{"record":{"id":"e64d4b418534be55","repo":"oxc-project/oxc","slug":"no-duplicate-polyfills-from-polyfill-io-are-allowe","errorCode":null,"errorMessage":"No duplicate polyfills from Polyfill.io are allowed. {polyfill_name} already shipped with Next.js.","messagePattern":"No duplicate polyfills from Polyfill\\.io are allowed\\. (.+?) already shipped with Next\\.js\\.","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/nextjs/no_unwanted_polyfillio.rs","lineNumber":18,"sourceCode":"use cow_utils::CowUtils;\nuse oxc_ast::{\n    AstKind,\n    ast::{JSXAttributeItem, JSXAttributeName, JSXAttributeValue},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_semantic::AstNode;\nuse oxc_span::Span;\n\nuse crate::{\n    context::{ContextHost, LintContext},\n    rule::Rule,\n    utils::{NEXT_POLYFILLED_FEATURES, find_url_query_value, get_next_script_import_local_name},\n};\n\nfn no_unwanted_polyfillio_diagnostic(polyfill_name: &str, span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(format!(\n        \"No duplicate polyfills from Polyfill.io are allowed. {polyfill_name} already shipped with Next.js.\"\n    ))\n    .with_help(\"See https://nextjs.org/docs/messages/no-unwanted-polyfillio\")\n    .with_label(span)\n}\n\nfn polyfill_io_security_warning(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\n        \"Using polyfill.io is a security risk due to a supply chain attack in 2024.\"\n    )\n    .with_help(\"Replace with a safe alternative like https://cdnjs.cloudflare.com/polyfill/ or use modern browser features directly. See: https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk\")\n    .with_label(span)\n}\n\n#[derive(Debug, Default, Clone)]\npub struct NoUnwantedPolyfillio;\n\ndeclare_oxc_lint!(","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/nextjs/no_unwanted_polyfillio.rs#L1-L36","documentation":"Warning from oxlint rule `nextjs/no-unwanted-polyfillio`. Next.js already polyfills a fixed feature list (`NEXT_POLYFILLED_FEATURES`); requesting those same features from Polyfill.io ships duplicate polyfill code to every visitor. The rule parses the `features` query of polyfill.io script URLs and reports each overlap; the same rule also warns that polyfill.io itself is a security risk after the June 2024 supply-chain takeover.","triggerScenarios":"A `<Script>` from `next/script` whose `src` contains `polyfill.io` with a `?features=` list naming at least one feature Next.js already polyfills (e.g. `Promise`, `Array.prototype.find`, `fetch`).","commonSituations":"Legacy boilerplate loading `https://cdn.polyfill.io/v3/polyfill.min.js?features=...`; keeping old-browser support via polyfill.io from before the 2024 compromise.","solutions":["Remove the duplicated feature names from the `features` query — those ship with Next.js already.","Better: drop polyfill.io entirely — bundle `core-js` via your Babel preset, or use a trusted mirror such as `https://cdnjs.cloudflare.com/polyfill/`.","If you must keep it, request only features absent from Next.js' polyfill list."],"exampleFix":"// before\n<Script src=\"https://cdn.polyfill.io/v3/polyfill.min.js?features=Promise,Array.prototype.find\" />\n\n// after\n<Script src=\"https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=Intl.Locale\" />","handlingStrategy":"validation","validationCode":"// any polyfill.io reference deserves review (security + duplicates):\n// rg -n 'polyfill\\.io' -g '*.{ts,tsx,js,jsx}' .","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not add new polyfill.io URLs at all — the domain was compromised in June 2024.","Prefer core-js via your build, or the cdnjs.cloudflare.com polyfill mirror.","Check requested features against Next.js' shipped polyfill list before loading any CDN polyfill."],"tags":["nextjs","polyfill","security","performance","lint"],"backgroundTag":"unwanted-polyfill","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}