Update dependency bootstrap to v4.1.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
bootstrap (source)	4.0.0 → 4.1.2

---

Bootstrap Cross-site Scripting vulnerability

CVE-2018-14041 / GHSA-pj7m-g53m-7638

More information

Details

In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-14041
• https://github.com/twbs/bootstrap/issues/26423
• https://github.com/twbs/bootstrap/issues/26627
• https://github.com/twbs/bootstrap/pull/26630
• https://access.redhat.com/errata/RHSA-2019:1456
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@​%3Cdev.drill.apache.org%3E
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
• https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@​%3Cissues.hbase.apache.org%3E
• https://seclists.org/bugtraq/2019/May/18
• https://www.oracle.com/security-alerts/cpuApr2021.html
• http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
• http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
• http://seclists.org/fulldisclosure/2019/May/10
• http://seclists.org/fulldisclosure/2019/May/11
• http://seclists.org/fulldisclosure/2019/May/13
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2018-14041.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2018-14041.yaml
• https://typo3.org/security/advisory/typo3-core-sa-2019-006
• https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2018-14041.yml
• https://github.com/advisories/GHSA-pj7m-g53m-7638

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

twbs/bootstrap (bootstrap)

v4.1.2

Compare Source

• Fixed an XSS vulnerability in tooltip, collapse, and scrollspy plugins
• Improved how we query elements in our JavaScript plugins
• Inline SVGs now have the same vertical alignment as images
• Fixed issues with double transitions on carousels
• Added Edge and IE10-11 fallbacks to our floating labels example
• Various improvements to form controls, including disabled states on file inputs and unified focus styles for selects

Checkout the v4.1.2 ship list and GitHub project for the full details.

v4.1.1

Compare Source

Our first patch release for Bootstrap 4! Here's a quick rundown of some of the changes:

• Added validation styles for file inputs
• Improved printing of dark tables
• Suppressed that text-hide deprecation notice by default
• Cleaned up some JS globals and improve coverage
• Bumped dependencies, namely Jekyll
• Fixed docs issue with incorrect name for our monospace font utility

Checkout the v4.1.1 ship list and GitHub project for the full details.

v4.1.0

Compare Source

• Added new custom range form control.
• Added new .carousel-fade modifier to switch carousel from horizontal sliding to crossfade.
• Added new .dropdown-item-text for plaintext dropdown items.
• Added new .flex-fill, .flex-grow-*, and .flex-shrink-* utilities.
• Added new .table-borderless variant for tables.
• Added new .text-monospace utility.
• Added new .text-body (default body color), .text-black-50 (50% opacity black), and .text-white-50 (50% opacity white) utilities.
• Added new .shadow-* utilities for quickly adding box-shadows.
• Added ability to disable Popper's positioning in dropdowns.
• Fixed longstanding issue with Chrome incorrectly rendering cards across CSS columns.
• Deprecated .text-hide—you'll see a warning during compilation—as it's a dated and undocumented feature.
• Fixed up Dashboard and Offcanvas examples across Firefox and IE.
• Breadcrumbs can now use non-string values as dividers.
• Updated our Theming docs to confirm you cannot use CSS variables in media queries (sorry folks!).

Be sure to look at the ship list and project board for more details on all our fixes.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.