Update dependency bootstrap to v5 [SECURITY] #267
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-bootstrap-vulnerability
branch
from
1a38667 to
074bdb6
Compare
|
@froschdesign iirc changing styles in here would affect all of the documentation? |
|
@Xerkus <title>laminas-form - Laminas Docs</title>
<link rel="stylesheet" href="https://docs.laminas.dev/css/styles.css">But we can not upgrade to version 5 without doing some updates: https://getbootstrap.com/docs/5.3/migration/#v500 |
|
Yes. I just finished figuring out differences for migration on getlaminas laminas/getlaminas.org#205 It will require some changes to the markup. I think this will need a new path for the styles and scripts so we can keep originals until all docs sites are migrated and rebuilt. Or may be we will be better off changing process to produce an asset bundle that is deployed to each sub-site independently at build time to avoid such problems in the future? |
No migration of the individual documentation is needed, only a rebuild. The theme files must be migrated. |
|
Can we rebuild archived repos? |
I don't know, but I don't think so. But we shouldn't refer to the documentaries any more either. If someone really needs to read the old stuff, the Markdown files are available in the repository itself. |
| datasource | package | from | to | | ---------- | --------- | ----- | ----- | | npm | bootstrap | 4.6.2 | 5.0.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
force-pushed
the
renovate/npm-bootstrap-vulnerability
branch
from
074bdb6 to
94fde81
Compare
This PR contains the following updates:
^4.6.1->^5.0.0GitHub Vulnerability Alerts
CVE-2024-6531
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
Release Notes
twbs/bootstrap (bootstrap)
v5.0.0Compare Source
Highlights
#32155: Updated
make-col()mixin to generate equal columns when no size is specified#32763: Added new
color-scheme()mixin#33389: Dropdown menus now have option become clickable
#33453: Added new docs footer
#33548: Offcanvas header components are now vertically aligned
#33549: Added offcanvas-top modifier
#33634: Added support for
.dropdown-items wrapped in<li>s#33626: Fix v5 regressions in tab dropdown functionality
🚀 Features
color-schememixin🎨 CSS
color-schememixin.nav-linkcolor consistent when using buttons:read-onlycss selector instead[readonly]for consistencyborder-topon Firefox☕️ JavaScript
hidemethod of dropdownisDisabledutil on dropdownnoopfunctionselectMenuItemmethod private.dropdown-itemwrapped in<li>tagsaltBoundaryoption📖 Docs
rel=noopenerattributeboundaryoptionboundaryoptionboundaryoption descriptionExamples
🌎 Accessibility
🏭 Tests
data-bs-backdrop="static"from modal tests🧰 Misc
📦 Dependencies
Configuration
📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Read more information about the use of Renovate Bot within Laminas.