The OpenJS Foundation is working to reduce potential security risks for jQuery, with support from the OpenSSF’s Project Alpha-Omega.
OpenSSF Project Alpha-Omega Invests in the OpenJS Foundation and jQuery to Help Secure the Consumer Web
By: Robin Ginn, Executive Director, OpenJS Foundation and Brian Behlendorf, General Manager, OpenSSF
Today, we’re excited to share that the Open Source Security Foundation (OpenSSF) Project Alpha-Omega is committing $350,000 to reduce potential security incidents for jQuery by helping modernize its consumers and its code.
OpenJS, working with the jQuery maintainers and industry experts, will undertake three core initiatives under this grant: an ecosystem risk audit, an expansion of its infrastructure modernization project, and a web modernization campaign.
“There’s a lot of work to be done to help secure the consumer web,” said Michael Scovetta, Alpha-Omega co-lead and Principal Security PM Manager at Microsoft. “We believe partnering with the vendor-neutral OpenJS Foundation is a great way to communicate out broadly to developers and to work with technology partners to reduce potential security incidents for jQuery. This is a wide ranging effort that is by no means simple.”
jQuery Core is still actively maintained, and the maintainers have taken steps to consolidate and modernize its infrastructure with support from the OpenJS Foundation including migrating and improving its CDN. jQuery is still used by 77% of the world’s top 10 million websites, but one-third of those sites are still using 15-year-old legacy jQuery 1.x when they should be using a much more current version.
As part of its modernization initiative, OpenJS Foundation has also helped jQuery with two projects under the jQuery umbrella through a careful transition: jQuery UI and jQuery Mobile. However, there is much work to be done to fully understand and mitigate potential risks.
“The use of ubiquitous technologies like jQuery is invisible to most, however potential problems could affect millions of websites. And, there’s no one-size-fits-all solution. This is exactly the type of project that the OpenSSF is looking to support, and we are excited to be working on our second project with the OpenJS Foundation, helping to advance open source security for all,” said Michael Winser, Alpha-Omega co-lead and Group Product Manager for Software Supply Chain Security and CI/CD at Google. “We are pleased to be committing to this project with the OpenJS Foundation and jQuery.”
The OpenJS Foundation and OpenSSF are looking forward to working closely together to help developers around the globe improve their open source security readiness!
If you’re interested in finding out how you can help, please contact the OpenJS Foundation via https://openjsf.org/collaboration/.
Authors: Michał Gołębiowski-Owczarek, Felix Nagel, and the jQuery team
The jQuery project is actively maintained and widely implemented — it’s used by 73% of 10 million most popular websites. As part of its ongoing effort to modernize the project, jQuery maintainers have taken steps to wind down one of its projects under the jQuery umbrella through a careful transition.
Today, jQuery UI announced version 1.13 — its first release in 5 years and the project’s final planned release. Perhaps the most important update is that jQuery UI 1.13 now runs on the latest version of jQuery Core, providing a number of browser compatibility and security updates that have been missing from previous releases, in addition to community fixes and improvements. The jQuery UI Download Builder has also been restored and updated so developers can continue to download UI along with their favorite themes. The release is part of an ongoing series of updates across all jQuery projects.
jQuery UI is in maintenance-only mode. Users should not expect any new releases, though patches may be issued to resolve critical security, interoperability, or regression bugs. Trac, the project’s bug-tracking tool, has been put in read-only mode and developers are asked to file any critical issues on the project’s GitHub repository.
jQuery UI was first launched in September 2007 as a curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery library. It quickly gained popularity because it was one of the best tested and most accessible UI frameworks of its time. The tool helped developers build UI components such as form controls and date pickers using the best practices back then. In its heyday, jQuery UI was adopted by a broad set of enterprises including Pinterest, PayPal, IMDB, Huffington Post, and Netflix.
Today, jQuery UI continues to be an important testbed for jQuery Core updates, helping the maintainer team spot bugs and interoperability issues that arise as the web platform evolves.
Celebrating jQuery UI’s History
With the launch of jQuery in 2006, web developers were able to access and manipulate DOM and CSS faster and easier than ever before. Thousands of open source jQuery widgets and plugins were created to handle previously tricky problems, like showing and hiding elements, rotating through image carousels, or picking dates on a calendar. The jQuery ecosystem became a playground full of tools for making new and interesting interactions possible on the web.
