Skip to content
This repository has been archived by the owner on Oct 18, 2024. It is now read-only.

Update jQuery from 1.12.4 to 3.6.3 #1280

Merged
merged 2 commits into from
Jan 20, 2023
Merged

Update jQuery from 1.12.4 to 3.6.3 #1280

merged 2 commits into from
Jan 20, 2023

Conversation

kevindew
Copy link
Member

@kevindew kevindew commented Jan 20, 2023

Trello: https://trello.com/c/lxxx5XLZ/178-govuk-has-a-half-implemented-content-security-policy-csp

Although there are many reasons to motivate an upgrade of such a legacy
dependency, the main motivation for this change was that jQuery 1.12
triggers CSP violations on initialisation in Firefox (due to 1 which
was removed by jQuery 2.2).

The reason this uses such an old version of jQuery is that we (GOV.UK)
used to share a version of jQuery across many apps and thus it was scary
to update as it was hard to test it's impacts. Since March 2022 2
Licence Finder has had it's own version of jQuery and thus it is easier
to judge the impacts.

To determine compatibly with jQuery 3 I ran this through jQuery migrate
3 and fixed the one warning. I also went through and manually tested
the code setting breakpoints to check various parts were executed.

Although there are many reasons to motivate an upgrade of such a legacy
dependency, the main motivation for this change was that jQuery 1.12
triggers CSP violations on initialisation in Firefox (due to [1] which
was removed by jQuery 2.2).

The reason this uses such an old version of jQuery is that we (GOV.UK)
used to share a version of jQuery across many apps and thus it was scary
to update as it was hard to test it's impacts. Since March 2022 [2]
Licence Finder has had it's own version of jQuery and thus it is easier
to judge the impacts.

To determine compatibly with jQuery 3 I ran this through jQuery migrate
[3] and fixed the one warning. I also went through and manually tested
the code setting breakpoints to check various parts were executed.

[1]: https://github.com/jquery/jquery/blob/e09907ce152fb6ef7537a3733b1d65ead8ee6303/src/event/support.js#L7-L20
[2]: c384fc5
[3]: https://github.com/jquery/jquery-migrate
This is so that dependabot can raise PRs for changes in dependencies
referenced in the package.json file, which is currently just jQuery.

My motivation for adding this is noticing we weren't getting dependabot
PRs to update jQuery from 1.12.
Copy link
Contributor

@MartinJJones MartinJJones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good to me 👍

@kevindew kevindew merged commit 0ddd8da into main Jan 20, 2023
@kevindew kevindew deleted the test-csp branch January 20, 2023 14:49
Copy link
Contributor

@leenagupte leenagupte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Licence Finder still works in Firefox and Chrome in integration, and I couldn't see any CSP violations in the Firefox console, so 👍

@@ -13,7 +13,7 @@ $(function() {

// $('el:bottom-offscreen') will return true if the element's
// bottom box border is off the screen
$.expr.filters['bottom-offscreen'] = function(el) {
$.expr.pseudos['bottom-offscreen'] = function(el) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, deprecated in jQuery 3.

Thanks for the review Leena ⭐ 🙇

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants