Pin issue regarding jsoneditor-svelte?

[thernstig]

With https://github.com/josdejong/svelte-jsoneditor out, this repo has no information about that in the README.md nor here in the issues, as far as I can see.

1. Could a pinned issue be added to this repo to let users know they should preferably move to jsoneditor-svelte?
2. Can the same info be added to the README.md?
3. Is this repo going into deprecation mode?

[josdejong]

Good point. I've now described the successor in the readme: https://github.com/josdejong/jsoneditor#successor-svelte-jsoneditor

I myself will keep maintaining jsoneditor, though I'll focus my efforts on developing svelte-jsoneditor further.

[thernstig]

@josdejong we found out that Ace (which this repo depends on) uses bad allowed CSP sources more specifically data, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources

data: Allows data: URLs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URLs. Use this sparingly and definitely not for scripts.

If the intention is to keep jsoneditor, would you e.g. take in new dependency updates in this repo if reports were made on Ace editor to not use data: directives?

[josdejong]

This sounds like a duplicate of #1418.

Yes if Ace has updates I would be happy to see if we can upgrade to the latest version (or accept a PR that does so).

[thernstig]

@josdejong do you also accept new feature requests on this repo?

Reason I am asking all these questions is that we want to request new features, but if the intention is to not implement new features in this repo then we might as well upgrade.

[josdejong]

Yes new feature requests are fine with me. I'll most likely not pick them up myself though, but since it is an open source project anyone can pick it up and implement a PR, and I will happily review and merge the PR.

On a side note, this repo has a lot of stale open issues, I should clean this up one day.

[thernstig]

Ok, understand completely. Seeing though as you and everyone else might prefer to focus on the svelte version it is probably better to request features there as in the end they will end up benefiting more users as more and more move over.

[josdejong]

yes agree