search

alphagov / tech-docs-gem

Gem to distribute the tech docs project
https://tdt-documentation.london.cloudapps.digital/
MIT License
15 stars 38 forks source link

JQuery Version fails our dependency check #217

Closed joel-stobart closed 3 years ago

joel-stobart commented 3 years ago

The jQuery version used in this library is v1.12.4 https://github.com/alphagov/tech-docs-gem/blob/master/lib/assets/javascripts/_vendor/jquery.js however this is vulnerable to a couple of issues https://www.cvedetails.com/vulnerability-list/vendor_id-6538/product_id-11031/version_id-286372/Jquery-Jquery-1.12.4.html

This is showing as a problem our build pipeline.

lfdebrux commented 3 years ago

I think in theory it would be good to remove jQuery from this repo altogether (and reduce our use of third-party libraries across the board), to reduce the amount of code user agents need to run.

Looking at our code I think it is only used in search.js and govuk-tech-docs.js, but in search it is doing quite a lot of heavy lifting. We also have other vendored code that currently relies on jQuery.

So in the interests of getting this issue closed quickly (and any security holes plugged), we should probably upgrade our vendored code ASAP.

It looks like @chao-xian and @ESKYoung had a go at this in https://github.com/alphagov/tech-docs-gem/pull/203 but eventually closed the PR... probably because we didn't get around to merging it in time? 😓 I will see about resurrecting that PR.

lfdebrux commented 3 years ago

PR to update jQuery and lodash (#203) has been merged; once it has been released we can close this issue.

lfdebrux commented 3 years ago

tech-docs-gem v2.4.3 with jquery v3.5.1 has been released 🎉

You can upgrade with bundle update govuk_tech_docs.