Bootstrap, the CSS framework powering roughly 19% of websites, shipped version 5.3.9 today, ending a 14-month gap since the last patch. The headline feature is a new .modal-xxl size sized to 1320px, alongside accessibility fixes and a tooltip/popover literal-text correction. More importantly for security teams, the release introduced staged npm publishing that requires 2FA-gated maintainer approval and OIDC trusted publishing to eliminate stored tokens. It's a non-breaking patch on the actively supported 5.x line with no known CVEs, landing while the team pivoted to the just-announced Bootstrap 6 alpha.

Bootstrap 5.3.9 Ships After a 14-Month Wait, Adds a New Modal Size and Hardens Its npm Publishing

The CSS framework behind roughly 19% of all websites got its first real feature bump in over a year, plus a security-process change you won't see in your code.

Bootstrap released version 5.3.9 today, per principal maintainer Mark Otto ("mdo"). The tag now carries the "Latest" badge on the project's GitHub releases page, so if you're on the 5.x line, this is the version you should be running.

At first glance, a .3.9 patch looks like routine maintenance. It mostly is. But three things here are worth your attention, and only one of them shows up in your compiled CSS.

Keep in mind that the ~14-month gap since the last patch is really the story here. 5.3.8 shipped on August 25, 2025. The team had been focused on Bootstrap 6. On October 8, 2026, they dropped the first alpha of that next major version, and the 5.3 line has mostly been coasting on upkeep since.

The one feature you'll actually use

The headline change is a new modal size. .modal-xxl. It's the fourth optional size, sized to match the framework's xxl container at 1320px. Before this, you topped out at .modal-xl.

The work comes from pull request #43291 by @julien-deramond and closes an issue open since 2024. It was really a port of an earlier, never-merged pull request that had to be reworked when the docs site moved from Hugo to Astro. It was also backported to Bootstrap 6, so expect it in the next major version too.

There are smaller things too. The decorative glow and wave animations in skeleton-loaders now sit behind the prefers-reduced-motion media query. Tooltips and popovers now preserve literal text from data attributes, so "9.90" keeps its trailing zero instead of getting trimmed. HTML content still runs through the existing sanitizer, which makes this a correctness fix rather than a security patch. For what it's worth, the famous XSS holes in Bootstrap 2.x and 3.x didn't touch the current line.

The rest is docs and build work, exactly what you'd expect from a patch. Docs search moved from Algolia DocSearch to local Pagefind. Broken links now trip CI. A translation link tied to a supply-chain attack got pulled. And yes, "falsie" became "falsely."

The change that doesn't show up in your stylesheet

Here's the bit most developers won't care about and security teams should. Merged the day before the release, pull request #43335 stages npm packages on publish and requires a maintainer to explicitly approve each one. That approval needs two-factor authentication. Publishing runs on npm's trusted publishing with OIDC auth via GitHub Actions, meaning no npm token is stored or ever in play. That's a genuine bite out of the attack surface for one of the most-copied packages on the registry.

For a package this widely mirrored, moving from token-based publishing to 2FA-gated approval plus OIDC trusted publishing is a real hygiene win. It also quietly puts Bootstrap ahead of many peers on release process.

The maintainer notes reveal some of the friction behind the curtain, though. The build had to pin npm 11.21.1 because npm 12 rejected a version_short config still used by the v5 scripts. The dry runs were tested against a throwaway 5.3.9 version and against 6.0.0-alpha.1, with nothing actually uploaded during testing.

What it means for you

Bootstrap 5.3.9 is a patch on the maintained 5.x line with no breaking changes. It stays MIT-licensed and depends only on @popperjs/core at runtime. There are no known CVEs for Bootstrap 5 — mdo has publicly said as much, and databases like Snyk report nothing for the modern package. The scary CVEs floating around, CVE-2019-8331 among them, all hit the 2.x, 3.x, and 4.x lines, which are long past end of life.

If you're under a compliance regime like SOC 2 or PCI DSS, staying on 5.x is the sensible move. EOL versions tend to trip audit findings in your SBOM.

npm i bootstrap@5.3.9

Head here to the GitHub releases page.