admin-lte 4.0.0-rc3 → 4.0.0-rc6

package/.browserslistrc

@@ -14,3 +14,4 @@ not Explorer <= 11
 not ie 11
 not android 4.4.3
 not ios_saf < 15.4
+not kaios <= 2.5 # fix floating label issues in Firefox (see https://github.com/postcss/autoprefixer/issues/1533)

package/.claude/settings.local.json

@@ -0,0 +1,33 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm audit:*)",
+      "Bash(npm run build:*)",
+      "Bash(npm ls:*)",
+      "Bash(gh pr list:*)",
+      "Bash(npm outdated:*)",
+      "Bash(npm install:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr diff:*)",
+      "Bash(rm:*)",
+      "Bash(gh api:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh issue view:*)",
+      "Bash(npm run css:*)",
+      "Bash(npm run js:*)",
+      "Bash(npm run js-lint:*)",
+      "Bash(npm run css-lint:*)",
+      "Bash(npm run lint:*)",
+      "Bash(npm whoami:*)",
+      "Bash(npm run production:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(npm view:*)",
+      "Bash(cat:*)",
+      "Bash(npm pack:*)",
+      "Bash(npm publish:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}

package/CHANGELOG.md

@@ -5,6 +5,136 @@ All notable changes to AdminLTE will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [4.0.0-rc6] - 2025-12-08
+
+### Security
+
+- **Fixed 4 Security Vulnerabilities:** Resolved all npm audit security issues
+  - Fixed high severity reflected XSS vulnerability in Astro server islands
+  - Fixed moderate severity authentication bypass via url.pathname in Astro
+  - Fixed moderate severity stored XSS in Astro Cloudflare adapter /_image endpoint
+  - Fixed moderate severity unsanitized class attribute in mdast-util-to-hast
+  - All vulnerabilities resolved by updating to Astro 5.16.4+
+
+### Added
+
+- **Sidebar State Persistence:** New feature to remember sidebar collapsed/expanded state
+  - Sidebar state now persists across page refreshes using localStorage
+  - Configurable via `enablePersistence` option (default: `true`)
+  - SSR-safe implementation with proper environment checks
+  - Mobile-aware: doesn't restore state on small screens (respects responsive breakpoints)
+  - Graceful error handling for private browsing mode
+  - Storage key: `lte.sidebar.state`
+
+### Changed
+
+- **GitHub Actions:** Updated all workflows to Node.js 22 (from Node.js 18)
+  - Node.js 18 reached End-of-Life on April 30, 2025
+  - Node.js 22 is the current Active LTS (supported until April 2027)
+  - Updated `setup-node` action from v3 to v4 across all workflows
+  - Updated CodeQL actions from v2 to v3
+  - Added `FORCE_COLOR: 2` environment variable to codeql.yml for consistency
+
+### Fixed
+
+- **Release Workflow:** Fixed zip command in release.yml
+  - Corrected `-d` flag to `-r` for recursive directory zipping
+  - Fixed filename inconsistency in release artifacts
+- **Nested Card Expand Icon:** Fixed issue #5909 where nested collapsed cards didn't show expand icon
+  - Updated CSS selectors to use direct child (>) scoping for card state icons
+  - Collapse/expand icons now correctly display for nested cards independently
+  - Card body/footer display rules now only affect direct children, not nested cards
+- **Card Widget JavaScript:** Fixed nested card collapse/expand affecting child cards
+  - Added `:scope >` selector to only target direct card-body/footer children
+  - Prevents parent card collapse from affecting nested card animations
+
+### Updated
+
+- **Dependencies:** Updated 15+ packages to latest versions
+  - @astrojs/check: 0.9.5 → 0.9.6
+  - @astrojs/mdx: 4.3.9 → 4.3.12
+  - @rollup/plugin-typescript: 12.1.3 → 12.3.0
+  - @typescript-eslint/eslint-plugin: 8.46.2 → 8.48.1
