chore(mkdocs.yml): Remove polyfill.io from extra_javascript
What the developer wrote
Authored by SatsCzar
chore(mkdocs.yml): Remove polyfill.io from extra_javascript
What changed, and why it matters
This commit removes a reference to polyfill.io from the project's documentation website configuration. Polyfill.io is a third-party JavaScript service that was used to make documentation pages work in older browsers. It became a security concern in 2024 when the polyfill.io domain was reported to have served malicious code to websites in some cases. Removing it reduces the risk that visitors to the Krux documentation site could be served malicious JavaScript by that external service. The change is defensive and does not by itself prove an attack occurred against Krux users.
Verify the generated documentation site no longer requests polyfill.io, consider auditing remaining external scripts (cdnjs.cloudflare.com entries) for integrity/subresource-integrity attributes, and review whether older documentation builds cached the polyfill.io reference.
Security signals we found
Removal of third-party JavaScript dependency with known supply-chain incident history (polyfill.io)
Documentation-site supply-chain hardening
No firmware or wallet code changed
Evidence from the diff
The commit deletes one line from mkdocs.yml: the extra_javascript entry loading https://polyfill.io/v3/polyfill.min.js?features=es6. MkDocs uses this list to inject scripts into generated documentation pages. The removal eliminates a supply-chain/dependency risk associated with polyfill.io, which was publicly reported in 2024 as having been used to distribute malware after a domain/asset transfer. The remaining extra_javascript entries (require.js and MathJax from cdnjs.cloudflare.com) are left unchanged. No code changes to the Krux firmware or wallet logic are present.
Changed components
mkdocs.yml documentation site configurationDocumentation site visitors' browsers (potential exposure to polyfill.io-supplied script)Inspect captured patch +0 / −1
diff --git a/mkdocs.yml b/mkdocs.yml
index b170032..6ca3e72 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -19,7 +19,6 @@ markdown_extensions:
emoji_generator: !!python/name:material.extensions.emoji.to_svg
extra_javascript:
- - https://polyfill.io/v3/polyfill.min.js?features=es6
- https://cdnjs.cloudflare.com/ajax/libs/require.js/2.3.4/require.min.js
- https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.7/MathJax.js?config=TeX-MML-AM_CHTML
Why this scored 50/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.