[BUG] [api-ui] bootstrap 3.4.1 is EoL and contains known CVEs

[mrnim94]

Rancher Server Setup

• Rancher version: v2.14.1 (or your current version)
• Installation option: Helm Chart

Describe the bug

@rancher/api-ui bundles bootstrap v3.4.1 which has reached End-of-Life and will not receive any security patches. This version is flagged by dependency scanners (Snyk, Trivy) with the following CVEs:

• CVE-2025-1647 (Low) – XSS via DOM clobbering in Tooltip/Popover components
• CVE-2024-6485 (Medium) – XSS via data-loading-text attribute in Button component

Bootstrap 3 EoL reference: https://blog.getbootstrap.com/2019/07/24/lts-plan/

To Reproduce

Run a dependency audit:

npm audit

Bootstrap 3.4.1 CVEs will be listed.

Result

CVEs are reported against bootstrap@3.4.1 bundled in @rancher/api-ui.

Expected Result

Bootstrap is bumped to a supported version (>=4.6.x or 5.3.x) so known CVEs are no longer flagged by security scanners.

Additional context

• Snyk advisory: https://security.snyk.io/package/npm/bootstrap/3.4.1
• CVE-2025-1647: https://nvd.nist.gov/vuln/detail/cve-2025-1647
• CVE-2024-6485: https://nvd.nist.gov/vuln/detail/CVE-2024-6485

[richard-cox]

@mrnim94 This seems to be a generic AI created issue. Can you reformat the description using our bug template?

[mrnim94]

I updated the issue @richard-cox