Use single copy of static assets. Update jQuery

[carltongibson]

Closes #5804

• Both Browsable API and Interactive Docs use Bootstrap v3.3.7.
  • This is the latest.
  • From the issue @blueyed linked to we should update to v3.4 when it is released.
• Bootstrap v3.3.7 is compatible with jQuery 3, so we're OK to update.

I have made the interactive docs use the top-level versions of jQuery and Bootstrap and updated jQuery to (latest) v3.3.1

Note: doesn't update doc theme. I guess we should pull from Mkdocs there.

Needs testing: Can you (yes, you!) give it a run please? Can all of you with CI builds and staging servers that report issues 10 minutes after a release give this a try too? — I'd like to make sure it all still works. Thanks!

[rpkilby]

It looks like the bootstrap-theme file for the docs has been removed, which is why the dist build is failing.

[carltongibson]

Ah, handy dist build 😀

OK. I’ll put that back in tomorrow.

[rpkilby]

See, all that packaging related pain and suffering for 3.7.4 was worth it. 😄

[tomchristie]

Looks good, yup!

[blueyed]

Thank you!

However the vulnerability in bootstrap (https://snyk.io/vuln/npm:bootstrap:20160627) is not fixed with this.
It says that it is fixed in versions 3.4.0 and 4.0.0-beta.2, but there does not seem to be a version 3.4.0 indeed. Therefore only version 4 appears to fix it.

[carltongibson]

Upgrading to v4 is not realistic, unless a user land PR comes in.

I read something on this that seemed to suggest a v3.4 would arrive at some point. Any chance you could follow up on the bootstrap issue tracker?

[rpkilby]

I skimmed the bootstrap repo for a v3.4 update, but I don't see any milestones or projects related to this. The only evidence that v3.4 is a possibility is the associated branch. I've asked their slack channel if there any plans, but I'm waiting for a response.

[blueyed]

@carltongibson

Upgrading to v4 is not realistic, unless a user land PR comes in.

What do you mean exactly, please elaborate on "user land PR".

[carltongibson]

@blueyed 😃

Someone putting in the leg-work to do it.

It's non-trivial. Totally do-able, but an amount of work that we don't have bandwidth for as of now.
Maybe that changes but best option is the above.

[rpkilby]

I got a response back on the slack channel. Basically, mdo agrees that v3.4 would be nice, but the reality is that developer availability is limited.

I've created a tracking issue here: twbs/bootstrap#25679

[490386Ayan]

what is the timeline for v.3.4 release? Kindly let me know the time line so we can use it. Since we are already using Bootstrap 3.3.7, so we need it asap. I have got only dev release link. Kindly reply me. Awaiting a positive reply.

[rpkilby]

Hi @490386Ayan. As stated in my previous comment, Bootstrap 3.4 is tracked in twbs/bootstrap/issues/25679. We don't have any association with Bootstrap and have no control over when 3.4 will be released.