+  - @typescript-eslint/parser: 8.46.2 → 8.48.1
+  - astro: 5.15.6 → 5.16.4 (includes security fixes)
+  - autoprefixer: 10.4.21 → 10.4.22
+  - eslint: 9.39.0 → 9.39.1
+  - eslint-plugin-astro: 1.4.0 → 1.5.0
+  - nodemon: 3.1.10 → 3.1.11
+  - prettier: 3.5.3 → 3.7.4
+  - rimraf: 6.1.0 → 6.1.2
+  - rollup: 4.52.4 → 4.53.3
+  - sass: 1.93.2 → 1.94.2
+  - stylelint: 16.25.0 → 16.26.1
+  - terser: 5.44.0 → 5.44.1
+
+## [4.0.0-rc5] - 2025-10-14
+
+### Updated
+- **Dependencies:** Updated 17+ packages to latest versions for improved security and performance
+  - @astrojs/mdx: 4.3.0 → 4.3.7
+  - @typescript-eslint/eslint-plugin: 8.36.0 → 8.46.1
+  - @typescript-eslint/parser: 8.36.0 → 8.46.1
+  - astro: 5.11.0 → 5.14.4
+  - bootstrap: 5.3.7 → 5.3.8
+  - concurrently: 9.2.0 → 9.2.1
+  - cross-env: 7.0.3 → 10.1.0 (major version)
+  - eslint: 9.30.1 → 9.37.0
+  - eslint-config-xo: 0.47.0 → 0.49.0
+  - eslint-config-xo-typescript: 8.0.1 → 9.0.0 (major version)
+  - eslint-plugin-unicorn: 59.0.1 → 61.0.2
+  - fs-extra: 11.3.0 → 11.3.2
+  - rollup: 4.44.2 → 4.52.4
+  - sass: 1.89.2 → 1.93.2
+  - stylelint: 16.21.1 → 16.25.0
+  - terser: 5.43.1 → 5.44.0
+  - typescript: 5.8.3 → 5.9.3
+
+### Fixed
+- **Security Vulnerabilities:** Resolved 2 security issues
+  - Fixed high severity DoS vulnerability in axios (updated to 0.30.2+)
+  - Fixed critical vulnerability in form-data random function (updated to 4.0.4+)
+
+### Removed
+- **Deprecated Files:** Removed `.eslintignore` file
+  - ESLint ignores are now properly configured in `eslint.config.js`
+  - Eliminates deprecation warnings in ESLint 9.x
+
+## [4.0.0-rc4] - 2025-07-10
+
+### Updated
+- **Dependencies:** Updated 8 packages to latest versions
+  - @rollup/plugin-typescript: 12.1.3 → 12.1.4
+  - @typescript-eslint/eslint-plugin: 8.35.1 → 8.36.0
+  - @typescript-eslint/parser: 8.35.1 → 8.36.0
+  - astro: 5.10.0 → 5.11.0
+  - eslint: 9.30.0 → 9.30.1
+  - prettier: 3.5.3 → 3.6.2
+  - rollup: 4.44.0 → 4.44.2
+  - stylelint: 16.21.0 → 16.21.1
+
+### Fixed
+- **Windows Build Compatibility:** Fixed npm scripts to work cross-platform by replacing Unix-specific shell commands with `shx`
+  - Updated `copy-assets` script to use `shx mkdir` and `shx cp` commands
+  - Updated `flatten-build` script to use `shx cp` and `shx rm` commands  
+  - Added `shx` package as dev dependency for cross-platform shell command support
+  - Resolves build failures on Windows systems with "The syntax of the command is incorrect" errors
+- **TeamViewer Modal Compatibility:** Fixed modal fade animations for remote desktop compatibility
+  - Updated accessibility CSS to use `transition: none` and `opacity: 1` instead of `display: block`
+  - Maintains WCAG 2.1 AA compliance while ensuring modals work properly in TeamViewer sessions
+  - Added specific transform overrides for modal dialogs in reduced motion mode
+- **Mobile Sidebar Scrolling:** Fixed sidebar closing unexpectedly when scrolling on mobile devices
+  - Updated touch event handling to differentiate between tap and scroll gestures
+  - Added proper overflow properties to sidebar wrapper for mobile viewport
+  - Sidebar now remains open during scroll operations on touch devices
+  - Resolves issue where scrolling in sidebar would immediately close it on mobile browsers
+- **Image Path Resolution:** Fixed mobile image loading by using relative paths in HTML
+  - **Root Cause:** Absolute paths like `/assets/img/user.jpg` caused 404 errors on mobile
+  - **Solution:** Generate relative image paths in Astro components based on page location
+  - **Result:** Images now load correctly on all devices and deployment scenarios
+
 ## [4.0.0-rc3] - 2025-06-24
 
