Bundled legacy Bootstrap static assets flagged by security scanners

[doidevbiz]

Flask-AppBuilder ships legacy front-end assets under flask_appbuilder/static/appbuilder/. Enterprise security scanners flag Apache Superset as using assets that are outdated/vulnerable (Bootstrap 3.x line is end-of-life).
Although the Superset 6.0 release notes state Bootstrap was removed from its frontend, these concerns block or complicate compliance sign-off for deployments and therefore reduce the competitiveness of Apache Superset.

Affected files under flask_appbuilder/static/appbuilder/:

flask_appbuilder/static/appbuilder/css/bootstrap.min.css
flask_appbuilder/static/appbuilder/css/bootstrap.min.css.map
flask_appbuilder/static/appbuilder/js/bootstrap.min.js
flask_appbuilder/static/appbuilder/css/bootstrap-datepicker/bootstrap-datepicker3.min.css
flask_appbuilder/static/appbuilder/js/bootstrap-datepicker/bootstrap-datepicker.min.js
flask_appbuilder/static/appbuilder/css/select2/select2-bootstrap.min.css

Solution:
With suggestions from Thomas Richardson on the Slack channel, I did a workaround as follows:
On a fresh Superset 6.1.0 install, I removed the files listed above and ran
the following:

• Login page: works; no functional errors
• Users list, roles list, and user info pages: work after running
  superset init (an initial 403 was a permissions-sync issue, unrelated to
  the removal)
• Dashboards, charts, SQL Lab, Database connections, etc.

This suggests the assets are not required by the default login flow or by
Superset's security pages in this configuration. I have not tested other
FAB-based applications, other auth types, or FAB's server-rendered ModelViews.

Positive Impact:
Restored customers' confidence against competitors like the OEMs, as this was highlighted as a security minus for Apache Superset.

Next:
A permanent fix is strongly recommended: see dpgaspar/Flask-AppBuilder#2490 (comment)