V4 dev backports and updates

.eslintignore

@@ -4,4 +4,3 @@
 /_gh_pages/
 /js/coverage/
 /site/sw.js
-/package.js

.eslintrc.json

@@ -21,7 +21,12 @@
       "warn",
       5
     ],
-    "new-cap": "off",
+    "new-cap": [
+      "error",
+      {
+        "properties": false
+      }
+    ],
     "no-console": "error",
     "no-mixed-operators": "off",
     "no-negated-condition": "off",

.github/CONTRIBUTING.md

@@ -124,10 +124,12 @@ Good pull requests—patches, improvements, new features—are a fantastic
 help. They should remain focused in scope and avoid containing unrelated
 commits.
 
-**Please ask first** before embarking on any significant pull request (e.g.
+**Please ask first** before embarking on any **significant** pull request (e.g.
 implementing features, refactoring code, porting to a different language),
 otherwise you risk spending a lot of time working on something that the
-project's developers might not want to merge into the project.
+project's developers might not want to merge into the project. For trivial
+things, or things that don't require a lot of your time, you can go ahead and
+make a PR.
 
 Please adhere to the [coding guidelines](#code-guidelines) used throughout the
 project (indentation, accurate comments, etc.) and any other requirements

CODE_OF_CONDUCT.md

@@ -40,7 +40,4 @@ Project maintainers who do not follow or enforce the Code of Conduct in good fai
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [https://www.contributor-covenant.org/version/1/4/code-of-conduct.html][version]
-
-[homepage]: https://www.contributor-covenant.org/
-[version]: https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 1.4, available at <https://www.contributor-covenant.org/version/1/4/code-of-conduct/>

js/tests/unit/tooltip.js

@@ -1170,7 +1170,7 @@ $(function () {
       })
 
     var tooltip = $trigger.data('bs.tooltip')
-    assert.strictEqual(tooltip.config.template.indexOf('script'), -1)
+    assert.strictEqual(tooltip.config.template.indexOf('href="javascript:alert(7)"'), -1)
   })
 
   QUnit.test('should allow custom sanitization rules', function (assert) {