16459 2026-10-18 00:47:27 +0000 error-report-web: upgrade Bootstrap 2.3.2 -> 3.4.1 and jQuery 1.10.2 -> 3.7.1 2026-10-18 02:07:53 +0000 1 1 6 Yocto Project Subprojects Error Reporting tool Error Reporting Tool 6.2 x86 Multiple IN PROGRESS REVIEW Medium+ normal 6.2 M1 1 tim.orling TicoTimo --- --- Don't know oldest_to_newest 107096 0 tim.orling 2026-10-18 00:47:27 +0000 error-report-web ships Bootstrap 2.3.2 (2013) and jQuery 1.10.2 (2013) in Post/static/. Neither has received fixes for years, and both have published XSS vulnerabilities, for example: jQuery < 3.5.0: CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 Bootstrap < 3.4.1: CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2019-8331 Most of these need untrusted data passed to particular jQuery/Bootstrap APIs or data-* attributes. Related hardening is already staging in my master-next: a Content Security Policy, tooltips that no longer render HTML, the commit popover built as text, and escaping on output instead of bleach. Upgrading removes the vulnerable code itself, and puts error-report-web on the same front-end versions as layerindex-web, which uses Bootstrap 3.4.1 and jQuery 3.7.1.