🚨 [security] Update bootstrap 4.3.1 → 4.6.0 (minor) #301

depfu · 2024-09-06T20:10:58Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ bootstrap (4.3.1 → 4.6.0) · Repo · Changelog

Release Notes

4.6.0

Highlights

Tooltips and popovers can have custom clases via customClass option.

Added new .navbar-nav-scroll class for scrolling expanded navbar contents on mobile devices.

For improved accessibiliy, spinners now slow down when prefers-reduced-motion is enabled.

v4.x docs are now built on Hugo for easier maintenance and backports from v5.x.

Darkened background-color of .dropdown-item for improved hover state contrast, and ligthened the disabled .dropdown-item color.

Improved alignment of form validation tooltips.

File inputs no longer extend beyond their containers.

CSS

#31557: Fix form validation tooltip alignment

#31657: Handle the Ubuntu sans-serif case

#31700: Suppress flexbox side effects in breadcrumb

#31882: Slow down spinners when prefers-reduced-motion

#31886: Fixed: Undefined mixin "deprecate" when importing "bootstrap-grid-scss"

#32141: Use correct value order

#32145: Avoid invisible real file input "spilling" out of container

#32160: Add overflow suppression to custom file label

#32211: Move negative margin-bottom from .nav-item to .nav-link

#32212: Remove needless Stylelint disables

#32833: Add .navbar-nav-scroll for vertical scrolling of navbar content

Add two new variables for pagination border-radius values; backport of #32423

Remove old/unnecessary reboot bug fix; backport of #32631

Suppress focus outline for buttons when it shouldn't be visible in Chromium; backport of #32689

Consistently use outline:0 rather than outline:none; backport of #32751

Darken dropdown item hover style; backport of #32754

Lighten disabled dropdown text to $gray-500

JS

#31820: Check for data-interval on the first slide of carousel

#31834/#32225: tooltip/popover: add a customClass option

#32001: Move js/src/index.js one folder up

#32045: tests: fix sanitizer test

#32220: Don't hide modal when config.keyboard is false

#32312: build-plugins: switch to "bundled" for babel helpers

Docs

#31861: Split up dropdown sizing docs to improve rendering

#31892: Remove redundant visually hidden "(current)" from pagination controls

#31893: manifest.json: Switch to relative URLs so that we don't need to change the path with every major/minor release

#31898: switch to suggesting jsDelivr as a CDN

#31904:

docs(forms): use a legend for fieldset instead of aria-label

docs(forms): fix incorrect legend nesting in fieldset

#31936: forms: change inline custom radio name

#31951: Update anchor-js to v4.3.0

#31960: Explicitly mention emoji fonts, tweak sentence in typography

#31981: list-group.md: fix snippet

#32005: Remove bugreport.apple.com since it doesn't work

#32015: Fix redirects

#32050: Make docs anchorjs links darker on keyboard focus

#32054: Add callouts about using light colors ideally on a dark background

#32077: Switch to Hugo

#32083: mention "Liberation Sans"

#32087: download.md: link to JS files comparison too

#32094: Changes to navbar documentation/explanation

#32106: Clarify JS bundle docs once more for v4

#32137: input-group.md: fix wrong class .visually-hidden

#32138: navbar.md: remove loading=lazy from snippets

#32147: Fix caniuse.com redirects

#32151: Mention user-select-all support in docs

#32196: homepage: split snippets and show copy buttons

#32203: Switch to jsDelivr for the remaining docs assets

#32223: introduction: split comments

#32247: Fix typos in tooltip/popover docs

#32253: Add Russian translation

#32363: Remove useless .text-left in Layout / Overview

#32399: Remove duplicated "follow Bootstrap on Twitter" link in Community section

#32457: Add mention of the bs-custom-file-input plugin needed for the custom file input

#32461: style clipboard button on :focus, not just :hover

#32462: Replace Lorem Ipsum placeholder text with more representative (or at least english language) text

#32634: Remove incorrect mention of dropdowns for dynamic tab behavior

#32639: v4: Add an actual data-touch="false" example in the carousel docs

#32728: add v5.0 in versions

#32761: Mention stretched-link constraints with table elements

#32789: Remove role="button" from CTA links in carousel example

#32791: Docs v4: Sass implementation and rounding precision

#32809:

