Bootstrap 5 Components

Fixed

• Links — external link targets set by editors (button externalLink, jnt:externalLink menu items in the multilevel and legacy navbar views) are now checked by the new b5:safeUrl function: only relative URLs and the http, https, mailto and tel schemes are kept, anything else (javascript:, data:, vbscript:, ftp:…) becomes #. HTML escaping alone kept these values inside the href but still let a javascript: link run when clicked. A button whose link is rejected renders disabled in live mode and shows the "no URL" badge in edit mode
• Navbar login — the logged-in username in the login menu is now escaped
• Carousel — without bootstrap5mix:carouselAdvancedSettings, the carousel rendered data-bs-wrap="false" and stopped at the last slide: the wrap default was set under a ${empty ride} test instead of ${empty wrap}. It now wraps, which is the Bootstrap default. Carousels that set wrap explicitly are unchanged

Added

• Tests — JUnit 5 tests for bootstrap5-components, run by mvn package: the b5: EL functions, the choicelist initializers, and the consistency between definitions.cnd, bootstrap5-components.tld and the Java classes they name (FunctionsTest, ChoiceInitializersTest, ModuleDescriptorsTest)

Behaviour change: carousels without Advanced settings now wrap after the last slide (Bootstrap default); before, they stopped.

Full changelog: bootstrap5-modules-2.4.6...bootstrap5-modules-2.4.7

Fixed

• Navbar login — the modal "Close" button rendered ???bootstrap5nt_navbar.label.close???: the key introduced in 2.4.5 was missing from every resource bundle. Added it in all six languages
• Grid — the section style attribute is now escaped, aligning it with the sibling id, class, role and aria-label attributes on the same tag
• Card — the cssClass, cardHeaderCssClass and cardBodyCssClass values from bootstrap5mix:cardAdvancedSettings are now escaped
• Navbar — navClass, brandLinkClass, togglerClass and divClass are now escaped in the wrapper view; ulClass, liClass and navLinkClass in the legacy JSP view; loginMenuULClass in the login view
• Navbar multilevel (Groovy) — CSS class properties, menu item titles and menu item URLs are now escaped before interpolation; attributes there are single-quoted, so the escaping covers ' as well
• Privacy settings modal — the cssClass and htmlId values are now escaped
• Stored XSS in views — plain-text and CSS class values set by editors were written into the HTML without escaping, so a value containing markup was rendered as markup. They are now escaped in button (title, modal title, close text, cssClass, style, size, state, modalSize, direction, placement, external link href), carousel item (title, caption, carouselItemClass, colours), carousel (carouselClass), card (title, footer, colours, alignment), accordion and tabs (item titles), custom and predefined grids (column classes, level), navbar (brandText, breakpoint class; titles and URLs in the legacy JSP view), breadcrumb (cssClass), figure (captionAlignment), pagination (layout, align), alert skin (backgroundColor), margin/padding classes, the privacy settings modal labels, and the page <title> of both starter templates. Rich text (bootstrap5mix:text) is still rendered as HTML
• Grid / Card — sectionElement and headerSize are used as tag names; values outside the choicelist now fall back to div
• i18n — English labels containing an em dash (padding/margin sizes, carousel variant, absolute areas level, container/section/row ID tooltips, image settings) rendered as â plus two control characters: the build reads .properties as ISO-8859-1, so the raw UTF-8 — in bootstrap5-components.properties was mangled. The character is now escaped as \u2014, like in the other bundles

Updated

• Build \u2014 bootstrap5-core now runs npm ci instead of npm install, so the bundled Bootstrap assets always match package-lock.json
• Build \u2014 removed the unused optional icu4j dependency from bootstrap5-components, and the <version> redundant with the parent in bootstrap5-components and bootstrap5-templates-starter

The bootstrap5-components bundle is now about 0.45 MB instead of 13.8 MB: the unused icu4j jar was embedded in it.

Full changelog: bootstrap5-modules-2.4.5...bootstrap5-modules-2.4.6

Added

• Navbar — third-level pages now render as Bootstrap 5 dropend submenus (.dropend + .submenu.dropdown-menu), supported in both the Groovy multilevel renderer and the legacy JSP view

Fixed

• Accordion — aria-expanded was hardcoded to "true"; now reflects actual open/closed state
• Breadcrumb — aria-label moved from <ol> to the wrapping <nav> element (WCAG 4.1.2); non-navigable items replaced <a href="#"> with <span> to remove dead links
• Button — removed invalid role="button" from <a> elements; modal trigger gains aria-haspopup="dialog" and aria-modal="true"; collapse trigger exposes dynamic aria-expanded; offcanvas uses conditional aria-labelledby/aria-label; disabled state uses <button disabled> instead of <a href="#">
• Carousel — indicators converted from <ol>/<li> to <div>/<button> with aria-label="Slide N" and aria-current="true"; prev/next controls converted to <button> with data-bs-target; outer div gains aria-roledescription="carousel" and aria-label; pause/play toggle added
• CarouselItem — added alt text, aria-roledescription="slide", and aria-label per slide; caption visible to AT on all viewports
• Navbar login — duplicate input id attributes eliminated; visually-hidden <label> elements added; login trigger converted from <a role="button"> to <button>; all decorative SVGs gain aria-hidden="true" focusable="false"
• Navbar multilevel (Groovy) — aria-current="page" on active links replaces the deprecated visually-hidden span; dropend toggle includes href, data-bs-toggle, aria-expanded, and id; submenu <ul> gains aria-labelledby
• Navbar multilevel (JSP) — aria-current="page" on active links; removed aria-haspopup="true" from dropdown toggles; removed invalid aria-labelledby from <div class="dropdown-menu">
• Navbar wrapper — aria-hidden="true" on toggler icon span; conditional alt on brand image
• Pagination — wrapped <ul class="pagination"> in <nav aria-label="Pagination">; numbered links gain aria-label="Page N"; active item gains aria-current="page"
• Privacy settings modal — converted BS4 tab markup to BS5 (data-bs-toggle; <button> tabs); aria-modal="true", aria-labelledby, and tabindex="-1" on modal; tab panels gain aria-labelledby and tabindex="0"; duplicate id (#privacyTabs_…) corrected
• Tabs — aria-selected leading-space typo fixed; tabindex added to tab buttons and panels; aria-label on tablist; aria-labelledby on tab panels

Full changelog: https://github.com/Jahia/bootstrap5/blob/2_X/CHANGELOG.md

🔼 Bootstrap updated: 5.3.7 → 5.3.8

Minor Bootstrap update including upstream bug fixes.

🐛 Bug fixes

• Language switcher — removed redundant/deprecated aria-owns attribute
• Login dropdown — duplicate class attribute on the Logout link (the logout class was silently ignored by the browser)
• Navbar — dropdown menus overflowing the viewport when the navbar is not inside a Bootstrap container
• Figure — missing fn taglib causing a JSP compilation error
• CarouselItem — Bootstrap 3 markup used in edit mode, replaced with Bootstrap 5
• Offcanvas — undefined ${visibility} variable generating an invalid HTML attribute
• Carousel — undefined ${carouselCaptionClass} variable
• Navbar — typo brandImageMobileeUrl (double e) preventing mobile brand image from rendering
• Navbar — wrong i18n key bootstrap5nt_navbarnavbar for the language switcher aria-label
• Margin mixin — wrong package declaration in margin.margin.groovy

📖 Documentation

• Fixed inconsistencies between markdown documentation and CND definitions (button, navbar, grid)
• Documented navbar brand resolution behaviour (site node vs local component)
• Added Javadoc to initializer classes (ButtonTypeInitializer, GridTypeInitializer, NavbarRootInitializer)
• Added JSDoc to multilevel-nav.js

Full Changelog: bootstrap5-modules-2.4.3...bootstrap5-modules-2.4.4

Updated all Bootstrap assets to version 5.3.7

Enhancements

• Pagination Placeholder in Edit Mode
  Added a placeholder message for empty pagination components when in edit mode. This improves UX by making the component’s presence visible even when no items are available.

New Features

• Improved documentation:
  • Added a new section in docs/text.md describing how to use the bootstrap5mix:text mixin in custom definitions, including how to display its value in JSP.
• Compatibility updates for Jahia 8.2:
  • The bootstrap5-package module was enhanced to properly support Jahia 8.2:
  • Added Jahia-Required-Version: 8.2.0.0 to the manifest.
  • Included a dependency on the skins module (org.jahia.modules:skins:8.2.0).
  • Improved configuration of the maven-assembly-plugin and maven-dependency-plugin to ensure valid and complete package generation.

Dependency Updates

• Updated all Bootstrap assets to version 5.3.6:
• This includes .css, .min.css, .rtl.css, and .js files across the core module.
• View all changes here: https://github.com/twbs/bootstrap/releases/tag/v5.3.6

Compatibility Notice

• This version requires Jahia 8.2 or higher.
• All dependencies on Spring Framework have been removed to simplify the codebase and eliminate unused dependencies.

New Features

• Enhanced Navbar Customization
• Introduced two new configurable properties:
  • liClass: defines the CSS class for each <li> item in the navbar (default: nav-item).
  • navLinkClass: defines the CSS class for each <a> link in the navbar (default: nav-link).
• These properties are available through the bootstrap5mix:customizeNavbar mixin and supported in both JSP and Groovy-based views.
• Improved CKEditor Integration
• Added “Remove Format” button to clear inline formatting.
• Introduced a custom “Wash” button to clean up pasted HTML (e.g., from MS Word), removing unnecessary tags and styles.
• Integrated purify.min.js and beautify-html.min.js to sanitize and beautify content.

Enhancements

• Refactored navbar.basenav-multilevel.groovy
• Simplified rendering logic with reusable helper methods.
• Improved readability and maintainability of the recursive menu generation.
• Enhanced support for jnt:page, jnt:nodeLink, and jnt:externalLink menu items.
• Security & Compatibility
• Added a safety check in ckconfig.js to prevent errors when accessing combo_inlinestyles if the UI component is not present in CKEditor.

Documentation

• Updated docs/navbar.md to describe the new customizable navbar properties.
• Updated docs/text.md and replaced text.png to reflect the new CKEditor toolbar with format-cleaning options.

• Add new tab type "underline"
• Add missing resource for permissions
• Update assets to Bootstrap v5.3.3
   

• Update assets to Bootstrap 5.3.1
• Improvements on CKEditor configuration
• Enhance the documentation

Fix the remember me login feature

• Prevent redirect issue on login
• Adding jmix:accessControllableContent as a parent to the components'category, to generate permission for this category
• Only load jQuery + multilevel assets if needed

Starting with version 2.2.0, the bootstrap5-core bundle no longer provides mappings for assets.

Update assets to v5.2.3

Set the tab name as the URL fragment when clicking on a tab

Update assets to v5.2.2

Update assets to v5.2.1

Update assets to v5.2.0

Rename some initializers for a better cohabitation with Bootstrap 4

• Update assets to v5.2.0-beta1
• Keep "row" string in custom row class name
• Remove jQuery dependency on tabs
• Use buttons for tabs

Change versions to 2.0.x so the version for Jahia 8 is bigger than Jahia 7 version.

This release has the same features and the same code as v1.0.8

Changelog:

• Bootstrap5-core bundle no longer provides mappings for assets (QA-14549)
• Update assets to v5.2.3
• Set the tab name as the URL fragment when clicking on a tab
• Keep "row" string in custom row class name
• Remove jQuery dependency on tabs
• Use buttons for tabs

About the mappings for assets

Starting with version 1.2.0, the bootstrap5-core bundle no longer provides mappings for assets. This means that you will need to ensure that all of your views use one of the following resources for a Bootstrap 5 project:

• bootstrap.min.css
• bootstrap.bundle.min.js

If you suspect that your code or some third-party bundles are still using uncompressed resources such as bootstrap.css or bootstrap.js, and even popper.js or popper.min.js, you may need to add the following mappings in a spring file:

<bean class="org.jahia.services.render.StaticAssetMapping">
    <property name="mapping">
        <map>
            <entry key="bootstrap.css" value="bootstrap.min.css"/>
            <entry key="bootstrap.js" value="bootstrap.bundle.min.js"/>
            <entry key="bootstrap.min.js" value="bootstrap.bundle.min.js"/>
            <entry key="popper.js" value="bootstrap.bundle.min.js"/>
            <entry key="popper.min.js" value="bootstrap.bundle.min.js"/>
        </map>
    </property>
</bean>

For best practice, it is recommended to use the following code when adding Bootstrap 5 resources to your templates:

<template:addResources type="css" resources="bootstrap.min.css"/>
<template:addResources type="javascript" resources="bootstrap.bundle.min.js" targetTag="${renderContext.editMode?'head':'body'}"/>

Full Changelog: bootstrap5-modules-1.1.2...bootstrap5-modules-1.2.0

Rename the pagesandfiles picker to pagesandfiles5 to avoid conflicts with Bootstrap 4

Upgrade assets to Bootstrap v5.1.3

New release for Jahia 7.3

Rename the pagesandfiles picker to pagesandfiles5 to avoid conflicts with Bootstrap 4

Upgrade assets to Bootstrap v5.1.3

Update Bootstrap 5 assets to v5.1.1

Update Bootstrap 5 assets to v5.1.0

• Fixes on Navmenu: status of the page, title for nodeLink, prevent duplicate IDs for more than 1 navigation menu is used on the same page
• Add a Bootstrap5 view for the privacySettingsModal

• Add new property to set Class(es) to set on the Card Header
• Workaround for QA-13750 (resources set to body with targetTag are not loaded; set to head on edit mode)

Update assets to v5.0.1. Check full change log at https://github.com/twbs/bootstrap/releases/tag/v5.0.1