Ben Weidig created TAP5-2836:
--------------------------------
Summary: Update require.js/underscore
Key: TAP5-2836
URL: https://issues.apache.org/jira/browse/TAP5-2836
Project: Tapestry 5
Issue Type: Improvement
Components: tapestry-core
Reporter: Ben Weidig
h2. Description
The currently used versions of the aforementioned JavaScript libraries are out
of date and contain CVEs. Even though:
* require.js 2.2.0 (CVE-2024-38999)
* underscore 1.13.7 (CVE-2026-27601)
Tapestry itself doesn't seem to use affected code paths, but they should be
updated.
h2. Proposed Solution
Update the libraries, as research suggests both updates are dropi-in
replacements without breaking changes:
* require.js 2.3.8
* underscore 1.13.8
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
