Skip to content

Use modernized waitMe plugin#3213

Merged
PromoFaux merged 1 commit into
developmentfrom
waitMe
Mar 29, 2025
Merged

Use modernized waitMe plugin#3213
PromoFaux merged 1 commit into
developmentfrom
waitMe

Conversation

@yubiuser

Copy link
Copy Markdown
Member

What does this PR aim to accomplish?:

Updates the used waitMe package because it's outdated and depends on an outdated jquery version

jquery  <=3.4.1
Severity: moderate
Cross-Site Scripting (XSS) in jquery - https://github.com/advisories/GHSA-rmxg-73gg-4p98
XSS in jQuery as used in Drupal, Backdrop CMS, and other products - https://github.com/advisories/GHSA-6c3j-c64m-qhgq
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-jpcq-cgw6-v4j6
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-gxr4-xjj5-5px2
No fix available
node_modules/waitme/node_modules/jquery
  waitme  *
  Depends on vulnerable versions of jquery
  node_modules/waitme

How does this PR accomplish the above?:

Replace the package with a modernized version found at https://github.com/carlosvidal/modernized-waitme which does not rely on jquery


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code and I have tested my changes.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)
  6. I have checked that another pull request for this purpose does not exist.
  7. I have considered, and confirmed that this submission will be valuable to others.
  8. I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
  9. I give this submission freely, and claim no ownership to its content.

  • I have read the above and my PR is ready for review. Check this box to confirm

@yubiuser

Copy link
Copy Markdown
Member Author

There is no npm package yes (carlosvidal/modernized-waitme#1), so this needs to stay as draft until we can update our package.json and package-lock.json

Comment thread scripts/lua/header.lp Outdated
@github-actions

Copy link
Copy Markdown
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

1 similar comment
@github-actions

Copy link
Copy Markdown
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@XhmikosR

Copy link
Copy Markdown
Contributor

Nice to see the jQuery usage to drop even if it's a little :)

That being said, I'd move this package to the vendor folder for now and move on if it works OK like the previous plugin.

@github-actions

Copy link
Copy Markdown
Contributor

Conflicts have been resolved.

@XhmikosR

Copy link
Copy Markdown
Contributor

@yubiuser I suggest that you move forward with this and remove the package.json changes for now. Assuming that this works the same as the previous plugin.

I have already started the work on reducing the jQuery usage in our code, so the less jQuery, the better.

Just wait after #3295 is merged and move the new assets where they belong better (vendor first grouped together like I did in #3295).

@github-actions

Copy link
Copy Markdown
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@github-actions

Copy link
Copy Markdown
Contributor

Conflicts have been resolved.

Signed-off-by: yubiuser <github@yubiuser.dev>
@yubiuser yubiuser marked this pull request as ready for review March 27, 2025 21:06
@yubiuser

Copy link
Copy Markdown
Member Author

The author has published an npm package.
Ready for review

@yubiuser yubiuser requested a review from a team March 27, 2025 21:07
@PromoFaux PromoFaux merged commit 6bef370 into development Mar 29, 2025
@PromoFaux PromoFaux deleted the waitMe branch March 29, 2025 10:52
@PromoFaux PromoFaux mentioned this pull request Mar 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants