How to Upgrade Your App to jQuery v3.5 or Newer

We're announcing the migration to jQuery v3.5 from prior versions in Splunk Enterprise, Splunk Cloud and all apps built on the platform. If your app uses jQuery as shipped with the Splunk platform, or uses a toolkit (Splunk Web Framework, Splunk JS Stack) that uses jQuery, you need to test that your app works with the updated version of jQuery.

Separately, if your app embeds a version of jQuery, you need to update this to version 3.5+ by August 31, 2021. After this date, all apps must use jQuery v3.5+ and be compatible with Splunk Enterprise 8.2. Splunk Enterprise and Splunk Cloud releases after August 31, 2021 will not support any prior versions of jQuery.

Splunk reserves the right to remove from Splunkbase any apps that continue to use unsupported jQuery versions. 

Why Should You Upgrade Your App?

Upgrading to jQuery 3.5 makes your app more secure by fixing known cross site scripting (XSS) related vulnerabilities as well as vulnerabilities created by object prototype pollution.

The upgraded version would potentially also improve app performance because of faster script execution time and loading time.

Once upgraded, your app will be compatible with Splunk Enterprise 8.2 and future releases.

Apps that are not updated by August 31, 2021 will be considered insecure. New apps and new versions of existing apps that are published to Splunkbase will not be made public if they contain outdated jQuery dependencies. The vetting process used to approve Splunkbase and private apps for installation in Splunk Cloud will start enforcing usage of jQuery 3.5 or newer at this time as well.

Upgrading Your App(s)

Before you start planning to upgrade your app, validate whether your app has any jQuery dependencies. You can use the Splunk AppInspect API with the `jquery` tag specified in order to check for usage of jQuery in your app. Please be aware that AppInspect may not catch all usage of jQuery in your app — it is still your responsibility as an app developer to test your app on Splunk Enterprise 8.2 where jQuery has been updated to at least version 3.5.

If any of the checks return a `warn` result, then you should follow the detailed steps outlined in “Upgrade your Splunk apps to use jQuery v3.5 in Splunk Cloud or Splunk Enterprise” to upgrade your app.

Testing Your New Release

Please plan to use a Splunk Enterprise 8.2 or later deployment to test that your app runs as expected. Splunk Enterprise 8.2 deployments will be available for public download on May 12, 2021.

Validating Your New Release

Splunk’s AppInspect API will validate issues your app may encounter during the Splunk Cloud Vetting process, including the issues described above. The AppInspect API is the tool that our Cloud Vetting team uses to identify potential security or operational issues in apps that customers want to run in Splunk Cloud. Cloud Vetting approval is required before your app can be installed in Splunk Cloud, so learning about any potential issues before uploading your app to Splunkbase can help you address them earlier.

You can learn more about AppInspect in "Validate quality of apps or add-ons with Splunk AppInspect for Splunk Cloud or Splunk Enterprise" and about the Cloud Vetting process in general in "Vet apps and add-ons for Splunk Cloud."

Finally, upload the new release of your app to Splunkbase and indicate that it is compatible with Splunk Enterprise 8.2. The process is documented in "Manage content on Splunkbase.”

If you have any questions, please reach out to us at jquery3.5-upgrade@splunk.com or at community.splunk.com.

^{Note: This information is subject to change at any time, at the sole discretion of Splunk LLC and without notice.}

----------------------------------------------------
Thanks!
Vidhi Agrawal