Repository navigation
Upgrade Bootstrap 4.5.3 → 5.3.8 in BFF and various samples - #411
Merged
Merged
Conversation
Resolves js/xss-through-dom code scanning alerts in vendored Bootstrap 4.x. - Replace vendored Bootstrap 4.5.3 (lib/bootstrap and FrontendHost libs/) with the official 5.3.8 dist, mirroring the existing file sets. - Migrate Razor/HTML markup: form-group -> mb-3, form-label, data-bs-*, me-auto, navbar container-fluid, badge bg-*, btn-block -> d-grid, form-inline -> flex utilities, btn class on Create button. - Remove jQuery copies that were only loaded for Bootstrap 4. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Restore responsive wrapping and control sizing in all eleven affected add-todo forms before approval.
11 open issues
What changed in this PR
Upgrades Bootstrap 4.5.3 to 5.3.8 across affected BFF v2–v4 and Owin samples to address vendored-library XSS scanning alerts, with corresponding markup migration and jQuery removal.
Changes:
- Update vendored Bootstrap assets, licenses, and documentation.
- Migrate forms, navigation, badges, buttons, and modal attributes to Bootstrap 5.
- Remove redundant jQuery dependencies and rename custom todo-form selectors.
Unresolved findings: Eleven frontend pages have a moderate responsive-layout regression at line 34: replacing .form-inline with d-flex removes wrapping and causes horizontal overflow on narrow screens. Restore wrapping and auto-size the controls in each affected page.
| File | Description |
|---|---|
various/clients/Owin/IdentityServerHost/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
various/clients/Owin/IdentityServerHost/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
various/clients/Owin/IdentityServerHost/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
various/clients/Owin/IdentityServerHost/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
various/clients/Owin/IdentityServerHost/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
various/clients/Owin/IdentityServerHost/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
various/clients/Owin/IdentityServerHost/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
various/clients/Owin/IdentityServerHost/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
various/clients/Owin/IdentityServerHost/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
various/clients/Owin/IdentityServerHost/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
various/clients/Owin/IdentityServerHost/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v4/SplitHosts/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v4/SplitHosts/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/ServerSideSessions/Index.cshtml |
Migrate filter-row spacing. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Account/Create/Index.cshtml |
Migrate registration spacing and labels. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/Views/Index.cshtml |
Migrate navbar, badges, and buttons; remove jQuery. |
BFF/v4/JsBffYarpSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v4/JsBffYarpSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v4/JsBffSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v4/JsBffSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v4/docker/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v4/docker/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/lib/bootstrap/README.md |
Refresh Bootstrap documentation. |
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/ServerSideSessions/Index.cshtml |
Migrate filter-row spacing. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v4/docker/ContainerizedIdentityServer/Pages/Account/Create/Index.cshtml |
Migrate registration spacing and labels. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v3/SplitHosts/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v3/SplitHosts/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v3/JsBffYarpSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v3/JsBffYarpSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v3/JsBffSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v3/JsBffSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v3/docker/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v3/docker/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v3/docker/ContainerizedIdentityServer/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v3/docker/ContainerizedIdentityServer/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v3/docker/ContainerizedIdentityServer/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v3/docker/ContainerizedIdentityServer/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/ServerSideSessions/Index.cshtml |
Migrate filter-row spacing. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v3/docker/ContainerizedIdentityServer/Pages/Account/Create/Index.cshtml |
Migrate registration spacing and labels. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/README.md |
Remove jQuery documentation. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/jquery/LICENSE.txt |
Remove jQuery license. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/LICENSE |
Update Bootstrap license. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/lib/bootstrap/dist/css/bootstrap-reboot.min.css |
Upgrade Reboot CSS. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Nav.cshtml |
Migrate navbar and dropdown markup. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Shared/_Layout.cshtml |
Remove jQuery include. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Device/Index.cshtml |
Migrate form spacing and labels. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml |
Migrate consent spacing. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml |
Migrate CIBA consent spacing. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Logout/Index.cshtml |
Migrate logout spacing. |
BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Account/Login/Index.cshtml |
Migrate login spacing and labels. |
BFF/v2/SplitHosts/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v2/SplitHosts/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v2/JsBffYarpSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v2/JsBffYarpSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
BFF/v2/JsBffSample/FrontendHost/wwwroot/StyleSheet.css |
Rename todo-form selectors. |
BFF/v2/JsBffSample/FrontendHost/wwwroot/index.html |
Migrate form/modal; remove jQuery. Moderate: wrapping regression at line 34. |
Review effort: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The consistent Bootstrap 5 migration has no unresolved blocking findings, and reported build and browser checks support compatibility.
No open issues 🎉
11 resolved since last review
Review effort: Balanced
maartenba
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the
js/xss-through-domcode scanning alerts in vendored Bootstrap 4.x underBFF/andvarious/.Changes
BFF/v{2,3,4}/TokenExchange/TokenExchange.IdentityServer,BFF/v{3,4}/docker/ContainerizedIdentityServer,BFF/v4/MultiFrontendSSO/MultiFrontendSSO.{Client,IdentityServer},various/clients/Owin/IdentityServerHostFrontendHost/wwwroot/libsinBFF/v{2,3,4}/{JsBffSample,JsBffYarpSample,SplitHosts}andBFF/v{3,4}/dockerform-group→mb-3(row mb-3),form-labelon labels,data-toggle/data-dismiss→data-bs-*,mr-auto→me-auto, navbar innercontainer-fluid,badge-*→bg-*,btn-block→d-grid,form-inline→ flex utilities (custom CSS renamed to.todo-form), added the missingbtnclass to the Create button (BS5 needs it for colours).lib/jquery,libs/jquery-3.6.0.min.js) from these hosts. It was only loaded for Bootstrap 4, and nothing else references it now.Not changed
Mvc/WebFormsalready use Bootstrap 5.x.DPoP.Bff,TokenExchange.BffandOpenApi.Bffuse Bootstrap 3.x, so they're outside the 4.x upgrade scope.bootstrap4-glyphiconsis a standalone icon font and still used, so I kept it.Validation
dotnet buildpasses for all 19 affected projects.BFF/orvarious/.