jQuery 3.4.0 represents an incremental update over version 3.3.1, offering developers refinements and improvements to this widely used JavaScript library. While both versions share the primary goal of simplifying DOM manipulation, event handling, and AJAX interactions, some notable differences exist in their development dependencies. In version 3.4.0, several dev dependencies have been updated to newer versions, such as q, grunt, husky, jsdom, karma and core-js. These updates often bring performance enhancements, bug fixes, and better compatibility with modern tooling. Specifically, the "@babel/core" and "@babel/plugin-transform-for-of" dependencies, introduced in 3.4.0 indicate a move towards leveraging newer JavaScript features and ensuring broader browser compatibility through transpilation. Also, support for testing has been improved by using karma-jsdom-launcher. Developers upgrading to 3.4.0 can expect a smoother development experience due to these updated tools and potentially improved runtime performance stemming from underlying dependency optimizations. Conversely, version 3.3.1 relied on older versions of similar development tools, and babel related dependencies that have a beta version. For developers using jQuery, these updates mean improved build processes, more robust testing capabilities, and potentially better compatibility with modern JavaScript development practices. The core functionalities of jQuery remain consistent between the two versions, ensuring a familiar experience for seasoned developers while providing a solid foundation for new users.
All the vulnerabilities related to the version 3.4.0 of the package
Potential XSS vulnerability in jQuery
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
This problem is patched in jQuery 3.5.0.
To workaround the issue without upgrading, adding the following to your code:
jQuery.htmlPrefilter = function( html ) {
return html;
};
You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.
Potential XSS vulnerability in jQuery
Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
This problem is patched in jQuery 3.5.0.
To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.