Plupload internal version is wrong? File is called 2.3.9, but version in the file is 2.3.6

Question

We have a security vulnerability issue where plupload 2.3.6 is cited as vulnerable. And the easy fix is to download 2.3.9 which we did from here: https://www.plupload.com/download/

And the zip file is called 2.3.9, but version number within the plupload.min.js the file is 2.3.6. Now, I've just seen that the version inside the plupload.full.min.js is 2.3.9! And that plupload.dev.js contains 2.3.6!

Any tips on the best way forward - to ensure we're not using a vulnerable version?

Answer 1

they have released version 3.1.5 (https://github.com/moxiecode/plupload/archive/v3.1.5.zip) which in the minimized version js file has

Plupload - multi-runtime File Uploader * v3.1.2, probably best to try that version, I wonder if they just forgot to update the js file notes

I hope this helps