`refinerycms-core` depends on a version of `jquery-ui-rails` with XSS vulnerabilities

refinery / refinerycms

An extendable Ruby on Rails CMS that supports Rails 6.0+

https://www.refinerycms.com/

MIT License

3.89k stars 1.26k forks source link

Open n7st opened 5 months ago

n7st commented 5 months ago

I'm seeing several dependabot security alerts due to jquery-ui-rails version 6's dependency on jQuery UI v1.12 (e.g. https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327).

These can be fixed by upgrading jquery-ui-rails to v7.0.0.

There's a slight issue with upgrading in that presently, the jquery-ui-rails gem hasn't got any maintainers who can push it to rubygems.

I believe this can be achieved (at least temporarily) using the GitHub repository's v7.0.0 tag.

n7st commented 2 months ago

jquery-ui-rails has a new maintainer who's released version 7.0.0 with the XSS fixes, but it looks like refinerycms-core is locked to version 6.