Build: updating dependencies

[Garneauma]

Supersedes: #9812, #9811, #9798, and #9626

Updates description

bootstrap-sass: not updated

• Bootstrap SASS version 3 has not been updated in a while.

code-prettify: not updated

• This tool has not been updated in 8 years. It might be worth looking at switching to another tool.

datatables.net: updated to version 1.13.11

• The latest version is 2.1.8, however this version would require many changes in our CSS as well as our build and JS.

dompurify: updated to version 3.1.7

• As of version 3.0.0, Dompurify dropped support for MSIE. Since we no longer support MSIE, we are ok to move to the latest version.

es5-shim: removed

• This dependency was added in version 4.0.0 of WET-BOEW to enable support of IE8 for the Geomap plugin. We no longer support IE8, so it is no longer needed.
• This dependency was squashed in the concatIE8 task, so no need to remove any file.

fast-json-patch: not updated

• Since we have customized this plugin, upgrading this tool will require further investigation.

html5shiv: removed

• This dependency was added more than 10 years ago to support HTML5 elements. The Web has evolved a lot since then. This tool is no longer needed.
• This dependency was squashed in the concatIE8 task, so no need to remove any file.

jquery: not updated

• Upgrading to version 3 or 4 would require A LOT of dev work.

jquery-validation: updated to version 1.21.0

• This project is not very active. However, it still releases 1-2 new versions every year. Might be worth looking for a new validation tool.

jsonpointer.js: not updated

• This tool has not been updated in 10 years. It might be worth looking for a new tool. However, it is essential for a few of our plugins, so we have to keep it.

magnific-popup: updated to version 1.2.0

• Updated to version 1.2.0. The keyboard trap fix that had been introduced with the latest version is no longer needed as it was a fix for Firefox which we no longer support.

mathjax: updated to version 3.2.2

• Not updated to version 4 as it is still in beta.

proj4: updated to version 2.14.0

• This dependency is necessary for the Geopmap plugin.

unorm: not updated

• This tool has not been updated in 5 years. It might be worth looking for a new tool or investigating whether it is still needed or not. This tool is used by the Filter plugin to normalize the search query characters.

Updates to the API

Datatables

Change type: patch
Files to update:

• wet-boew/js/deps/jquery.dataTables.js
• wet-boew/js/deps/jquery.dataTables.min.js

Dompurify

Change type: patch

es5-shim

Change type: patch

html5shiv

Change type: patch

jQuery Validation

Change type: patch
Files to update:

• wet-boew/js/deps/jquery.validate.js
• wet-boew/js/deps/jquery.validate.min.js
• wet-boew/js/deps/additional-methods.js
• wet-boew/js/deps/additional-methods.min.js

Magnific popup

Change type: patch

• wet-boew/js/deps/jquery.magnific-popup.js
• wet-boew/js/deps/jquery.magnific-popup.min.js

Mathjax

Change type: patch

Proj4

Change type: patch

• wet-boew/js/deps/proj4.js
• wet-boew/js/deps/proj4.min.js

[duboisp]

We would need a list of plugin with their change impact (Minor/Patch)

Let's chat

[EricDunsworth]

Regarding this:

magnific-popup: updated to version 1.2.0

• Updated to version 1.2.0. The keyboard trap fix that had been introduced with the latest version is no longer needed as it was a fix for Firefox which we no longer support.

@Garneauma Is that a wise course of action? Are modern versions of Firefox still impacted by that keyboard trap issue?

IIRC Firefox used to treat iframe elements like interactive content (keyboard-tabbing would shift focus onto the iframe element itself before going "inside" of it). But that behaviour was changed in Firefox 126. So if the keyboard trap fix was a patch of sorts for the old behaviour, it might not be needed anymore in recent versions of Firefox.

Btw an upstream PR for WET's keyboard trap fix was sent back in 2017 (via dimsemenov/Magnific-Popup#945), but is still open to this day...

The upstream project still seems to be active (v1.2.0 was released on June 8th), but it doesn't look like its maintainers have merged any PRs since late 2021.

PS:
IMO it feels like a bad practice to deliberately "undo" Firefox fixes in what already exists (unless the fixes are no longer needed in newer versions). Especially given that WET has historically supported Firefox.

I'm not aware of any popular web frameworks that don't officially support Firefox/Gecko. Plus it's unclear why Canada.ca's browser usage statistics would have a direct impact on WET's supported browsers (although I could see it making sense for GCWeb).

If WET/GCWeb/GCDS place all of their eggs in one basket (i.e. currently popular browser engines - like WebKit/Blink) and support for other rendering engines eventually degrades to the point of being unusable... that risks "locking-in" Canada.ca to specific browsers in the long-term. That goes against the idea of interoperability and is the same kind of "IE-only" mindset many crappy sites had ages ago :P.

For example, if Firefox were to regain its overall popularity in the future, that might not be reflected in Canada.ca's browser usage statistics. If users felt "forced" to switch over to another browser when visiting Canada.ca (because FF is totally broken), they'd probably get into the habit of using another browser for that specific site. End result would be statistics skewed in favour of the user's "fallback" browser.

[duboisp]

@EricDunsworth are you able to reproduce the issue with a recent version of FF version?

@Garneauma can you spin up a working example to allow @EricDunsworth to test.

@EricDunsworth We don't support FF anymore, if there any compatibility issue, you can submit that a PR to fix it. That can be also to update our own fork of Magnific Popup, please open a PR that update it and apply the fix and we will review it.

[Garneauma]

As discussed during the technical review, let's move forward with this. @EricDunsworth will try to find the original PR for the patch of Magnific popup when he has the time in order to figure out if the patch is still needed.

[EricDunsworth]

FWIW the original WET PR for the magnific popup plugin's keyboard trap fix was #7850.

The only notable change in the 1.0.0+keyboard_trap_fix branch was the addition of && e.target !== document on one line (diff on line 773 of jquery.magnific-popup.js in the associated commit). Literally all of the other changes were meaningless linting adjustments. Same deal in dimsemenov/Magnific-Popup#945.

There's some backstory about the change in the WET and upstream PRs. In a nutshell, it sounds like when the lightbox plugin contains an iframe element, the keyboard tabbing sequence gets "reset" to the top of the popup upon tabbing-out of the iframe in Firefox (or at least back in 2017 it did).

#7850 (comment) linked out to a Lightbox test page in the WET PR, but is long dead. It might be possible to replicate the affected scenario by creating a practical example using the Lightbox plugin's lbx-iframe configuration option.

PS:
Might also be worthwhile to test in Firefox ESR 115 (still supported by Mozilla atm) vs latest versions to see if FF 126's changed iframe behaviour influenced anything.

[duboisp]

@EricDunsworth

Might also be worthwhile to test in Firefox ESR 115

Note that I am still using FF as my primary browser to perform code review and test. So it is kindly supported, but not officially because of the web stat. For sure, if there is an issue or a difference in the behaviour, we might consider to apply a fix for it.

[duboisp]

Review and tested locally,

Looks good, prior to merge please wait for the same confirmation for the equivalent PR but in the GCWeb repository.

I tested more specifically the following impacted plugin

• Geomap
• Table enhancement (data table)
• Lightbox and image galary
• Multimedia player with the youtube video in a popup (do use iframe)
• Data ajax (To ensure the DOM purify update have no impact)

I do confirm that I can build and run the site/framework locally.

I ran the unit testing and all good too. 238 test has passed.