Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 - #196
Merged
Merged
Conversation
The gaurav theme bundled jQuery 1.12.4, which has known XSS vulnerabilities (CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023), and Bootstrap 3.4.0, which has CVE-2019-8331. It now ships jQuery 3.7.1 and Bootstrap 3.4.1, the last Bootstrap 3 release, taken unmodified from the official webjars. The old files were unmodified 3.4.0 releases, so no local changes are lost, and the file names stay the same so the theme's templates and theme.xml don't change. The theme uses only Bootstrap's collapse and dropdown plugins, both verified at phone and desktop widths. roller-ui/scripts/jquery-2.1.1.min.js is removed. Nothing in Roller references it, and serving it exposed another vulnerable jQuery. Weblogs that customized the gaurav theme keep their own copies of these files.
snoopdave
approved these changes
Sep 27, 2026
snoopdave
left a comment
snoopdave
left a comment
Contributor
There was a problem hiding this comment.
embedding jquery.js is not ideals, but this is an improvement that we should merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows up on the jQuery work in #185 by getting rid of the vulnerable jQuery copies Roller still ships outside the admin UI (which is already on the jQuery 3.7.1 webjar).
theme.xmlstay as they are.roller-ui/scripts/jquery-2.1.1.min.jsis deleted. Nothing in Roller references it.Verified on a fresh
jetty:runinstance with a weblog on the gaurav theme: the page loads jQuery 3.7.1 and Bootstrap 3.4.1, and the navbar collapse toggle and the Categories dropdown, the only Bootstrap plugins the theme uses, work at phone and desktop widths with no script errors.Weblogs that customized gaurav keep their own copies of these files. Bootstrap 3 is end of life, so its remaining advisories (CVE-2024-6485, CVE-2025-1647) have no fixed release; moving gaurav to Bootstrap 5 would be a separate redesign.
This doesn't overlap with #156, which removes basicmobile's CDN jQuery 2.1.1 and jQuery Mobile. Once both land, Roller no longer ships or references jQuery 1.x or 2.x. The admin UI's move to jQuery 4.0 is left for after #156, since it touches
head.jsp.