admin-lte 4.0.0-rc4 → 4.0.0-rc7

package/.browserslistrc

@@ -14,3 +14,4 @@ not Explorer <= 11
 not ie 11
 not android 4.4.3
 not ios_saf < 15.4
+not kaios <= 2.5 # fix floating label issues in Firefox (see https://github.com/postcss/autoprefixer/issues/1533)

package/.claude/settings.local.json

@@ -1,28 +1,37 @@
 {
   "permissions": {
     "allow": [
-      "WebFetch(domain:github.com)",
-      "Bash(npm run css-lint)",
+      "Bash(npm audit:*)",
       "Bash(npm run build:*)",
-      "Bash(npm install)",
-      "Bash(npm run:*)",
-      "Bash(npm test:*)",
+      "Bash(npm ls:*)",
+      "Bash(gh pr list:*)",
+      "Bash(npm outdated:*)",
       "Bash(npm install:*)",
-      "Bash(npm start)",
-      "WebFetch(domain:adminlte.io)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr diff:*)",
       "Bash(rm:*)",
-      "Bash(find:*)",
-      "Bash(sed:*)",
-      "Bash(gh pr list:*)",
-      "Bash(npm audit:*)",
-      "Bash(npm outdated)",
-      "Bash(npm update:*)",
+      "Bash(gh api:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh issue view:*)",
+      "Bash(npm run css:*)",
+      "Bash(npm run js:*)",
+      "Bash(npm run js-lint:*)",
+      "Bash(npm run css-lint:*)",
+      "Bash(npm run lint:*)",
+      "Bash(npm whoami:*)",
+      "Bash(npm run production:*)",
       "Bash(git add:*)",
       "Bash(git commit:*)",
-      "Bash(git tag:*)",
-      "Bash(gh release create:*)",
-      "Bash(npm publish:*)"
+      "Bash(npm view:*)",
+      "Bash(cat:*)",
+      "Bash(npm pack:*)",
+      "Bash(npm publish:*)",
+      "Bash(npm dist-tag add:*)",
+      "Bash(git init:*)",
+      "Bash(gh repo create:*)",
+      "Bash(git push)"
     ],
-    "deny": []
+    "deny": [],
+    "ask": []
   }
-}
+}

