[
https://issues.apache.org/jira/browse/TAP5-2836?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ben Weidig resolved TAP5-2836.
------------------------------
Fix Version/s: 5.10.0
Resolution: Done
> Update require.js/underscore
> ----------------------------
>
> Key: TAP5-2836
> URL: https://issues.apache.org/jira/browse/TAP5-2836
> Project: Tapestry 5
> Issue Type: Improvement
> Components: tapestry-core
> Reporter: Ben Weidig
> Assignee: Ben Weidig
> Priority: Major
> Fix For: 5.10.0
>
>
> h2. Description
> The currently used versions of the aforementioned JavaScript libraries are
> out of date and contain CVEs. Even though:
> * require.js 2.2.0 (CVE-2024-38999)
> * underscore 1.13.7 (CVE-2026-27601)
> Tapestry itself doesn't seem to use affected code paths, but they should be
> updated.
> h2. Proposed Solution
> Update the libraries, as research suggests both updates are dropi-in
> replacements without breaking changes:
> * require.js 2.3.8
> * underscore 1.13.8
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
