08c21134cd
If you output HTML with MathJax content Pandoc might uses a JS library provided by cdn.polyfill.io which is now considered to be a bad actor. https://sansec.io/research/polyfill-supply-chain-attack Pandoc does not use this domain in recent versions but upgrading it seems more complex right now especially if we consider backports to the stable releases.