build(deps): bump bootstrap from 4.6.1 to 5.0.0 in /app #847
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=80&v=4){kind=small}
Bumps [bootstrap](https://github.com/twbs/bootstrap) from 4.6.1 to 5.0.0. - [Release notes](https://github.com/twbs/bootstrap/releases) - [Commits](twbs/bootstrap@v4.6.1...v5.0.0) --- updated-dependencies: - dependency-name: bootstrap dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
There was a problem hiding this comment.
Code change looks good to me. Though cannot tell if there are any breaking changes between v4.6.1 and v5.0.0...
EDIT: Okay, there seem to be breaking changes, not sure if they affect us though? https://getbootstrap.com/docs/5.0/migration/
cc @jamaljsr
|
Sadly, migrating from bootstrap v4 to v5 is a pretty substantial process to resolve many breaking changes. Most changes are in the CSS classes which won't be caught by tests, but completely break the styling of the UI. According to the security advisory, this vulnerability is only present in the carousel component which we do not use in our app. So we do not have any attack vectors to worry about at this moment. I do think we need to upgrade bootstrap eventually since v4.x has been EOL since 2023 and will no longer receive security updates. There may eventually come a time when an exploit that does impact us surfaces. @levmi I would suggest creating an issue and prioritizing it against other work in our backlog. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
bot
deleted the
dependabot/npm_and_yarn/app/bootstrap-5.0.0
branch
|
@dependabot ignore versions ^5.0.0 |
|
Sorry, the command you entered is not valid for this pull request. Please check the syntax and try again. Valid commands: |
|
@dependabot ignore this dependency |
|
OK, I won't notify you about bootstrap again, unless you re-open this PR. |
2 participants
Bumps bootstrap from 4.6.1 to 5.0.0.
Release notes
Sourced from bootstrap's releases.
... (truncated)
Commits
bf09367Release v5.0.0 (#33647)48ae5a7Rewrite migration guide (#33834)f086572refactor(docs): Added form file input variables (#33833)1a54286Fix doc typo and Bootstrap Icons link (#33832)e2df73fUpdate migration guide for some v5 changes (#33829)1e6356aNeutralise more words from placeholder text (#33731)6633845Bump eslint-config-xo from 0.35.0 to 0.36.0 (#33646)cb38744Tweak toast docs (#33810)c2ff225Bump rollup from 2.46.0 to 2.47.0 (#33818)c090ea2Bump@babel/preset-envfrom 7.14.0 to 7.14.1 (#33819)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.