Bootstrap NES 3.4.x

3.4.8 (NES) - June 26, 2025

Notes

• This release updates the version naming scheme (i.e. to 3.4.1-bootstrap-3.4.8). There are no functional changes in this release.
• Full Version: 3.4.1-bootstrap-3.4.8

Bug Fixes

• None

3.4.7 (NES) - February 21, 2025

Notes

• This release fixes a syntax error that could affect Bootstrap assets when bundled with other files. It also introduces additional security enhancements.

Bug Fixes

• Helper: Fix syntax error
  • Add a trailing semicolon to js/helpers.js Immediately Invoked Function Expression (IIFE) statement. This prevents syntax errors with legacy bundlers that use simple concatenation.
• Tooltip:
  • Improve handling of unsanitized HTML to ensure consistent application of proper sanitization.
    • This fixes a medium severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-1647).
• Popover:
  • Improve handling of unsanitized HTML to ensure consistent application of proper sanitization.
    • This fixes a medium severity XSS vulnerability (CVE-2025-1647).

3.4.6 (NES) - January 28, 2025

Notes

• This release updates version numbers in static file headers.

Bug Fixes

• Build: Internal version text updates
  • Update version text in several .less, .css, and .js assets to match HeroDevs NES versions and help security scanners detect the correct Bootstrap NES version number.

3.4.5 (NES) - June 21, 2024

Notes

• This release enhances the handling of attribute data used in the Carousel component.

Bug Fixes

• Carousel: Improve selector extraction from carousel navigation href attributes.
  • This fixes a medium severity XSS vulnerability (CVE-2024-6484).

3.4.4 (NES) - June 18,2024

Notes

• This release enhances the handling of attribute data used in several Bootstrap NES components.

Bug Fixes

• Alert:
  • Improve URL/hash extraction logic for href attribute.
• Button:
  • Improve handling of button state data passed through href and any data-*-text including data-complete-text and data-reset-text.
    • This fixes a medium severity XSS vulnerability (CVE-2024-6485).
• Carousel:
  • Improve selector extraction from Carousel navigation href attributes.
    • This fixes a medium severity XSS vulnerability (CVE-2024-6484).
  • Improve URL/hash extraction logic for href attribute.
• Dropdown:
  • Improve URL/hash extraction logic for href attribute.
• Tab:
  • Improve URL/hash extraction logic for href attribute.

3.4.3 (NES) - February 16, 2024

Notes

• This release fixes an issue from Bootstrap NES v3.4.2 where the minified scripts contained non-relative paths.

Bug Fixes

• Build: Fix URL paths in minified CSS to be relative to current file instead of dist/.

3.4.2 (NES) - February 1, 2024

Notes

• This is the initial release of Bootstrap NES 3.4.x. This release contains no functional changes from Bootstrap 3.4.1.