search

trimble-oss / website-modus-bootstrap.trimble.com

Documentation and code samples for using the Modus Bootstrap framework
https://modus-bootstrap.trimble.com/docs/v1/
MIT License
3 stars 1 forks source link

npm audit reports moderate XSS vulnerability with bootstrap 4.6.2 #463

Closed enowak1031 closed 1 month ago

enowak1031 commented 2 months ago

bootstrap 4 is in EOL mode - and the bootstrap team won't fix this according to https://github.com/twbs/bootstrap/issues/40685

This needs an upgrade from Bootstrap 4 -> 5

Bootstrap 4.6.2 was released 2 years ago Bootstrap 5.0.0 was released 3 years ago so this should be stable by now

"Martin Heuschober, Thu 7:40 AM Hey I saw your names on the Modus kanban board - I opened a jira ticket about XSS vulnerability in Bootstrap 4 https://jira.trimble.tools/browse/MODUS-60 a week ago and didn't get a response on the ticket. So I want to make sure it is not missed."

coliff commented 2 months ago

This is a known issue and has been discussed before.

The best thing to do is upgrade to Modus Bootstrap v2. I can provide instructions.

mh-trimble commented 1 month ago

as far as I can see npm install @trimble-oss/modus-bootstrap will install 1.6.4 (as of sept 5th 2024) how can I upgrade to v2 and where do I find resources for that?

coliff commented 1 month ago

Hello! I was just about to reach out to you to let you know that you can now install!

The npm package is at: https://www.npmjs.com/package/@trimble-oss/modus-bootstrap

The site has been updated too: https://modus-bootstrap.trimble.com/

You may find this script I created useful for migrating your site/templates: https://github.com/coliff/bootstrap-5-migrate-tool#bootstrap-5-migrate-tool

Happy coding and please reach out if you have any questions at all!