Gathering detailed insights and metrics for bootstrap
Gathering detailed insights and metrics for bootstrap
The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.
Installations
npm install bootstrapDeveloper
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
Typescript Support
No
Node Version
20.11.1
NPM Version
10.2.4
Statistics
170,961 Stars
22,917 Commits
78,891 Forks
6,724 Watching
108 Branches
1,392 Contributors
Updated on 28 Nov 2024
Languages
JavaScript (37.5%)
HTML (33.79%)
SCSS (15.76%)
CSS (12.91%)
PowerShell (0.04%)
Total Downloads
Cumulative downloads
Total Downloads
1,161,330,185
Last day
-3.5%
838,046
Compared to previous day
Last week
1.5%
4,726,643
Compared to previous week
Last month
5.9%
20,114,479
Compared to previous month
Last year
-11.3%
239,434,425
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
1
Dev Dependencies
49
ipsasskarmaeslintglobbyjqueryrolluprtlcssterserjasminenodemonpostcssshelljsvnu-jarhugo-bincross-envsass-truestylelint@babel/cli@babel/corebundlewatchpostcss-cliautoprefixernpm-run-all2clean-css-clikarma-jasminelockfile-lint@popperjs/coreeslint-config-xohammer-simulator@babel/preset-enveslint-plugin-html@rollup/plugin-babeleslint-plugin-importeslint-plugin-unicornkarma-chrome-launcherkarma-detect-browsers@rollup/plugin-replaceeslint-plugin-markdownkarma-firefox-launcherrollup-plugin-istanbul@rollup/plugin-commonjskarma-rollup-preprocessorfind-unused-sass-variables@rollup/plugin-node-resolvekarma-browserstack-launcherkarma-jasmine-html-reporterstylelint-config-twbs-bootstrapkarma-coverage-istanbul-reporter
Versions
Bootstrap
Sleek, intuitive, and powerful front-end framework for faster and easier web development.
Explore Bootstrap docs »
Report bug
·
Request feature
·
Themes
·
Blog
Bootstrap 5
Our default branch is for development of our Bootstrap 5 release. Head to the v4-dev branch to view the readme, documentation, and source code for Bootstrap 4.
Table of contents
- Quick start
- Status
- What's included
- Bugs and feature requests
- Documentation
- Contributing
- Community
- Versioning
- Creators
- Thanks
- Copyright and license
Quick start
Several quick start options are available:
- Download the latest release
- Clone the repo:
git clone https://github.com/twbs/bootstrap.git - Install with npm:
npm install bootstrap@v5.3.3 - Install with yarn:
yarn add bootstrap@v5.3.3 - Install with Composer:
composer require twbs/bootstrap:5.3.3 - Install with NuGet: CSS:
Install-Package bootstrapSass:Install-Package bootstrap.sass
Read the Getting started page for information on the framework contents, templates, examples, and more.
Status
What's included
Within the download you'll find the following directories and files, logically grouping common assets and providing both compiled and minified variations.
Download contents
1bootstrap/ 2├── css/ 3│ ├── bootstrap-grid.css 4│ ├── bootstrap-grid.css.map 5│ ├── bootstrap-grid.min.css 6│ ├── bootstrap-grid.min.css.map 7│ ├── bootstrap-grid.rtl.css 8│ ├── bootstrap-grid.rtl.css.map 9│ ├── bootstrap-grid.rtl.min.css 10│ ├── bootstrap-grid.rtl.min.css.map 11│ ├── bootstrap-reboot.css 12│ ├── bootstrap-reboot.css.map 13│ ├── bootstrap-reboot.min.css 14│ ├── bootstrap-reboot.min.css.map 15│ ├── bootstrap-reboot.rtl.css 16│ ├── bootstrap-reboot.rtl.css.map 17│ ├── bootstrap-reboot.rtl.min.css 18│ ├── bootstrap-reboot.rtl.min.css.map 19│ ├── bootstrap-utilities.css 20│ ├── bootstrap-utilities.css.map 21│ ├── bootstrap-utilities.min.css 22│ ├── bootstrap-utilities.min.css.map 23│ ├── bootstrap-utilities.rtl.css 24│ ├── bootstrap-utilities.rtl.css.map 25│ ├── bootstrap-utilities.rtl.min.css 26│ ├── bootstrap-utilities.rtl.min.css.map 27│ ├── bootstrap.css 28│ ├── bootstrap.css.map 29│ ├── bootstrap.min.css 30│ ├── bootstrap.min.css.map 31│ ├── bootstrap.rtl.css 32│ ├── bootstrap.rtl.css.map 33│ ├── bootstrap.rtl.min.css 34│ └── bootstrap.rtl.min.css.map 35└── js/ 36 ├── bootstrap.bundle.js 37 ├── bootstrap.bundle.js.map 38 ├── bootstrap.bundle.min.js 39 ├── bootstrap.bundle.min.js.map 40 ├── bootstrap.esm.js 41 ├── bootstrap.esm.js.map 42 ├── bootstrap.esm.min.js 43 ├── bootstrap.esm.min.js.map 44 ├── bootstrap.js 45 ├── bootstrap.js.map 46 ├── bootstrap.min.js 47 └── bootstrap.min.js.map
We provide compiled CSS and JS (bootstrap.*), as well as compiled and minified CSS and JS (bootstrap.min.*). Source maps (bootstrap.*.map) are available for use with certain browsers' developer tools. Bundled JS files (bootstrap.bundle.js and minified bootstrap.bundle.min.js) include Popper.
