[Snyk] Security upgrade bootstrap from 3.4.1 to 4.0.0 #174
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
large-file/package.json
large-file/package-lock.json
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-BOOTSTRAP-7444617
SNYK-JS-BOOTSTRAP-7444593
Release notes
Package name: bootstrap
Our first stable v4 release! 🎉
Highlights:
border-color
for them darkened from$gray-200
to$gray-300
..order-0
classes to reset column order.Project board
For more details, visit #25098.
Breaking changes
As mentioned in our Beta 2 release, we needed to make a few more breaking changes in Beta 3. We've summarized them here and in our migration docs—be sure to read them!
Rewrote native and custom check controls. Both browser default and custom checkboxes and radios now have simpler markup after removing the
<input>
from the<label>
. Now, all checkboxes and radios have a parent<div>
and sibling<input>
and<label>
pair. This is essential for form validation and disabled inputs because we can use the input's state to style the label.In addition, custom checkbox and radio elements no longer have a
.custom-control-indicator
. This is generated from the new.custom-control-label
.Input groups were rewritten with specific
.input-group-{prepend|append}
classes. The new approach allows us to support validation styles and messages within input groups, while also adding support for custom selects, custom file inputs, and multiple.form-control
s.Responsive tables are once again parent classes to avoid accessiblity issues with changing a
<table>
'sdisplay
.Deleted the
.col-form-legend
class, consolidating it's styles into the.col-form-label
class.Read the Migration page for further details.
More highlights
In addition to the breaking changes, we've addressed a few more general issues that may impact your project.
Restored
cursor: pointer
to non-disabled links, buttons,.close
, navbar toggler, and pagination links.Added a new vertically centered modal option with
.modal-dialog-centered
.Added new dropleft and dropright variants for dropdowns in #23860.
Our npm package no longer includes any files other than our source and dist JavaScript and CSS files. If you previously relied on our running our scripts via the
node_modules
folder, you'll need to update your build tools.Print styles have moved to bottom of the import stack to properly override styles.
For more details on this release's changes, take a look at the Beta 3 ship list issue, as well as the Beta 3 project.
Beta 2 is here! Read the full ship list for details on what issues were closed and PRs merged.
Highlights
.offset-
modifiers in #23445. Originally our intent was to supplement this with our margin utilities, but we underestimated the appeal of fixed number column offsets.color
from.badge
, and it's associated$badge-color
variable, in #23529.grayscale
function togray
to avoid breaking CSS nativegrayscale
filter in #23579..table-inverse
,.thead-inverse
, and.thead-default
to.*-dark
and.*-light
, matching our color schemes used elsewhere in #23560..table-responsive-{sm,md,lg,xl}
to the already present.table-responsive
. You might need to adjust your usage depending on when you want a table to resize. See #22804.bootstrap.bundle.js
andbootstrap.bundle.min.js
. See #23735.float
to flexbox in #23683.color-yiq
from a mixin that included thecolor
property to a function that returns a value, allowing you to use it for any CSS property. For example, instead ofcolor-yiq(#000)
, you'd writecolor: color-yiq(#000);
.It's a beta! Holy crap this took forever. Thanks for sticking with me on this one—means a lot, y'all <3.
Highlights!
.navbar-expand
instead of.navbar-toggleable
, remove toggler position modifiers (relies on flex utils now), and fix a handful of bugs..order-
modifiers and margin utilities.cursor: pointer
s to restore browser defaults and better indicate actions vs hyperlinks.order
utilities to better match utility naming scheme of.property-value
._custom.scss
in our import order.peerDependencies
as they're not requirements for every part of Bootstrap.Be sure to read the full ship list.
Happy New Year! It's our final alpha for Bootstrap 4.
Details
Highlights
property: value
pairs (instead of creating new names for things). For example,.flex-items-between
is now.justify-content-between
to applyjustify-content: between;
. This also adds tons of new flexbox utilities fordisplay
,order
,wrap
, and more.float
s and clearfixs have been removed,.nav-inline
removed (on account ofdisplay: flex
inlining for us on.nav
), added fill and justify options, and more..no-gutters
.col-xs-6
,col-md-auto
, andcol-xl-4
to a single element).xs
tier no longer requires a breakpoint abbreviation, making for shorter and more descriptive classes and an easier migration from v3. For example, instead of.d-xs-none
, it's back to.d-none
while it remains.d-{sm,md,lg,xl}-none
for those breakpoints..active
, all.in
, and all.open
classes for our JavaScript powered components for more consistent naming. For example, instead it's now.collapse.show
instead of.collapse.in
and.show > .dropdown-menu
instead of.open > .dropdown-menu
to better communicate the visibility of elements.<progress>
element due to lack of animations, no support for multiple bars, and no support for labels on the progress bars.#
s in our SVG data URLs that are used to add vector background-images..tag
back to.badge
, like v3, to avoid conflicts with common WordPress styles.background-image
s, and more..form-check
and.form-check-inline
now share the same markup. Switch between the two by adding or removing.form-check-inline
as a modifier._animation.scss
to_transitions.scss
for clarity.$blue
) for additional customization.Fifth alpha! View the milestone for details: #20630.
Fourth alpha release!
See the closed milestone for details.
Third alpha release!
See the closed milestone for details.
Second alpha release!
See the closed milestone or the blog post for more details.
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:![](https://camo.githubusercontent.com/7efe021e1d93fbde87ca5654f12d50c213266f184876fb0272e0852a8f37c51a/68747470733a2f2f6170692e7365676d656e742e696f2f76312f706978656c2f747261636b3f646174613d65794a33636d6c305a55746c65534936496e4a79576d785a634564485932527954485a7362306c596430645563566734576b4652546e4e434f5545774969776959573576626e6c746233567a535751694f694a68597a56694e7a5a6d4e5330354e57566d4c5451314d4749744f57566b4d4330314f5759315a47517759325932593245694c434a6c646d567564434936496c425349485a705a58646c5a434973496e42796233426c636e52705a584d694f6e736963484a4a5a434936496d466a4e5749334e6d59314c546b315a5759744e445577596930355a5751774c5455355a6a566b5a44426a5a6a5a6a59534a3966513d3d)
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS)