scala-compiler jar contains jQuery 1.8.2 that is vulnerable to number of XSS attacks: CVE-2012-6708, CVE-2012-6708, CVE-2019-11358

[plokhotnyuk]

It was detected by the amazing sbt-dependency-check plugin when applied for jsoniter-scala repo.

Steps to get and open reports for different Scala versions:

git clone https://github.com/plokhotnyuk/jsoniter-scala
cd jsoniter-scala
sbt clean +dependencyCheck
xdg-open jsoniter-scala-macros/target/scala-2.11/dependency-check-report.html
xdg-open jsoniter-scala-macros/target/scala-2.12/dependency-check-report.html
xdg-open jsoniter-scala-macros/target/scala-2.13/dependency-check-report.html

[exoego]

I want to provide help to this issue.
Let me have a couple of days.

[exoego]

Question to @scala/docs
What is a web browser requirement for ScalaDoc, especially Internet Explorer ?

Supported versions

• jQuery 1.x: Supports IE6+
• jQuery 2.x: Supports IE8+
• jQuery 3.x: Supports IE9+

According to some browser usage statistics (I digged https://caniuse.com), global IE6-9 usage is very low (less than 0.5%).
Since Microsoft already terminated IE8 support, I think we may switch to jQuery 2.x or 3.x, which supposed to be faster and more stable.

[dwijnand]

Yeah, jQuery 3.x sounds reasonable. I'll let you know if there's pushback on that idea.

[exoego]

Opened a PR scala/scala#8179