefkah commented Mar 28, 2024

Cannot per se confirm that the output is exactly the same as the polyfill.io one, seem to be very minute differences in the minification, but nothing i'm concerned about.

@tefkah tefkah merged commit 33c318f into pubpub:master Mar 28, 2024
@gabestein
Copy link
Member

Well, this was prescient. Thanks again for the heads up, @SukkaW.

https://sansec.io/research/polyfill-supply-chain-attack

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants