fix: bump jquery version to latest #36
Conversation
There was a problem hiding this comment.
LGTM, but why don't we update to the latest? The latest one seems 3.7.1 as per https://jquery.com/download/.
jquery versions older than 3.5.0 is known to introduce cross-site scripting and prototype pollution vulnerabilities. We're not really affected by this (we're just serving HTML), but let's just bump this to avoid security scanning tools complaining. Signed-off-by: Babis Chalios <bchalios@amazon.es>
bchalios
force-pushed
the
fix_jquery_version
branch
from
c598d8c to
4f28dd9
Compare
bchalios
changed the title
done! |
|
Are we sure things are gonna continue working? It doesnt looks like we're using jQuery for anything exotic that might've changed between 1.x and 3.x, but there's this masonry script that is minimized and seems to pull some jquery library from somewhere, which I'm worried about. |
Any suggestions on how we can test that? |
|
it is working on localhost :) |
Reason for this PR
jquery versions older than 3.5.0 is known to introduce cross-site scripting and prototype pollution vulnerabilities. We're not really affected by this (we're just serving HTML), but let's just bump this to avoid security scanning tools complaining.
Description of changes
Just bump the version to latest (3.7.1) for
jquery.License acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the MIT-0 [1] license.
[1] https://github.com/aws/mit-0
PR checklist
[Author TODO: Meet these criteria & check the boxes.][Reviewer TODO: Verify checked boxes. Request changes if criteria not met]git commit -s).