fabien-h2o commented on issue #32785: URL: https://github.com/apache/superset/issues/32785#issuecomment-4918423013
Hi! Following up on this thread, which remains the clearest description of the residual Bootstrap 3.4.1 asset served from `/static/appbuilder/css/bootstrap.min.css` on the pre-login FAB-rendered views (it drops away once the React SPA loads post-login). We're tracking this as part of a federal compliance review. The concern here isn't a specific active CVE but rather that Bootstrap 3.x has been end-of-life since 2019, so scanners flag it as an unsupported/EOL dependency. I saw your note here that this is known technical debt, with the plan being to migrate the remaining server-generated views into the React SPA and then remove Bootstrap entirely. Could you help confirm a couple of things: 1. Is there a milestone, target release, or rough timeline associated with removing the last FAB-rendered views (and with them, Bootstrap 3.x)? 2. If so, is there a canonical issue or project board to follow for progress? I see [SIP-131](https://github.com/apache/superset/issues/28377) covers decoupling the FAB security model, but I couldn't find a dedicated tracking issue for the frontend migration specifically. Even a "no fixed date, but tracked here" answer would help our documentation. Thanks for the continued work on the SPA migration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