 ### Production Deployment & Cross-Platform Compatibility

package/CLAUDE.md

@@ -0,0 +1,79 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+AdminLTE is a Bootstrap 5 admin dashboard template (v4.0.0-rc5). It provides responsive UI components for building admin panels and control dashboards.
+
+## Build Commands
+
+```bash
+npm install          # Install dependencies
+npm start            # Start dev server with file watching (http://localhost:3000)
+npm run build        # Build all assets (CSS, JS, docs)
+npm run production   # Full production build with linting and bundlewatch
+npm run lint         # Run all linters (JS, CSS, docs, lockfile)
+```
+
+### Individual Build Tasks
+
+```bash
+npm run css          # Build CSS only (compile, prefix, rtl, minify)
+npm run js           # Build JavaScript only (compile, minify)
+npm run css-lint     # Lint SCSS files
+npm run js-lint      # Lint TypeScript/JavaScript files
+```
+
+## Architecture
+
+### Source Structure
+
+- **src/ts/** - TypeScript source files compiled via Rollup to `dist/js/adminlte.js`
+- **src/scss/** - SCSS source files compiled via Sass to `dist/css/adminlte.css`
+- **src/html/** - Astro-based documentation/demo pages
+- **src/config/** - Build tool configurations (rollup, postcss, astro, assets)
+- **src/assets/** - Static images copied to dist
+
+### JavaScript Components (src/ts/)
+
+Entry point: `adminlte.ts` exports all components:
+- `Layout` - Core layout management and hold-transition behavior
+- `PushMenu` - Sidebar toggle functionality
+- `Treeview` - Hierarchical menu navigation
+- `CardWidget` - Card collapse/expand/remove actions
+- `DirectChat` - Chat widget toggle
+- `FullScreen` - Fullscreen toggle functionality
+- `initAccessibility` - WCAG 2.1 AA accessibility features
+
+### SCSS Structure (src/scss/)
+
+Entry point: `adminlte.scss` imports Bootstrap then AdminLTE components:
+- `_bootstrap-variables.scss` - Bootstrap variable overrides
+- `_variables.scss` / `_variables-dark.scss` - AdminLTE theme variables
+- `parts/` - Organized component groups (core, components, extra-components, pages, miscellaneous)
+- Individual component files (`_cards.scss`, `_app-sidebar.scss`, etc.)
+
+### Documentation (src/html/)
+
+Built with Astro framework:
+- `pages/` - Demo pages and documentation
+- `components/` - Reusable Astro components and MDX content
+- Output goes to `dist/html/` then flattened to `dist/`
+
+### Build Output (dist/)
+
+Production assets:
+- `dist/js/adminlte.min.js` - Compiled and minified JavaScript (UMD format)
+- `dist/css/adminlte.min.css` - Compiled and minified CSS
+- `dist/css/*.rtl.css` - RTL (right-to-left) variants
+- `dist/assets/` - Static assets
+
+## Key Technologies
+
+- Bootstrap 5.3.x - CSS framework base
+- TypeScript - JavaScript source language
+- Sass - CSS preprocessor
+- Rollup - JavaScript bundler
+- Astro - Documentation site generator
+- PostCSS with Autoprefixer and RTLCSS - CSS post-processing

package/README.md

@@ -9,23 +9,28 @@
 **AdminLTE** is a fully responsive administration template. Based on **[Bootstrap 5](https://getbootstrap.com/)** framework and also the JavaScript plugins.
 Highly customizable and easy to use. Fits many screen resolutions from small mobile devices to large desktops.
 
-## What's New in v4.0.0-rc3
+## What's New in v4.0.0-rc6
 
-**Production Deployment & Cross-Platform Compatibility** - This release resolves critical production deployment issues:
+**Security & Feature Release** - Important security fixes and new sidebar persistence feature:
 
-- **Fixed Production Builds** - Resolved CSS/JS path issues, sidebar navigation, and image loading in all deployment scenarios
-- **Smart Path Resolution** - Automatic relative path calculation works for root deployment, sub-folders, and CDN hosting  
-- **RTL CSS Fix** - Eliminated rtlcss interference with standard LTR production builds
-- **Updated Dependencies** - Bootstrap 5.3.7, Bootstrap Icons 1.13.1, OverlayScrollbars 2.11.0
-- **Zero Console Errors** - Fixed all CDN integrity mismatches and runtime issues
-- **FTP/Static Host Ready** - Perfect compatibility with traditional hosting and modern static platforms
+- **Security Fixes** - Resolved 4 vulnerabilities (XSS in Astro, auth bypass, unsanitized attributes)
+- **Sidebar State Persistence** - Sidebar now remembers collapsed/expanded state across page refreshes
+- **Node.js 22** - Updated all GitHub Actions workflows to Node.js 22 LTS (supported until 2027)
+- **Latest Dependencies** - 15+ packages updated including Astro 5.16.4, Prettier 3.7.4, Rollup 4.53.3
+- **CI/CD Improvements** - Updated CodeQL actions to v3, fixed release workflow bugs
 
