diff --git a/.browserslistrc b/.browserslistrc
index c71c8b9c717b..cddd23005246 100644
--- a/.browserslistrc
+++ b/.browserslistrc
@@ -9,3 +9,4 @@ Firefox ESR
iOS >= 12
Safari >= 12
not Explorer <= 11
+not kaios <= 2.5 # fix floating label issues in Firefox (see https://github.com/postcss/autoprefixer/issues/1533)
diff --git a/.bundlewatch.config.json b/.bundlewatch.config.json
index 5960b3bef571..6f680664ca67 100644
--- a/.bundlewatch.config.json
+++ b/.bundlewatch.config.json
@@ -2,55 +2,55 @@
"files": [
{
"path": "./dist/css/bootstrap-grid.css",
- "maxSize": "7.25 kB"
+ "maxSize": "6.5 kB"
},
{
"path": "./dist/css/bootstrap-grid.min.css",
- "maxSize": "6.5 kB"
+ "maxSize": "6.0 kB"
},
{
"path": "./dist/css/bootstrap-reboot.css",
- "maxSize": "2.5 kB"
+ "maxSize": "3.5 kB"
},
{
"path": "./dist/css/bootstrap-reboot.min.css",
- "maxSize": "2.35 kB"
+ "maxSize": "3.25 kB"
},
{
"path": "./dist/css/bootstrap-utilities.css",
- "maxSize": "7.75 kB"
+ "maxSize": "11.75 kB"
},
{
"path": "./dist/css/bootstrap-utilities.min.css",
- "maxSize": "7 kB"
+ "maxSize": "10.75 kB"
},
{
"path": "./dist/css/bootstrap.css",
- "maxSize": "26 kB"
+ "maxSize": "32.5 kB"
},
{
"path": "./dist/css/bootstrap.min.css",
- "maxSize": "23.5 kB"
+ "maxSize": "30.25 kB"
},
{
"path": "./dist/js/bootstrap.bundle.js",
- "maxSize": "42.5 kB"
+ "maxSize": "43.0 kB"
},
{
"path": "./dist/js/bootstrap.bundle.min.js",
- "maxSize": "22.75 kB"
+ "maxSize": "23.5 kB"
},
{
"path": "./dist/js/bootstrap.esm.js",
- "maxSize": "27.5 kB"
+ "maxSize": "28.0 kB"
},
{
"path": "./dist/js/bootstrap.esm.min.js",
- "maxSize": "18.5 kB"
+ "maxSize": "18.25 kB"
},
{
"path": "./dist/js/bootstrap.js",
- "maxSize": "28.25 kB"
+ "maxSize": "28.75 kB"
},
{
"path": "./dist/js/bootstrap.min.js",
diff --git a/.cspell.json b/.cspell.json
index bfbdaad79c49..d2434c30a608 100644
--- a/.cspell.json
+++ b/.cspell.json
@@ -3,10 +3,12 @@
"words": [
"affordance",
"allowfullscreen",
+ "Analyser",
"autohide",
"autohiding",
"autoplay",
"autoplays",
+ "autoplaying",
"blazingly",
"Blockquotes",
"Bootstrappers",
@@ -18,6 +20,7 @@
"btnradio",
"callout",
"callouts",
+ "camelCase",
"clearfix",
"Codesniffer",
"combinator",
@@ -37,6 +40,7 @@
"dropright",
"dropstart",
"dropup",
+ "dgst",
"errorf",
"favicon",
"favicons",
@@ -48,6 +52,7 @@
"Hoverable",
"hreflang",
"hstack",
+ "importmap",
"jsdelivr",
"Jumpstart",
"keyframes",
@@ -59,6 +64,8 @@
"markdownify",
"mediaqueries",
"minifiers",
+ "misfunction",
+ "mkdir",
"monospace",
"mouseleave",
"navbars",
@@ -71,7 +78,6 @@
"Packagist",
"popperjs",
"prebuild",
- "precompiled",
"prefersreducedmotion",
"prepended",
"printf",
@@ -81,11 +87,15 @@
"roboto",
"RTLCSS",
"ruleset",
+ "sassrc",
"screenreaders",
"scrollbars",
"scrollspy",
"Segoe",
+ "semibold",
+ "socio",
"srcset",
+ "stackblitz",
"stickied",
"Stylelint",
"subnav",
@@ -100,17 +110,16 @@
"unstyled",
"Uppercased",
"urlize",
+ "urlquery",
"vbtn",
"viewports",
+ "Vite",
"vstack",
"walkthroughs",
"WCAG",
"zindex"
],
"language": "en-US",
- "files": [
- "**/*.md"
- ],
"ignorePaths": [
".cspell.json",
"dist/",
diff --git a/.eslintignore b/.eslintignore
index a18b03a5df54..e42161487a5b 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -2,5 +2,8 @@
**/dist/
**/vendor/
/_site/
+/site/public/
/js/coverage/
/site/static/sw.js
+/site/static/docs/**/assets/sw.js
+/site/layouts/partials/
diff --git a/.eslintrc.json b/.eslintrc.json
index d8e83a8d2eec..da686166f5a8 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -14,6 +14,35 @@
"error",
"never"
],
+ "import/extensions": [
+ "error",
+ "ignorePackages",
+ {
+ "js": "always"
+ }
+ ],
+ "import/first": "error",
+ "import/newline-after-import": "error",
+ "import/no-absolute-path": "error",
+ "import/no-amd": "error",
+ "import/no-cycle": [
+ "error",
+ {
+ "ignoreExternal": true
+ }
+ ],
+ "import/no-duplicates": "error",
+ "import/no-extraneous-dependencies": "error",
+ "import/no-mutable-exports": "error",
+ "import/no-named-as-default": "error",
+ "import/no-named-as-default-member": "error",
+ "import/no-named-default": "error",
+ "import/no-self-import": "error",
+ "import/no-unassigned-import": [
+ "error"
+ ],
+ "import/no-useless-path-segments": "error",
+ "import/order": "error",
"indent": [
"error",
2,
@@ -22,6 +51,7 @@
"SwitchCase": 1
}
],
+ "logical-assignment-operators": "off",
"max-params": [
"warn",
5
@@ -46,20 +76,166 @@
"error",
"after"
],
+ "prefer-object-has-own": "off",
+ "prefer-template": "error",
"semi": [
"error",
"never"
],
+ "strict": "error",
"unicorn/explicit-length-check": "off",
+ "unicorn/filename-case": "off",
+ "unicorn/no-anonymous-default-export": "off",
"unicorn/no-array-callback-reference": "off",
"unicorn/no-array-method-this-argument": "off",
"unicorn/no-null": "off",
+ "unicorn/no-typeof-undefined": "off",
"unicorn/no-unused-properties": "error",
+ "unicorn/numeric-separators-style": "off",
"unicorn/prefer-array-flat": "off",
+ "unicorn/prefer-at": "off",
"unicorn/prefer-dom-node-dataset": "off",
+ "unicorn/prefer-global-this": "off",