Bugs and feature requests
Have a bug or a feature request? Please first read the issue guidelines and search for existing and closed issues. If your problem or idea is not addressed yet, please open a new issue.
Documentation
Bootstrap's documentation, included in this repo in the root directory, is built with Hugo and publicly hosted on GitHub Pages at https://getbootstrap.com/. The docs may also be run locally.
Documentation search is powered by Algolia's DocSearch.
Running documentation locally
- Run
npm installto install the Node.js dependencies, including Hugo (the site builder). - Run
npm run test(or a specific npm script) to rebuild distributed CSS and JavaScript files, as well as our docs assets. - From the root
/bootstrapdirectory, runnpm run docs-servein the command line. - Open
http://localhost:9001/in your browser, and voilà.
Learn more about using Hugo by reading its documentation.
Documentation for previous releases
You can find all our previous releases docs on https://getbootstrap.com/docs/versions/.
Previous releases and their documentation are also available for download.
Contributing
Please read through our contributing guidelines. Included are directions for opening issues, coding standards, and notes on development.
Moreover, if your pull request contains JavaScript patches or features, you must include relevant unit tests. All HTML and CSS should conform to the Code Guide, maintained by Mark Otto.
Editor preferences are available in the editor config for easy use in common text editors. Read more and download plugins at https://editorconfig.org/.
Community
Get updates on Bootstrap's development and chat with the project maintainers and community members.
- Follow @getbootstrap on Twitter.
- Read and subscribe to The Official Bootstrap Blog.
- Ask questions and explore our GitHub Discussions.
- Discuss, ask questions, and more on the community Discord or Bootstrap subreddit.
- Chat with fellow Bootstrappers in IRC. On the
irc.libera.chatserver, in the#bootstrapchannel. - Implementation help may be found at Stack Overflow (tagged
bootstrap-5). - Developers should use the keyword
bootstrapon packages which modify or add to the functionality of Bootstrap when distributing through npm or similar delivery mechanisms for maximum discoverability.
Versioning
For transparency into our release cycle and in striving to maintain backward compatibility, Bootstrap is maintained under the Semantic Versioning guidelines. Sometimes we screw up, but we adhere to those rules whenever possible.
See the Releases section of our GitHub project for changelogs for each release version of Bootstrap. Release announcement posts on the official Bootstrap blog contain summaries of the most noteworthy changes made in each release.
Creators
Mark Otto
Jacob Thornton
Thanks
Thanks to BrowserStack for providing the infrastructure that allows us to test in real browsers!
Thanks to Netlify for providing us with Deploy Previews!
Sponsors
Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]
Backers
Thank you to all our backers! 🙏 [Become a backer]
Copyright and license
Code and documentation copyright 2011–2024 the Bootstrap Authors. Code released under the MIT License. Docs released under Creative Commons.
Stable Version
The latest stable version of the package.
