Breaking Change T1253095
Visible to All Users

Bootstrap Controls - Bootstrap default version is updated from 4 to 5

What Changed

In v24.2, we updated the Bootstrap version from 4 to 5 in ASP.NET Bootstrap applications. When you create a new Bootstrap Web Site project, it has a reference to Bootstrap v5 by default.

Reasons for Change

In previous versions, the DevExpress ASP.NET Bootstrap controls referenced Bootstrap v4. The Bootstrap v4.0 - v4.6.2 is affected by the following vulnerability: Bootstrap Cross-Site Scripting (XSS) vulnerability. Note that the DevExpress controls do not use Bootstrap scripts, however, you can use JavaScript Bootstrap in other parts of your applications. The vulnerability was addressed in v5.0, so we updated Bootstrap to this version in our templates.

Impact on Existing Apps

If the bootstrap mode setting was set to v4 in the project Web.Config file, the ASP.NET Bootstrap components work as expected, however, your Bootstrap application may have Bootstrap Cross-Site Scripting (XSS) vulnerability.

If you did not specify the bootstrap mode setting, the Bootstrap components may render incorrectly.

How to Update Existing Apps

We recommend that you update Bootstrap files to v5 and set the bootstrap mode setting to Bootstrap5 in the project's Web.Config file:

HTML
<configuration> ... <devExpress> <bootstrap mode="Bootstrap5" /> </devExpress> ... </configuration>

Refer to Bootstrap Framework Version for more information.

Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.