Suggest pulling CodeIgniter from Ubuntu, upgrading Ubuntu to 24.04

[kjetilk]

Description

Upon a quick inspection, I noticed that the repo bundles CodeIgniter (in the system folder) and various things in the vendor folder. This practice has various security implications, so I suggest looking into changing this with some urgency.

This suggested PR consists of two commits, a documentation update with what is required to remove the dependency from the bundle, and actually removing the bundle.

Bundling open source projects into your own repo is problematic, because those who deploy it will all need to stay on top of any security issues that may come up, unless they can rely on the community behind the repo.

Failure to do so may result in that you have known security vulnerabilities in the deployed web app. That's not to be taken lightly, in this day of automated AI attacks.

In this case, there have been no updates, which is a warning flag. In various communities, there are technical approaches to this problem, in npm, there are audit tools and warnings to upgrade to the latest upstream version. I may be old, but that's not my preferred way, because that may force you to scramble to update unrelated matters as upstream changes.

The better solution, IMHO, is available from Ubuntu in this case. CodeIgniter has been packaged and is available in Ubuntu 24.04 LTS, so in principle, you can just upgrade the backend image to 24.04, add the Ubuntu package to the install, and off you go.

In practice, it is rarely that easy, because backward compatibility may have been broken, both in Ubuntu (quite unlikely), in PHP, and in CodeIgniter itself. Thus, this would have to be tested in a test environment before it is deployed.

Nevertheless, it should be done, and I believe it is also important to do it for the code in vendor for the same reason. Instead, such code should be pulled in, either from Ubuntu as above, or by the deployment scripts, which can be automated here on Github.

Type of change

• [x ] This change requires a documentation update

How Has This Been Tested?

Has not been tested. It is not just deployable, but must be done in an upgrade