How to update the last jQuery 1.x version with the provided security patches from jQuery 3.x?

Viewed 137

We use jQuery 1.12.4 on our site - the latest 1.x version from before they stopped supporting it. PCI compliance scans are flagging this as being vulnerable and out of date, because there are some security patches in the latest 3.x versions (e.g. https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).

We can't simply move to 3.x because there are many breaking changes and incompatibilities; it would be an enormous undertaking. Luckily, they provide an example of how to back-port the security patches into 1.x here: https://github.com/DanielRuf/snyk-js-jquery-565129

This is great for the un-minified file, but doesn't help on the minified one we need for production. I've never done it before, but I was going to try to follow their advice and build and minify it myself. But I can't even find the source code for jQuery 1.x! I pulled down the code from https://github.com/jquery/jquery and built it, but it's version 4.x.

Is there anywhere I can get the minified version of jQuery 1.12.4 with the latest security patches applied?

Or, does someone at least know where the source code for jQuery 1.x is?

1 Answers

Turns out you don't need the full source code to produce the minified file. I guess I was thinking about how 'builds' typically work in my experience to create compiled output from source code (.Net, Angular, etc).

I was able to hand-edit the latest non-minified file with the provided changes, then minify it from there.

Related