Update to jQuery 3.3.1

[coliff]

It'd be good to update to jQuery 3.3.1. jQuery 2.x is no longer supported and has some XSS issues (https://snyk.io/test/npm/jquery/2.2.4)

I've tested this theme with jQuery 3.3.1 and it works correctly.

[matalo33]

Would you be able to submit a PR for this?

If you do, please give a URL to where you obtained jquery from. Preferably a link to a specific version, not just 'latest'. This is so I can validate the file hasn't been modified before merging 👍

[coliff]

Sure thing. I'll do that shortly. I was thinking of suggesting that we load jQuery from a CDN with a local fallback - like HTML5Boilerplate recommends.

It'd be like this:

  <script src="https://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script>
  <script>window.jQuery || document.write('<script src="js/jquery-3.3.1.min.js"><\/script>')</script>

REF: https://github.com/h5bp/html5-boilerplate/blob/6.1.0/dist/index.html

What do you think?

[matalo33]

I like the idea of using CDN but I remember having a conversation about this with @matcornic in the past... he wanted the site to remain functional even in an "internal" or "offline" network.

This option of trying CDN and then falling back could work. We should check whether there's a noticeable delay while an 'offline' client fails or times out reaching the CDN.

Also it would make sense to apply this change to all libraries loaded by the theme which are available via a CDN.

[coliff]

The option for using CDN first with a local fallback for jQuery is simple to implement and doesn't impact performance even when running without Internet access. You can test how it works by blocking access to the CDN with Chrome dev tools. There isn't such an option for the other JS scripts to detect if CDN is available if not fallback to locally hosted. I think doing this CDN-first approach just for jQuery is fine.

[matcornic]

@coliff @matalo33 yes I wanted the website to work offline. With CDN and fallback to local is great solution for both worlds

[coliff]

Great - thanks for confirming @matcornic - I'll open a PR shortly.

[blackmichael]

@coliff Is there any progress on this?

[coliff]

This is dealt with PR #237 which I hope will be merged.

[matalo33]

Closed by #237