PCMDI / pcmdi.github.io

repo for hosting web pages
5 stars 27 forks source link

Address dependabot alerts (3) #512

Closed durack1 closed 1 year ago

durack1 commented 1 year ago

It seems that we have 3 alerts for old jquery-dataTables libraries (1.10.1 vs 1.13.4 latest) and jquery itself (3.1.0 vs 3.7.0 latest) - see https://github.com/PCMDI/pcmdi.github.io/security/dependabot.

I have recently been dealing with these issues across other repos, so have updated these libraries in one place PCMDI/assets and plan to keep these updated (as I am updating these for other repos durack1/CMIPOcean, WCRP-CMIP/CMIP6_CVs, plus others)

Here's an example of use (here, along with the googleAnalytics block):


<link rel="stylesheet" type="text/css" charset="utf-8" href="https://pcmdi.github.io/assets/jquery/jquery.dataTables.min.css" />
<script type="text/javascript" charset="utf-8" src="https://pcmdi.github.io/assets/jquery/jquery.slim.min.js"></script>
<script type="text/javascript" charset="utf-8" src="https://pcmdi.github.io/assets/jquery/jquery.dataTables.min.js"></script>
<!-- Global site tag (gtag.js) - Google Analytics -->
<script type="text/javascript" src="https://pcmdi.github.io/assets/google/googleAnalyticsTag.js" ></script>
<script type="text/javascript">
//<![CDATA[
$(document).ready( function () {
    $('#table_id').DataTable();
    } );
//]]>
</script>\n"""
...
mauzey1 commented 1 year ago

The jQuery files are in the repo but they are not being used. We are using files from ajax.googleapis.com. I will remove the old versions of jQuery in the repo, and will try replacing the current links to jQuery with the ones in PCMDI/assets.