‘New and interesting’ doesn’t always translate to ‘good and useful’ — though there were many good plugins available, it was not always easy to tell which would be the most performant or provide the best user experience. Developers might have to go searching for the right tools or worse, spend significant time swapping through several plugins to figure out which one worked best. Further, there were few examples of best practices in user experience on the web, so visitors to one website could have vastly different (and thus confusing) interactions when they performed a similar task on another website.
Members of the jQuery Core team wanted to help developers write performant, high-quality, and reusable jQuery components for their sites and applications. After some discussion, the idea for a second library with strict standards for coding, documentation, and theming was born. The project’s vision and goals included: developing a collaborative design process; providing flexible styling and themes; creating elegant visual and interaction design; providing a robust API; and prioritizing progressive enhancement, accessibility, internationalization and localization support.
In September 2007, jQuery UI officially launched as a set of user interface interactions, effects, widgets, and themes built on top of jQuery. Soon after, the team shifted their focus to provide a full set of APIs and methods to allow developers to create flexible, full-featured widgets that met high standards of quality. CSS effects such as easing and animation were added in and helped developers create more modern, enhanced experiences. The team at Filament Group later added a ThemeRoller, allowing developers to get started quickly by providing customizable theme boilerplate. ThemeRoller is still operational today.
By the end of 2008, jQuery UI had an exploding community of users, developers, and interaction designers regularly providing updates and improvements to the project as best practices and style preferences evolved. Between 2009 and 2016, the community provided a variety of new official and unofficial themes and plugins, interoperability and other bug fixes, robust testing processes, and support for multiple versions of jQuery.
jQuery UI’s prior official release came in September 2016, nearly a decade after it started. In that timeframe, the jQuery community had helped inspire dozens of other open source projects, pattern and component libraries. But newer CSS frameworks and approaches were taking hold, and slowly the community moved on to other projects. The UI team and jQuery Mobile teams merged, and the group focused more on maintenance and compatibility with jQuery Core.
Celebrating jQuery UI Maintainers and Contributors
The scope of the project and the inclusiveness of the community was responsible for helping countless web makers develop a love and appreciation for user experience, localization, internationalization, accessibility, and clean, reusable code. Though many hours of work and contribution went into making jQuery UI a successful library, the jQuery UI core team deserves extra recognition for more than a decade of hard work shepherding the work and the community throughout the project’s lifecycle. Alex Schmitz, Jörn Zaefferer, Felix Nagel, Mike Sherov, Rafael Xavier de Souza, and Scott González led a team of many core contributors and more than 300 additional authors.
Additional gratitude is owed to Michał Gołębiowski-Owczarek for preparing the 1.13 release and stewarding the repository for the past year.
OpenJS Foundation will forever be grateful for the work of these open source developers and the impact they had on the ecosystem through their work. Please join us in celebrating these developers and jQuery UI!
Authors: Michał Gołębiowski-Owczarek, Felix Nagel, and the jQuery team
Please note that:
- The Download Builder will remain available.
- Mobile 1.4 is not compatible with the new jQuery Core.
- Issues will be turned off. Please report critical security bugs via email to firstname.lastname@example.org.
Celebrating jQuery Mobile’s History
jQuery Mobile was conceived and announced in 2010, three years after the launch of jQuery. The project was exciting and ambitious. At announcement, jQuery Mobile promised compatibility across multiple platforms, browsers, and versions. Several mobile browser vendors, including Palm and Mozilla, signed on to sponsor the project:
“The jQuery community has focused on making the Web as productive and fun as possible. When we heard the mission behind jQuery Mobile, we wanted to help. With webOS we have shown that the Web platform is fantastic for developers, so we are excited to help make jQuery Mobile as good as it can be.” -Dion Almaer – Palm
At the time, the mobile web was desperately in need of a framework capable of working across all browsers, allowing developers to build truly mobile web applications. jQuery had already changed the way developers were building on the web, making it easier (and faster) to create secure, compliant applications.
With jQuery Mobile, the project’s goals were to bring the ease-of-use of jQuery to HTML-capable mobile device browsers and to make it easier for developers to build progressively enhanced web applications. Led by Todd Parker of Filament Group, a development studio known for their work on cross platform and accessibility-first applications, jQuery Mobile launched its alpha release in October 2010.
