Bootstrap 4 Modules 4.7.0

What's Changed

⚠️ Breaking Changes

• Requires Jahia 8.2.0+ — Jahia 8.0 and 8.1 are end-of-life
• Requires Java 11+ — compiler target raised from Java 8 to Java 11
• Spring removed — OSGi Declarative Services only; no Spring context, no Blueprint extender

🔒 Security Fixes

• XSS: page1Title unescaped in navbar dropdown link (navbar.basenav.jsp)
• XSS: brandText unescaped in navbar body (navbar.jsp)
• Stored XSS: title/caption unescaped in carousel item body text (carouselItem.jsp)
• Stored XSS: footer property unescaped in card (card.jsp)

🐛 Bug Fixes

• Carousel indicators: active class on <button> instead of <li> — visual state broken after first slide
• Carousel: wrong guard variable ${empty ride} defaulted wrap (should be ${empty wrap})
• Carousel JS: pause/play labels injected via fn:escapeXml into <script> string — replaced with data-attribute pattern
• Pagination: disabled prev/next links keyboard-activatable after tabindex="-1" removal — restored alongside aria-disabled
• Card: dynamic tag name for header sanitized with whitelist instead of fn:escapeXml
• Package jar: was named *-root.jar — now correctly bootstrap4-package-4.7.0.jar
• Package: bootstrap4-core dependency version was literally c (typo)

♿ Accessibility (WCAG 2.1 AA)

Full WCAG 2.1 Level AA pass across all components: breadcrumb, carousel, carousel item, tabs, navbar, pagination, button/modal, alert, grid, image. Highlights:

• Carousel: accessible indicators (buttons), prev/next controls, pause/play button (WCAG 2.2.2)
• Navbar: dropdown triggers converted to <button>, aria-current="page" on active links
• All components: proper landmark regions, ARIA roles/labels, keyboard navigation

🏗️ Build

• Maven CI-friendly ${revision} — version defined once in root pom
• Package aligned with Bootstrap 5 pattern (jahia-packages-parent, full manifest entries)
• CodeQL + Dependabot enabled
• LICENSE.txt and SECURITY.md added

📖 Documentation

• CHANGELOG.md introduced
• MIGRATION.md — migration guides extracted from README
• Bootstrap 4 EOL warning with link to Bootstrap 5

Full changelog: bootstrap4-modules-4.6.8...bootstrap4-modules-4.7.0