Bump chart.js and admin-lte in /assets

[dependabot]

Removes chart.js. It's no longer used after updating ancestor dependency admin-lte. These dependencies need to be updated together.

Removes chart.js

Updates admin-lte from 2.4.18 to 4.1.0

Release notes

Sourced from admin-lte's releases.

v4.0.0

AdminLTE 4.0.0 — first stable release of the v4 line. A ground-up rewrite on Bootstrap 5.3 with no jQuery.

📖 Documentation · 🚀 Migration from v3 · 🎨 Live preview

---

Highlights

• 18 new demo pages — Calendar (FullCalendar), Kanban (SortableJS), Chat, File Manager, Projects, Mailbox (Inbox/Read/Compose), Form Wizard, Data Tables (Tabulator), Profile, Settings, Invoice, Pricing, FAQ, plus 404 / 500 / Maintenance error pages.
• Documentation overhaul — Getting Started, Customization, RTL, Migration from v3, Layout Blueprint, Recipes, Deployment, Recommended Integrations, JavaScript Plugins Overview. Split sidebar navigation so the live preview no longer feels like a docs site. Reading-friendly typography with consistent card wrappers across every page.
• FAQ rebuilt as a custom page with a hero, live search, section chips, and an accordion of 19 questions across six topics.
• Six issue fixes: #6010, #6019, #6020, #6021, #6026, #6028.
• Visible color-mode toggle in the default topbar, with localStorage persistence and prefers-color-scheme integration.
• Major dependency upgrades: ESLint 9 → 10, TypeScript 5.9 → 6, Stylelint 16 → 17, Astro 6.0 → 6.3, and refreshed minor versions across autoprefixer / postcss / rollup / sass / terser.
• Dependency tree cleanup: dropped eslint-plugin-import, eslint-config-xo*, and the legacy .eslintrc.json. Flat config only.
• Security: npm overrides for yaml and stylelint-config-twbs-bootstrap mean npm install runs without --legacy-peer-deps and reports 0 vulnerabilities.

Breaking changes from v3

v3	v4
.wrapper	.app-wrapper
.main-header	.app-header
.main-sidebar	.app-sidebar
.content-wrapper	.app-main
data-toggle	data-bs-toggle (Bootstrap 5)
data-widget="pushmenu"	data-lte-toggle="sidebar"
data-widget="treeview"	data-lte-toggle="treeview"
.dark-mode body class	data-bs-theme="dark" attribute
jQuery required	Vanilla TypeScript — no jQuery
enablePersistence defaulted on	Defaults off; opt in via data-enable-persistence="true"

See the dedicated Migration from v3 guide for the complete list and step-by-step upgrade order.

Install

npm install admin-lte@4.0.0

Or via CDN:

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/admin-lte@4.0.0/dist/css/adminlte.min.css" />
<script src="https://cdn.jsdelivr.net/npm/admin-lte@4.0.0/dist/js/adminlte.min.js"></script>

See CHANGELOG.md for the full notes.

... (truncated)

Changelog

Sourced from admin-lte's changelog.

