Dne 28.8.2018 v 15:58 Christopher napsal(a):
On Tue, Aug 28, 2018 at 8:49 AM Vít Ondruch <vondruch(a)redhat.com
So this is the email announcing orphaning js-jquery1:
But apparently it is used by more packages then just a few. So is
somebody, who would be willing (more than me) to keep the package
Given the security vulnerabilities in jQuery 1 (and 2) and the fact
that upstream dropped them a long time ago, I strongly recommend the
packages be retired than kept alive. Packagers depend on the newer
js-jquery (3) instead, patching as needed.
Of course I see your point. Nevertheless, I still believe that it is
better to have the CVEs in one package where they will be eventually
fixed then spread across the whole Fedora bundled in all packages,
because I am quite sure this will be the result of retiring js-jquery1.
Speaking of the two rubygem- packages from the list:
1. rubygem-cucumbe is going to be migrated to the latest jQuery. Anyway,
this is testing framework, so I don't see the old and vulnerable jQuery
as a big deal.
2. I opened ticket to migrate rubygem-apipie-rails to the most recent
version of jQuery, but I don't think it is going to happen soon. Also,
it is probably used in some generated documentation, not sure how
critical the old jQuery is.
And in addition:
3. There is jQuery embedded in every rubygem-*-doc package from
rubygem-rdoc. You can use it as and example of bundling. But anyway,
this is again "just" documentation, if used, then typically used just
locally (although somebody might expose the documentation externally).