"unicorn/prefer-module": "off",
"unicorn/prefer-query-selector": "off",
"unicorn/prefer-spread": "off",
+ "unicorn/prefer-string-raw": "off",
+ "unicorn/prefer-string-replace-all": "off",
+ "unicorn/prefer-structured-clone": "off",
"unicorn/prevent-abbreviations": "off"
- }
+ },
+ "overrides": [
+ {
+ "files": [
+ "build/**"
+ ],
+ "env": {
+ "browser": false,
+ "node": true
+ },
+ "parserOptions": {
+ "sourceType": "module"
+ },
+ "rules": {
+ "no-console": "off",
+ "unicorn/prefer-top-level-await": "off"
+ }
+ },
+ {
+ "files": [
+ "js/**"
+ ],
+ "parserOptions": {
+ "sourceType": "module"
+ }
+ },
+ {
+ "files": [
+ "js/tests/*.js",
+ "js/tests/integration/rollup*.js"
+ ],
+ "env": {
+ "node": true
+ },
+ "parserOptions": {
+ "sourceType": "script"
+ }
+ },
+ {
+ "files": [
+ "js/tests/unit/**"
+ ],
+ "env": {
+ "jasmine": true
+ },
+ "rules": {
+ "no-console": "off",
+ "unicorn/consistent-function-scoping": "off",
+ "unicorn/no-useless-undefined": "off",
+ "unicorn/prefer-add-event-listener": "off"
+ }
+ },
+ {
+ "files": [
+ "js/tests/visual/**"
+ ],
+ "plugins": [
+ "html"
+ ],
+ "settings": {
+ "html/html-extensions": [
+ ".html"
+ ]
+ },
+ "rules": {
+ "no-console": "off",
+ "no-new": "off",
+ "unicorn/no-array-for-each": "off"
+ }
+ },
+ {
+ "files": [
+ "scss/tests/**"
+ ],
+ "env": {
+ "node": true
+ },
+ "parserOptions": {
+ "sourceType": "script"
+ }
+ },
+ {
+ "files": [
+ "site/**"
+ ],
+ "env": {
+ "browser": true,
+ "node": false
+ },
+ "parserOptions": {
+ "sourceType": "script",
+ "ecmaVersion": 2019
+ },
+ "rules": {
+ "no-new": "off",
+ "unicorn/no-array-for-each": "off"
+ }
+ },
+ {
+ "files": [
+ "site/src/assets/application.js",
+ "site/src/assets/partials/*.js",
+ "site/src/assets/search.js",
+ "site/src/assets/snippets.js",
+ "site/src/assets/stackblitz.js",
+ "site/src/plugins/*.js"
+ ],
+ "parserOptions": {
+ "sourceType": "module",
+ "ecmaVersion": 2020
+ }
+ },
+ {
+ "files": [
+ "**/*.md"
+ ],
+ "plugins": [
+ "markdown"
+ ],
+ "processor": "markdown/markdown"
+ },
+ {
+ "files": [
+ "**/*.md/*.js",
+ "**/*.md/*.mjs"
+ ],
+ "extends": "plugin:markdown/recommended-legacy",
+ "parserOptions": {
+ "sourceType": "module"
+ },
+ "rules": {
+ "unicorn/prefer-node-protocol": "off"
+ }
+ }
+ ]
}
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index be4ad836de22..ee959bcfedf8 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -1,6 +1,6 @@
# Contributing to Bootstrap
-Looking to contribute something to Bootstrap? **Here's how you can help.**
+Looking to contribute something to Bootstrap? **Here’s how you can help.**
Please take a moment to review this document in order to make the contribution
process easy and effective for everyone involved.
@@ -18,24 +18,26 @@ the preferred channel for [bug reports](#bug-reports), [features requests](#feat
and [submitting pull requests](#pull-requests), but please respect the following
restrictions:
-* Please **do not** use the issue tracker for personal support requests. Stack
- Overflow ([`bootstrap-5`](https://stackoverflow.com/questions/tagged/bootstrap-5) tag),
- [Slack](https://bootstrap-slack.herokuapp.com/) or [IRC](/README.md#community) are better places to get help.
+- Please **do not** use the issue tracker for personal support requests. Stack Overflow ([`bootstrap-5`](https://stackoverflow.com/questions/tagged/bootstrap-5) tag), [our GitHub Discussions](https://github.com/twbs/bootstrap/discussions) or [IRC](/README.md#community) are better places to get help.
-* Please **do not** derail or troll issues. Keep the discussion on topic and
+- Please **do not** derail or troll issues. Keep the discussion on topic and
respect the opinions of others.
-* Please **do not** post comments consisting solely of "+1" or ":thumbsup:".
+- Please **do not** post comments consisting solely of "+1" or ":thumbsup:".
Use [GitHub's "reactions" feature](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/)
instead. We reserve the right to delete comments which violate this rule.
-* Please **do not** open issues regarding the official themes offered on .
- Instead, please email any questions or feedback regarding those themes to `themes AT getbootstrap DOT com`.
+
+## Issues assignment
+
+The core team will be looking at the open issues, analyze them, and provide guidance on how to proceed. **Issues won’t be assigned to anyone outside the core team.** However, contributors are welcome to participate in the discussion and provide their input on how to best solve the issue, and even submit a PR if they want to. Please wait that the issue is ready to be worked on before submitting a PR, we don’t want to waste your time.
+
+Please keep in mind that the core team is small, has limited resources and that we are not always able to respond immediately. We will try to provide feedback as soon as possible, but please be patient. If you don’t get a response immediately, it doesn’t mean that we are ignoring you or that we don’t care about your issue or PR. We will get back to you as soon as we can.
