PuzzleServer / mainpuzzleserver

The main repo for the Puzzle Hunt and Puzzleday servers.
MIT License
9 stars 32 forks source link

Remove jquery #869

Open jbodner09 opened 1 year ago

jbodner09 commented 1 year ago

Dependabot opened 2 security issues on us this week for a jquery library we have sitting on our website. If we're not using it, we need to remove it. If we are, we need to update it, or even better, stop. There is no need for jquery in the year 202X, so whatever we're using it for, I'll bet we don't need to be.

vidapour commented 1 year ago

bootstrap 5? work unknown, investigation + testing required

jbodner09 commented 1 year ago

Investigation for #890 led to 2 conclusions.

First, our client side validation apparently STILL depends on jquery. For some reason, ASP.NET core has absolutely no built-in way to do this except with jquery. There are outside libraries we can use that are pretty much drop-in replaceable, but we'd want to do our due diligence on them.

Second, updating bootstrap to the jqueryless version breaks pretty much everything. For reasons unknown, they just changed a ton of their APIs/CSS classes between our current version and version 5, so we'd have to do a HUGE sweep of the site to change/fix things.

However, I believe it's ultimately worth the effort to update bootstrap. Despite all the sweeping needed, the amount of actual work to do that shouldn't be that much. AND we'd get a number of benefits from the latest version of bootstrap (for example, they have built-in toast components for notifications in newer versions!).

So, between those two things, once bootstrap is updated, I'd say it would be well worth removing jquery since we'd ONLY need it for the validation at that point.

jbodner09 commented 1 year ago

Most likely update candidate: https://github.com/haacked/aspnet-client-validation Article with detailed how-to-use: https://andrewlock.net/adding-client-side-validation-to-aspnet-core-without-jquery-or-unobtrusive-validation/

Other options: its basis: https://github.com/ryanelian/aspnet-validation Or this older one: https://github.com/kraaden/unobtrusive-validation

jbodner09 commented 1 year ago

Likely bootstrap migration bugaboos:

See https://getbootstrap.com/docs/5.3/migration/, https://getbootstrap.com/docs/4.6/migration/, https://github.com/twbs/bootstrap/releases