extra_javascript:
    - javascripts/mathjax.js
-   - https://polyfill.io/v3/polyfill.min.js?features=es6
    - https://unpkg.com/mathjax@3/es5/tex-mml-chtml.js

Added by @squidfunk

Context

No response

Description

Polyfill.io was bought by a Chinese company earlier this year and has since then gone on to inject malicious code into the polyfill code it delivers.

Polyfill.io should be removed where possible, if not Fastly and Cloudflare have set up mirrors of safe code.

Related links

• [Polyfill supply chain attack hits 100K+ sites] (https://sansec.io/research/polyfill-supply-chain-attack)
• Polyfill.io JavaScript supply chain attack impacts over 100K sites

Use Cases

This'll affect all users of the project.

Visuals

No response

Before submitting

• I have read and followed the change request guidelines.
• I have verified that my idea is a change request and not a bug report.
• I have ensured that, to the best of my knowledge, my idea will benefit the entire community.
• I have included relevant links to the documentation, related issues, and discussions to underline the need for my idea.