Skip to content

Conversation

@gyulalaszlo
Copy link
Contributor

Fix Dependabot issues with JQuery and Grunt -- none of the mentioned specific problems are relevant for this specific code, but the versions used in the repo are generally very-very old, and should be updated if possible:

JQuery:

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Grunt:

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

I've done some minimal testing and can confirm that it builds and the basic pages load without problems (looking at the JQuery major changelog for 3.0 I dont think there are any breaking changes, but my assumptions are not good replacements for real-world tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants