Verifone Status Page
Ctrlk
Login

Cardinal Songbird Integration Update

Visa is introducing Subresource Integrity (SRI) and a new quarterly release model for the Songbird JavaScript library.

Not sure if this affects you? If your role is not related to technical integrations — for example reconciliation, reporting, or operations — please forward this page to your technical or development team. If you are unsure who that is, your IT contact or e-commerce manager is a good starting point.

This post is to inform you of an upcoming change to the Cardinal Songbird JavaScript library that may require action from your technical team before 17th June 2026.

What Is Changing

Visa is implementing Subresource Integrity (SRI) in the Songbird JavaScript library and shifting the deployment process from a single release to a quarterly release cadence. Each release will include a new URL path with semantic versioning and a corresponding hash value.

With this new release schedule, Visa will not support versions older than 18 months. Integrations must be kept up to date with each quarterly release, or they risk service interruption when unsupported versions are decommissioned.

The current migration to v2.1.0 is the first release under this new model and must be completed by 17th June 2026.

Does This Apply To You?

OK No Action Required

Verifone Hosted Checkout

If you use the Verifone Hosted Payment Page (HPP) exclusively, Songbird is managed by Verifone. No changes are required on your side.

!Action Required

Direct / Custom Integration

If your site or app directly embeds the Cardinal Songbird script, your team must update the URL and hash before 17th June 2026.

What Your Technical Team Needs To Do

A full integration guide is attached as a PDF below. In summary, your development or integration team will need to:

  1. Update the Songbird script URL

    Replace the existing Songbird script URL with the new v2.1.0 versioned URL for your environment (staging or production).

  2. Add the integrity and crossorigin attributes

    Include the SHA-384 hash and crossorigin="anonymous" on the script tag. Both are required — one without the other provides no security benefit.

  3. Test in staging before promoting to production

    Verify the full 3DS authentication flow completes successfully in your non-production environment before deploying to live.

Deadline: 17th June 2026. Legacy Songbird endpoints will be decommissioned following Cardinal's data centre migration. Integrations not updated by this date may experience service interruption.

paperclip

Attached: Cardinal Songbird v2.1.0 — Integration Guide (PDF) Includes implementation examples for Plain HTML, React, Next.js, Angular, Vue, and PHP, plus environment configuration guidance and a verification checklist.

Click here to download the Integration Guide (PDF)

Support

If you encounter issues during migration, contact the appropriate Verifone support team based on the environment you are working in:

Environment
Team
Contact

Staging / Non-Production

Technical Services

[email protected]

Production

Merchant Helpdesk

[email protected]

Last updated

Was this helpful?