[KrzysztofPajak]

Resolves #(none — Dependabot alerts 208–211 and 232–237)
Type: bugfix

Two dependency updates for the vulnerabilities GitHub reports on the default branch: Vite (build tooling) and the jQuery the Admin, Store and Vendor panels run.

Issue

Vite

Both frontend projects, src/Web/Grand.Web/vueapp (storefront) and src/Web/Grand.SharedUIResources/adminapp (Admin, Store and Vendor panels), build with Vite 8.3.2. Vite 8.3.0–8.3.2 bundles a launch-editor affected by three advisories, all on Windows: the fs.existsSync() existence check can be bypassed (high), editor CLI flags can be misread into running a command (moderate), and escapeCmdArgs() does not escape % (moderate).

They are reachable only through the Vite dev server (npm run dev, "open in editor" from the browser) on a developer machine. Production serves the prebuilt bundles and contains no Vite code.

jQuery

The Admin, Store and Vendor panels load wwwroot/administration/build/js/jquery.min.js, which is jQuery 2.2.4. It is affected by the known jQuery XSS advisories fixed in 3.0, 3.4 and 3.5 (CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023): HTML passed to .html(), .append() and $() can run script, and $.extend(true, …) allows prototype pollution. Dependabot reports the same version through the jquery dev dependency of adminapp (the copy the serializer tests compare against), but the copy the browsers actually run is the vendored file, which Dependabot does not see.

jQuery cannot simply be removed: about 300 admin views, admin.common.js, admin.search.js, the form validation (jquery.validate + unobtrusive), summernote, elFinder, jQuery UI (autocomplete), magnific-popup, typeahead, tagEditor, fineuploader, farbtastic, daterangepicker and jquery.tmpl depend on it.

Solution

Vite

vite raised to ^8.3.5 (the latest 8.3.x; the advisories are fixed from 8.3.3) in both package.json files, with the lock files regenerated by npm install. Both projects rebuilt with npm run build and the committed bundles updated. The bundle changes are minifier output only (if/return rewritten as conditional expressions); no source changed. The lock files are generated with npm 11, which keeps the libc fields npm uses to pick the glibc or musl native bindings of rolldown on Linux.

jQuery

• build/js/jquery.min.js replaced with jQuery 3.7.1 (the npm jquery@3.7.1 dist file, sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=, the same as the official CDN SRI).
• build/js/custom.js: $(window).load(fn) (removed in jQuery 3.0) → $(window).on('load', fn). The block only runs when NProgress is loaded, which no panel does today.
• adminapp: the jquery dev dependency raised to ^3.7.1 (lock file: only the jquery entry changes). param.test.js compares the grid serializer with jQuery 3, which writes a space as %20 where jQuery 2 (and the Kendo transports) wrote +; the serializer keeps +, the tests treat the two as equal (the model binders decode both the same). README updated.

Nothing else needed changing. jQuery Migrate 3.5.2 (used only during testing, not shipped) reported no removed API in use; what it reports is deprecated-but-present API (.bind, event shorthands like .click(), $.isFunction, $.trim, jQuery.expr[':'], mostly inside the vendored plugins), which jQuery 3.7.1 still supports and only jQuery 4 removes. The one behaviour change it flagged, removeAttr('disabled') in daterangepicker, has the same effect in 3.x because disabled is a reflected attribute.

Breaking changes

• Vite: none. Build tooling only; the bundles keep their names, format (IIFE) and globals.
• jQuery: Admin views of third-party plugins that use API removed in jQuery 3.0 (.size(), .andSelf(), .load(fn) / .unload(fn) / .error(fn) event aliases, jqXHR.success/error/complete, $(document).on('ready'), .selector) will need updating. None of the shipped plugins or panels uses them.

Testing

Vite

1. cd src/Web/Grand.Web/vueapp && npm ci && npm run lint && npm run build → lint clean, build succeeds, git status shows no changes in wwwroot/bundles beyond this PR.
2. cd src/Web/Grand.SharedUIResources/adminapp && npm ci && npm run lint && npm test && npm run build → lint clean, 218 tests passed, build succeeds.
3. node -e "console.log(require('./node_modules/vite/package.json').version)" in both folders → 8.3.5.
4. Run the storefront and open the Admin panel: the home page, a product page, the admin product list (grid) and a product edit page (tabs, selects) work as before.

jQuery

Done on a fresh install with sample data (Admin, a store manager and a vendor account), comparing jQuery 2.2.4 with 3.7.1 on the same database:

1. cd src/Web/Grand.SharedUIResources/adminapp && npm ci && npm test && npm run lint → 218 tests passed, lint clean.
2. Every page linked from the Admin (135), Store (70) and Vendor (15) menus, plus one edit page per list, with every tab clicked: no console error, page error or HTTP 5xx with 3.7.1 that 2.2.4 does not also have (the only one on both: a sample blog post the store manager may not open).
3. Scenarios, all passing on both versions:
   • login pages of the three panels, client-side validation of an empty login form and of Category create (jquery.validate + unobtrusive);
   • summernote (typing, code(), code view) and the elFinder dialog from its "Manage pictures" button;
   • fineuploader: category picture upload and the product Pictures tab upload;
   • daterangepicker on the dashboard (open, preset), dashboard charts;
   • typeahead header search;
   • jQuery UI autocomplete on the Order list (Admin, Store, Vendor);
   • tagEditor on product tags (adds a tag, the hidden input follows);
   • magnific-popup: category tab "Add" popups, specification attribute option popup with the farbtastic colour picker;
   • jquery.tmpl: discount requirement added and rendered, customer group user field row;
   • DiscountRules.Standard: all 5 rule forms load in the requirements tab;
   • plugin configuration pages in Admin and Store (Facebook, Google, ShippingByWeight and ShippingPoint with their "Add" popups, FixedRate shipping/tax, CountryStateZip, FacebookPixel, GoogleAnalytics, Slider, BrainTree, CashOnDelivery, Stripe);
   • Store and Vendor product edit (tagEditor, summernote, uploaders).
   • full flows, saved and reloaded: summernote bold text and a link from its link dialog; elFinder (from the editor) creating a folder, uploading a picture into it, inserting the picture into the editor and deleting the folder through its own confirm dialog; the category saved and the description (text, link, picture) read back after a reload; product tags with one tag added and one removed, saved and read back.
4. npm run e2e -- --project=en-US --project=foreign-locale against the same instance: 49 passed, 13 failed, 1 skipped, and the same 13 fail with jQuery 2.2.4. They click a .dropdown-item (Delete, Copy product, Import) without opening its dropdown first, so they are out of date and unrelated to this change.

Unrelated, seen on both jQuery versions and left for a separate change: elFinder thumbnails return HTTP 500 (MissingMethodException for SixLabors.ImageSharp.Image.Load(Stream, out IImageFormat) in elFinder.Net.Core 1.5.0), so the file manager shows no thumbnails; uploading, picking and deleting files work.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.