package/CHANGELOG.md

@@ -7,6 +7,149 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.0.0-rc7] - 2026-03-10
+
+### Added
+
+- **Sidebar Without Hover:** New `sidebar-without-hover` body class that prevents collapsed mini sidebar from expanding on hover (#5837)
+  - New demo page at `layout/collapsed-sidebar-without-hover.html`
+- **JavaScript Documentation:** Added documentation pages for all JS components
+  - Layout, Card Widget, Direct Chat, Fullscreen, and Accessibility modules
+  - Updated PushMenu documentation with configuration options and responsive behavior
+  - All 7 JS components now fully documented in the sidebar navigation
+- **Accessibility Module:** WCAG 2.1 AA compliance features (skip links, focus management, keyboard navigation, reduced motion, live announcements)
+- **Print Layout Fix:** Sidebar and main content now both visible when printing (#5996)
+
+### Changed
+
+- **Sidebar Persistence:** `enablePersistence` now defaults to `false` (was `true`). Opt in via `data-enable-persistence="true"` on `.app-sidebar`. **BREAKING CHANGE**
+- **Layout Plugin Refactor:** Single Layout instance with persistent hold-transition timer, proper cleanup on resize (#5956)
+- **PushMenu Plugin Refactor:** Single PushMenu instance with proper responsive logic, config from data attributes, mobile-aware state management (#5954)
+- **Login/Register Box:** Increased width from 360px to 400px (#5963)
+
+### Fixed
+
+- **Fixed Footer with Layout Fixed:** Footer now stays pinned at the bottom when using both `.fixed-footer` and `.layout-fixed` (#5805)
+- **Mobile Sidebar Scroll Chaining:** Added `overscroll-behavior: contain` to prevent page scroll when scrolling sidebar on mobile (#5864)
+- **Sidebar Flicker on Load:** Resolved by layout refactor fixing duplicate initialization and broken hold-transition timer (#5952)
+- **Bootstrap Modal Escape Key:** Accessibility module no longer intercepts Escape key when a Bootstrap modal is open (#5993)
+- **Pagination Border Radius:** Fixed `calc()` syntax in `_bootstrap-variables.scss` to match Bootstrap 5.3 format (#5951)
+- **slideUp/slideDown at Duration 0:** Added early return guard for zero/near-zero animation durations (#5964)
+- **TypeScript Comments in Build:** Added `removeComments: true` to tsconfig.json for smaller unminified bundles (#5953)
+
+### Updated
+
+- **Dependencies:** Updated all packages to latest semver-compatible versions
+  - astro: 5.x → 6.0.0
+  - @astrojs/mdx: 4.x → 5.0.0
+  - @astrojs/check: 0.9.6 → 0.9.7
+  - @rollup/plugin-typescript: 12.3.0 → 12.3.1
+  - @typescript-eslint/eslint-plugin: 8.48.1 → 8.50.0
+  - @typescript-eslint/parser: 8.48.1 → 8.50.0
+  - autoprefixer: 10.4.22 → 10.4.23
+  - eslint: 9.39.1 → 9.39.4
+  - postcss: 8.5.7 → 8.5.8
+  - rollup: 4.53.3 → 4.59.0
+  - sass: 1.94.2 → 1.97.3
+  - terser: 5.44.1 → 5.44.3
+  - typescript: 5.9.2 → 5.9.3
+- **Bundlewatch:** Updated adminlte.js size limit to 5.2 kB
+
+## [4.0.0-rc6] - 2025-12-08
+
+### Security
+
+- **Fixed 4 Security Vulnerabilities:** Resolved all npm audit security issues
+  - Fixed high severity reflected XSS vulnerability in Astro server islands
+  - Fixed moderate severity authentication bypass via url.pathname in Astro
+  - Fixed moderate severity stored XSS in Astro Cloudflare adapter /_image endpoint
+  - Fixed moderate severity unsanitized class attribute in mdast-util-to-hast
+  - All vulnerabilities resolved by updating to Astro 5.16.4+
+
+### Added
+
