Skip to content

Conversation

@miovd
Copy link
Contributor

@miovd miovd commented Jun 1, 2023

Please check if the PR fulfills these requirements

  • The commit message follows our guidelines

What kind of change does this PR introduce?
Vulnerability fix https://github.com/powsybl/powsybl.github.io/security/dependabot/1
[CVE-2020-11022] Potential XSS vulnerability in jQuery

Signed-off-by: VEDELAGO MIORA <miora.ralambotiana@rte-france.com>
@miovd miovd requested a review from flo-dup June 1, 2023 13:35
@olperr1
Copy link
Member

olperr1 commented Feb 21, 2024

This PR is ineffective: it only change a comment!

Each component of assets/vendor should be examined since it can be incompatible with the new JQuery version.
For instance, the site uses "bootstrap v4.4.1" and I don't think it is compatible (see the v4.4 and v4.5 documentations).

@So-Fras
Copy link
Member

So-Fras commented Feb 26, 2024

Regarding the components present in assets/vendor, I have found the following latest versions:

  • aos --> update to 2.3.4
  • bootstrap --> update to 5.3.3
  • boxicons --> update to 2.1.4 ?
  • counterup --> update to 2.8.0
  • fontawesome --> (6.5.1)
  • icofont (1.0.1, already up-to-date)
  • isotope (3.0.6, already up-to-date)
  • jQuery --> update to 3.7.1 (latest version)
  • jQuery.easing --> update to 1.13.2
  • owl-carousel (2.3.4, already up-to-date)
  • php email form --> is it php emailer ? If yes, update to 6.9.1
  • remixicon --> update to 4.2.0
  • venobox --> update to 2.1.3
  • waypoints (4.0.1, already up-to-date)

What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants