Security issues within JQuery and Angular libraries - updates are available

Hi,

although I’m not sure if the specific issues within these libraries are used within Matomo, it would help security posture to always use the most recent (stable) versions of libraries used by Matomo.

Can this be made part of the standard Matomo updates?

Kind regards,
Ties Voskamp

Hi,

None of those security issues should affect Matomo (and if you know that they do, please report a proof of concept to https://matomo.org/security/).

Updating libraries is of course still always a good idea and has been done in Matomo 4 (it uses the latest angular.js version). Updating jquery is a lot harder as Wordpress doesn’t allow plugins to use any version apart from the one shipped with Wordpress and this one has been stuck on an old version for quite some time (https://core.trac.wordpress.org/ticket/37110). Also materialize css depends on jquery<3 which makes things more complicated (https://github.com/matomo-org/matomo/issues/12961).

Hi Lukas,

Wow, you’re quick! :slightly_smiling_face:
Thanks for your explanation. Looking forward to start testing Matomo 4!
Keep up the good work!

Kind regards,
Ties Voskamp

1 Like