Clarify Sass import and customize docs for how to modify variable defaults

Add an npm starter project callout to a few pages

#32827: Add a live toast example to the docs

#32759: Mention CSP and embedded SVGs in v4 docs

docs(dropdowns): clarify where is .show applied

Require .has-validation for input groups with validation

Fix mobile menu jump & double border

Remove double spaces from homepage SVGs

browserconfig.xml: switch to relative image path

Tweak the wording for collapse to indicate button is preferred/more semantic; backport of #32632

Clarify the $enable-shadows option in our docs; backport of #32685

Examples

#31979: v4 Examples/Floating-labels: fix bad behavior with autofill

#32198: examples: add the version number in title

Misc

#29753: Improve build/generate-sri.js regex

#32003: CI: switch to Node.js 14

#32008: Update Edge's Rendering Engine on CONTRIBUTING.md

#32486: BrowserStack: test on macOS Catalina instead of High Sierra

#32756: Stylelint: disallow some property values

Fix for npm 7.x package.json: move version_short variable under the config object; backport of #32737

Update build-examples script so that the resulting examples zip file includes only the needed files

Various CI tweaks

Updated devDependencies

4.5.3

CSS

#31653: Add a comment to our escape-svg function to note that data URIs must be quoted.

#31693: Use the custom-control shadow variable instead of the generic input-focus-box-shadow.

#31793: Backport some v5 changes (improved th styling in Reboot, custom form field styling when printing, and improvements to .text-break).

#29714: Keep custom check, radio, and switch theme when printing.

#30781: Reboot's th updates: Inherit font-weight: bold that comes from user agent stylesheets.

#30932: .text-break changes to drop overflow-wrap and use word-wrap once again

#31754: Improve versions page rendering (also reversed the order while I was here)

#31846: Backports the z-index change to .close buttons in dismissible .alerts.

JS

#31000: Avoid multiple change event trigger in buttons plugin. Not applicable to v5 since our button JS plugin has been mostly replaced with pure CSS.

#31673: Fix dropdown variable always evaluating to true.

#31696: Ensure hidePrevented.bs.modal can be prevented.

#31718: Backports new $dropdown-padding-x variable from v5.

Docs

#30811: Mention GPU acceleration fix in docs callout for popovers. Doesn't apply to v5 since we're updating to Popper v2.

#30838: Explain the dispose method more appropriately.

#31706: Backports updated margins for code snippets for improved readability.

#31769: Backports JS bundle guidance from v5.

#31851: Backports mention of missing to and nextwhenvisible methods.

Misc

#31297: Switch to xo ESLint config

Updated devDependencies versions

4.5.2

This release addresses the following two issues:

#31438 restores the make-container-max-widths mixin. We won't be using the mixin ourselves, but it will remain in the codebase for the rest of v4 with today's release. We've added a deprecation notice as well.

#31439 removes flex: 1 0 100% from .rows. This was added to address shrinking rows inside the navbar component after our responsive containers were added in v4.4.0. Removing this rolls us back to the expected grid and flex behavior—your row will shrink unfortunately without further changes. We could add extra custom CSS to address this, but it seems shortsighted to rush into that. Instead, apply .flex-fill to the .row and your row will behave as usual.

4.5.1

CSS

#30808: Simplify list-group borders in cards

#30810: Add z-index to .custom-check to fix their rendering in CSS columns

#30817: Add border-radius to .card-img-overlay

#30830: Prevent conflicts with components with classes

#30922: Fix color on disabled checked state for custom controls

#30932: Restore word-break: break-word; on .text-break utility.

#30940: Prevent .row from shrinking in flex containers

#30957: Nullify custom form states' box-shadow

#30959: Toasts in IE11

#30960: Fix IE11 validation tooltip alignment in input groups

#30965: Improve floating labels example in IE

#30966: Improve floating labels with Edge and a general refactor

#30969: Remove duplicated container breakpoints in compiled CSS

#30999: Revert min-width: 0 on .col due to unforeseen side effects

#31148: Remove duplicate properties on custom controls

#31165: Remove backdrop-filter from docs subnav and toasts

#31339: Add link to view docs pages on GitHub

#31347: Turn off scroll anchoring for accordions

#31381: Remove overflow: hidden from toasts

JavaScript

#30326: Prevent overflowing static backdrop modal animation

#30936: Add role="dialog" in modals via JavaScript

#30992: Avoid preventing input event onclick

#31155: Clear timeout before showing the toast

Build

#30797: Fix release script docs

#31011: Updated Babel config

#31296: Update to Ruby 2.7 and Bundler 2.x

Docs

#30809: Update docs callout for responsive SVG images

#30813: Mention Bootstrap Icons in extend/icons.md page

#30896: Improve wording on Downloads page

#30897: Prevent skip links from overlapping header in docs

#30957: Add .card-img-bottom example

#30973: Update some nav examples by removing .nav-item from .nav-link to be more consistent

