[cherry-pick] Upgrade jQuery in samples to version 3.5.1 (#21577) #21792
Conversation
captainsafia
requested review from
Tratcher,
analogrelay and
ryanbrandenburg
as code owners
captainsafia
changed the title
|
Jquery changes look fine, not sure we should see src/submodules/MessagePack-CSharp changes tho? |
captainsafia
force-pushed
the
cherry-query
branch
from
6ee7e5b to
fa38de0
Compare
🤦 Fixed. |
Pilchie
added
the
area-mvc
ryanbrandenburg
left a comment
ryanbrandenburg
left a comment
There was a problem hiding this comment.
Looks great. My only suggestion is to manually launch one of these websites (if you haven't already) and confirm that the integrity check passes in a real browser. We've run into problems in the past where integrity checks failed for kind of obtuse reasons even though they "matched".
captainsafia
force-pushed
the
cherry-query
branch
from
fa38de0 to
ac51988
Compare
|
I've validating this on one of the auth samples. |
|
@captainsafia is this ready for Shiproom already? |
captainsafia
added
the
Servicing-consider
|
Hello human! Please make sure you've included the Shiproom Template in a comment or (preferably) the PR description. Also, make sure this PR is not marked as a draft and is ready-to-merge. |
leecow
added
Servicing-approved
|
@captainsafia the branch is open for 3.1.6, want me to merge this? |
Yes, please. |
Description
jQuery versions 3.4.0 and below are impacted by CVE-2019-11358. This PR updates all the jQuery versions currently used in this repo (2.2.0 and 3.3.1) to 3.5.1.
Customer Impact
This issue was reported by a customer in #20001. Component Governance and other automated security checks will flag repositories that contain the vulnerable version of jQuery included by default in our templates and samples. Users can work around the issue by removing the assets generated by the template and replacing them with the updated versions.
Regression?
No regressions.
Risk
The jump from 2.2.0 to 3.5.1 is a major version bump in the jQuery dependency. The following samples with this major version bump were validated.
Given these validations and the fact that this PR brings in a security fix for a dependency of samples and templates, the risk is low.