Remove malicious polyfill.io usage

[alanhamlett]

Polyfill.io is redirecting to malicious websites. This PR removes the optional and unnecessary polyfill.io usage.

[hotwebmatter]

I'm not a maintainer, but this looks good to me.

Merging this would also resolve #1162

There's some urgency here; without this patch, the Choices-js library functions as a vector for malware. 👾

[mbomb007]

Good to go

[mbomb007]

I will also note that the website linked on the repo, choices-js[dot]github[dot]io/Choices/ contains the malicious CDN until this is fixed.

[mbomb007]

The repo doesn't appear to be maintained anymore. Nothing has been committed or merged in two years, neither on this repo, nor in any other repo by the main two maintainers.

Can someone contact a maintainer or someone with access to merge commits?

[icf-chartmann]

I'm emailing the maintainer at matt@modeldba.com

Hi Matt,

There is a PR (#1161) to replace the newly malicious polyfill.io dependency for the Choices library. The PR has been reviewed and approved but requires the maintainer to merge.
There are hundreds of thousands of Drupal websites using Webforms that rely on this plugin.
Please review and merge.
I will help find a new maintainer if you’re interested, but for now, please take action on this critical security issue.

Sincerely,
Carey Hartmann and the Drupal Community