[meta] Priorities for 2024-12-04 release of Drupal 7

These past days I have been working on implementing CSP headers for a few legacy sites. While 📌 [D7] Convert drupalSettings from JavaScript to JSON, to allow for CSP in the future RTBC is a good idea, it solves only one minor problem for adopting CSP and I think there is a much more direct / feasible route which also enables more of contrib to work:

1. Authenticate scripts using nonces as implemented in the d7csp module. This already solves the problem with inline scripts including the Drupal settings.
2. Apply the patch from ✨ Forward CSP nonces when inserting JS from AJAX requests Active to also forward the nonce to AJAX loaded JS
3. Use seckit’s config or a hooks as provided by d7csp to declare the rest of the resources needed.
4. Catch any stray inline styles or JavaScript that’s embedded bypassing drupal_add_js().

Overall I think using nonces are the easiest way to introduce CSP to Drupal 7 sites. It works without changing Drupal settings. Apart from the minor change to misc/ajax.js anything else can be handled in contrib.

https://www.drupal.org/project/drupal/releases/7.103 → was released today.

That's it for the scheduled releases of D7.

Unfortunately we didn't manage to tick off every item on the todo list, but hopefully we're leaving D7 in pretty good shape.

Thank you to everyone that's contributed to D7 over ~14 years and more than a hundred releases.

Still no CSP, that's a shame.

Seems like Klaus is heading up a nice community driven D7 LTS initiative over at D7Security, looks like only module support for now, but I'm presuming the plan is to include any core security fixes if/when they're found.

Automatically closed - issue fixed for 2 weeks with no activity.