Replies: 6 comments 11 replies
-
|
I think we'd love to get jQuery 4 released this year as it's been a while since a major update (5.5 years at this point) but that all depends on whether we manage to fix all the blockers. With that in mind, maintaining security support for jQuery 3.x until the end of 2026 sounds sensible but I think we'd like to discuss that within the team before making any commitments. That said, with an update as major as jQuery 4.0 we'll surely have the first beta a few months before the final release so you'll know in advance the release may be coming. Also, could you explain why it'd be easier for you if we didn't release jQuery 4 in 2022? Does it matter that much as long as security support for jQuery 3.x is maintained? |
Beta Was this translation helpful? Give feedback.
-
|
hmmm |
Beta Was this translation helpful? Give feedback.
-
|
@mgol with jQuery 1/2 vs. 3, once they moved into security-only mode, certain security fixes weren't backported - see the two discussed #4421 Because for Drupal core we don't just have our own core jQuery usage, but also thousands of contributed modules, with possibly hundreds of those reliant on jQuery, we ended up implementing mitigations for both of those SAs via our own private security process. So based on that experience, the security support that the current release gets vs. previous releases can be different. Not that this necessarily the wrong approach for you, but the difference between updating to a new release vs. manually backporting a change is quite big for us. Separately to this, we've also run into issues where security releases were bundled with other changes, meaning delays for us updating to the security release due to also having to test and adapt to small API/behaviour changes at the same time (vs. for example a 'pure' security release and then a separate bugfix release). Otherwise, we generally try to release major versions on the latest version of our dependencies. So if for example we knew now that jQuery 4 was going to come out at the end of February, we'd probably make an effort to incorporate it into Drupal 10 (and/or support both versions), but given we're struggling to remove jQuery UI still, it's very unlikely we'd be able to do that in practice, and especially not with a release date towards the end of the year. But that is more about us not wanting to be out of date before a release, rather than a specific practical issue if the security support is there. |
Beta Was this translation helpful? Give feedback.
-
Most often, the security updates are actually in jQuery minors of the latest branch (so API additions are there along with bugfixes), which is why that has added impact for Drupal. (Drupal itself has dedicated patch releases for security issues that contain no non-security commits.) |
Beta Was this translation helpful? Give feedback.
-
OK, that's a good point. Normally, when a security issue gets reported, we fix it on the
Note that when we release 4.0.0 final, we'll backport fewer & fewer stuff to the 3.x line, essentially leaving it mostly for fixes for more severe issues, mostly security. This means it'll be less of an issue for you.
As we're trying to follow semver now, we're reluctant to include breaking changes without a major bump. The 3.5.0 case was an exception and it caused a lot of issues reported from users surprised there was a breaking change, even though we documented it as best as we could and we included opt-outs. However, that's also a Node.js strategy for security fixes being breaking changes within a single major line - release them as a minor, not a patch release. Maybe there's no better way. As for the 1.x/2.x case, there was only one security fix we didn't backport due to it being potentially breaking: a fix for #2432. The other fixes we didn't backport were only not backported because we stopped supporting the 1.x/2.x lines even with security fixes by the time they were fixed. And, to be honest, that single 3.0 security fix we didn't backport shouldn't be treated as a security fix... It did fix a potential security footgun but it was all documented behavior so everything behaved as expected, even if consequences of that documented behavior might not have been obvious to everyone. I had a discussion with one guy from Snyk about this and he agreed. |
Beta Was this translation helpful? Give feedback.
-
This would save a ton of work for us (and I imagine other projects out there) if it's feasible to implement. The worries that jQuery 3 will lose security support before our major version is EOL are still there (I follow the % done for the 4.0.0 milestone a bit neurotically), but being able to ship jQuery security updates without worrying whether they are going to break our ecosystem with the rest of the minor would save us days or weeks of work each year. Thanks for considering it! |
Beta Was this translation helpful? Give feedback.
-
|
hmmm........interesting |
Beta Was this translation helpful? Give feedback.
-
|
Hello everybody! |
Beta Was this translation helpful? Give feedback.
-
We never promised a release in 2022. That said, all blockers are closed and we’re in a process of preparing a 4.0.0 beta. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks |
Beta Was this translation helpful? Give feedback.
-
|
I've opened an issue to adopt jQuery 4 in Drupal core. Drupal 10 uses jQuery 3 and will be EOL in ~2026, we won't be able to update to jQuery 4 in Drupal 10. However we are planning the Drupal 11 release this year in either June, August, or December depending on when all blockers are completed, and if a stable jQuery 4 is available we'd obviously much prefer to ship with that. We'll try to provide feedback on the beta release as early as possible. |
Beta Was this translation helpful? Give feedback.
-
|
This also brings up the question of jQuery 3 EOL again. From Drupal's perspective, if we're able to release Drupal 11 on jQuery 4, then Drupal 10 will be the last release with jQuery 3, and that will be supported until the very latest some time in 2027, but much more likely 2026. If we're not able to release Drupal 11 on jQuery 4, then for us everything gets shifted two years (Drupal 12 release in 2026, Drupal 11 EOL in 2028). Based on prior comments here, it seemed like jQuery 3 support until 2026 felt feasible, is that still the case? And I'm guessing you would not be keen on supporting jQuery 3 until 2028, but it would be good to know whether that's definitely not the case sooner than later. |
Beta Was this translation helpful? Give feedback.
-
|
2026 feels feasible to me, 2028 is a bit too distant for me to say anything. But considering jQuery 4 blockers are closed and the beta is coming soon, I really hope we finally release in the next few months. While we have a number of breaking changes, a few huge planned refactors were postponed to 5.0 so there's hope we won't get too many time consuming issues in 4.0 to fix before the final release. |
Beta Was this translation helpful? Give feedback.
-
I'm glad hearing that the new version will be out soon. Are we finally getting the .each method to return the element first and the index second like the native array functions? Im tired of doing .each((_, el) => { }) instead of just (el => {}) |
Beta Was this translation helpful? Give feedback.
-
|
That would make code targeting both jQuery 3 & 4 close to impossible so that’s not going to happen. |
Beta Was this translation helpful? Give feedback.
-
|
Oh ok. Thanks for the great work anyways. Love to use jquery :) |
Beta Was this translation helpful? Give feedback.
-
|
jQuery has defined Symbol(iterator) for a while, which lets you say |
Beta Was this translation helpful? Give feedback.
-
Description
This is in many ways a duplicate of #4421, but on Drupal's side we have more clear potential timelines ourselves, so any updated information would be very useful for us.
Per that issue, we currently use jQuery 3 in various places, and expose it as a library.
We are in the process of removing jQuery UI as a dependency, but have not completed this work yet and won't completely finish it before releasing Drupal 10 at some point this year (between June and December), although we no longer expose it as a library.
We are currently discussing Drupal 10 EOL dates, and one suggested timeframe is mid-end 2026.
Our main questions are:
Is there any likelihood that jQuery 4 will be released in 2022? (to be 100% honest, it's easier for us if it isn't released this year...).
Can we be confident that jQuery 3 will be supported for security releases until the end of 2026?
We're actively working on reducing our surface area and dependencies, so it's possible that by the next major Drupal release (timeline still TBD) these questions will be less pressing for us since we'll have less things to update to jQuery 4 by then, but if a release was imminent this year, it would be really good to know.
Beta Was this translation helpful? Give feedback.
All reactions