[4.1.0] - 2026-07-02

Added

• ESM bundle and TypeScript declarations on npm: dist/js/adminlte.esm.js (+ .min) ships alongside the UMD build, generated .d.ts files ship under dist/js/types/, and package.json gains module, types, and a full exports map (with sass/style conditions and ./dist/* + ./src/scss/* subpaths). import { PushMenu } from "admin-lte" now resolves natively in Vite/webpack and type-checks out of the box — previously the package shipped a single minified UMD file with no typings at all.
• Component lifecycle API (Bootstrap-style): every JS component now has getInstance(element), getOrCreateInstance(element, config?) and dispose(), backed by a per-element WeakMap registry (instances are garbage-collected with their elements — Turbo-safe). The data API now uses delegated document-level listeners, so toggles inside content inserted after page load (AJAX partials, Turbo Frames) work without re-initialisation. PushMenu is finally controllable programmatically via PushMenu.getInstance(sidebar).
• ColorMode module in the bundle: the light/dark/auto switcher (persisted in lte-theme, OS-preference aware, [data-bs-theme-value] data-API, changed.lte.color-mode event) is now part of adminlte.js. Applications no longer need to copy the demo's inline script; the demo pages now use the bundled module. Only the tiny no-flash snippet in <head> remains inline, by design.
• bootstrap declared as a peer dependency — the Sass source imports it, so @use "admin-lte/src/scss/adminlte" now works after a plain npm install admin-lte (npm installs the peer automatically). Documented the required Sass load-path setup.
• New demo pages: a blank starter page (the most-requested v3 page, absent from v4), a dedicated ApexCharts page with six chart types, and a Users management page (searchable directory table, add-user and delete-confirmation modals, pagination). All linked from the sidebar.
• Test baseline: a vitest + happy-dom unit suite (30 tests across the component lifecycle, card/treeview/push-menu behavior, ColorMode, and slide animations) wired into npm run production; plus npm run test-a11y — an axe-core check over key built demo pages that fails on serious/critical WCAG violations, with a dedicated GitHub workflow.

Fixed

• First findings of the new axe gate, fixed at the source: breadcrumb links now use the darker link shade (Bootstrap's default blue was 4.26:1 against the content-header's gray background — below WCAG AA's 4.5:1), the direct-chat message pane is keyboard-focusable (tabindex="0" + role="log"), and muted footnote text uses text-body-secondary instead of the failing text-secondary.

Changed

• Component events overhauled (behavior change): all plugin events are now bubbling CustomEvents dispatched on the component's root element (the card, the nav item, the sidebar) — previously most were non-bubbling and card events fired on whatever was clicked, including the <i> icon. Animated actions gained cancelable "before" events (collapse/expand/remove.lte.card-widget, expand/collapse.lte.treeview, open/collapse.lte.push-menu) and their "after" events (collapsed, expanded, removed, opened, …) now fire when the animation completes, not when it starts. If you listened for card events on the tool buttons themselves, listen on the card or on document instead.
• Docs styles split out of the production CSS: the documentation/FAQ styling now compiles to a separate adminlte-docs.css, loaded only by the docs pages. Together with the 4.0.4 dedup, adminlte.min.css is down to ~40.4 KB gzip (from 46.7 KB in 4.0.3); bundlewatch budgets tightened accordingly.
• Vendored Bootstrap variables fork replaced: the 1,766-line _bootstrap-variables.scss copy (which had to be re-synced by hand every Bootstrap release) is gone; AdminLTE's ~10 actual changes now live in a small _bootstrap-overrides.scss loaded before Bootstrap's own variables. Compiled CSS is byte-identical.
• Sass deprecation policy: the build no longer silences all warnings (--quiet); it silences only dependency warnings and the known @import deprecation (--quiet-deps --silence-deprecation=import), so new deprecations in AdminLTE's own code surface at build time. All deprecated global built-ins (map-get, map-keys) migrated to the sass:map module. The full @use module-system migration is intentionally deferred until Bootstrap ships module-system Sass (Bootstrap 6) — Bootstrap 5's partials are designed around @import's shared global namespace and cannot be loaded individually via @use.
• Rewrote the color-mode docs page around the bundled ColorMode module (the old copy-paste script it showed used a stale storage key); tsconfig.json no longer carries the invalid "root": true option.

[4.0.4] - 2026-07-02

Added

• Forgot-password example page — both login pages have linked forgot-password.html since 4.0.0, but the page didn't exist (dead link in every deployed demo). Now shipped and listed in the sidebar under Examples › Version 1.
• Treeview exposes its state to assistive tech: submenu toggle links now carry aria-expanded, stamped on init and kept in sync on open/close.

Fixed

• npm packaging: the package is now built from a files allowlist instead of the .npmignore denylist. Stray local files can no longer leak into the tarball (4.0.2 shipped an untracked working file this way), and the demo/docs HTML — which SECURITY.md advises never to deploy — is no longer published to npm. Unpacked size drops from 12.7 MB to 9.0 MB (177 → 95 files). Also declares engines: node >= 20.
• CSS bundles shipped the docs-site styles twice: _docs.scss was imported from both adminlte.scss and parts/_core.scss, and Sass @import duplicates output — ~23 KB of dead weight in each of the four dist stylesheets.
• Accessibility module keyboard handling:
  • removed the document-edge Tab wrap — it acted as a page-level keyboard trap (WCAG 2.1.2), preventing keyboard users from ever tabbing out to the browser chrome
  • arrow keys are no longer intercepted inside inputs, textareas, selects, or contenteditable elements (typing in a navbar search field used to yank focus into the menu), and menu arrow-navigation only engages when focus is actually on a menu item
  • modal focus restore now captures the triggering element on show.bs.modal (capturing on shown stored an element inside the modal, so closing dropped focus to <body>); [autofocus] is respected
• Hotwired Turbo no longer duplicates injected DOM: the skip links, #live-region, and sidebar overlay are now reused when a restored <body> snapshot already contains them — previously they accumulated one copy per navigation.
• Card widget: remove() now actually removes the card from the DOM after the animation (it only hid it, so hidden form fields kept submitting); clicking the collapse toggle mid-animation reverses it instead of being swallowed; widget events now dispatch on the toggle button itself rather than a clicked <i> icon; minimize() cleans up its inline styles.
• Slide animations are cancelable: rapid-toggling a treeview or card no longer lets a stale animation timer strip styles mid-flight and desync display state.
• Treeview accordion guard compared each open item against the parent <ul> (never true), so open() on an already-open item slid its own menu shut.
• PushMenu reacts to viewport changes via matchMedia on the actual breakpoint crossing — mobile URL-bar/keyboard resizes and same-side width changes no longer re-expand a sidebar the user collapsed; the default breakpoint (991.98) now matches the CSS convention, fixing a 992px off-by-one.
• Callout variants referenced two custom properties that were never defined, so links and inline code inside callouts never recolored; the user-menu footer used --bs-light-bg, which doesn't exist in Bootstrap 5.3 (now --bs-tertiary-bg).
• Demo pages: Bootstrap JS CDN pin updated 5.3.7 → 5.3.8 to match the compiled CSS; removed the dead navbar-search button (data-widget="navbar-search" has no implementation in v4); every page now has exactly one <h1> (page titles were <h3>); breadcrumbs are wrapped in <nav aria-label="breadcrumb">; all icon-only buttons (card tools, topbar toggles) have aria-labels; auth forms have real <label>s and <main> landmarks; dated "Google+" copy updated.

Changed

• ACCESSIBILITY-COMPLIANCE.md rewritten as an accurate accessibility statement — what's implemented, what's partial (treeview keyboard pattern, drag-and-drop alternatives, touch-target sizes), and what's on the roadmap — replacing the aspirational all-checked WCAG checklist. Demo meta descriptions updated to match.
• bundlewatch budgets recalibrated: CSS budgets tightened (46 → 44 kB min+gzip) to lock in the docs-dedup win; JS budget raised (5.8 → 6.5 kB) for the behavior fixes above.

... (truncated)

Commits

• 9fa52cc chore(release): 4.1.0
• fa81f61 fix(a11y): first findings of the new axe gate, fixed at the source
• 9b60fbd feat(html): starter, ApexCharts and Users demo pages
• 467afb2 feat(test): vitest unit suite and axe accessibility gate
• 483117d refactor(scss): replace the vendored Bootstrap variables fork; adopt sass:map
• 24ea8f6 feat(js): Bootstrap-style component lifecycle, delegated data-api, bubbling e...
• 765f1dc chore(build): budgets for the new bundles; record 4.1 changes
• 6f2d97c feat(js): ship the color-mode switcher as a bundled ColorMode module
• f9db9c6 feat(css): split the docs styles into their own stylesheet
• 4da0606 feat(npm): ship ESM bundle, TypeScript declarations and an exports map
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by silkalns, a new releaser for admin-lte since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.