This is an automated email from the ASF dual-hosted git repository.
epugh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new 5938cb4a8d7 SOLR-16309: Bump jquery ui to deal with some older cve's
(#4735)
5938cb4a8d7 is described below
commit 5938cb4a8d7a118fab0ba4031a4ac935f510e649
Author: Eric Pugh <[email protected]>
AuthorDate: Tue Aug 25 16:06:31 2026 -0400
SOLR-16309: Bump jquery ui to deal with some older cve's (#4735)
---
NOTICE.txt | 4 ++
changelog/unreleased/SOLR-16309.yml | 11 ++++
gradle/validation/rat-config.xml | 5 ++
solr/webapp/web/css/angular/jquery-ui.min.css | 63 ++++++++++++----------
.../web/css/angular/jquery-ui.structure.min.css | 48 +++++++++--------
solr/webapp/web/libs/jquery-ui.min.js | 34 +++---------
6 files changed, 87 insertions(+), 78 deletions(-)
diff --git a/NOTICE.txt b/NOTICE.txt
index a99704fd7ab..876f5eca838 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -19,6 +19,10 @@ Copyright (c) 2013 Aggregate Knowledge, Inc.,
https://github.com/aggregateknowle
This product includes the JQuery JavaScript library created by John Resig.
Copyright (c) 2010 John Resig, http://jquery.com/
+This product includes the jQuery UI JavaScript library.
+Copyright OpenJS Foundation and other contributors, https://jqueryui.com
+License: MIT https://jquery.org/license
+
This product includes the D3.js JavaScript library created by Michael Bostock.
Copyright (c) 2012, Michael Bostock, https://github.com/mbostock/d3
diff --git a/changelog/unreleased/SOLR-16309.yml
b/changelog/unreleased/SOLR-16309.yml
new file mode 100644
index 00000000000..3dfeb51e943
--- /dev/null
+++ b/changelog/unreleased/SOLR-16309.yml
@@ -0,0 +1,11 @@
+title: >
+ Upgraded the bundled jQuery UI library (used for tooltips in the Admin UI's
+ Cloud graph view) from an old, unversioned build to 1.13.3, resolving
+ CVE-2021-41182, CVE-2021-41183, and CVE-2021-41184. Also added the missing
+ jQuery UI attribution to NOTICE.txt.
+type: dependency_update
+authors:
+ - name: Eric Pugh
+links:
+ - name: SOLR-16309
+ url: https://issues.apache.org/jira/browse/SOLR-16309
diff --git a/gradle/validation/rat-config.xml b/gradle/validation/rat-config.xml
index 8a70ce7affd..22d2fd9942a 100644
--- a/gradle/validation/rat-config.xml
+++ b/gradle/validation/rat-config.xml
@@ -46,6 +46,11 @@
<text> ; License: MIT</text>
</license>
+ <!-- Inline MIT comment used by jQuery UI bundled assets -->
+ <license family="MIT" id="MIT-jqueryui" name="MIT (jQuery UI)">
+ <text>Released under the MIT license.</text>
+ </license>
+
<!-- Machine-generated source files that carry no license header -->
<license family="GEN" id="GEN" name="Generated">
<any>
diff --git a/solr/webapp/web/css/angular/jquery-ui.min.css
b/solr/webapp/web/css/angular/jquery-ui.min.css
index b7dce773565..00f240a3415 100644
--- a/solr/webapp/web/css/angular/jquery-ui.min.css
+++ b/solr/webapp/web/css/angular/jquery-ui.min.css
@@ -1,28 +1,37 @@
-/*! jQuery UI - v1.12.1 - 2017-10-31
-* http://jqueryui.com
+/*! jQuery UI - v1.13.3 - Custom build (core, tooltip, theme)
+* https://jqueryui.com
-Available for use under the MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-* Includes: core.css, tooltip.css, theme.css
-* To view and modify this theme, visit
http://jqueryui.com/themeroller/?scope=&folderName=base&cornerRadiusShadow=8px&offsetLeftShadow=0px&offsetTopShadow=0px&thicknessShadow=5px&opacityShadow=30&bgImgOpacityShadow=0&bgTextureShadow=flat&bgColorShadow=666666&opacityOverlay=30&bgImgOpacityOverlay=0&bgTextureOverlay=flat&bgColorOverlay=aaaaaa&iconColorError=cc0000&fcError=5f3f3f&borderColorError=f1a899&bgTextureError=flat&bgColorError=fddfdf&iconColorHighlight=777620&fcHighlight=777620&bor
[...]
-* Copyright jQuery Foundation and other contributors; Licensed MIT */
-
-.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0
0 0
0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:abs
[...]
\ No newline at end of file
+Copyright OpenJS Foundation and other contributors
+Released under the MIT license.
+https://jquery.org/license
+*/
+/*!
+ * jQuery UI CSS Framework 1.13.3
+ * https://jqueryui.com
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license.
+ * https://jquery.org/license
+ *
+ * https://api.jqueryui.com/category/theming/
+
*/.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0
0 0
0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:after,.ui-helper-clearfix:before{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:
[...]
