Bug 16459 - error-report-web: upgrade Bootstrap 2.3.2 -> 3.4.1 and jQuery 1.10.2 -> 3.7.1
Summary: error-report-web: upgrade Bootstrap 2.3.2 -> 3.4.1 and jQuery 1.10.2 -> 3.7.1
Status: IN PROGRESS REVIEW
Alias: None
Product: Error Reporting tool
Classification: Yocto Project Subprojects
Component: Error Reporting Tool (show other bugs)
Version: 6.2
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 6.2 M1
Assignee: Tim Orling
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2026-10-18 00:47 UTC by Tim Orling
Modified: 2026-10-18 02:07 UTC (History)
0 users

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Orling 2026-10-18 00:47:27 UTC 
error-report-web ships Bootstrap 2.3.2 (2013) and jQuery 1.10.2 (2013) in
Post/static/. Neither has received fixes for years, and both have published
XSS vulnerabilities, for example:

  jQuery < 3.5.0:      CVE-2015-9251, CVE-2019-11358, CVE-2020-11022,
                       CVE-2020-11023
  Bootstrap < 3.4.1:   CVE-2018-14040, CVE-2018-14041, CVE-2018-14042,
                       CVE-2019-8331

Most of these need untrusted data passed to particular jQuery/Bootstrap
APIs or data-* attributes. Related hardening is already staging in my
master-next: a Content Security Policy, tooltips that no longer render
HTML, the commit popover built as text, and escaping on output instead
of bleach. Upgrading removes the vulnerable code itself, and puts
error-report-web on the same front-end versions as layerindex-web, which
uses Bootstrap 3.4.1 and jQuery 3.7.1.