+- **Sidebar State Persistence:** New feature to remember sidebar collapsed/expanded state
+  - Sidebar state now persists across page refreshes using localStorage
+  - Configurable via `enablePersistence` option (default: `true`)
+  - SSR-safe implementation with proper environment checks
+  - Mobile-aware: doesn't restore state on small screens (respects responsive breakpoints)
+  - Graceful error handling for private browsing mode
+  - Storage key: `lte.sidebar.state`
+
+### Changed
+
+- **GitHub Actions:** Updated all workflows to Node.js 22 (from Node.js 18)
+  - Node.js 18 reached End-of-Life on April 30, 2025
+  - Node.js 22 is the current Active LTS (supported until April 2027)
+  - Updated `setup-node` action from v3 to v4 across all workflows
+  - Updated CodeQL actions from v2 to v3
+  - Added `FORCE_COLOR: 2` environment variable to codeql.yml for consistency
+
+### Fixed
+
+- **Release Workflow:** Fixed zip command in release.yml
+  - Corrected `-d` flag to `-r` for recursive directory zipping
+  - Fixed filename inconsistency in release artifacts
+- **Nested Card Expand Icon:** Fixed issue #5909 where nested collapsed cards didn't show expand icon
+  - Updated CSS selectors to use direct child (>) scoping for card state icons
+  - Collapse/expand icons now correctly display for nested cards independently
+  - Card body/footer display rules now only affect direct children, not nested cards
+- **Card Widget JavaScript:** Fixed nested card collapse/expand affecting child cards
+  - Added `:scope >` selector to only target direct card-body/footer children
+  - Prevents parent card collapse from affecting nested card animations
+
+### Updated
+
+- **Dependencies:** Updated 15+ packages to latest versions
+  - @astrojs/check: 0.9.5 → 0.9.6
+  - @astrojs/mdx: 4.3.9 → 4.3.12
+  - @rollup/plugin-typescript: 12.1.3 → 12.3.0
+  - @typescript-eslint/eslint-plugin: 8.46.2 → 8.48.1
+  - @typescript-eslint/parser: 8.46.2 → 8.48.1
+  - astro: 5.15.6 → 5.16.4 (includes security fixes)
+  - autoprefixer: 10.4.21 → 10.4.22
+  - eslint: 9.39.0 → 9.39.1
+  - eslint-plugin-astro: 1.4.0 → 1.5.0
+  - nodemon: 3.1.10 → 3.1.11
+  - prettier: 3.5.3 → 3.7.4
+  - rimraf: 6.1.0 → 6.1.2
+  - rollup: 4.52.4 → 4.53.3
+  - sass: 1.93.2 → 1.94.2
+  - stylelint: 16.25.0 → 16.26.1
+  - terser: 5.44.0 → 5.44.1
+
+## [4.0.0-rc5] - 2025-10-14
+
+### Updated
+- **Dependencies:** Updated 17+ packages to latest versions for improved security and performance
+  - @astrojs/mdx: 4.3.0 → 4.3.7
+  - @typescript-eslint/eslint-plugin: 8.36.0 → 8.46.1
+  - @typescript-eslint/parser: 8.36.0 → 8.46.1
+  - astro: 5.11.0 → 5.14.4
+  - bootstrap: 5.3.7 → 5.3.8
+  - concurrently: 9.2.0 → 9.2.1
+  - cross-env: 7.0.3 → 10.1.0 (major version)
+  - eslint: 9.30.1 → 9.37.0
+  - eslint-config-xo: 0.47.0 → 0.49.0
+  - eslint-config-xo-typescript: 8.0.1 → 9.0.0 (major version)
+  - eslint-plugin-unicorn: 59.0.1 → 61.0.2
+  - fs-extra: 11.3.0 → 11.3.2
+  - rollup: 4.44.2 → 4.52.4
+  - sass: 1.89.2 → 1.93.2
+  - stylelint: 16.21.1 → 16.25.0
+  - terser: 5.43.1 → 5.44.0
+  - typescript: 5.8.3 → 5.9.3
+
+### Fixed
+- **Security Vulnerabilities:** Resolved 2 security issues
+  - Fixed high severity DoS vulnerability in axios (updated to 0.30.2+)
+  - Fixed critical vulnerability in form-data random function (updated to 4.0.4+)
+
+### Removed
+- **Deprecated Files:** Removed `.eslintignore` file
+  - ESLint ignores are now properly configured in `eslint.config.js`
+  - Eliminates deprecation warnings in ESLint 9.x
+
 ## [4.0.0-rc4] - 2025-07-10
 
