Remove or fix timeline formatter

[aslakhellesoy]

A user reported the following via direct email:

---

Issue: Older version of JQuery library within io.cucumber (cucumber-core) is red flagged during nexus scan and identified as security vulnerable and need to be upgraded.

Details:
We are currently leverage few of the MAVEN dependencies from io.cucumber for our BDD framework and we are currently noticing a nexus scan error at The Hartford (Policy issue) because of older version of JQuery library used in the cucumber library.

Also, refer the below screenshot for the library where we are having this issue and we tried to update to the latest cucumber-core library and it is still referring to the old version of the JQuery library.

---

Now, we could easily upgrade to the latest jQuery (3.4.1 as of this writing), but how would we test that this doesn't break the formatter? From what I can tell we don't have any automated tests for the timeline formatter's JavaScript code.

I would suggest we delete the timeline formatter from Cucumber-JVM. It can be resurrected as a standalone formatter, similar to the new cucumber-html-formatter (based on React, with a better test suite).

I also suggest we remove the old html-formatter - it uses an even older version of jQuery.

[mpkorstanje]

The time line formatter is useful for analyzing the behavior of parallel tests. So I'd like to keep it.

Removing the HTML formatter would break peoples first usage experience. The alternatives are tied to maven/gradle/jenkins/ect. So not so keen on that either.

Wouldn't be against replacing but it'd have to be a comparable product.

As for updating/fixing both. There are some tests but since its html you'll have to visually look at them anyway. Not that the timeline formatter is that complicated though.

If you want to be creative about it, you could consider down grading to a version that doesn't have any vulnerabilities. 😄

[mpkorstanje]

Might also be a good idea to get our JQuiry from a Web Jars dependency. That will hopefully make things a bit more maintainable ( in the sense that we'll get CVSE scanning from github, don't need to copy past files, ect).

[aslakhellesoy]

Might also be a good idea to get our JQuiry from a Web Jars dependency.

Since we're going to deprecate the timeline formatter (as described in #1769) I don't think that is necessary.

[mpkorstanje]

Fair enough. We can always do that if another alert comes by.