Problem/Motivation

Update whatever is allowed in a minor.

There are two kinds: the front-end facing libraries in core/assets and the development dependencies specified in core/package.json.

(8.8.x=)$ pwd
core/assets/vendor
(8.8.x=)$ ls -1
backbone
ckeditor
classList
domready
farbtastic
html5shiv
jquery
jquery-form
jquery-joyride
jquery-once
jquery-ui-touch-punch
jquery.cookie
jquery.ui
matchMedia
modernizr
normalize-css
picturefill
underscore

(8.8.x=)$ pwd
core
(8.8.x=)$ date
Tue Jun 11 13:10:46 EDT 2019
(8.8.x=)$ npm outdated
Package                 Current  Wanted  Latest  Location
chokidar                  2.1.6   2.1.6   3.0.1  Drupal
chromedriver             2.46.0  2.46.0  75.0.0  Drupal
dotenv-safe               5.0.1   5.0.1   6.1.0  Drupal
eslint                   4.19.1  4.19.1  5.16.0  Drupal
eslint-config-prettier   2.10.0  2.10.0   4.3.0  Drupal
eslint-plugin-prettier    2.7.0   2.7.0   3.1.0  Drupal
nightwatch               0.9.21  0.9.21  1.1.12  Drupal
stylelint                9.10.1  9.10.1  10.1.0  Drupal
stylelint-order           2.2.1   2.2.1   3.0.0  Drupal

Proposed resolution

Remaining tasks

Done:

Release notes snippet

Comments

cilefen created an issue. See original summary.

cilefen’s picture

cilefen commented
Priority: Normal » Major
Issue summary: View changes
cilefen’s picture

cilefen commented
Issue summary: View changes
alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented

Note that we need to use yarn for updating core/package.json

Nice catch on /core/assets/vendor - I think some of these have existing issues and have proved controversial if memory serves me right - see #2821525: Update normalize.css to the most recent version for example.

mradcliffe’s picture

mradcliffe
he/him
Primary language English
commented

A user on SE pointed out that jquery.cookie is deprecated in favor of js-cookie.

There's a seemingly backwards-compatible release here that we should probably try out/review first.

xjm’s picture

xjm
she/her
Primary language English
commented
Title: Update core JavaScript libraries before 8.7.0 » Update core JavaScript libraries before 8.8.0
Version: 8.7.x-dev » 8.8.x-dev
Issue tags: -8.7.0 release notes

The deadline for this has passed, so it will need to be 8.8.x. Thanks!

cilefen’s picture

cilefen commented

@mradcliffe: #2550717: [JS] Replace jQuery.cookie with JS-cookie and provide a BC layer

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented

A new patch release of CKEditor was released during DrupalCon: #3050757: Update CKEditor to 4.11.4.

bowevil’s picture

bowevil commented

I have a question on this remaining task:
jQuery is at v3.2.1, latest is v3.3.1

jQuery is now 3.4.0 per: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/

Does this mean that there will be a patch to update jQuery in core/assets?

effulgentsia’s picture

effulgentsia commented
Issue summary: View changes

Does this mean that there will be a patch to update jQuery in core/assets?

Hopefully, yes, but it requires someone to submit the patch, and people to review it (e.g., manually test it with the various jQuery-related features that we have in Drupal). I opened #3052502: Update jQuery to version 3.4 for anyone who wants to help with that effort. Thanks!

bowevil’s picture

bowevil commented

+1 @effulgentsia for opening that up.

cilefen’s picture

cilefen commented
Issue summary: View changes
cilefen’s picture

cilefen commented
Issue summary: View changes
bramdriesen’s picture

bramdriesen
he/him
Primary language Dutch
Location Belgium 🇧🇪🇪🇺
commented

Created a patch for #3052502: Update jQuery to version 3.4 which is ready for review. All tests passed :)

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Issue summary: View changes

#3052502: Update jQuery to version 3.4 landed! 🥳

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented

github's complaints about these items in yarn.lock are going to drive me nuts!

growl dependency

------------------------------------------------

Vulnerable versions: < 1.10.0

Upgrade to: 1.10.0

Defined in: yarn.lock

Vulnerabilities: CVE-2017-16042 (Critical severity)=20

https-proxy-agent dependency

------------------------------------------------

Vulnerable versions: < 2.2.0

Upgrade to: 2.2.0

Defined in: yarn.lock

Vulnerabilities: CVE-2018-3736 (High severity) WS-2018-0072 (High sever=
ity)=20

cryptiles dependency

------------------------------------------------

Vulnerable versions: < 4.1.2

Upgrade to: 4.1.2

Defined in: yarn.lock

Vulnerabilities: CVE-2018-1000620 (High severity)=20

js-yaml dependency

------------------------------------------------

Vulnerable versions: < 3.13.1

Upgrade to: 3.13.1

Defined in: yarn.lock

Vulnerabilities: WS-2019-0063 (High severity) WS-2019-0032 (Moderate se=
verity)=20

http-proxy-agent dependency

------------------------------------------------

Vulnerable versions: < 2.1.0

Upgrade to: 2.1.0

Defined in: yarn.lock

Vulnerabilities: WS-2018-0085 (High severity)=20

diff dependency

------------------------------------------------

Vulnerable versions: < 3.5.0

Upgrade to: 3.5.0

Defined in: yarn.lock

Vulnerabilities: WS-2018-0590 (High severity)=20

stringstream dependency

------------------------------------------------

Vulnerable versions: < 0.0.6

Upgrade to: 0.0.6

Defined in: yarn.lock

Vulnerabilities: WS-2018-0103 (Moderate severity)=20

lodash dependency

------------------------------------------------

Vulnerable versions: < 4.17.13

Upgrade to: 4.17.13

Defined in: yarn.lock

Vulnerabilities: CVE-2019-10744 (Critical severity)=20

lodash.mergewith dependency

------------------------------------------------

Vulnerable versions: < 4.6.2

Upgrade to: 4.6.2

Defined in: yarn.lock

Vulnerabilities: CVE-2019-10744 (Critical severity)=20

lodash.defaultsdeep dependency

------------------------------------------------

Vulnerable versions: < 4.6.1

Upgrade to: 4.6.1

Defined in: yarn.lock

Vulnerabilities: CVE-2019-10744 (Critical severity)=20

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

xjm’s picture

xjm
she/her
Primary language English
commented

I believe 8.7.8 resolved several of the items in #16, although not all of them.

mradcliffe’s picture

mradcliffe
he/him
Primary language English
commented

8.8.0 is released so I think this is outdated and I think further work needs to go in #3094468: [plan] Update core JavaScript (and CSS) dependencies prior to 9.0.0-beta1 for 8.9.0/9.0.0.

Webbeh’s picture

Webbeh
he/him/his
Location Georgia, USA
commented
Title: Update core JavaScript libraries before 8.8.0 » Update core JavaScript libraries before 8.9.0/9.0.0
Related issues: +#3094468: [plan] Update core JavaScript (and CSS) dependencies prior to 9.0.0-beta1
gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Status: Active » Closed (duplicate)

IMHO @mradcliffe is right, I got confirmation from @lauriii :) The work is at #3094468: [plan] Update core JavaScript (and CSS) dependencies prior to 9.0.0-beta1 now.