Skip to content

Update vendored jquery-ui from 1.13.3 to 1.14.1#8656

Closed
tobischo wants to merge 3 commits intoactiveadmin:3-0-stablefrom
tobischo:security/update-jquery-ui-to-1-14-1
Closed

Update vendored jquery-ui from 1.13.3 to 1.14.1#8656
tobischo wants to merge 3 commits intoactiveadmin:3-0-stablefrom
tobischo:security/update-jquery-ui-to-1-14-1

Conversation

@tobischo
Copy link

JavaScript files have been manually updated because:

  • newer version of jquery-ui is available with version 1.14.1
  • jquery-ui 1.13 is not officially supported anymore

Ref:

@tagliala
Copy link
Contributor

Thanks for this PR, because of security concerns on the vendored assets, I would prefer to do this by myself and manually test all the pages that may be affected by this change

Ref: #8329

@tagliala tagliala self-assigned this Mar 22, 2025
@tobischo
Copy link
Author

tobischo commented Mar 22, 2025

Sure, would be happy about that.

I had to prepare a change for our system anyway until it is fixed here, as our infosec team was complaining when they spotted that there is a version of something that is not officially supported anymore. 😅
So I figured I could make it available and save you the trouble.
I certainly do not have the full picture of what might break to ensure that it is covered.
I can tell you that all our use cases are working and we were confident enough to put it into production.

tagliala added a commit that referenced this pull request Mar 22, 2025
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
@tagliala tagliala mentioned this pull request Mar 22, 2025
21 tasks
tagliala added a commit that referenced this pull request Mar 22, 2025
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Mar 22, 2025
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
@tagliala
Copy link
Contributor

Superseded by #8670

@tagliala tagliala closed this Mar 22, 2025
tagliala added a commit that referenced this pull request Jan 31, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Jan 31, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Jan 31, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Jan 31, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Jan 31, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
tagliala added a commit that referenced this pull request Feb 4, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1
- Fix an issue with Datepicker not being initialized correctly in
  jQuery 4 (See jquery/jquery-ui#2385 for more information)

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
- jquery/jquery-ui#2385
tagliala added a commit that referenced this pull request Feb 4, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1
- Fix an issue with Datepicker not being initialized correctly in
  jQuery 4 (See jquery/jquery-ui#2385 for more information)

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
- jquery/jquery-ui#2385
tagliala added a commit that referenced this pull request Feb 4, 2026
JavaScript files have been manually updated because:
- `jquery-ui-rails` is unmaintained and it is bundling 1.13.0
- An active fork of `jquery-ui-rails` is bundling 1.13.2, but there is
  a more recent version (1.13.3)

Files removed because they have been dropped from jQuery UI:
- form.js
- ie.js
- safe-active-element.js
- safe-blur.js

Additionally:
- Allow jQuery 4
- Bump minimum required jQuery to 3.7.1
- Fix an issue with Datepicker not being initialized correctly in
  jQuery 4 (See jquery/jquery-ui#2385 for more information)

Refs:
- #8656
- https://jqueryui.com/upgrade-guide/1.14/#removed-apis
- jquery/jquery-ui#2385
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants