Bootstrap 4.4.0 represents an incremental update over the previous stable release, Bootstrap 4.3.1, of the popular front-end framework. While both versions share the same core mission of enabling responsive, mobile-first web development, several key differences emerge when examining their development dependencies and peer dependencies.
Primarily, Bootstrap 4.4.0 reflects updates across a wide array of development tools, ensuring compatibility with newer versions and incorporating potential performance improvements and bug fixes. Major upgrades can be seen in tools like Rollup, Node Sass, jQuery, and Babel, the javascript compiler. jQuery bumps from version 3.3.1 to 3.4.1 while Babel upgrades from v7.2.2 to v7.7.4, important if your project also uses these tools. Developers utilizing these tools in their build processes will observe alignment with the updated framework. In addition, new tools were added for the newer version, like find-unused-sass-variables in order to further help developers.
Peer dependencies remain relatively consistent, with "jquery" maintaining its support range from "1.9.1 - 3" and similar updates for "popper.js", but now targeting version "^1.16.0" instead of "^1.14.7". This suggests a continued commitment to compatibility with established JavaScript libraries while adopting refinements in their API.
The release date differential highlights a commitment to ongoing maintenance and incremental improvements. Build size and file count remain similar, so any impact on project size and performance is likely minimal. Developers should review the changelog for Bootstrap 4.4.0 to pinpoint specific bug fixes, feature enhancements, and potential breaking changes to ensure a smooth upgrade path and maximize the benefits of the updated framework.
All the vulnerabilities related to the version 4.4.0 of the package
Bootstrap Cross-Site Scripting (XSS) vulnerability
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