## Issues and labels
-Our bug tracker utilizes several labels to help organize and identify issues. Here's what they represent and how we use them:
+Our bug tracker utilizes several labels to help organize and identify issues. Here’s what they represent and how we use them:
- `browser bug` - Issues that are reported to us, but actually are the result of a browser-specific bug. These are diagnosed with reduced test cases and result in an issue opened on that browser's own bug tracker.
- `confirmed` - Issues that have been confirmed with a reduced test case and identify a bug in Bootstrap.
@@ -59,7 +61,7 @@ Good bug reports are extremely helpful, so thanks!
Guidelines for bug reports:
0. **[Validate your HTML](https://html5.validator.nu/)** to ensure your
- problem isn't caused by a simple error in your own code.
+ problem isn’t caused by a simple error in your own code.
1. **Use the GitHub issue search** — check if the issue has already been
reported.
@@ -69,10 +71,10 @@ Guidelines for bug reports:
3. **Isolate the problem** — ideally create a [reduced test
case](https://css-tricks.com/reduced-test-cases/) and a live example.
- [This JS Bin](https://jsbin.com/lolome/edit?html,output) is a helpful template.
+ These [v4 CodePen](https://codepen.io/team/bootstrap/pen/yLabNQL) and [v5 CodePen](https://codepen.io/team/bootstrap/pen/qBamdLj) are helpful templates.
-A good bug report shouldn't leave others needing to chase you up for more
+A good bug report shouldn’t leave others needing to chase you up for more
information. Please try to be as detailed as possible in your report. What is
your environment? What steps will reproduce the issue? What browser(s) and OS
experience the problem? Do other browsers show the bug differently? What
@@ -103,17 +105,17 @@ Sometimes bugs reported to us are actually caused by bugs in the browser(s) them
| Vendor(s) | Browser(s) | Rendering engine | Bug reporting website(s) | Notes |
| ------------- | ---------------------------- | ---------------- | ------------------------------------------------------ | -------------------------------------------------------- |
-| Mozilla | Firefox | Gecko | https://bugzilla.mozilla.org/enter_bug.cgi | "Core" is normally the right product option to choose. |
-| Apple | Safari | WebKit | https://bugs.webkit.org/enter_bug.cgi?product=WebKit | In Apple's bug reporter, choose "Safari" as the product. |
-| Google, Opera | Chrome, Chromium, Opera v15+ | Blink | https://bugs.chromium.org/p/chromium/issues/list | Click the "New issue" button. |
-| Microsoft | Edge | Blink | https://developer.microsoft.com/en-us/microsoft-edge/ | Go to "Help > Send Feedback" from the browser |
+| Mozilla | Firefox | Gecko | | "Core" is normally the right product option to choose. |
+| Apple | Safari | WebKit | | In Apple’s bug reporter, choose "Safari" as the product. |
+| Google, Opera | Chrome, Chromium, Opera v15+ | Blink | | Click the "New issue" button. |
+| Microsoft | Edge | Blink | | Go to "Help > Send Feedback" from the browser |
## Feature requests
Feature requests are welcome. But take a moment to find out whether your idea
-fits with the scope and aims of the project. It's up to *you* to make a strong
-case to convince the project's developers of the merits of this feature. Please
+fits with the scope and aims of the project. It’s up to _you_ to make a strong
+case to convince the project’s developers of the merits of this feature. Please
provide as much detail and context as possible.
@@ -126,8 +128,8 @@ commits.
**Please ask first** before embarking on any **significant** pull request (e.g.
implementing features, refactoring code, porting to a different language),
otherwise you risk spending a lot of time working on something that the
-project's developers might not want to merge into the project. For trivial
-things, or things that don't require a lot of your time, you can go ahead and
+project’s developers might not want to merge into the project. For trivial
+things, or things that don’t require a lot of your time, you can go ahead and
make a PR.
Please adhere to the [coding guidelines](#code-guidelines) used throughout the
@@ -139,7 +141,7 @@ any dist files (`dist/` or `js/dist`).** Those files are automatically generated
edit the source files in [`/bootstrap/scss/`](https://github.com/twbs/bootstrap/tree/main/scss)
and/or [`/bootstrap/js/src/`](https://github.com/twbs/bootstrap/tree/main/js/src) instead.
-Similarly, when contributing to Bootstrap's documentation, you should edit the
+Similarly, when contributing to Bootstrap’s documentation, you should edit the
documentation source files in
[the `/bootstrap/site/content/docs/` directory of the `main` branch](https://github.com/twbs/bootstrap/tree/main/site/content/docs).
**Do not edit the `gh-pages` branch.** That branch is generated from the
@@ -167,33 +169,47 @@ included in the project:
git pull upstream main
```
-3. Create a new topic branch (off the main project development branch) to
+3. Install or update project dependencies with npm:
+
+ ```bash
+ npm install
+ ```
+
+4. Create a new topic branch (off the main project development branch) to
contain your feature, change, or fix:
```bash
git checkout -b
```
-4. Commit your changes in logical chunks. Please adhere to these [git commit
+5. Commit your changes in logical chunks. Please adhere to these [git commit
message guidelines](https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
- or your code is unlikely be merged into the main project. Use Git's
+ or your code is unlikely be merged into the main project. Use Git’s
[interactive rebase](https://help.github.com/articles/about-git-rebase/)
feature to tidy up your commits before making them public.
-5. Locally merge (or rebase) the upstream development branch into your topic branch:
+6. Ensure your changes compile the dist CSS and JS files in the `dist/` directory. Verify
+ the build succeeds locally without errors.
+
+ ```bash
+ npm run dist
+ ```
+
+7. Locally merge (or rebase) the upstream development branch into your topic branch:
```bash
git pull [--rebase] upstream main
```
-6. Push your topic branch up to your fork:
+8. Commit your changes, but **do not push compiled CSS and JS files in `dist` and `js/dist`**.
+ Push your topic branch up to your fork:
```bash
git push origin
```
-7. [Open a Pull Request](https://help.github.com/articles/about-pull-requests/)
- with a clear title and description against the `main` branch.
+9. [Open a pull request](https://help.github.com/articles/about-pull-requests/)
+ with a clear title and description against the `main` branch.
