[
https://issues.apache.org/jira/browse/TAP5-2836?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097368#comment-18097368
]
ASF subversion and git services commented on TAP5-2836:
-------------------------------------------------------
Commit 76cf30aa5a5ca762c9d6dce97ab20d50451e3b39 in tapestry-5's branch
refs/heads/master from Ben Weidig
[ https://gitbox.apache.org/repos/asf?p=tapestry-5.git;h=76cf30aa5 ]
TAP5-2836: update require.js/underscore
> Update require.js/underscore
> ----------------------------
>
> Key: TAP5-2836
> URL: https://issues.apache.org/jira/browse/TAP5-2836
> Project: Tapestry 5
> Issue Type: Improvement
> Components: tapestry-core
> Reporter: Ben Weidig
> Assignee: Ben Weidig
> Priority: Major
>
> h2. Description
> The currently used versions of the aforementioned JavaScript libraries are
> out of date and contain CVEs. Even though:
> * require.js 2.2.0 (CVE-2024-38999)
> * underscore 1.13.7 (CVE-2026-27601)
> Tapestry itself doesn't seem to use affected code paths, but they should be
> updated.
> h2. Proposed Solution
> Update the libraries, as research suggests both updates are dropi-in
> replacements without breaking changes:
> * require.js 2.3.8
> * underscore 1.13.8
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
