Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a fork of the Bootstrap 4 ruby gem for Ruby on Rails (Sprockets) and Hanami (formerly Lotus), which removes the sassc-rails dependency.
For Sass versions of Bootstrap 3 and 2 see bootstrap-sass instead.
Please see the appropriate guide for your environment of choice:
Add bootstrap
to your Gemfile:
gem 'bootstrap', '~> 4.6.1'
Ensure that sprockets-rails
is at least v2.3.2.
bundle install
and restart your server to make the files available through the pipeline.
Import Bootstrap styles in app/assets/stylesheets/application.scss
:
// Custom bootstrap variables must be set or imported *before* bootstrap.
@import "bootstrap";
The available variables can be found here.
Make sure the file has .scss
extension (or .sass
for Sass syntax). If you have just generated a new Rails app,
it may come with a .css
file instead. If this file exists, it will be served instead of Sass, so rename it:
$ mv app/assets/stylesheets/application.css app/assets/stylesheets/application.scss
Then, remove all the *= require
and *= require_tree
statements from the Sass file. Instead, use @import
to import Sass files.
Do not use *= require
in Sass or your other stylesheets will not be able to access the Bootstrap mixins and variables.
Bootstrap JavaScript depends on jQuery.
If you're using Rails 5.1+, add the jquery-rails
gem to your Gemfile:
gem 'jquery-rails'
Bootstrap tooltips and popovers depend on popper.js for positioning.
The bootstrap
gem already depends on the
popper_js gem.
Add Bootstrap dependencies and Bootstrap to your application.js
:
//= require jquery3
//= require popper
//= require bootstrap-sprockets
While bootstrap-sprockets
provides individual Bootstrap components
for ease of debugging, you may alternatively require
the concatenated bootstrap
for faster compilation:
//= require jquery3
//= require popper
//= require bootstrap
If your framework uses Sprockets or Hanami, the assets will be registered with Sprockets when the gem is required, and you can use them as per the Rails section of the guide.
Otherwise you may need to register the assets manually. Refer to your framework's documentation on the subject.
Bootstrap requires the use of Autoprefixer. Autoprefixer adds vendor prefixes to CSS rules using values from Can I Use.
If you are using bootstrap with Rails, autoprefixer is set up for you automatically. Otherwise, please consult the Autoprefixer documentation.
By default all of Bootstrap is imported.
You can also import components explicitly. To start with a full list of modules copy
_bootstrap.scss
file into your assets as _bootstrap-custom.scss
.
Then comment out components you do not want from _bootstrap-custom
.
In the application Sass file, replace @import 'bootstrap'
with:
@import 'bootstrap-custom';
FAQs
Unknown package
We found that nex-bootstrap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.