CVE-2019-11358

Advisory

Crate-docs-theme 0.13.0 updates its NPM dependency 'jquery' to v3.5.1 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----------------

- SEO: Added `rel="noopener"` to Github links (links to cross-origin
destinations are unsafe)
- Updated/removed Bootstrap and jQuery packages (nine vulnerabilities detected)
- SEO: Added `height: auto;` to the logo css (lighthouse cought a wrong AR)
- SEO: Added alt & title tags to logos in header and footer
- Moved esi to the correct position
- SEO: Added dns-prefech/preconnect to googleapis.com and cdn.crate.io
- Updated version tag for css/js in `base.html` for cleaner caches
- SEO: Added language `xml:lang="en" lang="en"`
- Added Favicon
- SEO: Preloading Font
- SEO: Minified/Combined static js/css files (except custom and doctools)
- SEO: Removed `maximum-scale=1` from meta viewport to allow zooming
- Added new rating feature below the feedbackbox
- SEO: Changed h3 to h2 for feedbackbox and new rating
- Fixed a minor css error in `crateio.css` and added `font-display: swap;`
- Fixed colors of the `Toggle Doc Menu` (mobile)
- Add left-margin to all lists
- Fix paragraph margins for lists using the "open" class

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5428
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358