Page MenuHomePhabricator

Check if tool is using latest version of CDNjs-hosted library
Open, Needs TriagePublicFeature

Description

Feature summary:
Provide some way by which a tool maintainer can check whether their tool, which imports libraries from https://cdnjs.toolforge.org/, is using the latest versions of those libraries or outdated ones.

Use case(s):
Tools that manage their dependencies using npm can easily do this using npm outdated, but for tools using CDNjs, there’s no easy way to do this (as far as I know). But CDNjs is the recommended way for Toolforge tools to load libraries.

Benefits (why should this be implemented?):
Using up-to-date libraries is important to ensure that bugs are fixed and security issues are resolved. (In the past, you could also argue that tools using the latest version have a better chance of sharing the library code with other tools in the browser’s cache, but browsers no longer share resources between domains.)

Related Objects

Event Timeline

I imagine this could be implemented either in the cdnjs tool itself, or in a separate tool. Doing it in cdnjs seems tricky given its current architecture (lighttpd serving static HTML pre-generated by a cronjob), but maybe that can be changed.

I also expect it’s up for debate how thoroughly this feature looks for CDNjs libraries in other tools:

  • I think it should at least fetch the tool’s index page (https://$toolname.toolforge.org/), and look for <script src="">, <link href="">, and <script type="importmap"> elements there.
  • If we’re feeling adventurous, we could search the tool’s home directory for world-readable files containing https://tools-static.wmflabs.org/cdnjs/, but there’s a risk of false positives (e.g. tools that keep old versions of their source code around, .git/rr-cache/ files, whatever).
  • We could also try crawling the tool (fetch other pages linked from the index page) and look for libraries there, since not all libraries might be used on all pages.
    • Or, depending on how interactive the feature is: just let the user specify additional URLs to scan.
  • We could try to fetch and parse any <script type="module"> scripts and see if they import any CDNjs libraries directly (import { createApp } from 'https://tools-static.wmflabs.org/cdnjs/ajax/libs/vue/3.3.4/vue.esm-browser.js';). But honestly, I’d rather avoid this, and just try to encourage all tools to use import maps instead (like I’ve done in T338834#9018520).