@next/next/no-unwanted-polyfillio

The polyfill.io domain changed hands, and in 2024 it started serving malicious code to the sites that loaded it. A script from https://polyfill.io/v3/ or https://cdn.polyfill.io/v2/ is always reported.

The same service lives on at polyfill-fastly.net, polyfill-fastly.io and cdnjs.cloudflare.com/polyfill/. For those hosts, the rule reads the features parameter and reports the features Next.js already includes, such as fetch, Promise, Map, URL, Object.entries and es2015 to es2019. Your users would download them twice.

The rule checks <script> elements and the component you import from next/script.

Configure

Off by default. To turn it on:

[lint.rules]
"@next/next/no-unwanted-polyfillio" = "error" # or "warn"

Examples

Reported:

export default function Polyfills() {
  return <script src="https://polyfill.io/v3/polyfill.min.js?features=IntersectionObserver" />;
}

import Script from "next/script";

export default function Polyfills() {
  return <Script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=fetch,Array.prototype.at" />;
}

Not reported, because Next.js doesn't include IntersectionObserver:

import Script from "next/script";

export default function Polyfills() {
  return <Script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=IntersectionObserver" />;
}