#31070: Fix some broken examples and typos

#31135: Move color utility callouts to start of page

#31234: Clean up docs forms for accessibility

#31344: Mention toasts in the components requiring JavaScript page

4.5.0

Highlights

New interaction utilities. Quickly set user-select with the new utilities and Sass map.

New Reboot style for pointer cursors. We now include a role="button" selector in Reboot to set cursor: pointer on non-<button> element buttons.

Examples are now downloadable. We've added a script to zip up and offer all our Examples as their own download from the docs.

Saved ~5% from the compressed minified JS builds.

Added guidance to our docs for how to work around our longstanding input group rounded corner bug.

Redesigned docs homepage and navbar to increment us towards v5's new docs design.

Deprecated bg-gradient-variant mixin as it's being removed in v5.

Updated to jQuery v3.5.1, Jekyll v4, and dropped Node.js < 10 for development.

CSS

#29413: Prevent vertical offset on progress bar in IE11

#29745: Add display: flex on .breadcrumb-item

#29819: Allow percentages in container widths

#29857: Escape brackets

#29946: Added new variable for padding on dropdown header

#30004: Fixes disabled .btn cursor

#30036: Added focus state to .btn-link

#30043: Fix IE auto-size input-group to column

#30049: Prevent grid with default cols from breaking when large pre is present by setting min-width: 0

#30074: Use word-wrap in .text-break for IE and Edge compatibility

#30166: Avoid border-radius functions returning negative values

#30183: Remove unnecessary reduce motion when $enable-transition: false

#30244: Fix centered modal scrolling issue

#30262: Prevent link underline change from affecting some components

#30361: Remove appearance from date inputs

#30391: Prevent redundant transition: none in transition()` mixin

#30497: Fix card list group borders & radii

#30504: Fix spinner-grow animation in Safari

#30515: Add .card-footer color

#30555, #30512, #30480: Use box-shadow mixin for .form-select, .btn, and other form controls

#30562: Added new interaction utilities for user-select and a new - role="button" in Reboot to set cursor: pointer.

#30582: Delete unnecessary appearance: none from button.close

#30594: Deprecate bg-gradient-variant mixin

#30605, #30606: Grid now checks for for $grid-columns > 0

#30609: Checks for an empty $grid-breakpoints map list to remove all breakpoints

#30660: Prevent list group style leaks

#30685: Disable auto-hiding scrollbar in IE and legacy Edge

JavaScript

#29886: Close modal with keyboard=true & backdrop=static

#29968: sanitizer.js: Add srcset in the allowed attributes

#30381: Updated tab.js to address accessibility issue when using ul/li semantic

#30383: ensure totype always return stringified null when null passed

#30388: enable button toggle on label when checkbox is inside

#30490: Switch to string constants to save ~5% on compressed file size

#30510, #30511: Fix event propagation from inactive and disabled dropdowns

#30744: ensure build plugins can exit in error

#30772: Prevent scrollbar replacement on non-integer width

22f75c: scrollspy: only accept valid Elements as input for target

Docs

Redesigned docs homepage

Improved tap target sizing in our navigation

Added examples for our input group border-radius workaround

Added warning to browser bugs page that it's no longer maintained

Added loading="lazy" for images

#29782: Improve wrapping and hit area of accordion example titles

#29820: move width after make-container() mixin

#29937: Add missing Noto Sans font to font stack

#29956: Add Microsoft Edge for macOS to supported browsers

#30130: Added ability to zip and download our Examples

#30175: Add version number in page titles

#30180: Changed input group validation examples to reflect issues with input group

#30207: Headings hierarchy in theming.md

#30325: Updated modal docs to simplify data-target usage and more

#30416: Clarify card group behavior

#30469: Remove holder.js leftovers

#30505: Use existing position utility in navbar example

#30695: make the check for URL stricter in our docs search

#30755: Removed role="document" from the modal dialog

Examples

#29886: Fix checkout page forms

#30573: Improve the responsiveness of our Dashboard example

Dependencies

Updated jQuery to v3.5.1

Replaced bundlesize with bundlewatch

Updated to Jekyll v4

Drop Node.js < 10

Misc devDependencies updates

4.4.1

Fix Dart Sass compatibility (#29755, #29763)

