search

angular-ui / ui-router

The de-facto solution to flexible routing with nested views in AngularJS
http://ui-router.github.io/
MIT License
13.56k stars 3.01k forks source link

chore(deps): bump handlebars from 4.0.11 to 4.1.2 #3778

Closed dependabot[bot] closed 5 years ago

dependabot[bot] commented 5 years ago

Bumps handlebars from 4.0.11 to 4.1.2.

Changelog *Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md).* > ## v4.1.2 - April 13th, 2019 > Chore/Test: > - [#1515](https://github-redirect.dependabot.com/wycats/handlebars.js/pull/1515) - Port over linting and test for typings ([@​zimmi88](https://api.github.com/users/zimmi88)) > - chore: add missing typescript dependency, add package-lock.json - 594f1e3 > - test: remove safari from saucelabs - 871accc > > Bugfixes: > - fix: prevent RCE through the "lookup"-helper - cd38583 > > Compatibility notes: > > Access to the constructor of a class thought `{{lookup obj "constructor" }}` is now prohibited. This closes > a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility. > > This kind of access is not the intended use of Handlebars and leads to the vulnerability described > in [#1495](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, > and because of the potential impact of the issue (we fear that most people won't use a new major version > and the issue may not be resolved on many systems). > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2) > > ## v4.1.1 - March 16th, 2019 > Bugfixes: > - fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62 > > Refactorings: > - replace "async" with "neo-async" - 048f2ce > - use "substring"-function instead of "substr" - 445ae12 > > Compatibility notes: > - This is a bugfix release. There are no breaking change and no new features. > > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.1.0...v4.1.1) > > ## v4.1.0 - February 7th, 2019 > New Features > > - import TypeScript typings - 27ac1ee > > Security fixes: > > - disallow access to the constructor in templates to prevent RCE - 42841c4, [#1495](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495) > > Housekeeping > > - chore: fix components/handlebars package.json and auto-update on release - bacd473 > - chore: Use node 10 to build handlebars - 78dd89c > - chore/doc: Add more release docs - 6b87c21 > > ... (truncated)
Commits - [`10b5fcf`](https://github.com/wycats/handlebars.js/commit/10b5fcf92e6f3ddcbcec93c05c00cfdbb2e8d303) v4.1.2 - [`dd0144c`](https://github.com/wycats/handlebars.js/commit/dd0144c77127a6336b66f16415a80a9ba03cd91e) Update release notes - [`594f1e3`](https://github.com/wycats/handlebars.js/commit/594f1e30dde4a862ed40a7bad3a5b2db3ed97f3c) chore: add missing typescript dependency, add package-lock.json - [`871accc`](https://github.com/wycats/handlebars.js/commit/871acccbb1409c2864b8dfd69d936878ea3458e3) test: remove safari from saucelabs - [`cd38583`](https://github.com/wycats/handlebars.js/commit/cd38583216dce3252831916323202749431c773e) fix: prevent RCE through the "lookup"-helper - [`c454d94`](https://github.com/wycats/handlebars.js/commit/c454d946e355405d2f24d7dd1ca151ff939b206e) Merge pull request [#1515](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1515) from zimmi88/4.x-typings-lint - [`9cfb5dd`](https://github.com/wycats/handlebars.js/commit/9cfb5ddad9cbe11e443cb8c5827a83d0ce040423) Merge pull request [#1516](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1516) from phil-davis/revert-double-release-notes - [`be44246`](https://github.com/wycats/handlebars.js/commit/be442462214d37d14bf9a909644d0c4455c0771d) Remove triplicate of v4.0.12 release notes - [`002561b`](https://github.com/wycats/handlebars.js/commit/002561be948f79965d7355038ad344ae0a000f38) Revert "Update release notes" - [`3fb6687`](https://github.com/wycats/handlebars.js/commit/3fb668701363fe85eef7dd8b8fc3e451ae8bd0b9) Port over linting and test for typings - Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.0.11...v4.1.2)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
JLLeitschuh commented 5 years ago

@christopherthielen I've been the one kicking off these dependabot PR's.

I don't do any JS development anymore, but I used to manage UI-Grid so I'm getting all the notifications about these sorts of things.

christopherthielen commented 5 years ago

There's been a couple problems with the travis build that is blocking me from merging these PRs. I'll try to fix the travis build so these can get merged!

dependabot[bot] commented 5 years ago

Looks like handlebars is up-to-date now, so this is no longer needed.

christopherthielen commented 5 years ago

I fixed travis and updated all deps. thanks for the notice!