Remove jquery-ui as it is no longer maintained

[diosmosis]

We use jquery-ui for the datepicker, tooltips and some modals. Since the latest release has bugs in it and does not appear to be maintained, we should perhaps switch away from it to materialize.

[sgiehl]

Replacing the datepicker won't be easy. We currently show the datepickers in our periodselection inline. MaterializeCSS does not have an option to display a datepicker inline. That means we need to find some hackish solution to make that possible. Or we might need to rethink the whole period selector, and change it in a way that doesn't need inline date pickers.
Tried replacing the other date pickers, but actually they would have this issue Dogfalo/materialize#6552

[tsteur]

In Matomo for WordPress I wanted to load only the needed jquery-ui files but noticed we're actually using 17 components: https://github.com/matomo-org/wp-matomo/blob/develop/plugins/WordPress/WpAssetManager.php#L40-L57

Maybe some of those components rely on each other but there were definitely more components used by us than you think so replacing it wouldn't be trivial.

Are there are known jquery UI security issues in the latest version? WordPress is also using jquery-ui in https://github.com/WordPress/WordPress/tree/master/wp-includes/js/jquery/ui and there were no updates in 4 years or so. AFAIK WP does apply security patches to jquery (as they are using jquery 1) so there might be no security issues so far?

The latest security fix I could find in jquery-ui directly is jquery/jquery-ui#1747

Seems a bit of development is still going on? https://github.com/jquery/jquery-ui/commits/master

[diosmosis]

Looks like the last release was in 2016: https://github.com/jquery/jquery-ui/releases. not sure what the ongoing development is.

[diosmosis]

FYI I just added this to 4.0 since that's when I created it. It doesn't need to be here.

[sgiehl]

If we don't do it in 4.0, I guess we should move it to the next major release, as removing JQuery UI might break the UI of some plugins, which shouldn't be done in a minor release imho

[Findus23]

Are there are known jquery UI security issues in the latest version?

There are no published ones. But that of course doesn't mean there aren't any, maybe no one is looking in such an old library.

Development definitely has stopped quite a while ago: https://blog.jqueryui.com/2017/12/the-future-of-jquery-ui-and-jquery-mobile/

[Findus23]

Bonus points: Jquery UI seems to be the single largest JS file embedded in the Matomo UI (66KB gzipped), so removing it might speed up the page load by quite a bit.

[tsteur]

Replacing all those components and coming up with a new design could be a lot of work. While there are no security issues and while WordPress is still supporting jquery-ui, there may not be a need to remove it in Matomo 5 just yet. Also the gain in JS size won't be too much since any other lib would also still consume a few KB and then it be in the end fairly little KBs that we would save considering how big the overall JS size is (currently 3.5MB with Vue and Angular). Would be probably good to see how much work this is as an estimate and then see if it's worth the benefit.