jQuery 4.0 - Prepare to fix your Javascript code

Specifically, we had changed our internal data object to use Object.create( null ) instead of a plain object ({}). We did that to prevent collisions with keys on Object.prototype properties. However, this also meant that developers (especially plugins) could no longer check what was in jQuery data with the native .hasOwnProperty() method, and it broke some code. We’ve reverted that change, but plan to put it back in jQuery 4.0. This change is the only code change in this release (3.5.0). Other changes include some minor updates to our docs and build system.

• replace obj.hasOwnProperty() with Object.prototype.hasOwnProperty.call() for all contexts where the returned jQuery object is {} instead of Object instance ; will work in all existing jQuery versions: 3.5.0, 3.5.1, 3.6.0, 3.6.1 ; will also work with the expected jQuery 4.0.

/*!
 * Bootstrap v3.4.1 (https://getbootstrap.com/)
 * Copyright 2011-2019 Twitter, Inc.
 * Licensed under the MIT license
 */

// changes to this file: bootstrap.js
// use Object.prototype.hasOwnProperty.call() instead of obj.hasOwnProperty() when jQuery returns {} instead of Object
// (c) 2022 w3soft.org
// license BSD

// ...

Tooltip.prototype.getOptions = function (options) {
		var dataAttributes = this.$element.data()

		for (var dataAttr in dataAttributes) {
		//	if (dataAttributes.hasOwnProperty(dataAttr) && $.inArray(dataAttr, DISALLOWED_ATTRIBUTES) !== -1) { // original code, does not work in jQuery 3.5.0 and upcoming 4.0 ; does work in jQuery 3.5.1 ... 3.6.1
		// #start fix: the above line is fixed as below and will work in all jQuery target versions: jQuery 3.5.0 / 3.5.1 / 3.6.0 / 3.6.1 and the upcoming jQuery 4.0
			if (
				dataAttributes && dataAttr && Object.prototype.hasOwnProperty.call(dataAttributes, dataAttr) &&
				$.inArray(dataAttr, DISALLOWED_ATTRIBUTES) !== -1
			) {
		// #end fix (c) w3soft.org
				delete dataAttributes[dataAttr]
			}
		}

		options = $.extend({}, this.getDefaults(), dataAttributes, options)

		if (options.delay && typeof options.delay == 'number') {
			options.delay = {
				show: options.delay,
				hide: options.delay
			}
		}

		if (options.sanitize) {
			options.template = sanitizeHtml(options.template, options.whiteList, options.sanitizeFn)
		}

		return options
	}

// ...

jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery('<div class="code" />') is actually converted to jQuery('<div class="code"></div>'). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.

The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. The jQuery team agreed it was necessary to fix this in a minor release, even though some code relies on the previous behavior and may break. The jQuery.htmlPrefilter function does not use a regex in 3.5.0 and passes the string through unchanged.

// sample code
// (c) 2022 w3soft.org
// license BSD

// old jQuery code, works until jQuery 3.4.1 inclusive ; !!! does NOT work correctly with jQuery 3.5.0 ... 3.6.1 ; will NOT work correctly with jQuery 4.0 !!!
var $div = jQuery('<div class="code" />'); // example 1
var $ul = jQuery('<ul />'); // example 2
var $select = jQuery('<select><option /></select>'); // example 3

// new, fixed jQuery code, works until jQuery 3.4.1 inclusive ; does also work with jQuery 3.5.0 ... 3.6.1 ; will work also with jQuery 4.0
var $div = jQuery('<div class="code"></div>'); // example 1, revised and fixed
var $ul = jQuery('<ul></ul>'); // example 2, revised and fixed
var $select = jQuery('<select><option></option></select>'); // example 3, revised and fixed

/*!
 * jQuery JavaScript Library v3.6.1 [ #modified, based on v3.6.1, with upstream fixes reverted from jQuery 3.5.0 for {} -> Object.create( null ) ]
 * https://jquery.com/
 *
 * Includes Sizzle.js
 * https://sizzlejs.com/
 *
 * Copyright OpenJS Foundation and other contributors
 * Released under the MIT license
 * https://jquery.org/license
 *
 * Date: 2022-08-26T17:52Z
 */

// ...

Data.prototype = {

	cache: function( owner ) {

		// Check if the owner object already has a cache
		var value = owner[ this.expando ];

		// If not, create one
		if ( !value ) {
			//-- # start fix: by w3soft.org
		//	value = {}; // this was the original code for this line before jQuery 3.5.0 and also in jQuery 3.5.1 ... 3.6.1
			value = Object.create( null ); // the above commented line was changed in jQuery 3.5.0, to prevent collisions ; rolled back as above in jQuery 3.5.1 ... 3.6.1 ; will be keep back in jQuery 4.0 and later
			//-- #end fix

// ...