 ### Updated

package/CLAUDE.md

@@ -4,103 +4,76 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-AdminLTE is a Bootstrap 5-based admin dashboard template with TypeScript components and SCSS styling. The project uses Astro for documentation generation and includes comprehensive build tooling for development and production.
+AdminLTE is a Bootstrap 5 admin dashboard template (v4.0.0-rc5). It provides responsive UI components for building admin panels and control dashboards.
 
-## Development Commands
+## Build Commands
 
-### Start Development
 ```bash
-npm start                    # Start development server with file watching (opens http://localhost:3000)
-npm run dev                  # Same as npm start
+npm install          # Install dependencies
+npm start            # Start dev server with file watching (http://localhost:3000)
+npm run build        # Build all assets (CSS, JS, docs)
+npm run production   # Full production build with linting and bundlewatch
+npm run lint         # Run all linters (JS, CSS, docs, lockfile)
 ```
 
-### Build Commands
-```bash
-npm run build               # Quick development build (CSS + JS + assets + docs)
-npm run production          # Full production build with linting and optimization
-npm run compile             # Build all assets (CSS, JS, assets, docs)
-```
+### Individual Build Tasks
 
-### Asset-Specific Commands
 ```bash
-npm run css                 # Build CSS only (compile + prefix + RTL + minify)
-npm run js                  # Build JavaScript only (compile + minify)
-npm run assets              # Process assets only
+npm run css          # Build CSS only (compile, prefix, rtl, minify)
+npm run js           # Build JavaScript only (compile, minify)
+npm run css-lint     # Lint SCSS files
+npm run js-lint      # Lint TypeScript/JavaScript files
 ```
 
-### Linting and Quality
-```bash
-npm run lint                # Run all linters (JS, CSS, docs, lockfile)
-npm run js-lint             # ESLint for JavaScript/TypeScript
-npm run css-lint            # Stylelint for SCSS
-npm run docs-lint           # Astro check for documentation
-```
+## Architecture
 
-### Individual Build Steps
-```bash
-npm run css-compile         # Compile SCSS to CSS
-npm run css-rtl             # Generate RTL versions
-npm run js-compile          # Compile TypeScript to JavaScript
-npm run docs-compile        # Build documentation with Astro
-```
+### Source Structure
 
-## Architecture
+- **src/ts/** - TypeScript source files compiled via Rollup to `dist/js/adminlte.js`
+- **src/scss/** - SCSS source files compiled via Sass to `dist/css/adminlte.css`
+- **src/html/** - Astro-based documentation/demo pages
+- **src/config/** - Build tool configurations (rollup, postcss, astro, assets)
+- **src/assets/** - Static images copied to dist
+
+### JavaScript Components (src/ts/)
+
+Entry point: `adminlte.ts` exports all components:
+- `Layout` - Core layout management and hold-transition behavior
+- `PushMenu` - Sidebar toggle functionality
+- `Treeview` - Hierarchical menu navigation
+- `CardWidget` - Card collapse/expand/remove actions
+- `DirectChat` - Chat widget toggle
+- `FullScreen` - Fullscreen toggle functionality
+- `initAccessibility` - WCAG 2.1 AA accessibility features
+
+### SCSS Structure (src/scss/)
+
+Entry point: `adminlte.scss` imports Bootstrap then AdminLTE components:
+- `_bootstrap-variables.scss` - Bootstrap variable overrides
+- `_variables.scss` / `_variables-dark.scss` - AdminLTE theme variables
+- `parts/` - Organized component groups (core, components, extra-components, pages, miscellaneous)
+- Individual component files (`_cards.scss`, `_app-sidebar.scss`, etc.)
+
+### Documentation (src/html/)
+
+Built with Astro framework:
+- `pages/` - Demo pages and documentation
+- `components/` - Reusable Astro components and MDX content
+- Output goes to `dist/html/` then flattened to `dist/`
+
+### Build Output (dist/)
+
+Production assets:
+- `dist/js/adminlte.min.js` - Compiled and minified JavaScript (UMD format)
+- `dist/css/adminlte.min.css` - Compiled and minified CSS
+- `dist/css/*.rtl.css` - RTL (right-to-left) variants
+- `dist/assets/` - Static assets
+
+## Key Technologies
 