+ * jQuery UI Tooltip 1.13.3
+ * https://jqueryui.com
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license.
+ * https://jquery.org/license
+ *
+ * https://api.jqueryui.com/tooltip/#theming
+ */.ui-tooltip{padding:8px;position:absolute;z-index:9999;max-width:300px}body
.ui-tooltip{border-width:2px}/*!
+ * jQuery UI CSS Framework 1.13.3
+ * https://jqueryui.com
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license.
+ * https://jquery.org/license
+ *
+ * https://api.jqueryui.com/category/theming/
+ *
+ * To view and modify this theme, visit https://jqueryui.com/themeroller/
+ */.ui-widget{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget
.ui-widget{font-size:1em}.ui-widget button,.ui-widget input,.ui-widget
select,.ui-widget
textarea{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget.ui-widget-content{border:1px
solid #c5c5c5}.ui-widget-content{border:1px solid
#ddd;background:#fff;color:#333}.ui-widget-content
a{color:#333}.ui-widget-header{border:1px solid
#ddd;background:#e9e9e9;color:#333;font-weight:700}.ui-widget-header a{col [...]
\ No newline at end of file
diff --git a/solr/webapp/web/css/angular/jquery-ui.structure.min.css
b/solr/webapp/web/css/angular/jquery-ui.structure.min.css
index 723d9a342f6..7a6ea4cba9f 100644
--- a/solr/webapp/web/css/angular/jquery-ui.structure.min.css
+++ b/solr/webapp/web/css/angular/jquery-ui.structure.min.css
@@ -1,24 +1,26 @@
-/*! jQuery UI - v1.12.1 - 2017-10-31
-* http://jqueryui.com
+/*! jQuery UI - v1.13.3 - Custom build (core, tooltip structure)
+* https://jqueryui.com
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-* Copyright jQuery Foundation and other contributors; Licensed MIT */
-
-.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0
0 0
0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:abs
[...]
\ No newline at end of file
+Copyright OpenJS Foundation and other contributors
+Released under the MIT license.
+https://jquery.org/license
+*/
+/*!
+ * jQuery UI CSS Framework 1.13.3
+ * https://jqueryui.com
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license.
+ * https://jquery.org/license
+ *
+ * https://api.jqueryui.com/category/theming/
+
*/.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0
0 0
0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:after,.ui-helper-clearfix:before{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:
[...]
+ * jQuery UI Tooltip 1.13.3
+ * https://jqueryui.com
+ *
+ * Copyright OpenJS Foundation and other contributors
+ * Released under the MIT license.
+ * https://jquery.org/license
+ *
+ * https://api.jqueryui.com/tooltip/#theming
+ */.ui-tooltip{padding:8px;position:absolute;z-index:9999;max-width:300px}body
.ui-tooltip{border-width:2px}
\ No newline at end of file
diff --git a/solr/webapp/web/libs/jquery-ui.min.js
b/solr/webapp/web/libs/jquery-ui.min.js
index face679a192..a398dc5ac1f 100644
--- a/solr/webapp/web/libs/jquery-ui.min.js
+++ b/solr/webapp/web/libs/jquery-ui.min.js
@@ -1,30 +1,8 @@
-/*!
-
-Copyright 2014 jQuery Foundation and other contributors
-http://jquery.com/
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+/*! jQuery UI - v1.13.3 - Custom build (widget, position, keycode, unique-id,
tooltip)
+* https://jqueryui.com
+Copyright OpenJS Foundation and other contributors
+Released under the MIT license.
+https://jquery.org/license
*/
-
-/*! jQuery UI - v1.12.1 - 2017-10-31 jquery.com | jquery.org/license */
-
-
-(function(t){"function"==typeof
define&&define.amd?define(["jquery"],t):t(jQuery)})(function(t){function
e(t){for(var
e=t.css("visibility");"inherit"===e;)t=t.parent(),e=t.css("visibility");return"hidden"!==e}t.ui=t.ui||{},t.ui.version="1.12.1";var
i=0,s=Array.prototype.slice;t.cleanData=function(e){return function(i){var
s,n,o;for(o=0;null!=(n=i[o]);o++)try{s=t._data(n,"events"),s&&s.remove&&t(n).triggerHandler("remove")}catch(a){}e(i)}}(t.cleanData),t.widget=function(e,i,s){var
n,o,a,r [...]
\ No newline at end of file
+!function(t){"use strict";"function"==typeof
define&&define.amd?define(["jquery"],t):t(jQuery)}(function(t){"use
strict";return t.ui=t.ui||{},t.ui.version="1.13.3"}),function(t){"use
strict";"function"==typeof
define&&define.amd?define(["jquery","./version"],t):t(jQuery)}(function(t){"use
strict";var
e,i=0,o=Array.prototype.hasOwnProperty,n=Array.prototype.slice;return
t.cleanData=(e=t.cleanData,function(i){var
o,n,s;for(s=0;null!=(n=i[s]);s++)(o=t._data(n,"events"))&&o.remove&&t(n).trig
[...]
\ No newline at end of file
