aspnet / jquery-validation-unobtrusive

Add-on to jQuery Validation to enable unobtrusive validation options in data-* attributes.
MIT License
257 stars 113 forks source link

Vulnerabilities in current jquery-validation package #167

Closed cklogs closed 3 months ago

cklogs commented 3 months ago

There are vulnerabilities in the currently used jquery-validation (1.19.5) subdependency of this library.

Can it be updated to the latest (1.20.1)?

image

Thank you.

javiercn commented 3 months ago

@cklogs our templates are updated/being updated to use the latest version.

As for this package, we don't have to update the version as it already allows installing the latest 1.x version (which is what happens)

/ # node -v
v22.4.1
/ # npm -v
10.8.1
/ # mkdir app
/ # cd app/
/app # vim package.json
/bin/sh: vim: not found
/app # npm init
This utility will walk you through creating a package.json file.
It only covers the most common items, and tries to guess sensible defaults.

See `npm help init` for definitive documentation on these fields
and exactly what they do.

Use `npm install <pkg>` afterwards to install a package and
save it as a dependency in the package.json file.

Press ^C at any time to quit.
package name: (app) test
version: (1.0.0) 0.1.0
description: Test for the version that npm install uses for jquery-unobtrusive
entry point: (index.js)
test command:
git repository:
keywords:
author:
license: (ISC)
About to write to /app/package.json:

{
  "name": "test",
  "version": "0.1.0",
  "description": "Test for the version that npm install uses for jquery-unobtrusive",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC"
}

Is this OK? (yes) y

npm notice
npm notice New patch version of npm available! 10.8.1 -> 10.8.2
npm notice Changelog: https://github.com/npm/cli/releases/tag/v10.8.2
npm notice To update run: npm install -g npm@10.8.2
npm notice
/app # npm install jquery-validation-unobtrusive

added 3 packages, and audited 4 packages in 2s

found 0 vulnerabilities
/app # ls node_modules/
jquery                         jquery-validation              jquery-validation-unobtrusive
/app # ls node_modules/jquery-validation
LICENSE.md    README.md     dist          package.json
/app # cat node_modules/jquery-validation/package.json
{
        "name": "jquery-validation",
        "title": "jQuery Validation Plugin",
        "description": "Client-side form validation made easy",
        "version": "1.21.0",
        "homepage": "https://jqueryvalidation.org/",
        "license": "MIT",
        "author": {
                "name": "Jörn Zaefferer",
                "email": "joern.zaefferer@gmail.com",
                "url": "http://bassistance.de"
        },
        "repository": {
                "type": "git",
                "url": "git://github.com/jquery-validation/jquery-validation.git"
        },
        "bugs": {
                "url": "https://github.com/jquery-validation/jquery-validation/issues"
        },
        "licenses": [
                {
                        "type": "MIT",
                        "url": "https://www.opensource.org/licenses/MIT"
                }
        ],
        "scripts": {
                "test": "grunt",
                "prepublish": "grunt"
        },
        "files": [
                "dist/localization/",
                "dist/additional-methods.js",
                "dist/additional-methods.min.js",
                "dist/jquery.validate.js",
                "dist/jquery.validate.min.js"
        ],
        "main": "dist/jquery.validate.js",
        "peerDependencies": {
                "jquery": "^1.7 || ^2.0 || ^3.1"
        },
        "devDependencies": {
                "commitplease": "2.3.1",
                "grunt": "1.0.1",
                "grunt-contrib-compress": "1.2.0",
                "grunt-contrib-concat": "1.0.1",
                "grunt-contrib-copy": "1.0.0",
                "grunt-contrib-jshint": "1.0.0",
                "grunt-contrib-qunit": "10.0.0",
                "grunt-contrib-uglify": "1.0.1",
                "grunt-contrib-watch": "1.0.0",
                "grunt-jscs": "2.8.0",
                "grunt-sri": "0.2.0",
                "grunt-text-replace": "0.4.0",
                "qunitjs": "2.3.3"
        },
        "keywords": [
                "jquery",
                "jquery-plugin",
                "forms",
                "validation",
                "validate"
        ]
}