[
https://issues.apache.org/jira/browse/TAP5-2836?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097378#comment-18097378
]
ASF subversion and git services commented on TAP5-2836:
-------------------------------------------------------
Commit 85f956e3c118d8624b40cb848e5bdd639f81642a in tapestry-5's branch
refs/heads/javax from Ben Weidig
[ https://gitbox.apache.org/repos/asf?p=tapestry-5.git;h=85f956e3c ]
TAP5-2836: update require.js/underscore
> Update require.js/underscore
> ----------------------------
>
> Key: TAP5-2836
> URL: https://issues.apache.org/jira/browse/TAP5-2836
> Project: Tapestry 5
> Issue Type: Improvement
> Components: tapestry-core
> Reporter: Ben Weidig
> Assignee: Ben Weidig
> Priority: Major
>
> h2. Description
> The currently used versions of the aforementioned JavaScript libraries are
> out of date and contain CVEs. Even though:
> * require.js 2.2.0 (CVE-2024-38999)
> * underscore 1.13.7 (CVE-2026-27601)
> Tapestry itself doesn't seem to use affected code paths, but they should be
> updated.
> h2. Proposed Solution
> Update the libraries, as research suggests both updates are dropi-in
> replacements without breaking changes:
> * require.js 2.3.8
> * underscore 1.13.8
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
