Issue using Frontend Toolkit after updating to jQuery 3.x about govuk_frontend_toolkit HOT 6 CLOSED

I am concerned we're going to go off on a bit of a tangent here that is not helpful to resolving the original issue. Can we start another issue if we want to discuss removing jQuery as a dependency?

@eserkansozer I think @NickColley mostly covered it, but upgrading to jQuery 3 will cause issues for users of your service using older browsers. Assuming you're trying to upgrade in response to CVE-2015-9251, I would suggest instead remaining on jQuery 1.x and ensuring that any AJAX requests you are making specify dataType, which as I understand it effectively mitigates the issue.

from govuk_frontend_toolkit.

Hello @eserkansozer !

We currently only have code that supports version jQuery 1.x.

jQuery version 3.x+ is two breaking releases ahead so the current code is very likely to not work with this version.

We have not updated to jQuery 3.x since it does not cover the browsers / devices as listed in the Service Manual (https://www.gov.uk/service-manual/technology/designing-for-different-browsers-and-devices#browsers-to-test-in)

I'm going to share this with the Frontend Community and also the GOV.UK Design System (who owns this 'product' at GDS), and we'll figure out the best way to move forwards.

In the meantime, my understanding about this vulnerability is that is related to jQuery's AJAX functionality, so if your service is not using this you may be okay.

For more info about this vulnerability see https://snyk.io/vuln/npm:jquery:20150627

from govuk_frontend_toolkit.

Now might be a good time to start removing the jQuery dependency instead?

from govuk_frontend_toolkit.

Thank you @NickColley @36degrees . We don't have any cross-domain Ajax requests in our service right now therefore we are safe.

The initiation of this discussion was GitHub sending us a warning notification about the vulnerability (which is still valid as anybody may misuse jQuery 1.x Ajax functions in our service or others which include front-end-toolkit as package). Though the risk may be regarded as low and not GDS's responsibility IMHO.

I understand that GDS needs to support older browsers so upgrade is not possible.

from govuk_frontend_toolkit.

That all makes sense – are you happy for me to close this issue as resolved?

from govuk_frontend_toolkit.

from govuk_frontend_toolkit.