Update jQuery

[DimitriPapadopoulos]

The current version is 3.4.1, as the name of src/js/jquery-3.4.1.min.js: implies.

Meanwhile, jQuery 3.5.0 has been released and fixes a security issue:
https://github.com/jquery/jquery/releases

Unfortunately, it's a breaking change:

NOTE: Despite being a minor release, this update includes a breaking change that we had to make to fix a security issue (CVE-2020-11022). Please follow the blog post & the upgrade guide for more details.

Perhaps upgrade to the latest jQuery 3.6.0?

[sappelhoff]

+1 for staying up to date, but we'd have to test if the upgrade breaks our "version panel" in the BIDS spec, see: #232, where the file you mention was added.

[DimitriPapadopoulos]

How do I test that offline? I'm afraid I'm not that good at website programming...

[DimitriPapadopoulos]

By the way, why is jQuery not tracked as a dependency by GitHub's Dependabot?
https://github.com/bids-standard/bids-specification/network/dependencies

It looks into these files:

• npm-requirements.txt
• requirements.txt
• tools/requirements.txt

I'm wondering whether there's a way to have it look elsewhere too.

[effigies]

Probably because it's vendored, rather than "required". I'm not sure how to set it up to be required.

[DimitriPapadopoulos]

Couldn't find anything in About the dependency graph or the following pages either.

[DimitriPapadopoulos]

Otherwise, for jQuery to be tracked, can't we add jquery in npm-requirements?

[effigies]

Looks like we'd need to use a package.json or something to track javascript dependencies: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

I would say if we want to do that with this, we put that in the same directory as the jquery file.

[DimitriPapadopoulos]

Yes, I've seen this table refers to package.json instead of npm-requirements which is missing. I'm concerned a package.json file might somehow shadow the npm-requirements file, but then I don't know much about the JavaScript ecosystem.

[effigies]

npm-requirements.txt is just our hack to have a simple format in the main repository, as opposed to hidden in the CI. It's just used for running a linter, and no tools respect it. GitHub is treating it like a Python requirements.txt.

[DimitriPapadopoulos]

Ah, now I get why it doesn't understand it:

npm-requirements.txt has no dependencies or is too large to display