Stable Version
5.3.3
MODERATE
14
MODERATE
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
Affected Versions
>= 1.4.0, < 3.4.1
Patched Versions
3.4.1
MODERATE
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability
Affected Versions
>= 4.0.0, <= 4.6.2
Patched Versions
5.0.0
MODERATE
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability
Affected Versions
>= 2.0.0, <= 3.4.1
Patched Versions
MODERATE
6.1/10
Summary
XSS vulnerability that affects bootstrap
Affected Versions
< 3.4.0
Patched Versions
3.4.0
MODERATE
6.1/10
Summary
bootstrap Cross-site Scripting vulnerability
Affected Versions
< 3.4.0
Patched Versions
3.4.0
MODERATE
6.1/10
Summary
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Affected Versions
>= 2.3.0, < 3.4.0
Patched Versions
3.4.0
MODERATE
6.1/10
Summary
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
MODERATE
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 2.3.0, < 3.4.0
Patched Versions
3.4.0
MODERATE
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
MODERATE
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
MODERATE
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 2.0.4, < 3.4.0
Patched Versions
3.4.0
MODERATE
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0-beta, < 4.0.0-beta.2
Patched Versions
4.0.0-beta.2
MODERATE
6.1/10
Summary
Bootstrap Vulnerable to Cross-Site Scripting
Affected Versions
>= 3.0.0, < 3.4.1
Patched Versions
3.4.1
MODERATE
6.1/10
Summary
Bootstrap Vulnerable to Cross-Site Scripting
Affected Versions
>= 4.0.0, < 4.3.1
Patched Versions
4.3.1
Reason
no binaries found in the repo
Reason
58 different organizations found -- score normalized to 10
Details
- Info: contributors work for CSSLint,HackFox,MaxCDN,Orange-OpenSource,PeerBlock,Rundiz-WP,VivreTech,afosto,apple @semantic-release,browser-bugs,caniuse-email,coinbase,colossal,components,dependents,eclipse,foxfile,github,gohugoio,google,gruntjs,h5bp,hiro,hirosystems,htmlhint,imagemin,itccsro,jekyll,liferay,lostisland,maintainers,maker,nodejs,octoenergy,on the prowl,opensourcedesign,orange,orange-business-services sa,owddm,patternfly,pi-hole,poole,primer,rubyloco,semantic-release,stylelint,stylelint-scss,svg-sprite,trimble-oss,trimblemaps,twbs,uncss,upriver,uxsolutions,validator,verizon,w3c,whatwg
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: Dependabot detected: .github/dependabot.yml:1
Reason
license file detected
Details
- Info: License file found in expected location: LICENSE:1
- Info: FSF or OSI recognized license: LICENSE:1
Reason
30 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
SAST tool detected but not run on all commmits
Details
- Warn: 28 commits out of 29 are checked with a SAST tool
- Info: SAST tool detected: CodeQL
Reason
security policy file detected
Details
- Info: Found linked content in security policy: SECURITY.md
- Info: Found text in security policy: SECURITY.md
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy: SECURITY.md
- Info: security policy detected in current repo: SECURITY.md
Reason
23 out of last 30 changesets reviewed before merge -- score normalized to 7
Reason
dependency not pinned by hash detected -- score normalized to 7
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/browserstack.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/browserstack.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bundlewatch.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/bundlewatch.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bundlewatch.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/bundlewatch.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/calibreapp-image-actions.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/calibreapp-image-actions.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cspell.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/cspell.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/cspell.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/cspell.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/css.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/css.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/css.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/css.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-close-require.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/issue-close-require.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/issue-labeled.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/js.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-sass.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/node-sass.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-sass.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/node-sass.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-notes.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/release-notes.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/scorecards.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Info: Dockerfile dependencies are pinned
- Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
- Info: no insecure (not pinned by hash) dependency downloads found in shell scripts
Reason
badge detected: in_progress
Reason
project is not fuzzed
Reason
0 out of 5 artifacts are signed or have provenance
Details
- Warn: release artifact v5.3.0-alpha1 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/87186776
- Warn: release artifact v5.3.0-alpha1 not signed: https://api.github.com/repos/twbs/bootstrap/releases/87186776
- Warn: release artifact v5.2.3 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/83835184
- Warn: release artifact v5.2.3 not signed: https://api.github.com/repos/twbs/bootstrap/releases/83835184
- Warn: release artifact v5.2.2 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/78817853
- Warn: release artifact v5.2.2 not signed: https://api.github.com/repos/twbs/bootstrap/releases/78817853
- Warn: release artifact v5.2.1 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/76503933
- Warn: release artifact v5.2.1 not signed: https://api.github.com/repos/twbs/bootstrap/releases/76503933
- Warn: release artifact v5.2.0 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/72344034
- Warn: release artifact v5.2.0 not signed: https://api.github.com/repos/twbs/bootstrap/releases/72344034
Reason
non read-only tokens detected in GitHub workflows
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/browserstack.yml:12
- Info: topLevel 'contents' permission set to 'read': .github/workflows/bundlewatch.yml:15
- Warn: no topLevel permission defined: .github/workflows/calibreapp-image-actions.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=permissions
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:23
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24
- Info: topLevel 'contents' permission set to 'read': .github/workflows/cspell.yml:14
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/cspell.yml:21
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/cspell.yml:20
- Info: topLevel 'contents' permission set to 'read': .github/workflows/css.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/docs.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-close-require.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-labeled.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/js.yml:15
- Warn: jobLevel 'checks' permission set to 'write': .github/workflows/js.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=permissions
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/js.yml:22
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/node-sass.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release-notes.yml:10
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-notes.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/release-notes.yml/main?enable=permissions
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:14
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:26
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:27
Score
6.8
/10
Last Scanned on 2022-12-28
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More