Bootstrap versions 4.1.0 and 4.0.0 represent incremental updates to the popular front-end framework, primarily focusing on enhancements and bug fixes rather than groundbreaking changes. Both versions maintain the core promise of providing responsive, mobile-first design components and utilities. Looking at devDependencies, the 4.1.0 release upgraded many development tools, indicating a focus on improving the development workflow and code quality. Key updates include newer versions of ESLint, Rollup, Node-Sass, Stylelint, and Babel, suggesting a move towards more modern JavaScript and CSS practices. Notably, the introduction of karma-coverage-istanbul-reporter in 4.1.0 points to a stronger emphasis on test coverage analysis. From a developer's perspective, the updates in development dependencies translates into a slightly better and more modern coding experience.
For developers integrating Bootstrap into their projects, the peer dependencies highlight compatible versions of jQuery and Popper.js. Version 4.1.0 requires Popper.js ^1.14.0 compared to ^1.12.9 in 4.0.0, so, depending on the existing setup, a required update might be needed. Both Bootstrap versions offer a robust set of tools for creating visually appealing and responsive web applications. Choosing between them largely depends on whether the enhancements and bug fixes in 4.1.0, along with the updated development dependencies, outweigh any potential compatibility considerations with existing projects. The consistent MIT license ensures flexible usage in a wide range of projects.
All the vulnerabilities related to the version 4.1.0 of the package
Bootstrap vulnerable to Cross-Site Scripting (XSS)
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
Bootstrap Cross-site Scripting vulnerability
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041.
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
Bootstrap Vulnerable to Cross-Site Scripting
Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.
For bootstrap 4.x upgrade to 4.3.1 or later.
For bootstrap 3.x upgrade to 3.4.1 or later.
Bootstrap Cross-Site Scripting (XSS) vulnerability
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
