Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove jquery-ui as it is no longer maintained #16033

Open
diosmosis opened this issue Jun 7, 2020 · 16 comments
Open

Remove jquery-ui as it is no longer maintained #16033

diosmosis opened this issue Jun 7, 2020 · 16 comments
Labels
c: Design / UI For issues that impact Matomo's user interface or the design overall. Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change. Technical debt Issues the will help to reduce technical debt
Milestone

Comments

@diosmosis
Copy link
Member

We use jquery-ui for the datepicker, tooltips and some modals. Since the latest release has bugs in it and does not appear to be maintained, we should perhaps switch away from it to materialize.

@diosmosis diosmosis added this to the 4.0.0 milestone Jun 7, 2020
@Findus23 Findus23 added the Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change. label Jun 8, 2020
@sgiehl
Copy link
Member

sgiehl commented Jun 17, 2020

Replacing the datepicker won't be easy. We currently show the datepickers in our periodselection inline. MaterializeCSS does not have an option to display a datepicker inline. That means we need to find some hackish solution to make that possible. Or we might need to rethink the whole period selector, and change it in a way that doesn't need inline date pickers.
Tried replacing the other date pickers, but actually they would have this issue Dogfalo/materialize#6552

@tsteur
Copy link
Member

tsteur commented Jun 17, 2020

In Matomo for WordPress I wanted to load only the needed jquery-ui files but noticed we're actually using 17 components: https://github.com/matomo-org/wp-matomo/blob/develop/plugins/WordPress/WpAssetManager.php#L40-L57

Maybe some of those components rely on each other but there were definitely more components used by us than you think so replacing it wouldn't be trivial.

Are there are known jquery UI security issues in the latest version? WordPress is also using jquery-ui in https://github.com/WordPress/WordPress/tree/master/wp-includes/js/jquery/ui and there were no updates in 4 years or so. AFAIK WP does apply security patches to jquery (as they are using jquery 1) so there might be no security issues so far?

The latest security fix I could find in jquery-ui directly is jquery/jquery-ui#1747

Seems a bit of development is still going on? https://github.com/jquery/jquery-ui/commits/master

@diosmosis
Copy link
Member Author

Looks like the last release was in 2016: https://github.com/jquery/jquery-ui/releases. not sure what the ongoing development is.

@diosmosis
Copy link
Member Author

FYI I just added this to 4.0 since that's when I created it. It doesn't need to be here.

@sgiehl
Copy link
Member

sgiehl commented Jun 18, 2020

If we don't do it in 4.0, I guess we should move it to the next major release, as removing JQuery UI might break the UI of some plugins, which shouldn't be done in a minor release imho

@Findus23
Copy link
Member

Are there are known jquery UI security issues in the latest version?

There are no published ones. But that of course doesn't mean there aren't any, maybe no one is looking in such an old library.

Development definitely has stopped quite a while ago: https://blog.jqueryui.com/2017/12/the-future-of-jquery-ui-and-jquery-mobile/

@tsteur tsteur modified the milestones: 4.0.0, 5.0.0 Jun 18, 2020
@Findus23
Copy link
Member

Bonus points: Jquery UI seems to be the single largest JS file embedded in the Matomo UI (66KB gzipped), so removing it might speed up the page load by quite a bit.

@tsteur
Copy link
Member

tsteur commented May 10, 2022

Replacing all those components and coming up with a new design could be a lot of work. While there are no security issues and while WordPress is still supporting jquery-ui, there may not be a need to remove it in Matomo 5 just yet. Also the gain in JS size won't be too much since any other lib would also still consume a few KB and then it be in the end fairly little KBs that we would save considering how big the overall JS size is (currently 3.5MB with Vue and Angular). Would be probably good to see how much work this is as an estimate and then see if it's worth the benefit.

@justinvelluppillai justinvelluppillai added the c: Design / UI For issues that impact Matomo's user interface or the design overall. label Jul 8, 2022
@rodelrod
Copy link

The situation now has changed and there is indeed a security issue that is triggering alarms: https://security.snyk.io/package/npm/jquery-ui/1.13.1

This is solved in version 1.13.2, so it would be good if JQuery UI version is at least updated to 1.13.2.

@sgiehl
Copy link
Member

sgiehl commented Jul 24, 2023

@rodelrod jquery-ui will be updated to 1.13.2 with Matomo 5. That was done as part of #19989
But we will still aim to fully remove it at some point.

@sgiehl
Copy link
Member

sgiehl commented Jul 28, 2023

I will create some smaller issues for each component that needs to be replaced, so we can work on solving this one step by step.

@rodelrod
Copy link

@rodelrod jquery-ui will be updated to 1.13.2 with Matomo 5. That was done as part of #19989 But we will still aim to fully remove it at some point.

Great news, thanks!

@tsteur
Copy link
Member

tsteur commented Jul 30, 2023

FYI jquery-ui is still receiving some updates see https://github.com/jquery/jquery-ui . It is in maintenance mode.

@sgiehl
Copy link
Member

sgiehl commented Jul 30, 2023

@tsteur It's (only) receiving security updates. That for sure lowers the priority of removing it, but we should still try to beginn converting the remaining stuff to materialize and/or vue.js, to get rid of some technical dept.

@tsteur
Copy link
Member

tsteur commented Jul 31, 2023

@sgiehl
Copy link
Member

sgiehl commented Jul 31, 2023

@tsteur Good to know. But I would still aim to remove jquery ui in one of the next major releases. I'm actually thinking about marking jQuery UI support as deprecated for Matomo 5 already. New plugins and core features shouldn't use it anymore, as most stuff can be easily replaced with materialize css or vue.js code.

@sgiehl sgiehl added the Technical debt Issues the will help to reduce technical debt label Aug 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Design / UI For issues that impact Matomo's user interface or the design overall. Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change. Technical debt Issues the will help to reduce technical debt
Projects
None yet
Development

No branches or pull requests

6 participants