Tooltipster unmaintained and JQuery EOL

[pedroyzkrak]

Hi! Before everything great work :)

Just a question: Have you had any thoughts on replacing tooltipster with anything else (e.g. https://github.com/atomiks/tippyjs)? Since it's unmaintained in quite some time now and uses an old version of JQuery that brings CVEs (e.g. https://nvd.nist.gov/vuln/detail/cve-2015-9251). Thanks!

[obecker]

Hi, thanks for your interest in decycle!

Actually, I don't really understand your concern. Tooltipster is a jquery plugin, and it is working with the current jquery version (3.7.1). So the decycle report doesn't use any old jquery version. As long as Tooltipster is working with the latest jquery versions and as long as there are no other issues in Tooltipster, I don't see a need to replace it.

Do I miss something?

[nightm4re94]

If I may interject here, there are several outdated jquery references in tooltipster:

• jQuery UI 1.11.4 is referenced here, here, here, and here, introducing the following CVEs:
  • CVE-2021-41182
  • CVE-2021-41183
  • CVE-2021-41184
  • CVE-2022-31160
• jQuery 1.10.2 is referenced here, introducing the following CVEs:
  • CVE-2015-9251
  • CVE-2019-11358
  • CVE-2020-11022
  • CVE-2020-11023

Since we can probably not expect an update to tooltipster, considering alternatives is a valid suggestion IMHO.
Any project that applies decycle will generate CVE alerts when scanned e.g. with Dependency-Check-Gradle.

[obecker]

Okay, I see what you mean. The OWASP dependency check reports these vulnerabilities. Decycle depends on the tooltipster webjar, which includes also jQuery 1.10.2 and jQuery UI 1.11.4. However, Decycle doesn't use these dependencies. So in the end this is a false positive report. I'll check what to do about it.

[nightm4re94]

One straightforward alternative would probably be to raise a PR in tooltipster that upgrades these dependency versions.

[obecker]

In my opinion this is rather an issue of the webjar, since both dependencies (jQuery and jQuery UI) are in the doc folder of the packed resources. I.e. the webjar contains the documentation and examples for tooltipster, which use outdated jQuery versions.

[obecker]

So I'm currently thinking about replacing or repacking the webjar ...

[nightm4re94]

Bravo, maestro 👏 Thanks for the fix.

[obecker]

A new decycle version (1.2.0) has been released just now.