From 237621e17777ea02ec72cff0b579bc59e5663f23 Mon Sep 17 00:00:00 2001 From: Joseph Le Date: Tue, 25 Jun 2024 13:11:45 -0700 Subject: [PATCH 1/2] docs: redirect Polyfill.io to cdnjs polyfill Polyfill.io is compromised: https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk https://x.com/triblondon/status/1761852117579427975 https://github.com/polyfillpolyfill/polyfill-service/issues/2873 https://sansec.io/research/polyfill-supply-chain-attack --- docs/guide/build.md | 2 +- packages/plugin-legacy/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guide/build.md b/docs/guide/build.md index 50abd7c91cea56..2bb95acea3021a 100644 --- a/docs/guide/build.md +++ b/docs/guide/build.md @@ -13,7 +13,7 @@ The production bundle assumes support for modern JavaScript. By default, Vite ta You can specify custom targets via the [`build.target` config option](/config/build-options.md#build-target), where the lowest target is `es2015`. -Note that by default, Vite only handles syntax transforms and **does not cover polyfills**. You can check out [Polyfill.io](https://polyfill.io/) which is a service that automatically generates polyfill bundles based on the user's browser UserAgent string. +Note that by default, Vite only handles syntax transforms and **does not cover polyfills**. You can check out [cdnjs's polyfill service](https://cdnjs.cloudflare.com/polyfill/) which automatically generates polyfill bundles based on the user's browser UserAgent string. Legacy browsers can be supported via [@vitejs/plugin-legacy](https://github.com/vitejs/vite/tree/main/packages/plugin-legacy), which will automatically generate legacy chunks and corresponding ES language feature polyfills. The legacy chunks are conditionally loaded only in browsers that do not have native ESM support. diff --git a/packages/plugin-legacy/README.md b/packages/plugin-legacy/README.md index 055cb6678c1bef..0aadd342aa60d3 100644 --- a/packages/plugin-legacy/README.md +++ b/packages/plugin-legacy/README.md @@ -91,7 +91,7 @@ npm add -D terser If `modernTargets` is not set, it is **not recommended** to use the `true` value (which uses auto-detection) because `core-js@3` is very aggressive in polyfill inclusions due to all the bleeding edge features it supports. Even when targeting native ESM support, it injects 15kb of polyfills! - If you don't have hard reliance on bleeding edge runtime features, it is not that hard to avoid having to use polyfills in the modern build altogether. Alternatively, consider setting `modernTargets` or using an on-demand service like [Polyfill.io](https://polyfill.io) to only inject necessary polyfills based on actual browser user-agents (most modern browsers will need nothing!). + If you don't have hard reliance on bleeding edge runtime features, it is not that hard to avoid having to use polyfills in the modern build altogether. Alternatively, consider setting `modernTargets` or using an on-demand service like [cdnjs's polyfill service](https://cdnjs.cloudflare.com/polyfill/) to only inject necessary polyfills based on actual browser user-agents (most modern browsers will need nothing!). ### `renderLegacyChunks` From 611c492800f9f2ad231dcf68914186a3217ce146 Mon Sep 17 00:00:00 2001 From: Bjorn Lu Date: Wed, 26 Jun 2024 11:14:47 +0800 Subject: [PATCH 2/2] Update README.md --- packages/plugin-legacy/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/plugin-legacy/README.md b/packages/plugin-legacy/README.md index 0aadd342aa60d3..ad90980609a285 100644 --- a/packages/plugin-legacy/README.md +++ b/packages/plugin-legacy/README.md @@ -91,7 +91,7 @@ npm add -D terser If `modernTargets` is not set, it is **not recommended** to use the `true` value (which uses auto-detection) because `core-js@3` is very aggressive in polyfill inclusions due to all the bleeding edge features it supports. Even when targeting native ESM support, it injects 15kb of polyfills! - If you don't have hard reliance on bleeding edge runtime features, it is not that hard to avoid having to use polyfills in the modern build altogether. Alternatively, consider setting `modernTargets` or using an on-demand service like [cdnjs's polyfill service](https://cdnjs.cloudflare.com/polyfill/) to only inject necessary polyfills based on actual browser user-agents (most modern browsers will need nothing!). + If you don't have hard reliance on bleeding edge runtime features, it is not that hard to avoid having to use polyfills in the modern build altogether. Alternatively, consider setting `modernTargets` or using an on-demand service like https://cdnjs.cloudflare.com/polyfill/ to only inject necessary polyfills based on actual browser user-agents (most modern browsers will need nothing!). ### `renderLegacyChunks`