Bootstrap 4.6.2 arrives as a refined iteration of the popular front-end framework, building upon the solid foundation of version 4.6.1. A key difference lies within the development dependencies, reflecting updates to the tooling ecosystem. Version 4.6.2 incorporates newer versions of crucial packages like eslint, rollup, terser, postcss, and @babel/core, bringing potential performance improvements and compatibility with the latest JavaScript standards. A notable addition in 4.6.2 are the github funding which show the comitment with the maintenance. The node-sass package is major version updated. These updates aim to enhance the development experience, potentially leading to faster build times and more efficient code optimization. While the core peer dependencies (jQuery and Popper.js) remain consistent, indicating sustained API compatibility, developers should note the updated versions of development tools when integrating into existing projects. The unpacked size increased indicating changes on vendor dependencies. From version 4.6.1 to 4.6.2 there is an obvious modernizing process in libraries such as eslint, babel and rollup, to match all the different upgrades in browser engines therefore the developer experience it is improved. Both versions maintain the MIT license, ensuring freedom of use in various projects, and continue to be actively supported by the Bootstrap Authors. For developers using Bootstrap, staying up-to-date with these incremental improvements ensures a more streamlined and efficient workflow.
All the vulnerabilities related to the version 4.6.2 of the package
Bootstrap Cross-Site Scripting (XSS) vulnerability
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.