[jira] [Commented] (TAP5-2836) Update require.js/underscore

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TAP5-2836?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097368#comment-18097368 ] 

ASF subversion and git services commented on TAP5-2836:
-------------------------------------------------------

Commit 76cf30aa5a5ca762c9d6dce97ab20d50451e3b39 in tapestry-5's branch refs/heads/master from Ben Weidig
[ https://gitbox.apache.org/repos/asf?p=tapestry-5.git;h=76cf30aa5 ]

TAP5-2836: update require.js/underscore


> Update require.js/underscore
> ----------------------------
>
>                 Key: TAP5-2836
>                 URL: https://issues.apache.org/jira/browse/TAP5-2836
>             Project: Tapestry 5
>          Issue Type: Improvement
>          Components: tapestry-core
>            Reporter: Ben Weidig
>            Assignee: Ben Weidig
>            Priority: Major
>
> h2. Description
> The currently used versions of the aforementioned JavaScript libraries are out of date and contain CVEs. Even though:
>  * require.js 2.2.0 (CVE-2024-38999)
>  * underscore 1.13.7 (CVE-2026-27601)
> Tapestry itself doesn't seem to use affected code paths, but they should be updated.
> h2. Proposed Solution
> Update the libraries, as research suggests both updates are dropi-in replacements without breaking changes:
>  * require.js 2.3.8
>  * underscore 1.13.8



--
This message was sent by Atlassian Jira
(v8.20.10#820010)