[YARN-11201] Upgrade jquery-ui to 1.13.1 in UI2

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: yarn-ui-v2
• Assignee: Unassigned
• Reporter: Tamas Domok
• Created: 28/Jun/22 07:03
• Updated: 25/Oct/22 18:03

Description

YARN-11092 updated the jquery-ui in the common package, but the UI2 still uses the older version 1.12.1.

https://www.cvedetails.com/vulnerability-list/vendor_id-6538/product_id-31126/Jquery-Jquery-Ui.html

• CVE-2021-41184
• CVE-2021-41183
• CVE-2021-41182

https://github.com/apache/hadoop/blob/trunk/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/bower.json#L14

    "jquery-ui": "1.12.1",

Unfortunately UI2 uses the shims repo which is not maintained https://github.com/components/jqueryui/issues/70, so if possible we should move to the main jquery repo https://github.com/jquery/jquery-ui.

Issue Links

• relates to: YARN-11361 Remove jQuery dependency