-### Core Structure
-- **src/ts/**: TypeScript source files for UI components
-- **src/scss/**: SCSS source files for styling
-- **src/html/**: Astro-based documentation and examples
-- **src/config/**: Build configuration files
-- **src/assets/**: Static assets (images, etc.)
-- **dist/**: Built assets and documentation
-
-### Key Components (src/ts/)
-- **adminlte.ts**: Main entry point that initializes all components
-- **layout.ts**: Core layout management and theme handling
-- **accessibility.ts**: WCAG 2.1 AA compliance features
-- **card-widget.ts**: Collapsible card functionality
-- **treeview.ts**: Navigation tree component
-- **push-menu.ts**: Sidebar menu toggle
-- **direct-chat.ts**: Chat widget functionality
-- **fullscreen.ts**: Fullscreen mode toggle
-
-### Build System
-- **Rollup**: JavaScript bundling (UMD format)
-- **Sass**: SCSS compilation with Bootstrap integration
-- **PostCSS**: CSS processing with autoprefixer and RTL support
-- **Astro**: Static site generation for documentation
-- **ESLint**: JavaScript/TypeScript linting with TypeScript ESLint, Unicorn, and Astro plugins
-
-### Styling Architecture
-- Built on Bootstrap 5.3.7 with custom variables
-- Modular SCSS structure in parts/ directory
-- Dark mode support with separate variable files
-- RTL (Right-to-Left) language support
-- Accessibility-focused styling
-
-### Development Workflow
-1. Source files are watched during development
-2. CSS and JS are automatically compiled and copied to src/html/public/
-3. Astro serves documentation with hot reloading
-4. Production builds include minification and optimization
-
-## Key Files and Configurations
-
-### Build Configuration
-- **src/config/rollup.config.js**: JavaScript bundling configuration
-- **src/config/astro.config.mjs**: Documentation build configuration
-- **src/config/postcss.config.mjs**: CSS processing configuration
-- **eslint.config.js**: Linting rules and file ignores
-
-### Main Entry Points
-- **src/ts/adminlte.ts**: Main TypeScript entry point
-- **src/scss/adminlte.scss**: Main SCSS entry point
-- **dist/js/adminlte.min.js**: Built JavaScript for production
-- **dist/css/adminlte.min.css**: Built CSS for production
-
-### Development Notes
-- The project uses ES modules (type: "module" in package.json)
-- TypeScript configuration is in tsconfig.json
-- File watching is handled by nodemon with specific patterns
-- Assets are copied to src/html/public/ during build for Astro integration
-- Production builds are flattened to dist/ root for deployment
+- Bootstrap 5.3.x - CSS framework base
+- TypeScript - JavaScript source language
+- Sass - CSS preprocessor
+- Rollup - JavaScript bundler
+- Astro - Documentation site generator
+- PostCSS with Autoprefixer and RTLCSS - CSS post-processing

package/README.md

@@ -9,23 +9,28 @@
 **AdminLTE** is a fully responsive administration template. Based on **[Bootstrap 5](https://getbootstrap.com/)** framework and also the JavaScript plugins.
 Highly customizable and easy to use. Fits many screen resolutions from small mobile devices to large desktops.
 
-## What's New in v4.0.0-rc3
+## What's New in v4.0.0-rc7
 
-**Production Deployment & Cross-Platform Compatibility** - This release resolves critical production deployment issues:
+**Bug Fixes, Refactors & Documentation** - Major plugin refactors, complete JS documentation, and new features:
 
-- **Fixed Production Builds** - Resolved CSS/JS path issues, sidebar navigation, and image loading in all deployment scenarios
-- **Smart Path Resolution** - Automatic relative path calculation works for root deployment, sub-folders, and CDN hosting  
-- **RTL CSS Fix** - Eliminated rtlcss interference with standard LTR production builds
-- **Updated Dependencies** - Bootstrap 5.3.7, Bootstrap Icons 1.13.1, OverlayScrollbars 2.11.0
-- **Zero Console Errors** - Fixed all CDN integrity mismatches and runtime issues
-- **FTP/Static Host Ready** - Perfect compatibility with traditional hosting and modern static platforms
+- **Layout & PushMenu Refactors** - Single-instance architecture, proper responsive logic, configurable via data attributes
+- **Sidebar Without Hover** - New `sidebar-without-hover` class to keep collapsed sidebar from expanding on hover
+- **Complete JS Documentation** - All 7 JavaScript components now fully documented
+- **Astro 6.0.0** - Upgraded to latest Astro with Vite 7 and Shiki 4
+- **Bug Fixes** - Fixed footer with layout-fixed, mobile scroll chaining, print layout, modal escape key, pagination borders
 
 **Key Improvements:**
-- ✅ Development and production environments now behave identically
-- ✅ Images, CSS, and JavaScript load correctly in any deployment structure  
-- ✅ Sidebar navigation displays properly with badges and arrow indicators
-- ✅ All CDN resources load without console errors
-- ✅ Complete production build included in repository for easy deployment
+
+- Fixed footer now works correctly with `layout-fixed` (#5805)
+- Sidebar no longer causes page scroll chaining on mobile (#5864)
+- Print layout shows both sidebar and content (#5996)
+- Sidebar persistence is now opt-in via `data-enable-persistence="true"` (**breaking change**)
+- All dependencies updated to latest versions
+
+**Install the latest:**
+```bash
+npm install admin-lte@4.0.0-rc7
+```
 
 See the [CHANGELOG.md](CHANGELOG.md) for complete details.
 
