What Changed
In v24.2, we updated the Bootstrap version from 4 to 5 in ASP.NET Bootstrap applications. When you create a new Bootstrap Web Site project, it has a reference to Bootstrap v5 by default.
Reasons for Change
In previous versions, the DevExpress ASP.NET Bootstrap controls referenced Bootstrap v4. The Bootstrap v4.0 - v4.6.2 is affected by the following vulnerability: Bootstrap Cross-Site Scripting (XSS) vulnerability. Note that the DevExpress controls do not use Bootstrap scripts, however, you can use JavaScript Bootstrap in other parts of your applications. The vulnerability was addressed in v5.0, so we updated Bootstrap to this version in our templates.
Impact on Existing Apps
If the bootstrap mode setting was set to v4 in the project Web.Config file, the ASP.NET Bootstrap components work as expected, however, your Bootstrap application may have Bootstrap Cross-Site Scripting (XSS) vulnerability.
If you did not specify the bootstrap mode setting, the Bootstrap components may render incorrectly.
How to Update Existing Apps
We recommend that you update Bootstrap files to v5 and set the bootstrap mode setting to Bootstrap5
in the project's Web.Config file:
HTML<configuration>
...
<devExpress>
<bootstrap mode="Bootstrap5" />
</devExpress>
...
</configuration>
Refer to Bootstrap Framework Version for more information.