On Tue, Aug 28, 2018 at 10:44 AM Vít Ondruch <vondruch@redhat.com> wrote:

Dne 28.8.2018 v 15:58 Christopher napsal(a):
On Tue, Aug 28, 2018 at 8:49 AM Vít Ondruch <vondruch@redhat.com> wrote:

So this is the email announcing orphaning js-jquery1:


But apparently it is used by more packages then just a few. So is there
somebody, who would be willing (more than me) to keep the package alive?


Given the security vulnerabilities in jQuery 1 (and 2) and the fact that upstream dropped them a long time ago, I strongly recommend the packages be retired than kept alive. Packagers depend on the newer js-jquery (3) instead, patching as needed.

Of course I see your point. Nevertheless, I still believe that it is better to have the CVEs in one package where they will be eventually fixed then spread across the whole Fedora bundled in all packages, because I am quite sure this will be the result of retiring js-jquery1.

That's fair.
Speaking of the two rubygem- packages from the list:

1. rubygem-cucumbe is going to be migrated to the latest jQuery. Anyway, this is testing framework, so I don't see the old and vulnerable jQuery as a big deal.

2. I opened ticket to migrate rubygem-apipie-rails to the most recent version of jQuery, but I don't think it is going to happen soon. Also, it is probably used in some generated documentation, not sure how critical the old jQuery is.

And in addition:

3. There is jQuery embedded in every rubygem-*-doc package from rubygem-rdoc. You can use it as and example of bundling. But anyway, this is again "just" documentation, if used, then typically used just locally (although somebody might expose the documentation externally).


[1] https://github.com/Apipie/apipie-rails/issues/628

devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org