**IMPORTANT**: By submitting a patch, you agree to allow the project owners to
license your work under the terms of the [MIT License](../LICENSE) (if it
@@ -209,15 +225,15 @@ includes code changes) and under the terms of the
[Adhere to the Code Guide.](https://codeguide.co/#html)
- Use tags and elements appropriate for an HTML5 doctype (e.g., self-closing tags).
-- Use CDNs and HTTPS for third-party JS when possible. We don't use protocol-relative URLs in this case because they break when viewing the page locally via `file://`.
+- Use CDNs and HTTPS for third-party JS when possible. We don’t use protocol-relative URLs in this case because they break when viewing the page locally via `file://`.
- Use [WAI-ARIA](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA) attributes in documentation examples to promote accessibility.
### CSS
[Adhere to the Code Guide.](https://codeguide.co/#css)
-- When feasible, default color palettes should comply with [WCAG color contrast guidelines](https://www.w3.org/TR/WCAG20/#visual-audio-contrast).
-- Except in rare cases, don't remove default `:focus` styles (via e.g. `outline: none;`) without providing alternative styles. See [this A11Y Project post](https://www.a11yproject.com/posts/2013-01-25-never-remove-css-outlines/) for more details.
+- When feasible, default color palettes should comply with [WCAG color contrast guidelines](https://www.w3.org/TR/WCAG/#distinguishable).
+- Except in rare cases, don’t remove default `:focus` styles (via e.g. `outline: none;`) without providing alternative styles. See [this A11Y Project post](https://www.a11yproject.com/posts/2013-01-25-never-remove-css-outlines/) for more details.
### JS
@@ -236,4 +252,4 @@ Run `npm run test` before committing to ensure your changes follow our coding st
By contributing your code, you agree to license your contribution under the [MIT License](../LICENSE).
By contributing to the documentation, you agree to license your contribution under the [Creative Commons Attribution 3.0 Unported License](https://creativecommons.org/licenses/by/3.0/).
-Prior to v3.1.0, Bootstrap's code was released under the Apache License v2.0.
+Prior to v3.1.0, Bootstrap’s code was released under the Apache License v2.0.
diff --git a/.github/INCIDENT_RESPONSE.md b/.github/INCIDENT_RESPONSE.md
new file mode 100644
index 000000000000..f3e8f5266ecb
--- /dev/null
+++ b/.github/INCIDENT_RESPONSE.md
@@ -0,0 +1,162 @@
+# Incident response plan
+
+This document describes how the Bootstrap maintainers respond to and manage security or operational incidents affecting the project, its website, or its distributed releases. This plan is public to promote transparency and community trust. Operational details (e.g., private contacts, credentials, or internal coordination tools) are maintained separately in the maintainers’ private documentation.
+
+---
+
+## 1. Purpose & Scope
+
+This plan defines how Bootstrap maintainers will:
+
+- Identify, triage, and manage security or integrity incidents affecting project code, releases, or infrastructure.
+- Communicate with the community and downstream consumers during and after an incident.
+- Record lessons learned and update processes to reduce future risk.
+
+It applies to:
+
+- The Bootstrap source code, documentation, and build pipelines.
+- Release artifacts (npm, CDN, GitHub releases).
+- The main website ([https://getbootstrap.com](https://getbootstrap.com)).
+- Any official Bootstrap GitHub organization infrastructure.
+
+It does **not** cover unrelated third-party forks or integrations.
+
+---
+
+## 2. Definitions
+
+- **Incident**: Any event that could compromise the confidentiality, integrity, or availability of Bootstrap code, releases, or users. Examples include:
+ - A discovered security vulnerability.
+ - A compromised GitHub account or CI/CD token.
+ - A malicious dependency or injected code in a release.
+ - Website defacement or unauthorized modification of documentation.
+ - Leaked secrets related to the project infrastructure.
+
+- **Incident Commander (IC)**: The maintainer responsible for coordinating the overall response.
+
+---
+
+## 3. Roles & Responsibilities
+
+| Role | Responsibilities |
+|------|-------------------|
+| **Incident Commander (IC)** | Coordinate the response, assign tasks, ensure timely communication. |
+| **Security Maintainers** | Triage reported vulnerabilities, assess impact, create fixes, handle embargoes. |
+| **Infrastructure Lead** | Manage CI/CD, website, and release infrastructure. |
+| **Communications Lead** | Manage public announcements, blog posts, and social updates. |
+| **Contributors & Community** | Promptly report suspected security issues and follow responsible disclosure guidelines. |
+
+In practice, Bootstrap’s core team fulfills these roles collectively, assigning an IC on a per-incident basis.
+
+---
+
+## 4. Incident workflow
+
+### 4.1 Detection & Reporting
+
+- All security issues should be **privately reported** via the contact method in [`SECURITY.md`](../SECURITY.md) or through GitHub’s Security Advisory mechanism.
+- Maintainers also monitor:
+ - Automated dependency scanners (e.g., Dependabot, npm audit).
+ - GitHub notifications and vulnerability alerts.
+ - Community channels for suspicious activity.
+
+### 4.2 Initial triage
+
+Upon receiving a report:
+
+1. A maintainer acknowledges receipt within 3 business days (or sooner, when possible).
+ Bootstrap is maintained by a small volunteer team; response times may vary slightly outside normal working hours.
+2. The IC assesses severity and impact:
+ - **Critical:** immediate compromise of release infrastructure or code integrity.
+ - **High:** exploitable vulnerability in distributed assets.
+ - **Medium:** minor vulnerability or low-likelihood attack vector.
+ - **Low:** informational, no direct risk.
+3. If confirmed as an incident, the IC opens a private coordination channel for maintainers and begins containment.
+
+### 4.3 Containment & Eradication
+
+- Revoke or rotate any affected credentials.
+- Disable compromised infrastructure or build pipelines if necessary.
+- Patch affected branches or dependencies.
+- Verify integrity of artifacts and releases.
+
+### 4.4 Communication
+
+- Keep the reporting party informed (when applicable).
+- For major incidents, the Communications Lead drafts a public advisory describing:
+ - What happened
+ - What was impacted
+ - How users can verify or mitigate
+ - What actions were taken
+- Communications occur after containment to avoid amplifying risk.
+
+Public disclosures are posted via:
+
+- GitHub Security Advisory if appropriate
+- [blog.getbootstrap.com/](https://blog.getbootstrap.com/)
+- [Bootstrap GitHub discussions](https://github.com/orgs/twbs/discussions)
+- [@getbootstrap](https://x.com/getbootstrap) on X (formerly Twitter) for critical security notices.
