search

twbs / bootstrap-sass

Official Sass port of Bootstrap 2 and 3.
http://getbootstrap.com/css/#sass
MIT License
12.59k stars 3.53k forks source link

Bootstrapp@3.3.7 is vulnerable to XSS - Fix is in Bootstrap@3.4.0 #1157

Closed narfk closed 6 years ago

narfk commented 6 years ago

Bootstrapp@3.3.7 is vulnerable to XSS (https://snyk.io/vuln/npm:bootstrap?lh@3.3.7) Fixes are available in Bootstrap 3.4.0 or higher.

Please update bootstrap-sass

glebm commented 6 years ago

Bootstrap 3.4.0 has not been released yet. This gem will be updated once it's released upstream. You can use branch next at this commit in the meantime: https://github.com/twbs/bootstrap-sass/commit/7ac94c96ef4e0007c7ad3cb73b57e1219b3529bd

narfk commented 6 years ago

👍

samgranger commented 6 years ago

@glebm any updates on 3.4.0 update for this gem?

glebm commented 6 years ago

3.4.0 still hasn't been released upstream

votw commented 6 years ago

@glebm : Any idea on release timelines for this fix?

don-spyker commented 6 years ago

@glebm There are updates in the bootstrap 3.4.0-dev branch. Will they be synced automatically in the next branch of bootstrap-sass?

glebm commented 6 years ago

@don-spyker They are in the next branch now along with sass -> sassc migration and other minor changes.

Closing this issue as there is nothing to do here until 3.4.0 has been released upstream.