Alpha features included several components, layouts and theming tools that simplified the process of building a mobile web application. Progressive enhancement and graceful degradation, which were hot (and tricky) topics in web development at the time, featured heavily: jQuery Mobile promised developers and users the best possible experience their platform could handle. Accessibility was another key feature, with Mobile promising a user experience that could be navigated by touch, keyboard, or screen reader via ARIA compatible components. Additional features such as simplicity, file size, and the ability to deploy jQuery Mobile applications through an app store drove further excitement.
Over the next year, the jQuery Mobile team continued to add compatible platforms and browsers, new components and themes, and eventually a themeroller tool that allowed developers to configure and download themes without writing any CSS.
The community response was overwhelming – by the time 1.0 was released in November 2011, jQuery Mobile had gathered over 125 contributors, dozens of articles, tutorials and demos, 8 published books, and a gallery of sites, plugins and extensions to welcome and introduce new developers to the project.
jQuery Mobile continued to make monthly releases throughout 2012 and 2013, regularly adding and improving components, resolving compatibility issues with mobile browsers, and making performance improvements to speed up page rendering times. The development team also continued to prioritize and highlight the importance of responsive web design and accessibility principles with each new release.
As the number of components and widgets swelled – both those that were officially supported or widely adopted in the community, performance and compatibility issues with mobile platforms, browsers, and jQuery core were also exacerbated. Though the project did have some automated tests, there were still a number of items that needed to be tested manually, which slowed down the development process.
In mid 2013, Jasper de Groot became the project lead and announced tighter development collaboration between jQuery UI and jQuery Mobile teams, sharing goals, roadmaps and code in order to ease the workload for both groups. The team continued to provide maintenance releases and support, but progress continued to slow under the burden of testing and supporting such a large community.
Alex Schmitz took over the lead in July 2014, but by that time the size of the project, combined with the pace and availability of new mobile browser features, made finding a viable path forward for the project increasingly difficult.
The latest stable version was released October 2014. Alex and team made a big push to update jQuery Mobile again in 2017 with the release of an alpha version of 1.5; this version would see compatibility with jQuery 3.0 and npm support among other things.
jQuery Mobile became an OpenJS Foundation Emeritus project in 2018, signifying that the goals of the project had been achieved.
jQuery modernization initiative
The deprecation of jQuery mobile follows the careful transition of another project under the jQuery project umbrella, jQuery UI.
jQuery Core is still actively maintained and widely implemented. As part of its modernization initiative, the team also has been making a series of updates this year to its infrastructure, including migrating and improving its CDN.
Celebrating jQuery Mobile Maintainers and Contributors
The contributions to jQuery Mobile opened up opportunities for people and organizations around the world, and we are thankful for all the contributions over the years. We would like to give an extra shout out of gratitude to the past maintainers of jQuery Mobile: Alexander Schmitz, Jasper de Groot, and Todd Parker.
As part of its ongoing infrastructure updates, the jQuery infrastructure team is making configuration and deployment changes to address intermittent outages reported by some users. The issue is the result of faulty IP allowlisting which affects users downloading jQuery project assets from certain IP addresses.
This issue is expected to be resolved in the next few weeks. In the interim, users can mitigate the issue by downloading and serving the files they need.
CDN migration is part of a package of infrastructure improvement projects the project has been undertaking this year. The infrastructure team plans to provide a full overview of these improvements, which will help support the long-term maintenance of jQuery and its related projects, later this summer.
Congrats to the jQuery team on their most recent release, version 3.6.0! jQuery is an Impact Project at the OpenJS Foundation.
The new release includes bug fixes and other improvements including:
- Returning JSON even for JSONP errors
- Redirecting focus to another element in a focus handler
- A fix for retrieving dimensions on table rows in Firefox, a fix for a crash in Chrome when a focusout event was triggered on a removed element, several improvements to some tests, and more.
Thank you to all of you who participated in this release by submitting patches, reporting bugs, or testing, including Dallas Fraser, Michal Golebiowski-Owczarek, Wonseop Kim, Wonhyoung Park, Beatriz Rezener, Natalia Sroka, and the whole team.
To read more about the new version and to download, visit the project’s blog.