Upgrade jQuery version


SilkUI uses jQuery 1.8.3 (released November 13, 2012)

This version of jQuery is no longer supported by the vendor, as it has reached its endof-life. 

Versions from 1.6.3 to (and including) 1.8.3 have known vulnerabilities associated with them.

This jQuery can by default interpret script content received via $.get(), despite it originating from a third-party location. This version may also execute script content when supplied via class selectors.

Please stay up-to-date with 3rd party libraries. The current version is 3.1.

Kind regards,

Matthias Preuter

Created on 20 Mar
Comments (8)

Is the outsystems not a subset of 1.8.3 and slightly customized?

Furthermore, personally I am not keen on a newer version, because chances are it's more bloated.

It could be a subset, but the above vulnerability; is valid. And maybe there are even more. It is always the best to stay up-to-date because of security updates.

Funny enough we have an issue now with a security audit :(

So I need to like it now :D

Maybe the same Auditor?

Or just supply a more recent version as a possible choice in the espace configuration. So you can check and switch on your own time.

We've done implementations to bypass the default jquery version but you may get conflicts trying to load two versions.

Regarding the 3.3.1 being more bloated. Actually it's the other way around.

JS evolved to have querySelectorAll. Which has the same job as the $ selector function from jQuery.

jQuery 3 only assigns $ to this function and builds upon it. While jQuery 1 (and 2 I think) has it built from the ground up.

The overall production size is reduced by almost 10KB but the runtime performance is a lot higher because the core of jQuery (the selector function) runs directly from vanilla JS. Meaning the function that runs all the time is now faster.

Personally, I've noticed specially the speed improvement on those big cycles and big ".each()"; It used to feel like the browser was about to break and now it never happens.

From 1 to 2 it had a lot of improvements for mobile as well, specially on ontouch events which didn't always trigger.

Please double check browser support as jQuery dropped some support by using the native functions (https://jquery.com/browser-support/ IE9+ and only the webkit version of Opera seems to be what to look for)

As a side note, querySelectorAll was such a massive improvement that it has a lot of developers moving away from jQuery because they only really used it for the selector.