In November 2022 we made a Penetration-Test with our own LimeSurvey V3.28.32 Server. The result was, that several libraries are old and have known security problems. See https://bugs.limesurvey.org/view.php?id=18492 (closed).

In the solution of Bug-Report 18492 we were told that with LS version 3.28.50+230221 the problem with old libraries is solved (with the eception of lodash which could not be found).

We updated LS to version 3.28.53 and told the Penetration-Test-crew that with the exception of lodash the problem with old libraries with known security problems should be solved.

Unfortunately a new Penetration-Test had the result, that 4 libraries still have security problems. Please include actual library-versions in a new Update of LimeSurvey 3.28.

Thanks.

Select2 4.0.2
You find it here: /limesurvey/tmp/assets/10e53f01/js/select2.full.min.js
known security problem: https://security.snyk.io/package/npm/select2/4.0.2
actual library-version is 4.0.13
https://github.com/select2/select2/

bootstrap-switch 3.3.2
You find it here: /limesurvey/tmp/assets/bc285a5f/js/bootstrap-switch.min.js
known security problem: https://security.snyk.io/package/npm/bootstrap-switch/3.3.2,
there is no more actual library-version (with no security problem) available, but as soon as one is available it should be included
https://snyk.io/advisor/npm-package/bootstrap-switch

lodash 4.17.15
You find it here: /limesurvey/tmp/assets/65017804/build.min/js/adminsidepanel.js
known security problem: https://security.snyk.io/package/npm/lodash/4.17.15,
actual library-version is 4.17.21
https://www.npmjs.com/package/lodash?activeTab=versions

There is still one old library with no known security problems
Bootstrap: 3.4.1
You find it here: /limesurvey/tmp/assets/eada61fb/bootstrap.min.js