CoreUI PRO v5.27.0 - Accessibility, Security & MultiSelect Improvements

We are excited to announce the release of CoreUI PRO v5.27.0 for Bootstrap. This release brings extensive accessibility improvements across the Autocomplete, Calendar, Multi Select, Range Slider, and Rating components, security hardening through a shared sanitizer, and a range of picker fixes.

---

Speed up your responsive apps and websites with fully-featured, ready-to-use open-source admin panel templates—free to use and built for efficiency.

---

How to Update

To update your project to CoreUI PRO v5.27.0, follow these steps:

1. Open your project’s package.json.
2. Locate the @coreui/coreui-pro entry under dependencies and update the version number to 5.27.0.
3. Save your changes to the package.json file.
4. In your project’s root directory, run the update command appropriate for your package manager:
   • For npm users, execute npm install.
   • For yarn users, execute yarn install.
   • For pnpm users, execute pnpm install.

What’s New

Accessibility

• Autocomplete: Exposes options as ARIA options with aria-controls wiring, announces no-results via a role="status" live region, and supports Home/End keys to focus the first/last option.
• Calendar: Day cells now carry a full-date aria-label and today’s date is marked.
• MultiSelect: Home/End keys focus the first/last option.
• Range Slider, Rating, Password Input: Improved accessibility labeling of form controls.
• Tooltip: Dismisses on the Escape key, in line with WCAG 1.4.13.
• OTP Input: Sets autocomplete=one-time-code for SMS autofill.

Security

• Sanitizer: Added a shared escapeHtml helper and SVGAllowlist.
• Autocomplete: Option labels are now escaped in highlighting to prevent XSS.
• Chip: Selected and remove icons are sanitized before injection.
• Rating, Range Slider, Calendar, Date Range Picker, pickers: Closed sanitize bypasses via data attributes and routed config strings through the sanitizer.

Bug Fixes

• MultiSelect: Hides the select-all control when a search yields no results.
• Date Picker: Disables the Today button when today’s date is disabled.
• Time Picker: Labels the hour column by picker mode rather than the locale default.
• Autocomplete: Selects the clicked option with allowOnlyDefinedOptions.
• Loading Button: Allows submit buttons to submit their form.
• Browser Compatibility: Avoided Array.prototype.at() to support the declared browser range.

Documentation & Tooling

• Migrated the documentation to the shared @coreui/astro-docs engine and upgraded to Astro 7.
• Added an AI Tools section (MCP Server and LLMs.txt) with a getting-started page.
• Synced the upstream CoreUI v5.9.0 changes and hardened CI and Dependabot configuration.

Migration Notes

This is a feature release with no breaking changes announced in the published release notes. After upgrading:

1. Install updated dependencies.
2. Run your test suite and verify the build.
3. Review picker, Autocomplete, and Multi Select interactions and any custom icon usage.

---

For the latest package files and update access, visit CoreUI Downloads.