Security issue with jquery in promtail 2.x

[patrickgraas]

Promtail 2.x contains a jquery version that is not secure according to Tenable.

Nessus scan reports on our windows servers:
JQuery 1.2 < 3.5.0 Multiple XSS
https://www.tenable.com/plugins/nessus/136929

Suggestion is to upgrade to jquery 3.5.0 or higher in a later version of Promtail.

Thanks

[veltmanj]

See: https://nvd.nist.gov/vuln/detail/CVE-2020-11022

This library is to my knowledge referenced in Promtail in the following file:
https://github.com/grafana/loki/blob/master/pkg/promtail/server/ui/templates/_base.html
On line 8: <script src="{{ pathPrefix }}/static/vendor/js/jquery-3.3.1.min.js?v={{ buildVersion }}"></script>

The actual jQuery JS libraries are in:
https://github.com/grafana/loki/tree/master/pkg/promtail/server/ui/static/vendor/js
More specific the following files:
https://github.com/grafana/loki/blob/master/pkg/promtail/server/ui/static/vendor/js/jquery-3.3.1.min.js
https://github.com/grafana/loki/blob/master/pkg/promtail/server/ui/static/vendor/js/jquery.min.js (version 3.2.1)

At the time of writing the latest version of jQuery is: 3.5.1
https://jquery.com/upgrade-guide/3.5/

Deprecations after 3.3.0:
https://api.jquery.com/category/deprecated/deprecated-3.4/
https://api.jquery.com/category/deprecated/deprecated-3.5/

[stale]

This issue has been automatically marked as stale because it has not had any activity in the past 30 days. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.