Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency of compromised polyfill.io #357

Closed
shtumi opened this issue Jun 29, 2024 · 5 comments
Closed

Dependency of compromised polyfill.io #357

shtumi opened this issue Jun 29, 2024 · 5 comments

Comments

@shtumi
Copy link

shtumi commented Jun 29, 2024

According to investigation of sansec.io
https://sansec.io/research/polyfill-supply-chain-attack
the library polyfill.io became compromised and lead potential security risks of malware injection
BazingaJsTranslationBundle contains link to polyfill.io in js/index.html
I guess need remove this legacy dependency by security reasons.

@karion
Copy link
Contributor

karion commented Jul 1, 2024

#359

@stof
Copy link
Contributor

stof commented Jul 4, 2024

@monteiro this should be closed as the PR has been merged

@monteiro
Copy link
Collaborator

monteiro commented Jul 4, 2024

thanks a lot @stof

@monteiro monteiro closed this as completed Jul 4, 2024
@AndreasA
Copy link

AndreasA commented Aug 1, 2024

@stof @monteiro What about an official release/tag for the fix? as it currently is only available using dev-master. Sure it is only relevant if the template is used directly but still.

@monteiro
Copy link
Collaborator

monteiro commented Aug 2, 2024

@AndreasA absolutely. I will do during today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants