pkp-lib
pkp-lib copied to clipboard
pkp/pkp-lib#9754 [stable-3_4_0] Update jquery, jquery-ui and chart.js to address security vulnerability reports
For v3.4.0, we need to
- [x] Upgrade jQuery from v3.6.0 to v.3.7.1
- [x] Upgrade jQuery validation from v1.11.1 to v1.19.5
- [x] Upgrade jQuery UI from v1.12.1 to v1.13.3
- [x] Upgrade ChartJS from v2.0.1 to v2.9.4
- [x] Adjust ChartJS configurations used for
usage-stats-chart.jsto make it compatible with the new version - [x] Add jquery, jquery-ui and jquery-validation to node dependencies and update submodule
- [x] OJS: ojs:stable-3_4_0 PR
- [x] OMP: omp:stable-3_4_0 PR
- [x] OPS: ops:stable-3_4_0 PR
Notes:
- My investigation suggests that there are no breaking changes in the upgrades for jQuery, jQuery UI and jQuery-validation upgrades. However for chart.js, adjustments are required for usage statistics to address minor issues for the
tooltipsoption configs. For more information, please check the docs for v2.9.4#tooltips - We removed
components/jqueryandcomponents/jqueryuiin composer dependencies, and instead used npm to install jquery, jquery-ui. We also removedlib/pkp/js/lib/jquery/plugins/validate(jquery-validation) andlib/pkp/js/lib/Chart.js&/lib/pkp/js/lib/Chart.min.js(chart.js) and also used npm to improve handling the version upgrades moving forward. Note that these npm dependencies are handled on the ojs/omp/ops app level. - We copied these node_modules to the existing paths for the mentioned dependencies, so changing the paths when adding these scripts in the frontend are NOT necessary for pkp:v3.4.0