Bootstrap 4.3.0 represents an iteration upon the solid base of version 4.2.1, offering developers refinements and updates crucial for modern web development. While both versions share the core philosophy of providing a responsive, mobile-first framework, subtle yet significant improvements distinguish the newer release.
A key area of focus for developers will be the updated dependency versions in 4.3.0. Several development dependencies, such as eslint, autoprefixer, and various Babel-related packages, have been bumped to newer versions, potentially bringing improved linting rules, better browser compatibility through updated CSS prefixing and more modern JavaScript transpilation. These upgrades, while seemingly under-the-hood, can streamline the development workflow and ensure better code quality and compatibility.
Notably, popper.js is updated in the new version as peer dependency. While this may not affect many end users of the library, it does indicate that developers should take note of this when installing the libary using tools like npm or yarn.
Beyond the technical underpinnings, developers will appreciate the continued commitment to maintaining consistent peer dependencies, with jquery being in the 1.9.1 - 3 range, thereby maintaining compatibility with a wide range of jQuery versions. This detail is important for projects that might have existing jQuery dependencies and demonstrates the careful consideration given to backward compatibility.
In summary, Bootstrap 4.3.0 is an incremental improvement that provides developers with updated development tools and crucial upgrades to maintain a modern and efficient workflow, while retaining the core features and functionality that made Bootstrap 4.2.1 a successful framework.
All the vulnerabilities related to the version 4.3.0 of the package
Bootstrap Vulnerable to Cross-Site Scripting
Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.
For bootstrap 4.x upgrade to 4.3.1 or later.
For bootstrap 3.x upgrade to 3.4.1 or later.
Bootstrap Cross-Site Scripting (XSS) vulnerability
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
