[
https://issues.apache.org/jira/browse/ZOOKEEPER-5085?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dávid Paksy updated ZOOKEEPER-5085:
-----------------------------------
Description:
OWASP dependency check found CVE in prototype.js on branch-3.9 and branch-3.8:
prototype.js (pkg:javascript/[email protected]): CVE-2020-27511(7.5)
This does not affect master branch because there the docs were already migrated
to React JS tech.
It seems that we don't even load this file on our doc pages on these branches:
*
[https://github.com/apache/zookeeper/blob/branch-3.9/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
*
[https://github.com/apache/zookeeper/blob/branch-3.8/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
!image-2026-09-01-11-27-29-800.png!
was:
OWASP dependency check found CVE in prototype.js on branch-3.9 and branch-3.8:
prototype.js (pkg:javascript/[email protected]): CVE-2020-27511(7.5)
It seems that we don't even load this file on our doc pages on these branches:
*
[https://github.com/apache/zookeeper/blob/branch-3.9/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
*
[https://github.com/apache/zookeeper/blob/branch-3.8/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
!image-2026-09-01-11-27-29-800.png!
> Remove unused vulnerable prototype.js from branch-3.9 and branch-3.8
> --------------------------------------------------------------------
>
> Key: ZOOKEEPER-5085
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5085
> Project: ZooKeeper
> Issue Type: Task
> Components: documentation
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Dávid Paksy
> Assignee: Dávid Paksy
> Priority: Major
> Labels: pull-request-available
> Attachments: image-2026-09-01-11-27-29-800.png
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> OWASP dependency check found CVE in prototype.js on branch-3.9 and branch-3.8:
> prototype.js (pkg:javascript/[email protected]): CVE-2020-27511(7.5)
>
> This does not affect master branch because there the docs were already
> migrated to React JS tech.
>
> It seems that we don't even load this file on our doc pages on these branches:
> *
> [https://github.com/apache/zookeeper/blob/branch-3.9/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
> *
> [https://github.com/apache/zookeeper/blob/branch-3.8/zookeeper-docs/src/main/resources/markdown/html/header.html#L11]
>
> !image-2026-09-01-11-27-29-800.png!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
