Bug 41142 - Update jQuery-validate plugin to 1.21.0
Summary: Update jQuery-validate plugin to 1.21.0
Status: Passed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Owen Leonard
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
: 34623 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-10-30 13:14 UTC by Owen Leonard
Modified: 2025-12-23 13:51 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: Sponsored
Comma delimited list of Sponsors: Athens County Public Libraries
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41142: Update jQuery-validate plugin to 1.21.0 (100.09 KB, patch)
2025-10-30 13:18 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 41142: Update jQuery-validate plugin to 1.21.0 (100.13 KB, patch)
2025-12-08 23:51 UTC, David Nind
Details | Diff | Splinter Review
Bug 41142: Update jQuery-validate plugin to 1.21.0 (100.13 KB, patch)
2025-12-09 00:42 UTC, David Nind
Details | Diff | Splinter Review
Bug 41142: Update jQuery-validate plugin to 1.21.0 (100.21 KB, patch)
2025-12-23 13:50 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2025-10-30 13:14:24 UTC
A new bug report for version 1.21.0.

> We've gotten reports that the jQuery-validate plugin is flagging in
> vulnerability scans (https://nvd.nist.gov/vuln/detail/CVE-2022-31147 for
> details on the associated CVE). 
> 
> I've put this in security to be on the safe side but if it should be moved,
> please do.
Comment 1 Owen Leonard 2025-10-30 13:18:58 UTC
Created attachment 188644 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Comment 2 Owen Leonard 2025-10-30 13:19:40 UTC
*** Bug 34623 has been marked as a duplicate of this bug. ***
Comment 3 David Nind 2025-12-08 23:51:34 UTC Comment hidden (obsolete)
Comment 4 David Nind 2025-12-08 23:53:35 UTC
I have signed off, but did note this behavour for the new budget form - which is the same before and after the patch:

1. New budget form: 
   - if I enter in start date but nowhere else, I can't save and it stays on the form
   - if I enter in the end date but nowhere else, I can't save and it stays on 
     the form
   - if I enter in the start date and end date but nothing in description, I can't
     save and it stays on the form
   - for each of the above, only the description field comes up with 
     "This field is required"
   - if I just enter something in the description (which is required), but not in
     start date and end date, and click Save, I can, but it is not saved 
     and you go back to the budget listing page
Comment 5 David Nind 2025-12-09 00:42:49 UTC
Created attachment 190319 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Comment 6 David Nind 2025-12-09 00:43:53 UTC
My sign-off line was incorrect, so have updated.
Comment 7 Martin Renvoize (ashimema) 2025-12-23 13:50:54 UTC
Created attachment 190695 [details] [review]
Bug 41142: Update jQuery-validate plugin to 1.21.0

This patch updates the jQuery validation plugin in both the staff
interface and the OPAC to the latest version, 1.21.0.

To test, apply the patch and clear your browser cache if necessary.

Test various pages in the staff client to confirm that form validation
works as expected:

 - Patron password change form:
   - Password must conform to minPasswordLength
   - Password must not contain leading/trailing spaces
   - Passwords must match

 - Administration -> Add or edit budget:
   - Description, start date, and end date are required
   - Start date must be before end date

 - Administration -> Add or edit Z39.50/SRU server:
   - Server name, hostname, port, and database are required
   - Port, rank, and timeout must be a number

Perform the same check of the "Change password" form in the OPAC.

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>