search

pkp / pkp-lib

The library used by PKP's applications OJS, OMP and OPS, open source software for scholarly publishing.
https://pkp.sfu.ca
GNU General Public License v3.0
297 stars 442 forks source link

Update jquery, jquery-ui and chart.js to address security vulnerability reports #9753

Open jardakotesovec opened 6 months ago

jardakotesovec commented 6 months ago

Describe the bug Acunetix vunlerability scanner recommends updating versions of some of the frontend dependencies.

To Reproduce

What application are you using? OJS 3.4

Additional information I used Acunetix vulnerability scan of my website and it showed that Chart.js needs to be updated to version 2.9.4 or above, jQuery Validation to version 1.19.5 or above and jQuery UI to version 1.13.0 or above (currently OJS version 3.4.0-4 is used chart.js v2.0.1, jquery validation v1.19.3 and jquery-ui v1.12.1)

==================================================== Pull requests:

pkp-lib (complete review notes are on the PRs for pkp-lib on each versions) main: https://github.com/pkp/pkp-lib/pull/10168 (merged) stable-3_4_0: https://github.com/pkp/pkp-lib/pull/10166 stable-3_3_0: https://github.com/pkp/pkp-lib/pull/10167 (merged)

OJS main: https://github.com/pkp/ojs/pull/4351 (merged) stable-3_4_0: https://github.com/pkp/ojs/pull/4352 (submodule update only) stable-3_3_0: https://github.com/pkp/ojs/pull/4353 (submodule update only, merged)

OMP main: https://github.com/pkp/omp/pull/1626 (merged) stable-3_4_0: https://github.com/pkp/omp/pull/1627 (submodule update only) stable-3_3_0: https://github.com/pkp/omp/pull/1628 (submodule update only, merged)

OPS main: https://github.com/pkp/ops/pull/725 (merged) stable-3_4_0: https://github.com/pkp/ops/pull/726 (submodule update only) stable-3_3_0: https://github.com/pkp/ops/pull/727 (submodule update only, merged)

ui-library main: https://github.com/pkp/ui-library/pull/380 (merged)

bootstrap3 main: https://github.com/pkp/bootstrap3/pull/224 (merged)

lensGalley main: https://github.com/asmecher/lensGalley/pull/70 (merged)

asmecher commented 1 day ago

@blesildaramirez, thanks, I've reviewed and merged the stable-3_3_0 PRs. I think we might need to put out a short-term release from stable-3_4_0 so I'll hold off on those for the moment.