Anvil using vulnerable Bootstrap version?

[simon]

Hi folks
I was running my Anvil app through https://www.webpagetest.org/ and it got an A for all dimensions except security, for which it got a B. Looking into the reasons for this, and apparently an old/vulnerable Bootstrap version is being used.

More details at this link. I don’t know enough about these things to be sure if it’s a real-world problem, but maybe this is something the team wants to look into?

Cheers
Simon

[meredydd]

I can confirm that these vulnerability affects parts of Bootstrap that Anvil does not use, so this vulnerability is not exposed

Nevertheless, we’ll get that updated.

[wim.vandebrug]

We ran a test against OWASP. This triggered a medium issue:
Vulnerable JS Library (Bootstrap 3.4.1) which resides in _/static/runtime/js/lib/bootstrap.min.js

Is there an update planned for?

[stucork]

hi @wim.vandebrug,

we do assess boostrap vulnerabilities

a couple of examples:

• CVE-2024-6485 | Vulnerability Database | Aqua Security
  (we don’t use bootstrap buttons)
• CVE-2025-1647 | Vulnerability Database | Aqua Security
  (we no longer use bootstrap components)

neither of which anvil is affected by.
note anvil-extras prior to 3.0.0 was using bootstrap popovers, so you may wish to upgrade to the latest version of anvil-extras which no longer uses any bootstrap components.

If there are any other bootstrap related CVEs you want us to look at let us know

If you want to remove bootstrap from your app, that’s also possible
see this post

How do I start with a truly blank project (no built-in HTML/CSS)?

Option 1 Select Custom Html Make a form a layout (create a Form, in the designer view find the “use as layout” option, tick it) Go to settings, Python Versions, scroll down Advanced Settings, untick all the legacy options Option 2 Create a new M3 Beta app Remove M3 as a dependency (The legacy features are already removed)