Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use modernized waitMe plugin #3213

Draft
wants to merge 1 commit into
base: development
Choose a base branch
from
Draft

Use modernized waitMe plugin #3213

wants to merge 1 commit into from

Conversation

yubiuser
Copy link
Member

What does this PR aim to accomplish?:

Updates the used waitMe package because it's outdated and depends on an outdated jquery version

jquery  <=3.4.1
Severity: moderate
Cross-Site Scripting (XSS) in jquery - https://github.com/advisories/GHSA-rmxg-73gg-4p98
XSS in jQuery as used in Drupal, Backdrop CMS, and other products - https://github.com/advisories/GHSA-6c3j-c64m-qhgq
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-jpcq-cgw6-v4j6
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-gxr4-xjj5-5px2
No fix available
node_modules/waitme/node_modules/jquery
  waitme  *
  Depends on vulnerable versions of jquery
  node_modules/waitme

How does this PR accomplish the above?:

Replace the package with a modernized version found at https://github.com/carlosvidal/modernized-waitme which does not rely on jquery


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code and I have tested my changes.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)
  6. I have checked that another pull request for this purpose does not exist.
  7. I have considered, and confirmed that this submission will be valuable to others.
  8. I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
  9. I give this submission freely, and claim no ownership to its content.

  • I have read the above and my PR is ready for review. Check this box to confirm

Signed-off-by: yubiuser <github@yubiuser.dev>
@yubiuser
Copy link
Member Author

There is no npm package yes (carlosvidal/modernized-waitme#1), so this needs to stay as draft until we can update our package.json and package-lock.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant