Gathering detailed insights and metrics for bootstrap-vue
Gathering detailed insights and metrics for bootstrap-vue
BootstrapVue provides one of the most comprehensive implementations of Bootstrap v4 for Vue.js. With extensive and automated WAI-ARIA accessibility markup.
Installations
npm install bootstrap-vueDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Node Version
17.1.0
NPM Version
8.1.2
Score
81.3
Supply Chain
96.2
Quality
80.4
Maintenance
50
Vulnerability
99.6
License
Releases
107
Languages
3
JavaScript
SCSS
Shell
JavaScript (97.84%)
SCSS (2.03%)
Shell (0.13%)
Developer
Download Statistics
Total Downloads
96,347,715
Last Day
7,206
Last Week
191,002
Last Month
842,174
Last Year
12,206,087
GitHub Statistics
MIT License
14,517 Stars
5,424 Commits
1,878 Forks
284 Watchers
9 Branches
345 Contributors
Updated on Jun 20, 2025
Bundle Size
1.10 MB
Minified
255.49 kB
Minified + Gzipped
Maintainers
4
Package Meta Information
Latest Version
2.23.1
Package Id
bootstrap-vue@2.23.1
Unpacked Size
46.99 MB
Size
8.60 MB
File Count
1,134
NPM Version
8.1.2
Node Version
17.1.0
Total Downloads
Cumulative downloads
Total Downloads
96,347,715
Dev Dependencies
68
@babel/cli@babel/core@babel/plugin-transform-modules-commonjs@babel/plugin-transform-runtime@babel/preset-env@babel/standalone@nuxt/content@nuxtjs/google-analytics@nuxtjs/pwa@nuxtjs/robots@nuxtjs/sitemap@testing-library/jest-dom@vue/compat@vue/compiler-dom@vue/test-utils@vue/test-utils-vue3autoprefixerbabel-corebabel-eslintbabel-jestbabel-plugin-istanbulbootstrap-iconsbundlewatchclean-css-clicodemirrorcodesandboxcore-jscross-enveslinteslint-config-prettiereslint-config-standardeslint-config-vueeslint-plugin-importeslint-plugin-jesteslint-plugin-markdowneslint-plugin-nodeeslint-plugin-prettiereslint-plugin-promiseeslint-plugin-vueexecahighlight.jshtml-loaderhuskyimproved-yarn-auditjestjitilint-stagedloader-utilslodashmarkednuxtpostcsspostcss-cliprettierrequire-contextrolluprollup-plugin-babelrollup-plugin-commonjsrollup-plugin-node-resolvesasssass-loaderstandard-versionterservuevue-routervue-server-renderervue-template-compilervue-test-utils-compat
With more than 85 components, over 45 available plugins, several directives, and 1000+ icons, BootstrapVue provides one of the most comprehensive implementations of the Bootstrap v4.5 component and grid system available for Vue.js v2.6, complete with extensive and automated WAI-ARIA accessibility markup.
Links
Sponsors
Support this project by becoming a sponsor.
Your logo will show up here with a link to your website. [Become a sponsor]
Backers
Thank you to all our backers! 🙏 [Become a backer]
Contributors
This project exists thanks to all the people who contribute. [Contribute].
Partners
License
Released under the MIT License. Copyright (c) BootstrapVue.
High
0/10
Summary
Cross-Site Scripting in bootstrap-vue
Affected Versions
<= 2.0.0-rc.11
Patched Versions
2.0.0-rc.12
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/build.yml:14
- Info: topLevel 'contents' permission set to 'read': .github/workflows/docs-deploy.yml:14
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:14
- Info: no jobLevel write permissions found
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 8/14 approved changesets -- score normalized to 5
Reason
SAST tool is not run on all commits -- score normalized to 5
Details
- Warn: 14 commits out of 25 are checked with a SAST tool
Reason
badge detected: InProgress
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/build.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/build.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/build.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-deploy.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/docs-deploy.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/bootstrap-vue/bootstrap-vue/test.yml/dev?enable=pin
- Info: 0 out of 18 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
41 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-4w2v-q235-vp99
- Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-vc8w-jr9v-vj7f
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
- Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-5v2h-r2cx-5xgj
- Warn: Project is vulnerable to: GHSA-rrrm-qjm4-v8hf
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-vf6r-87q4-2vjf
- Warn: Project is vulnerable to: GHSA-8g77-54rh-46hx
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-325j-24f4-qv5x
- Warn: Project is vulnerable to: GHSA-vx3p-948g-6vhq
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-5j4c-8p2g-v4jx
- Warn: Project is vulnerable to: GHSA-g3ch-rx76-35fx
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Score
6.4
/10
Last Scanned on 2025-06-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More