Bug 41142

Summary: Update jQuery-validate plugin to 1.21.0
Product: Koha Reporter: Owen Leonard <oleonard>
Component: Architecture, internals, and plumbingAssignee: Owen Leonard <oleonard>
Status: Passed QA --- QA Contact: Martin Renvoize (ashimema) <martin.renvoize>
Severity: normal    
Priority: P5 - low CC: cking, david, evelyn, martin.renvoize
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34623
GIT URL: Initiative type: ---
Sponsorship status: Sponsored Comma delimited list of Sponsors: Athens County Public Libraries
Crowdfunding goal: 0 Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 41142: Update jQuery-validate plugin to 1.21.0
Bug 41142: Update jQuery-validate plugin to 1.21.0
Bug 41142: Update jQuery-validate plugin to 1.21.0
Bug 41142: Update jQuery-validate plugin to 1.21.0

Description Owen Leonard 2025-10-30 13:14:24 UTC
A new bug report for version 1.21.0.

> We've gotten reports that the jQuery-validate plugin is flagging in
> vulnerability scans (https://nvd.nist.gov/vuln/detail/CVE-2022-31147 for
> details on the associated CVE). 
> 
> I've put this in security to be on the safe side but if it should be moved,
> please do.
Comment 1 Owen Leonard 2025-10-30 13:18:58 UTC
Created attachment 188644 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Comment 2 Owen Leonard 2025-10-30 13:19:40 UTC
*** Bug 34623 has been marked as a duplicate of this bug. ***
Comment 3 David Nind 2025-12-08 23:51:34 UTC Comment hidden (obsolete)
Comment 4 David Nind 2025-12-08 23:53:35 UTC
I have signed off, but did note this behavour for the new budget form - which is the same before and after the patch:

1. New budget form: 
   - if I enter in start date but nowhere else, I can't save and it stays on the form
   - if I enter in the end date but nowhere else, I can't save and it stays on 
     the form
   - if I enter in the start date and end date but nothing in description, I can't
     save and it stays on the form
   - for each of the above, only the description field comes up with 
     "This field is required"
   - if I just enter something in the description (which is required), but not in
     start date and end date, and click Save, I can, but it is not saved 
     and you go back to the budget listing page
Comment 5 David Nind 2025-12-09 00:42:49 UTC
Created attachment 190319 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Comment 6 David Nind 2025-12-09 00:43:53 UTC
My sign-off line was incorrect, so have updated.
Comment 7 Martin Renvoize (ashimema) 2025-12-23 13:50:54 UTC
Created attachment 190695 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>