+
+### 4.5 Recovery
+
+- Validate all systems and releases are secure.
+- Resume normal operations.
+- Tag patched releases and notify affected users.
+
+### 4.6 Post-incident review
+
+Within two weeks after resolution:
+
+- Conduct an internal debrief.
+- Record:
+ - Root cause
+ - What worked / what didn’t
+ - Remediation steps
+ - Documentation or automation updates needed
+- Summarize lessons learned in the private maintainers’ wiki (with optional public summary if appropriate).
+
+---
+
+## 5. Severity levels & Response targets
+
+| Severity | Example | Target response (volunteer team) |
+|-----------|----------|----------------------------------|
+| **Critical** | Compromised release, stolen signing keys | Acknowledge ≤ 24h (best effort), containment ≤ 48h, fix ideally ≤ 14d |
+| **High** | Vulnerability enabling arbitrary code execution | Acknowledge ≤ 3 business days, fix ideally ≤ 14–21d |
+| **Medium** | XSS or content injection on docs site | Acknowledge ≤ 5 business days, fix in next release cycle |
+| **Low** | Minor issue with limited risk | Acknowledge ≤ 7 business days, fix as scheduled |
+
+**Note:** Timelines represent good-faith targets for a small volunteer core team, not hard SLAs. The maintainers will always prioritize public safety and transparency, even if timing varies.
+
+---
+
+## 6. Public disclosure principles
+
+Bootstrap follows a responsible disclosure approach:
+
+- Work privately with reporters and affected parties before publishing details.
+- Never name reporters without consent.
+- Coordinate embargo periods with downstream consumers when needed.
+- Publish advisories only after patches or mitigations are available.
+
+---
+
+## 7. Communication Channels
+
+| Purpose | Channel |
+|----------|----------|
+| Private reporting | Email address in [`SECURITY.md`](./SECURITY.md) or GitHub advisory form |
+| General updates | [blog.getbootstrap.com/](https://blog.getbootstrap.com/) blog |
+| Security advisories | GitHub Security Advisory dashboard |
+| Social alerts | [@getbootstrap](https://x.com/getbootstrap) |
+| GitHub discussion alerts | [github.com/orgs/twbs/discussions](https://github.com/orgs/twbs/discussions) |
+
+---
+
+## 8. Plan Maintenance
+
+This plan is reviewed at least annually or after any major incident. Changes are approved by the Core Team and recorded in Git history.
+
+---
+
+_The Bootstrap maintainers are committed to transparency, user trust, and continuous improvement in our security and response practices._
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 000000000000..04df74f36a56
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,38 @@
+### Description
+
+
+
+### Motivation & Context
+
+
+
+### Type of changes
+
+
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Refactoring (non-breaking change)
+- [ ] Breaking change (fix or feature that would change existing functionality)
+
+### Checklist
+
+
+
+
+- [ ] I have read the [contributing guidelines](https://github.com/twbs/bootstrap/blob/main/.github/CONTRIBUTING.md)
+- [ ] My code follows the code style of the project _(using `npm run lint`)_
+- [ ] My change introduces changes to the documentation
+- [ ] I have updated the documentation accordingly
+- [ ] I have added tests to cover my changes
+- [ ] All new and existing tests passed
+
+#### Live previews
+
+
+
+-
+
+### Related issues
+
+
diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md
index a4739f589a4f..26b3be42c5b5 100644
--- a/.github/SUPPORT.md
+++ b/.github/SUPPORT.md
@@ -6,6 +6,6 @@ See the [contributing guidelines](CONTRIBUTING.md) for sharing bug reports.
For general troubleshooting or help getting started:
-- Join [the official Slack room](https://bootstrap-slack.herokuapp.com/).
+- Ask and explore [our GitHub Discussions](https://github.com/twbs/bootstrap/discussions).
- Chat with fellow Bootstrappers in IRC. On the `irc.libera.chat` server, in the `#bootstrap` channel.
- Ask and explore Stack Overflow with the [`bootstrap-5`](https://stackoverflow.com/questions/tagged/bootstrap-5) tag.
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 000000000000..957877282f68
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,3 @@
+name: "CodeQL config"
+paths-ignore:
+ - dist
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 29135b4007e5..138a4465c7ed 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,24 +1,30 @@
version: 2
updates:
- - package-ecosystem: npm
+ - package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: weekly
day: tuesday
time: "12:00"
timezone: Europe/Athens
- open-pull-requests-limit: 10
- reviewers:
- - XhmikosR
+ groups:
+ github-actions:
+ patterns:
+ - "*"
+ - package-ecosystem: npm
+ directory: "/"
labels:
- dependencies
- v5
- versioning-strategy: increase
- rebase-strategy: disabled
- - package-ecosystem: "github-actions"
- directory: "/"
schedule:
interval: weekly
day: tuesday
time: "12:00"
timezone: Europe/Athens
+ versioning-strategy: increase
+ rebase-strategy: disabled
+ groups:
+ production-dependencies:
+ dependency-type: "production"
+ development-dependencies:
+ dependency-type: "development"
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index 5d0f45de88d1..0289984bec06 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -7,6 +7,9 @@ categories:
- title: '❗ Breaking Changes'
labels:
- 'breaking-change'
+ - title: '🚀 Highlights'
+ labels:
+ - 'release-highlight'
- title: '🚀 Features'
labels:
- 'new-feature'
diff --git a/.github/workflows/browserstack.yml b/.github/workflows/browserstack.yml
index 0a3426e80439..16bd7a914d54 100644
--- a/.github/workflows/browserstack.yml
+++ b/.github/workflows/browserstack.yml
@@ -2,24 +2,32 @@ name: BrowserStack
on:
push:
+ branches:
+ - "**"
+ - "!dependabot/**"
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
browserstack:
runs-on: ubuntu-latest
- if: github.repository == 'twbs/bootstrap' && (!contains(github.event.commits[0].message, '[ci skip]') && !contains(github.event.commits[0].message, '[skip ci]'))
+ if: github.repository == 'twbs/bootstrap'
timeout-minutes: 30
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
cache: npm
diff --git a/.github/workflows/bundlewatch.yml b/.github/workflows/bundlewatch.yml
index 14deaa97f8ff..e490be150162 100644
--- a/.github/workflows/bundlewatch.yml
+++ b/.github/workflows/bundlewatch.yml
@@ -2,14 +2,17 @@ name: Bundlewatch
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
bundlewatch:
@@ -17,10 +20,12 @@ jobs:
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
cache: npm
diff --git a/.github/workflows/calibreapp-image-actions.yml b/.github/workflows/calibreapp-image-actions.yml
new file mode 100644
index 000000000000..0f56922d3905
--- /dev/null
+++ b/.github/workflows/calibreapp-image-actions.yml
@@ -0,0 +1,32 @@
+name: Compress Images
+
+on:
+ pull_request:
+ paths:
+ - '**.jpg'
+ - '**.jpeg'
+ - '**.png'
+ - '**.webp'
+
+permissions:
+ contents: read
+
+jobs:
+ build:
+ # Only run on Pull Requests within the same repository, and not from forks.