@@ -67,9 +72,9 @@ To build for production:
 
 ## Browser Support
 
-AdminLTE supports all modern browsers with the latest Bootstrap 5.3.7:
+AdminLTE supports all modern browsers with the latest Bootstrap 5.3.8:
 - Chrome (latest)
-- Firefox (latest) 
+- Firefox (latest)
 - Safari (latest)
 - Edge (latest)
 
@@ -82,6 +87,62 @@ AdminLTE v4 build scripts work cross-platform:
 
 All npm scripts use cross-platform utilities to ensure consistent behavior across different operating systems.
 
+## Security & Production Deployment
+
+### Important Security Notice
+
+AdminLTE is a **UI template** - when deploying to production, follow these critical guidelines:
+
+**What to Deploy:**
+- Only compiled production assets: `dist/js/adminlte.min.js` and `dist/css/adminlte.min.css`
+- Your application-specific files
+
+**What NOT to Deploy:**
+- `node_modules/` directory
+- Demo/example HTML files (index.html, index2.html, index3.html, etc.)
+- Source files (`src/` directory)
+- Development configuration files
+
+**CVE-2021-36471 Notice:**
+This CVE is **disputed** and does not represent a vulnerability in AdminLTE. It refers to demo pages being accessible when developers incorrectly deploy example files to production. AdminLTE v4 has a clear separation between development demos and production assets. See [SECURITY.md](SECURITY.md) for complete details.
+
+**Production Build:**
+```bash
+npm run production  # Builds optimized assets in dist/
+```
+
+For detailed security guidelines, authentication requirements, and best practices, see [SECURITY.md](SECURITY.md).
+
+## Sponsorship
+
+Support AdminLTE development by becoming a sponsor or donor.
+
+<p align="center">
+  <a href="https://github.com/sponsors/danny007in">
+    <img src="https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86" alt="Sponsor on GitHub" />
+  </a>
+  &nbsp;&nbsp;
+  <a href="https://www.paypal.me/daniel007in">
+    <img src="https://img.shields.io/static/v1?label=Donate&message=%E2%9D%A4&logo=PayPal&color=%2300457C" alt="Donate via PayPal" />
+  </a>
+</p>
+
+## Our Sponsors
+
+<p align="center">
+  <a href="https://github.com/spizzo14"><img src="https://unavatar.io/github/spizzo14?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: spizzo14" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/tomhappyblock"><img src="https://unavatar.io/github/tomhappyblock?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: tomhappyblock" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/stefanmorderca"><img src="https://unavatar.io/github/stefanmorderca?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: stefanmorderca" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/tito10047"><img src="https://unavatar.io/github/tito10047?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: tito10047" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/sitchi"><img src="https://unavatar.io/github/sitchi?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: sitchi" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/npreee"><img src="https://unavatar.io/github/npreee?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: npreee" loading="lazy" /></a>&nbsp;&nbsp;
+  <a href="https://github.com/isaacmorais"><img src="https://unavatar.io/github/isaacmorais?fallback=https%3A%2F%2Fraw.githubusercontent.com%2FJamesIves%2Fgithub-sponsors-readme-action%2Fdev%2F.github%2Fassets%2Fplaceholder.png" width="50" height="50" alt="User avatar: isaacmorais" loading="lazy" /></a>&nbsp;&nbsp;
+</p>
+
+<p align="center">
+  <a href="https://github.com/sponsors/danny007in">Your avatar here? Become a sponsor</a>
+</p>
+
 ## Contributing
 
 - Highly welcome.
@@ -95,11 +156,6 @@ All npm scripts use cross-platform utilities to ensure consistent behavior acros
 - After installation completes, run `npm start`
 - Cool, Send your changes in PR to `master` branch.
 
-## Sponsorship
-
-Support AdminLTE development by becoming a sponsor.
-[Github Sponsors](https://github.com/sponsors/danny007in) or
-[PayPal](https://www.paypal.me/daniel007in)
 
 ## License
 
@@ -113,3 +169,4 @@ AdminLTE.io reserves the right to change the license of future releases.
 - [Pickaface](https://pickaface.net/)
 - [Unsplash](https://unsplash.com/)
 - [Uifaces](http://uifaces.com/)
+- [Unavatar](https://unavatar.io/)

package/SECURITY.md

@@ -0,0 +1,99 @@
+# Security Policy
+
+## Reporting Security Issues
+
+If you discover a security vulnerability in AdminLTE, please report it by emailing the maintainers or opening a private security advisory on GitHub. We take security seriously and will respond promptly.
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.x     | :white_check_mark: |
+| 3.x     | :x:                |
+| < 3.0   | :x:                |
+
+## Security Best Practices
+
+AdminLTE is a frontend admin dashboard template. When deploying applications built with AdminLTE, follow these security best practices:
+
+### 1. Production Deployment
+
+- **Never expose `node_modules` directory** in production environments
+- **Remove demo/example files** (like `index2.html`, `index3.html`) from production builds
+- **Use a proper build process** that only includes necessary production assets
+- **Configure web server properly** to prevent directory traversal attacks
+
+### 2. Build Process
+
+When deploying to production:
+
+```bash
+# Build only production assets
+npm run production
+
+# Deploy only the dist/ directory contents you need
+# Typically: dist/js/adminlte.min.js and dist/css/adminlte.min.css
+```
+
+### 3. What NOT to Deploy
+
+Do not deploy these to production:
+- `node_modules/` directory
+- Example/demo HTML files (`index.html`, `index2.html`, `index3.html`, etc.)
+- Source files (`src/` directory)
+- Development configuration files
+- Documentation files
+
+## Known CVE Issues
+
+### CVE-2021-36471 (Disputed)
+
+**Status**: This CVE is **disputed** and does not represent a vulnerability in AdminLTE itself.
+
+**Issue**: CVE-2021-36471 claims AdminLTE 3.1.0 has a "Directory Traversal vulnerability" that allows remote attackers to view demo pages via `/admin/index2.html` and `/admin/index3.html`.
+
+**Clarification**:
+- The `index2.html` and `index3.html` files are **example/demo pages** intended for developer reference during development
+- This is **not a vulnerability in AdminLTE** - it is a **deployment misconfiguration** by website developers
+- The issue occurs when developers incorrectly deploy:
+  - Their entire `node_modules` folder publicly
+  - Demo/example files in production environments
+  - Without proper web server configuration
+
+**Resolution**:
+- AdminLTE 4.x has restructured the project architecture with clear separation between development demos and production assets
+- Follow the production deployment best practices above
+- Only deploy the compiled production assets from `dist/js/` and `dist/css/`
+- The original CVE researcher acknowledged this should be classified as low/info severity, not critical
+
+**For More Information**:
+- [GitHub Issue #4948](https://github.com/ColorlibHQ/AdminLTE/issues/4948)
+- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2021-36471) (marked as disputed)
+
+## Secure Development
+
+### Content Security Policy (CSP)
+
+When implementing AdminLTE in your application, consider adding appropriate Content Security Policy headers to prevent XSS attacks.
+
+### Authentication & Authorization
+
+AdminLTE is a **UI template only** and does not include authentication or authorization. You must:
+- Implement proper authentication in your backend
+- Secure all API endpoints
+- Use HTTPS in production
+- Implement proper session management
+- Follow OWASP security guidelines
+
+### Dependencies
+
+- Keep AdminLTE and its dependencies up to date
+- Regularly run `npm audit` to check for vulnerabilities
+- Review security advisories for Bootstrap and other dependencies
+
+## Contact
+
+For security concerns, please contact the maintainers through:
+- GitHub Issues (for general questions)
+- GitHub Security Advisories (for sensitive security issues)
+- Project maintainer email (check package.json)