Inquiry regarding Bootstrap 3 / AdminLTE 2 security roadmap and vulnerability management

[karenzio]

I am reaching out to ask about the long-term roadmap regarding the Bootstrap 3 and AdminLTE 2 dependencies in SonataAdmin.
Our organization uses SonataAdmin for our backend infrastructure. During a recent compliance audit, our automated vulnerability scanners flagged the outdated Bootstrap 3 version as a security risk.

While we are currently submitting a false-positive/mitigation claim based on the isolated nature of the admin environment and restricted user access, we want to align our internal security timeline with your project's roadmap.

Could you please share any insights on:

• Are there active plans or an open milestone to migrate to AdminLTE 3 / 4 (and subsequently Bootstrap 4 / 5)?
• What is the recommended approach for enterprise users to handle these specific upstream frontend scanner alerts?
• Are there any known backported security patches or specific configuration flags you recommend to fully mitigate risks associated with Bootstrap 3 within SonataAdmin?

[core23]

Maybe I can answer some of your questions, as they were asked a couple of times in the past years.

Are there active plans or an open milestone to migrate to AdminLTE 3 / 4 (and subsequently Bootstrap 4 / 5)?

Currently there are around 0-1 active maintainers for this projects. Most of the old maintainers are not actively using this project or are fine with the current situation.

Personally, I joined this project ~10 years ago, but my priority has shifted and my private time is limited for open source work. I'd like to have bootstrap 5 support, but this requires a little bit more of work, because it affects multiple sonata repos.

What is the recommended approach for enterprise users to handle these specific upstream frontend scanner alerts? Are there any known backported security patches or specific configuration flags you recommend to fully mitigate risks associated with Bootstrap 3 within SonataAdmin?

We don't have / hard any enterprise support for this project. We completely rely on the community who is creating pull requests. Maybe the lack of (paid) enterprise support is one of the problems, why this project feels dead and no-one is willing to invest any more time...

There's also an issue regarding this problems: #8361

[karenzio]

Thank you so much for your candid and transparent reply. We deeply appreciate your honesty about the current project status, and we are incredibly grateful for the 10+ years of dedication you have given to keeping this bundle alive in your private time.

We completely understand how the shift in priorities and a lack of paid enterprise support impact large-scale upgrades like a Bootstrap 5 migration across multiple repos.

Thank you again for all your hard work on SonataAdmin.