 **Key Improvements:**
-- ✅ Development and production environments now behave identically
-- ✅ Images, CSS, and JavaScript load correctly in any deployment structure  
-- ✅ Sidebar navigation displays properly with badges and arrow indicators
-- ✅ All CDN resources load without console errors
-- ✅ Complete production build included in repository for easy deployment
+
+- ✅ Zero security vulnerabilities - all npm audit issues resolved
+- ✅ Sidebar state persists in localStorage (configurable, SSR-safe, mobile-aware)
+- ✅ GitHub Actions use Node.js 22 (Active LTS until April 2027)
+- ✅ CodeQL security scanning updated to latest v3 actions
+- ✅ Release workflow fixed for proper asset packaging
+
+**Install the latest:**
+```bash
+npm install admin-lte@4.0.0-rc6
+```
 
 See the [CHANGELOG.md](CHANGELOG.md) for complete details.
 
@@ -69,10 +74,75 @@ To build for production:
 
 AdminLTE supports all modern browsers with the latest Bootstrap 5.3.7:
 - Chrome (latest)
-- Firefox (latest) 
+- Firefox (latest)
 - Safari (latest)
 - Edge (latest)
 
+## Platform Support
+
+AdminLTE v4 build scripts work cross-platform:
+- **Windows** - Command Prompt, PowerShell, Git Bash
+- **macOS** - Terminal, iTerm2
+- **Linux** - Bash, Zsh, and other Unix shells
+
+All npm scripts use cross-platform utilities to ensure consistent behavior across different operating systems.
+
+## Security & Production Deployment
+
+### Important Security Notice
+
+AdminLTE is a **UI template** - when deploying to production, follow these critical guidelines:
+
+**What to Deploy:**
+- Only compiled production assets: `dist/js/adminlte.min.js` and `dist/css/adminlte.min.css`
+- Your application-specific files
+
+**What NOT to Deploy:**
+- `node_modules/` directory
+- Demo/example HTML files (index.html, index2.html, index3.html, etc.)
+- Source files (`src/` directory)
+- Development configuration files
+
+**CVE-2021-36471 Notice:**
+This CVE is **disputed** and does not represent a vulnerability in AdminLTE. It refers to demo pages being accessible when developers incorrectly deploy example files to production. AdminLTE v4 has a clear separation between development demos and production assets. See [SECURITY.md](SECURITY.md) for complete details.
+
+**Production Build:**
+```bash
+npm run production  # Builds optimized assets in dist/
+```
+
+For detailed security guidelines, authentication requirements, and best practices, see [SECURITY.md](SECURITY.md).
+
+## Sponsorship
+
+Support AdminLTE development by becoming a sponsor or donor.
+
+<p align="center">
+  <a href="https://github.com/sponsors/danny007in">
+    <img src="https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86" alt="Sponsor on GitHub" />
+  </a>
+  &nbsp;&nbsp;
+  <a href="https://www.paypal.me/daniel007in">
+    <img src="https://img.shields.io/static/v1?label=Donate&message=%E2%9D%A4&logo=PayPal&color=%2300457C" alt="Donate via PayPal" />
+  </a>
+</p>
+
+## Our Sponsors
+
+<p align="center">
+  <a href="https://github.com/spizzo14"><img src="https://unavatar.io/github/spizzo14?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: spizzo14" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/tomhappyblock"><img src="https://unavatar.io/github/tomhappyblock?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: tomhappyblock" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/stefanmorderca"><img src="https://unavatar.io/github/stefanmorderca?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: stefanmorderca" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/tito10047"><img src="https://unavatar.io/github/tito10047?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: tito10047" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/sitchi"><img src="https://unavatar.io/github/sitchi?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: sitchi" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/npreee"><img src="https://unavatar.io/github/npreee?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: npreee" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/isaacmorais"><img src="https://unavatar.io/github/isaacmorais?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: isaacmorais" loading="lazy" /></a>&nbsp;&nbsp;
+</p>
+
+<p align="center">
+  <a href="https://github.com/sponsors/danny007in">Your avatar here? Become a sponsor</a>
+</p>
+
 ## Contributing
 
 - Highly welcome.
@@ -86,11 +156,6 @@ AdminLTE supports all modern browsers with the latest Bootstrap 5.3.7:
 - After installation completes, run `npm start`
 - Cool, Send your changes in PR to `master` branch.
 