+ if: github.event.pull_request.head.repo.full_name == github.repository
+ name: calibreapp/image-actions
+ runs-on: ubuntu-latest
+ permissions:
+ # allow calibreapp/image-actions to update PRs
+ pull-requests: write
+ steps:
+ - name: Clone repository
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
+
+ - name: Compress Images
+ uses: calibreapp/image-actions@f32575787d333b0579f0b7d506ff03be63a669d1 # v1.4.1
+ with:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2aa437417e96..2e60948fdfd2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -7,13 +7,12 @@ on:
- v4-dev
- "!dependabot/**"
pull_request:
- # The branches below must be a subset of the branches above
branches:
- main
- v4-dev
- "!dependabot/**"
schedule:
- - cron: "0 2 * * 5"
+ - cron: "0 2 * * 4"
workflow_dispatch:
jobs:
@@ -21,18 +20,25 @@ jobs:
name: Analyze
runs-on: ubuntu-latest
permissions:
- actions: read
- contents: read
security-events: write
steps:
- name: Checkout repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Initialize CodeQL
- uses: github/codeql-action/init@v1
+ uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
with:
+ config-file: ./.github/codeql/codeql-config.yml
languages: "javascript"
+ queries: +security-and-quality
+
+ - name: Autobuild
+ uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v1
+ uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+ with:
+ category: "/language:javascript"
diff --git a/.github/workflows/cspell.yml b/.github/workflows/cspell.yml
index 6787888fec89..95d69d2c6715 100644
--- a/.github/workflows/cspell.yml
+++ b/.github/workflows/cspell.yml
@@ -2,27 +2,35 @@ name: cspell
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+
+permissions:
+ contents: read
jobs:
cspell:
+ permissions:
+ # allow streetsidesoftware/cspell-action to fetch files for commits and PRs
+ contents: read
+ pull-requests: read
runs-on: ubuntu-latest
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Run cspell
- uses: streetsidesoftware/cspell-action@v1
+ uses: streetsidesoftware/cspell-action@e5a858a18b7e0b56e0342b1dcad796308b7341a2 # v8.1.1
with:
config: ".cspell.json"
- files: "**/*.md"
+ files: "**/*.{md,mdx}"
inline: error
incremental_files_only: false
diff --git a/.github/workflows/css.yml b/.github/workflows/css.yml
index 0059dc44d267..30d1d87b057d 100644
--- a/.github/workflows/css.yml
+++ b/.github/workflows/css.yml
@@ -2,14 +2,17 @@ name: CSS
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
css:
@@ -17,10 +20,12 @@ jobs:
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
cache: npm
@@ -30,3 +35,6 @@ jobs:
- name: Build CSS
run: npm run css
+
+ - name: Run CSS tests
+ run: npm run css-test
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d06105061591..7cbb3ad5b9eb 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -2,14 +2,17 @@ name: Docs
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
docs:
@@ -17,10 +20,12 @@ jobs:
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
cache: npm
@@ -37,9 +42,9 @@ jobs:
run: npm run docs-vnu
- name: Run linkinator
- uses: JustinBeckwith/linkinator-action@v1
+ uses: JustinBeckwith/linkinator-action@af984b9f30f63e796ae2ea5be5e07cb587f1bbd9 # v2.3
with:
paths: _site
recurse: true
verbosity: error
- skip: "^(?!http://localhost)"
+ skip: "^http://localhost"
diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml
new file mode 100644
index 000000000000..711ec3c7b3a1
--- /dev/null
+++ b/.github/workflows/issue-close-require.yml
@@ -0,0 +1,26 @@
+name: Close Issue Awaiting Reply
+
+on:
+ schedule:
+ - cron: "0 0 * * *"
+
+permissions:
+ contents: read
+
+jobs:
+ issue-close-require:
+ permissions:
+ # allow actions-cool/issues-helper to update issues and PRs
+ issues: write
+ pull-requests: write
+ runs-on: ubuntu-latest
+ if: github.repository == 'twbs/bootstrap'
+ steps:
+ - name: awaiting reply
+ uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3.7.4
+ with:
+ actions: "close-issues"
+ labels: "awaiting-reply"
+ inactive-day: 14
+ body: |
+ As the issue was labeled with `awaiting-reply`, but there has been no response in 14 days, this issue will be closed. If you have any questions, you can comment/reply.
diff --git a/.github/workflows/issue-labeled.yml b/.github/workflows/issue-labeled.yml
new file mode 100644
index 000000000000..55e488bedb63
--- /dev/null
+++ b/.github/workflows/issue-labeled.yml
@@ -0,0 +1,26 @@
+name: Issue Labeled
+
+on:
+ issues:
+ types: [labeled]
+
+permissions:
+ contents: read
+
+jobs:
+ issue-labeled:
+ permissions:
+ # allow actions-cool/issues-helper to update issues and PRs
+ issues: write
+ pull-requests: write
+ if: github.repository == 'twbs/bootstrap'
+ runs-on: ubuntu-latest
+ steps:
+ - name: awaiting reply
+ if: github.event.label.name == 'needs-example'
+ uses: actions-cool/issues-helper@d1d51fccf39469b5458203b1369060db0ff0c0db # v3.7.4
+ with:
+ actions: "create-comment"
+ token: ${{ secrets.GITHUB_TOKEN }}
+ body: |
+ Hello @${{ github.event.issue.user.login }}. Bug reports must include a **live demo** of the issue. Per our [contributing guidelines](https://github.com/twbs/bootstrap/blob/main/.github/CONTRIBUTING.md), please create a reduced test case on [CodePen](https://codepen.io/) or [StackBlitz](https://stackblitz.com/) and report back with your link, Bootstrap version, and specific browser and Operating System details.
diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml
index e9719000e3fd..40bb7c17b58a 100644
--- a/.github/workflows/js.yml
+++ b/.github/workflows/js.yml
@@ -2,26 +2,35 @@ name: JS Tests
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
run:
+ permissions:
+ # allow coverallsapp/github-action to create new checks issues and fetch code
+ checks: write
+ contents: read
name: JS Tests
runs-on: ubuntu-latest
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: ${{ env.NODE }}
cache: npm
@@ -36,7 +45,8 @@ jobs:
run: npm run js-test
- name: Run Coveralls
- uses: coverallsapp/github-action@1.1.3
+ uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+ if: ${{ !github.event.repository.fork }}
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
path-to-lcov: "./js/coverage/lcov.info"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 418232a66d9a..d69cbbb8d330 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,14 +2,17 @@ name: Lint
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
lint:
@@ -17,10 +20,12 @@ jobs:
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
cache: npm
diff --git a/.github/workflows/node-sass.yml b/.github/workflows/node-sass.yml
index 8a958a7a9ed4..791d1a971773 100644
--- a/.github/workflows/node-sass.yml
+++ b/.github/workflows/node-sass.yml
@@ -2,14 +2,17 @@ name: CSS (node-sass)
on:
push:
- branches-ignore:
- - "dependabot/**"
+ branches:
+ - main
pull_request:
workflow_dispatch:
env:
FORCE_COLOR: 2
- NODE: 16
+ NODE: 22
+
+permissions:
+ contents: read
jobs:
css:
@@ -17,10 +20,12 @@ jobs:
steps:
- name: Clone repository
- uses: actions/checkout@v2
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v2
+ uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
with:
node-version: "${{ env.NODE }}"
@@ -29,3 +34,16 @@ jobs:
npx --package node-sass@latest node-sass --version
npx --package node-sass@latest node-sass --output-style expanded --source-map true --source-map-contents true --precision 6 scss/ -o dist-sass/css/
ls -Al dist-sass/css
+
+ - name: Check built CSS files for Sass variables
+ shell: bash
+ run: |
+ SASS_VARS_FOUND=$(find "dist-sass/css/" -type f -name "*.css" -print0 | xargs -0 --no-run-if-empty grep -F "\$" || true)
+ if [[ -z "$SASS_VARS_FOUND" ]]; then
+ echo "All good, no Sass variables found!"
+ exit 0
+ else
+ echo "Found $(echo "$SASS_VARS_FOUND" | wc -l | bc) Sass variables:"
+ echo "$SASS_VARS_FOUND"
+ exit 1
+ fi
diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
new file mode 100644
index 000000000000..5a6c1af18c6c
--- /dev/null
+++ b/.github/workflows/publish-nuget.yml
@@ -0,0 +1,34 @@
+name: Publish NuGet Packages
+
+on:
+ release:
+ types: [published]
+
+permissions:
+ contents: read
+
+jobs:
+ package-nuget:
+ runs-on: windows-latest
+ if: ${{ github.repository == 'twbs/bootstrap' && startsWith(github.event.release.tag_name, 'v') }}
+ env:
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ steps:
+ - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
+
+ - name: Set up NuGet
+ uses: nuget/setup-nuget@323ab0502cd38fdc493335025a96c8fdb0edc71f # v2.0.1
+ with:
+ nuget-api-key: ${{ secrets.NuGetAPIKey }}
+ nuget-version: '5.x'
+
+ - name: Pack NuGet packages
+ shell: pwsh
+ run: |
+ $bsversion = $env:GITHUB_REF_NAME.Substring(1)
+ nuget pack "nuget\bootstrap.nuspec" -Verbosity detailed -NonInteractive -BasePath . -Version $bsversion
+ nuget pack "nuget\bootstrap.sass.nuspec" -Verbosity detailed -NonInteractive -BasePath . -Version $bsversion
+ nuget push "bootstrap.$bsversion.nupkg" -Verbosity detailed -NonInteractive -Source "https://api.nuget.org/v3/index.json"
+ nuget push "bootstrap.sass.$bsversion.nupkg" -Verbosity detailed -NonInteractive -Source "https://api.nuget.org/v3/index.json"
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index bbd0a2448bfa..d37d5e84120c 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -6,11 +6,18 @@ on:
- main
workflow_dispatch:
+permissions:
+ contents: read
+
jobs:
update_release_draft:
+ permissions:
+ # allow release-drafter/release-drafter to create GitHub releases and add labels to PRs
+ contents: write
+ pull-requests: write
runs-on: ubuntu-latest
if: github.repository == 'twbs/bootstrap'
steps:
- - uses: release-drafter/release-drafter@v5
+ - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 000000000000..0fe07c672b3e
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+ # For Branch-Protection check. Only the default branch is supported. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+ branch_protection_rule:
+ # To guarantee Maintained check is occasionally updated. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+ schedule:
+ - cron: '27 12 * * 2'
+ push:
+ branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+ if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+ permissions:
+ # Needed to upload the results to code-scanning dashboard.
+ security-events: write
+ # Needed to publish results and get a badge (see publish_results below).
+ id-token: write
+ # Uncomment the permissions below if installing in a private repository.
+ # contents: read
+ # actions: read
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+ # - you want to enable the Branch-Protection check on a *public* repository, or
+ # - you are installing Scorecard on a *private* repository
+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+ # Public repositories:
+ # - Publish results to OpenSSF REST API for easy access by consumers
+ # - Allows the repository to include the Scorecard badge.
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
+ # For private repositories:
+ # - `publish_results` will always be set to `false`, regardless
+ # of the value entered here.
+ publish_results: true
+
+ # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+ # file_mode: git
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # Upload the results to GitHub's code scanning dashboard (optional).
+ # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+ - name: "Upload to code-scanning"
+ uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+ with:
+ sarif_file: results.sarif
diff --git a/.gitignore b/.gitignore
index 2215d636addf..235ad54948dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,5 @@
# Ignore docs files
/_site/
-# Hugo files
-/resources/
-/.hugo_build.lock
# Numerous always-ignore extensions
*.diff
@@ -29,7 +26,6 @@
*.sublime-workspace
nbproject
Thumbs.db
-/.vscode/
# Local Netlify folder
.netlify
@@ -38,5 +34,12 @@ Thumbs.db
*.komodoproject
# Folders to ignore
+/dist-sass/
/js/coverage/
/node_modules/
+
+# Site
+/site/dist
+/site/node_modules
+/site/.astro
+/site/public
diff --git a/.prettierignore b/.prettierignore
new file mode 100644
index 000000000000..32442e87a0db
--- /dev/null
+++ b/.prettierignore
@@ -0,0 +1,12 @@
+# Prettier is only used for the website
+
+site/.astro
+site/dist
+site/public
+site/src/assets
+site/src/scss
+site/src/pages/**/*.md
+site/src/pages/**/*.mdx
+site/src/content/**/*.mdx
+site/src/layouts/RedirectLayout.astro
+site/static
diff --git a/.stylelintignore b/.stylelintignore
index 0759a69acead..b7013de7ef81 100644
--- a/.stylelintignore
+++ b/.stylelintignore
@@ -2,4 +2,5 @@
**/dist/
**/vendor/
/_site/
+/site/public/
/js/coverage/
diff --git a/.stylelintrc b/.stylelintrc
deleted file mode 100644
index 94c8ec15528b..000000000000
--- a/.stylelintrc
+++ /dev/null
@@ -1,31 +0,0 @@
-{
- "extends": [
- "stylelint-config-twbs-bootstrap"
- ],
- "rules": {
- "declaration-property-value-disallowed-list": {
- "border": "none",
- "outline": "none"
- },
- "function-disallowed-list": [
- "calc",
- "lighten",
- "darken"
- ],
- "property-disallowed-list": [
- "border-radius",
- "border-top-left-radius",
- "border-top-right-radius",
- "border-bottom-right-radius",
- "border-bottom-left-radius",
- "transition"
- ],
- "scss/dollar-variable-default": [
- true,
- {
- "ignore": "local"
- }
- ],
- "scss/selector-no-union-class-name": true
- }
-}
diff --git a/.stylelintrc.json b/.stylelintrc.json
new file mode 100644
index 000000000000..589884aae7ab
--- /dev/null
+++ b/.stylelintrc.json
@@ -0,0 +1,60 @@
+{
+ "extends": [
+ "stylelint-config-twbs-bootstrap"
+ ],
+ "reportInvalidScopeDisables": true,
+ "reportNeedlessDisables": true,
+ "overrides": [
+ {
+ "files": "**/*.scss",
+ "rules": {
+ "declaration-property-value-disallowed-list": {
+ "border": "none",
+ "outline": "none"
+ },
+ "function-disallowed-list": [
+ "calc",
+ "lighten",
+ "darken"
+ ],
+ "property-disallowed-list": [
+ "border-radius",
+ "border-top-left-radius",
+ "border-top-right-radius",
+ "border-bottom-right-radius",
+ "border-bottom-left-radius",
+ "transition"
+ ],
+ "scss/dollar-variable-default": [
+ true,
+ {
+ "ignore": "local"
+ }
+ ],
+ "scss/selector-no-union-class-name": true
+ }
+ },
+ {
+ "files": "scss/**/*.{test,spec}.scss",
+ "rules": {
+ "scss/dollar-variable-default": null,
+ "declaration-no-important": null
+ }
+ },
+ {
+ "files": "site/**/*.scss",
+ "rules": {
+ "scss/dollar-variable-default": null
+ }
+ },
+ {
+ "files": "site/**/examples/**/*.css",
+ "rules": {
+ "comment-empty-line-before": null,
+ "property-no-vendor-prefix": null,
+ "selector-no-qualifying-type": null,
+ "value-no-vendor-prefix": null
+ }
+ }
+ ]
+}
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
new file mode 100644
index 000000000000..bc5df00e1618
--- /dev/null
+++ b/.vscode/extensions.json
@@ -0,0 +1,10 @@
+{
+ "recommendations": [
+ "astro-build.astro-vscode",
+ "dbaeumer.vscode-eslint",
+ "EditorConfig.EditorConfig",
+ "hossaini.bootstrap-intellisense",
+ "streetsidesoftware.code-spell-checker",
+ "stylelint.vscode-stylelint"
+ ]
+}
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 000000000000..9c6ae2d622a3
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,10 @@
+{
+ "editor.codeActionsOnSave": {
+ "source.fixAll.eslint": "explicit",
+ "source.fixAll.stylelint": "always"
+ },
+ "editor.renderWhitespace": "all",
+ "scss.validate": false,
+ "stylelint.enable": true,
+ "stylelint.validate": ["scss"]
+}
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 5c6a4e727cd4..756298316059 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -2,42 +2,131 @@
## Our Pledge
-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
## Our Standards
-Examples of behavior that contributes to creating a positive environment include:
+Examples of behavior that contributes to a positive environment for our
+community include:
-- Using welcoming and inclusive language
-- Being respectful of differing viewpoints and experiences
-- Gracefully accepting constructive criticism
-- Focusing on what is best for the community
-- Showing empathy towards other community members
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+ and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+ community
-Examples of unacceptable behavior by participants include:
+Examples of unacceptable behavior include:
-- The use of sexualized language or imagery and unwelcome sexual attention or advances
-- Trolling, insulting/derogatory comments, and personal or political attacks
+- The use of sexualized language or imagery, and sexual attention or advances of
+ any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
- Public or private harassment
-- Publishing others' private information, such as a physical or electronic address, without explicit permission
-- Other conduct which could reasonably be considered inappropriate in a professional setting
+- Publishing others’ private information, such as a physical or email address,
+ without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+ professional setting
-## Our Responsibilities
+## Enforcement Responsibilities
-Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
-Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
## Scope
-This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
## Enforcement
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at mdo@getbootstrap.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+mdo@getbootstrap.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
-Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
## Attribution
-This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 1.4, available at
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
diff --git a/LICENSE b/LICENSE
index dda75ca9a5bb..fa7c00bc4ebd 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,7 +1,6 @@
The MIT License (MIT)
-Copyright (c) 2011-2022 Twitter, Inc.
-Copyright (c) 2011-2022 The Bootstrap Authors
+Copyright (c) 2011-2025 The Bootstrap Authors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
diff --git a/README.md b/README.md
index cf2e31111f31..e3618e643e5c 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
+ 