pkp-lib icon indicating copy to clipboard operation
pkp-lib copied to clipboard

pkp/pkp-lib#9754 [stable-3_4_0] Update jquery, jquery-ui and chart.js to address security vulnerability reports

Open blesildaramirez opened this issue 1 year ago • 1 comments

For v3.4.0, we need to

  • [x] Upgrade jQuery from v3.6.0 to v.3.7.1
  • [x] Upgrade jQuery validation from v1.11.1 to v1.19.5
  • [x] Upgrade jQuery UI from v1.12.1 to v1.13.3
  • [x] Upgrade ChartJS from v2.0.1 to v2.9.4
  • [x] Adjust ChartJS configurations used for usage-stats-chart.js to make it compatible with the new version
  • [x] Add jquery, jquery-ui and jquery-validation to node dependencies and update submodule

Notes:

  1. My investigation suggests that there are no breaking changes in the upgrades for jQuery, jQuery UI and jQuery-validation upgrades. However for chart.js, adjustments are required for usage statistics to address minor issues for the tooltips option configs. For more information, please check the docs for v2.9.4#tooltips
  2. We removed components/jquery and components/jqueryui in composer dependencies, and instead used npm to install jquery, jquery-ui. We also removed lib/pkp/js/lib/jquery/plugins/validate (jquery-validation) and lib/pkp/js/lib/Chart.js & /lib/pkp/js/lib/Chart.min.js (chart.js) and also used npm to improve handling the version upgrades moving forward. Note that these npm dependencies are handled on the ojs/omp/ops app level.
  3. We copied these node_modules to the existing paths for the mentioned dependencies, so changing the paths when adding these scripts in the frontend are NOT necessary for pkp:v3.4.0

blesildaramirez avatar Jul 05 '24 12:07 blesildaramirez

CLA assistant check
All committers have signed the CLA.

CLAassistant avatar Jul 05 '24 12:07 CLAassistant