Fair point, just to see what happens I've updated to the latest 1.x version in a way that should be a diff and not a file replace. I suspect the diff is still too large though.

This missing a number of places the names need to be changed:

15:35 $ ack 'jquery-1.11'
examples/user_interfaces/embedding_webagg_sgskip.py
61:    <script src="_static/jquery/js/jquery-1.11.3.min.js"></script>

doc/api/api_changes.rst
1814:   +    <script src="_static/jquery/js/jquery-1.11.3.min.js"></script>

lib/matplotlib.egg-info/SOURCES.txt
1221:lib/matplotlib/backends/web_backend/jquery/js/jquery-1.11.3.js
1222:lib/matplotlib/backends/web_backend/jquery/js/jquery-1.11.3.min.js

lib/matplotlib/backends/web_backend/single_figure.html
7:    <script src="{{ prefix }}/_static/jquery/js/jquery-1.11.3.min.js"></script>

lib/matplotlib/backends/web_backend/all_figures.html
7:    <script src="{{ prefix }}/_static/jquery/js/jquery-1.11.3.min.js"></script>

On the call we decided to go with this (despite the concerns about size) for expediency and trusting git's compression.

We should also verify that this actually fixes the CVEs against jquery.

I favor keeping the part of this PR that switches to using the unversioned name.

We also need to update jquery-ui as that is what the CVE in #11199 is actually against.

Does this need to be urgently fixed? The CVE has been opened for more than 1y now, I don't see why this would have become urgent all of a sudden.
I can make #11246 work (as I said it's mostly there...), just not right now due to other priorities.

Yeah, replacing jquery-ui too makes this a bit of a large diff..

Closing in favor of #11246