Add :disabled for disabled fieldset (#29762)

4.4.0

Highlights

Here's what you need to know about v4.4.0. Remember that with every minor and major release of Bootstrap, we ship a new URL for our hosted docs to ensure URLs continue to work.- New responsive containers! Over a year in the making, fluid up to a particular breakpoint, available for all responsive tiers.

New responsive .row-cols classes for quickly specifying the number of columns across breakpoints. This one is huge for those of you who have asked for responsive card decks.

New escape-svg() function for simplifying our embedded background-image SVGs for forms and more.

New add() and subtract() functions for avoiding errors and zero values from CSS's built in calc feature.

New make-col-auto() mixin to make our .col-auto class available with custom HTML.

Fixed an issue with Microsoft Edge not picking up :disabled styles by moving selectors to [disabled].

Deprecated: bg-variant(), nav-divider(), and form-control-focus() mixins are now deprecated as they're going away in v5.

Updated our spacing and alignment for modal footer elements like buttons to automatically wrap when space is constrained.

More flexible form control validation styles thanks to fewer chained selectors. Also updated the :invalid validation icon to be an alert instead of an × to avoid confusion with browser functionality for clearing the form field value.

Fixed a couple dozen CSS and JS bugs.

Moved to GitHub Actions for CI/CD! Expect more updates to our CI setup over time here while Actions evolves.

Updated documentation to fix links and typos, improved landmarks for secondary navigation, and a new security doc for guidelines on reporting potential vulnerabilities.

Links

List of closed issues and merged pull requests

Review the project board

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ chart.js (2.9.1 → 2.9.4) · Repo

Security Advisories 🚨

🚨 Prototype pollution in chart.js

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

Release Notes

2.9.4

This is the last release of v2 and focused on fixing bugs identified in the v2.9.3 release.

Bugs Fixed

#7404 - Preserve prototypes when cloning. Thanks @iddings

#7587 - Fix docs for external moment.js. Thanks @mojoaxel

#7853 - Fix box recursion when dimensions are NaN. Thanks @alessandroasm

#7883 - Fix call stack exception when computing label sizes. Thanks @silentmatt

#7918 - Prevent global prototype pollution via the merge helper

#7920 - Use Object.create(null) as merge target, to prevent prototype pollution

2.9.3

Bug Fixes

#6698 Fix undefined variable

#6719 Don't make legend empty when fill is false

Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@kurkle, @benmccann, and @etimberg).

2.9.2

Bug Fixes

#6641 IE11 & Edge compatible style injection

#6655 Backwards compatible default fill for radar charts

#6660 Improve clipping of line charts when border widths are large

#6661 When a legend item is clicked, make sure the correct item is hidden

#6663 Refresh package-lock file to pick up new dependency

Performance

#6671 Stop unnecessary line calculations

Documentation

#6643 Combine performance documentation sections

Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@nagix, @kurkle, @benmccann, @etimberg and @simonbrunel).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🗑️ emoji-regex (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update bootstrap to version 4.6.0

9fbbef4

depfu bot added the depfu label Sep 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update bootstrap 4.3.1 → 4.6.0 (minor) #301

🚨 [security] Update bootstrap 4.3.1 → 4.6.0 (minor) #301

depfu bot commented Sep 6, 2024

🚨 [security] Update bootstrap 4.3.1 → 4.6.0 (minor) #301

Are you sure you want to change the base?

🚨 [security] Update bootstrap 4.3.1 → 4.6.0 (minor) #301

Conversation

depfu bot commented Sep 6, 2024

What changed?

✳️ bootstrap (4.3.1 → 4.6.0) · Repo · Changelog

Highlights

CSS

JS

Docs

Examples

Misc

CSS

JS

Docs

Misc

CSS

JavaScript

Build

Docs

Highlights

CSS

JavaScript

Docs

Examples

Dependencies

Highlights

Links

✳️ chart.js (2.9.1 → 2.9.4) · Repo

Bugs Fixed

Bug Fixes

Bug Fixes

Performance

Documentation

🗑️ emoji-regex (removed)