[plan] Update core JavaScript (and CSS) dependencies prior to 9.0.0-beta1

Should we also update packages in package.json?

Added some related issues. There is probably some additional info. in comments and issue summary related to this in #3042182: Update core JavaScript libraries before 8.9.0/9.0.0.

There is a replacement for jquery-cookie as js-cookie, which is in Need review.

Looking at #3074267: Replace jQuery UI position() with PopperJS, I think popper.js is the minified version of 1.15.0, but that isn't guaranteed. I couldn't find any other mention of updating.

I did confirm the md5 checksum of popper.min.js in core is e21a6649041ef6f5f1bf43f11946621f, which is the same as the one available at https://unpkg.com/popper.js@1.15.0/dist/umd/popper.min.js.

I added not about github repository being read-only for farbtastic.

created #3100943: Update jquery-once to 2.2.3

Opened #3101543: Update core JavaScript dependencies listed in package.json for dependencies listed in package.json.

Added normalize.css issue

Updated IS with underscore issue.

Added Popperjs issue to IS

Added SortableJS issue to IS.

Added backbonejs issue

D8/D9 are on CKEditor 4.13.0. Shortly after 8.8.0 shipped, 4.13.1 was released. See #3105327: Update CKEditor to version 4.13.1.

New release https://github.com/jashkenas/underscore/releases/tag/1.9.2 but changes only in docs and tests

Opened new issue for updating stylelint to 13.0.0: #3107926: Update stylelint to ^13.0.0.

Popper.js 2 has been released #3108402: Update to Popper.js to 2.0.0.

Gabor asked for feedback on Twitter, so here we are :D

It may not fit entirely in this issue but has there been any discussion on moving front-end dependencies to composer using asset-packagist? I realise this is different from what the rest of the front-end world does but it does fit better with what some contrib projects (Open Social in our case) are doing. It also makes these sorts of decisions easier/moot in the future because proper conflicts can be detected by composer if Drupal updates something that doesn't work with a module or theme.

If that route isn't chosen, by all means, please update everything that's possible, it's probably the only opportunity in a while. Most dependencies in the list can either be overwritten by themes (normalize et al) or scoped to certain code (jQuery et al).

Opened new issue to prepare for the release of Yarn 2: #3109556: Update from Yarn 1 to Yarn 4.

@Kingdutch Thank you for the review! The discussion about moving frontend dependencies to Composer using asset-packagist is happening in #2873160: Implement core management of 3rd-party FE libraries. If you have some more time to help us out, we could also use some help reviewing the child issues updating specific libraries 😇

I will check out the issue, thanks! We're currently hard at work on the Open Social 8.0 release. If there's updates left after this I'll be sure to take a look :)

Tagging as a requirement for Drupal 9.0-beta1.

New version of SortableJS is available. Created a followup with a patch for it #3111244: Update SortableJS to 1.10.2.

js-cookie just released beta4 four days ago, so we should keep an eye on that (probably after beta).

https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.4

Another surprise update: #3120022: Update CKEditor to version 4.14.0

Is this issue in the queue for a Drupal 8 fix. Modernizr 3.3.1 has a security vulnerability: https://snyk.io/test/npm/modernizr/3.3.1 and needs to be bumped up to at least 3.4.0.