-## Sponsorship
-
-Support AdminLTE development by becoming a sponsor.
-[Github Sponsors](https://github.com/sponsors/danny007in) or
-[PayPal](https://www.paypal.me/daniel007in)
 
 ## License
 
@@ -104,3 +169,4 @@ AdminLTE.io reserves the right to change the license of future releases.
 - [Pickaface](https://pickaface.net/)
 - [Unsplash](https://unsplash.com/)
 - [Uifaces](http://uifaces.com/)
+- [Unavatar](https://unavatar.io/)

package/SECURITY.md

@@ -0,0 +1,99 @@
+# Security Policy
+
+## Reporting Security Issues
+
+If you discover a security vulnerability in AdminLTE, please report it by emailing the maintainers or opening a private security advisory on GitHub. We take security seriously and will respond promptly.
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.x     | :white_check_mark: |
+| 3.x     | :x:                |
+| < 3.0   | :x:                |
+
+## Security Best Practices
+
+AdminLTE is a frontend admin dashboard template. When deploying applications built with AdminLTE, follow these security best practices:
+
+### 1. Production Deployment
+
+- **Never expose `node_modules` directory** in production environments
+- **Remove demo/example files** (like `index2.html`, `index3.html`) from production builds
+- **Use a proper build process** that only includes necessary production assets
+- **Configure web server properly** to prevent directory traversal attacks
+
+### 2. Build Process
+
+When deploying to production:
+
+```bash
+# Build only production assets
+npm run production
+
+# Deploy only the dist/ directory contents you need
+# Typically: dist/js/adminlte.min.js and dist/css/adminlte.min.css
+```
+
+### 3. What NOT to Deploy
+
+Do not deploy these to production:
+- `node_modules/` directory
+- Example/demo HTML files (`index.html`, `index2.html`, `index3.html`, etc.)
+- Source files (`src/` directory)
+- Development configuration files
+- Documentation files
+
+## Known CVE Issues
+
+### CVE-2021-36471 (Disputed)
+
+**Status**: This CVE is **disputed** and does not represent a vulnerability in AdminLTE itself.
+
+**Issue**: CVE-2021-36471 claims AdminLTE 3.1.0 has a "Directory Traversal vulnerability" that allows remote attackers to view demo pages via `/admin/index2.html` and `/admin/index3.html`.
+
+**Clarification**:
+- The `index2.html` and `index3.html` files are **example/demo pages** intended for developer reference during development
+- This is **not a vulnerability in AdminLTE** - it is a **deployment misconfiguration** by website developers
+- The issue occurs when developers incorrectly deploy:
+  - Their entire `node_modules` folder publicly
+  - Demo/example files in production environments
+  - Without proper web server configuration
+
+**Resolution**:
+- AdminLTE 4.x has restructured the project architecture with clear separation between development demos and production assets
+- Follow the production deployment best practices above
+- Only deploy the compiled production assets from `dist/js/` and `dist/css/`
+- The original CVE researcher acknowledged this should be classified as low/info severity, not critical
+
+**For More Information**:
+- [GitHub Issue #4948](https://github.com/ColorlibHQ/AdminLTE/issues/4948)
+- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2021-36471) (marked as disputed)
+
+## Secure Development
+
+### Content Security Policy (CSP)
+
+When implementing AdminLTE in your application, consider adding appropriate Content Security Policy headers to prevent XSS attacks.
+
+### Authentication & Authorization
+
+AdminLTE is a **UI template only** and does not include authentication or authorization. You must:
+- Implement proper authentication in your backend
+- Secure all API endpoints
+- Use HTTPS in production
+- Implement proper session management
+- Follow OWASP security guidelines
+
+### Dependencies
+
+- Keep AdminLTE and its dependencies up to date
+- Regularly run `npm audit` to check for vulnerabilities
+- Review security advisories for Bootstrap and other dependencies
+
+## Contact
+
+For security concerns, please contact the maintainers through:
+- GitHub Issues (for general questions)
+- GitHub Security Advisories (for sensitive security issues)
+- Project maintainer email (check package.json)