You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On the support/3.x branch, replace links to the polyfill.io website in the comments of our vendored polyfills with the following note at the top of the file:
/** * NOTE * * These polyfills were generated using polyfill.io, which was reported as compromised on 25th June 2024. * * We generated this code well before the compromise, and it is free of malicious code. * However, we recommend checking any polyfills you have generated in a similar way. */
Why
polyfill.io was reported as compromised on 25th June 2024. While our code doesn't load scripts directly from the live service, the polyfills in govuk-frontend had been extracted from this service while it was free of malicious code. These extracts have comments pointing to the polyfill.io website, which would lead our users to a malicious site.
Who needs to work on this
Developers
Who needs to review this
Developers
Done when
Comments linking to polyfill.io in our polyfills have been removed in favour of a generic note.
The text was updated successfully, but these errors were encountered:
What
On the
support/3.x
branch, replace links to the polyfill.io website in the comments of our vendored polyfills with the following note at the top of the file:Why
polyfill.io was reported as compromised on 25th June 2024. While our code doesn't load scripts directly from the live service, the polyfills in govuk-frontend had been extracted from this service while it was free of malicious code. These extracts have comments pointing to the polyfill.io website, which would lead our users to a malicious site.
Who needs to work on this
Developers
Who needs to review this
Developers
Done when
The text was updated successfully, but these errors were encountered: