4 ms·

There was some discussion about this on an earlier jQuery-update-thread: There's no urgent need to update your sites to the most recent version. Other than with

• dmethvin 14y ago
  That's not quite true about security. There is a very bad practice some ajaxy sites have where they select parts of the page using `$(location.hash)` [1]. Since that string is in the URL and entirely in control of outside code, it's pretty easy to get the page to run something that might send information to a third party. That particular hole was closed in jQuery 1.6.4 but there are still plenty of people running older versions. We're tightening this down even further in 1.9 to prevent a few other cases, which I am sure will break some code, but the only real solution is good input hygiene and HTML escaping on the part of the application itself. [1] http://jsfiddle.net/dmethvin/uKYUP/ http://jsfiddle.net/dmethvin/uKYUP/
  • cstuder 14y ago
    That's why I wrote 'close to no security issues'. What I didn't realise is that jQuery 1.6 is only from last year.