Bump jQuery to v3.7.1 and jQuery-UI to v1.14.2 (#2476)
## Context - jQuery is a bit outdated (not a big deal) - jquery-ui is outdated, there exists CVE (and we're probably not vulnerable) - the `"components-jqueryui"` package is unmaintained: in case of a vulnerability, dependabot won't trigger an update. ## Proposed solution - Bump jQuery to the latest minor version (3.7.1) - Migrating to version 4 is out of scope: version 3.X is still benefits from security updates ([source](https://jquery.com/support/)) and `bootstrap-datepicker3` requires jQuery < 4 as of today. - Migrate to the `"jquery-ui"` to take advantage of the depandabot updates (probably the best motivation behind this PR). Side-notes: - `_respectSize` [is monkey-patched here](https://github.com/gristlabs/grist-core/blob/c9155e0f9a52d5f03b5eece37c93903657af18df/app/client/components/viewCommon.js#L12), but the original method has been untouched since version 1.2.0 (you may check the associated commits): https://github.com/jquery/jquery-ui/blame/08b704407a4a0ed4d8fe544aac5953ea378e6361/ui/widgets/resizable.js#L629 - also no call to external function except `this._isNumber`, also untouched. ## Related issues ## Has this been tested? <!-- Put an `x` in the box that applies: --> - [ ] 👍 yes, I added tests to the test suite - [ ] 💭 no, because this PR is a draft and still needs work - [x] 🙅 no, because this is not relevant here - [ ] 🙋 no, because I need help <!-- Detail how we can help you --> ## Screenshots / Screencasts <!-- delete if not relevant -->
F
Florent committed
e2bd86ba176ab6d69f9d579e2aad3f05ab98e3f0
Parent: 506c093
Committed by GitHub <noreply@github.com>
on 8/20/2026, 4:18:15 PM