We bundle jquery, currently version jquery 1.6.2 and jquery-ui
1.8.14 (both from mid-2011).

These _might_ be vulnerable to several CVEs, see
[[bugs/outdated_jquery-ui]] for one discussion. A glance at
[OpenCVE](https://app.opencve.io/cve/?vendor=jquery) shows many more that
might apply.

Relatedly, [Debian would prefer we don't bundle it in the
package](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=643338), but
stripping it out or referencing an external copy is non-trivial (as Joey
outlines)

The APIs are broken between the versions we've bundled and the current
versions (as smcv said in the prior linked page) so we can't just update
the bundled ones.

To try and sort this out I think we should review what we're using from
Jquery, and determine what the best choice is for that functionality in
future (which might be to continue with jquery and jquery-ui).

*— [[Jon]], 2025-08-27*

----

`loginselector` (no doc page) uses jquery.
There's a tiny use in `templates/login-selector.tmpl` which could easily
be substituted for a longer, standard DOM method of finding the `fieldset`.
The remaining use is in 
`underlays/login-selector/ikiwiki/login-selector/login-selector.js`, which
calls `extend` once, and is otherwise just accessors. So for `loginselector`,
it would be easy to remove the jquery dependency.

[[plugins/attachment]] uses `jquery.fileupload.js`, `jquery.fileupload-ui.js`,
`jquery.iframe-transport.js`, `jquery.tmpl.js` and `jquery-ui.js`. I think
it would be much harder to remove or replace. (I'm at the limit of my JS
knowledge here.)

However, if it was the only user of jquery, we could at least move the jquery
JS into the attachment underlay, adjacent to the other jquery-related JS, and
not have a separate jquery underlay. It would be a small step forward, to
sequester the stuff in one place. Or maybe a waste of time. I don't know!

*— [[Jon]], 2025-08-28*

> Doesn't feel like a waste of time to me at all: reducing the blast radius is a great idea, imho, but it might cause problems for third-party plugins that *assume* jquery is present... maybe that's where it's more of a problem? maybe a progressive deprecation?  -- [[anarcat]]

[[!template id=gitbranch author="[[Jon]]" branch=jon/minimize-jquery]]

>> Thanks for the encouragement! I've de-jquery'd the login selector.
>> Patches in the branch detailed in the template. If anyone is prepared
>> to give this some basic testing that would be appreciated.
*— [[Jon]], 2025-09-16*

----

I've merged the de-jqueryification of `loginselector` after performing
some more testing. Next up, `attachment`… *— [[Jon]], 2025-09-29*
