Add allowAccessToMethodsOnFunctions option to restore 1.x behaviour so that cwise can upgrade. (@archmoj in #31)
Do not use this option if you are not sure that you need it, as it had previously been removed for security reasons. There is a known exploit to execute arbitrary code. Only use it on trusted inputs, like the developer's JS files in a build system.
v2.0.5
Fix function bodies being invoked during declaration. (@RoboPhred in #30)
v2.0.4
Short-circuit evaluation in && and || expressions. (@RoboPhred in #28)
Start tracking changes.
v2.0.3
Disallows accessing .constructor and .__proto__ properties, which could be used to access the Function() constructor. (browserify/static-eval#27)
Thanks to an anonymous reporter!
Add allowAccessToMethodsOnFunctions option to restore 1.x behaviour so that cwise can upgrade. (@archmoj in #31)
Do not use this option if you are not sure that you need it, as it had previously been removed for security reasons. There is a known exploit to execute arbitrary code. Only use it on trusted inputs, like the developer's JS files in a build system.
2.0.5
Fix function bodies being invoked during declaration. (@RoboPhred in #30)
2.0.4
Short-circuit evaluation in && and || expressions. (@RoboPhred in #28)
This version was pushed to npm by goto-bus-stop, a new releaser for static-eval since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/gkjohnson/react-polymer-component/network/alerts).
Bumps static-eval from 2.0.0 to 2.1.0.
Release notes
Sourced from static-eval's releases.
Changelog
Sourced from static-eval's changelog.
Commits
1a4d7342.1.0054adacci: add node 1409c4b83Merge pull request #31 from archmoj/allow-cwise-transforme619afcmake option to enable allowAccessToMethodsOnFunctions namely to be used by cw...36587c2remove trailing spaces798b0d5ci: add node 12 and 13b5ab0d72.0.5aa0eaebMerge pull request #30 from RoboPhred/fix-func-decl-invoke23bc6caMerge branch 'master' into fix-func-decl-invoke9d39dd5Update repository URL in package.json.Maintainer changes
This version was pushed to npm by goto-bus-stop, a new releaser for static-eval since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/gkjohnson/react-polymer-component/network/alerts).