Changelog
*Sourced from [realms-shim's changelog](https://github.com/Agoric/realms-shim/blob/master/NEWS.md).*
> ## Release 1.2.1 (16-Oct-2019)
>
> SECURITY UPDATE: This release fixes a sandbox escape found by GitHub user
> "XmiliaH". All users should update to this version.
>
> * Evaluate all "transform functions" in the target Realm, to avoid leaking
> parent-Realm objects to those functions.
> * Use pre-extracted `Array.reduce` instead of the transform list's alleged
> `.reduce` method.
> * For more details, see
> https://github.com/Agoric/realms-shim/security/advisories/GHSA-7cg8-pq9v-x98q
>
> Non-security fixes:
>
> * Improve how functions get stringified, so the `esm` module loader will
> cause fewer changes to the source code. ([#67](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/67))
Commits
- [`7c4d47c`](https://github.com/Agoric/realms-shim/commit/7c4d47c9097ba189d3320057ccdf7d4383899014) release 1.2.1
- [`f14c1ea`](https://github.com/Agoric/realms-shim/commit/f14c1ea7c0e988e7f39076549d5e13f44ca3e703) Merge 'fix-transform'
- [`6184c7a`](https://github.com/Agoric/realms-shim/commit/6184c7a6997e482d593e7c60e40a7f6e57d8a744) Resolve issues with transforms
- [`60f29d0`](https://github.com/Agoric/realms-shim/commit/60f29d0f9cc5cd1c04c9ad3b5e75c70a459baf86) Refactor evaluation stringified functions ([#69](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/69))
- [`b72dc32`](https://github.com/Agoric/realms-shim/commit/b72dc324126cad5143c3de0639eadc1807287289) Make endowments writable. ([#68](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/68))
- [`b19cecf`](https://github.com/Agoric/realms-shim/commit/b19cecf0ec8cba8d614081f45f4cec6e8dea2147) Improve stringify of functions ([#67](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/67))
- [`a7407f9`](https://github.com/Agoric/realms-shim/commit/a7407f95bfbfa34ec39ddbdca4ad7a022938f232) 1.2.1-dev.0
- See full diff in [compare view](https://github.com/Agoric/realms-shim/compare/v1.2.0...v1.2.1)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Agoric/PlaygroundVat/network/alerts).
Bumps realms-shim from 1.2.0 to 1.2.1.
Changelog
*Sourced from [realms-shim's changelog](https://github.com/Agoric/realms-shim/blob/master/NEWS.md).* > ## Release 1.2.1 (16-Oct-2019) > > SECURITY UPDATE: This release fixes a sandbox escape found by GitHub user > "XmiliaH". All users should update to this version. > > * Evaluate all "transform functions" in the target Realm, to avoid leaking > parent-Realm objects to those functions. > * Use pre-extracted `Array.reduce` instead of the transform list's alleged > `.reduce` method. > * For more details, see > https://github.com/Agoric/realms-shim/security/advisories/GHSA-7cg8-pq9v-x98q > > Non-security fixes: > > * Improve how functions get stringified, so the `esm` module loader will > cause fewer changes to the source code. ([#67](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/67))Commits
- [`7c4d47c`](https://github.com/Agoric/realms-shim/commit/7c4d47c9097ba189d3320057ccdf7d4383899014) release 1.2.1 - [`f14c1ea`](https://github.com/Agoric/realms-shim/commit/f14c1ea7c0e988e7f39076549d5e13f44ca3e703) Merge 'fix-transform' - [`6184c7a`](https://github.com/Agoric/realms-shim/commit/6184c7a6997e482d593e7c60e40a7f6e57d8a744) Resolve issues with transforms - [`60f29d0`](https://github.com/Agoric/realms-shim/commit/60f29d0f9cc5cd1c04c9ad3b5e75c70a459baf86) Refactor evaluation stringified functions ([#69](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/69)) - [`b72dc32`](https://github.com/Agoric/realms-shim/commit/b72dc324126cad5143c3de0639eadc1807287289) Make endowments writable. ([#68](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/68)) - [`b19cecf`](https://github.com/Agoric/realms-shim/commit/b19cecf0ec8cba8d614081f45f4cec6e8dea2147) Improve stringify of functions ([#67](https://github-redirect.dependabot.com/Agoric/realms-shim/issues/67)) - [`a7407f9`](https://github.com/Agoric/realms-shim/commit/a7407f95bfbfa34ec39ddbdca4ad7a022938f232) 1.2.1-dev.0 - See full diff in [compare view](https://github.com/Agoric/realms-shim/compare/v1.2.0...v1.2.1)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Agoric/PlaygroundVat/network/alerts).