Bumps mathjs from 3.13.1 to 3.20.2. This update includes security fixes.
Vulnerabilities fixed
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/51031497-800c-43b4-a798-95c20e0d17e9).*
> **[CVE-2017-1001003] Improper Input Validation**
> math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
>
> Affected versions: <3.17.0
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/1e6c8e7a-4371-43fe-8772-1aedc76baca1).*
> **[CVE-2017-1001002] math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. ...**
> math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
>
> Affected versions: <3.17.0; <=3.17.0
Changelog
*Sourced from [mathjs's changelog](https://github.com/josdejong/mathjs/blob/develop/HISTORY.md).*
> ## 2018-02-07, version 3.20.2
>
> - Upgraded to `typed-function@0.10.7` (bug-fix release).
> - Fixed option `implicit` not being copied from an `OperatorNode`
> when applying function `map`. Thanks [**HarrySarson**](https://github.com/HarrySarson).
> - Fixed [#995](https://github-redirect.dependabot.com/josdejong/mathjs/issues/995): spaces and underscores not property being escaped
> in `toTex()`. Thanks [**FSMaxB**](https://github.com/FSMaxB).
>
>
> ## 2018-01-17, version 3.20.1
>
> - Fixed [#1018](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1018): `simplifyCore` failing in some cases with parentheses.
> Thanks [**firepick1**](https://github.com/firepick1).
>
>
> ## 2018-01-14, version 3.20.0
>
> - Implement support for 3 or more arguments for operators `+` and `*` in
> `derivative`. Thanks [**HarrySarson**](https://github.com/HarrySarson). See [#1002](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1002).
> - Fixed `simplify` evalution of `simplify` of functions with more than two
> arguments wrongly: `simplify('f(x, y, z)') evaluated to `f(f(x, y), z)`
> instead of `f(x, y, z)`. Thanks [**joelhoover**](https://github.com/joelhoover).
> - Fixed `simplify` throwing an error in some cases when simplifying unknown
> functions, for example `simplify('f(4)')`. Thanks [**joelhoover**](https://github.com/joelhoover).
> - Fixed [#1013](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1013): `simplify` wrongly simplifing some expressions containing unary
> minus, like `0 - -x`. Thanks [**joelhoover**](https://github.com/joelhoover).
> - Fixed an error in an example in the documentation of `xor`. Thanks [**denisx**](https://github.com/denisx).
>
>
> ## 2018-01-06, version 3.19.0
>
> - Extended functions `distance` and `intersect` with support for BigNumbers.
> Thanks [**ovk**](https://github.com/ovk).
> - Improvements in function `simplify`: added a rule that allows combining
> of like terms in embedded quantities. Thanks [**joelhoover**](https://github.com/joelhoover).
>
>
> ## 2017-12-28, version 3.18.1
>
> - Fixed [#998](https://github-redirect.dependabot.com/josdejong/mathjs/issues/998): An issue with simplifying an expression containing a subtraction.
> Thanks [**firepick1**](https://github.com/firepick1).
>
>
> ## 2017-12-16, version 3.18.0
>
> - Implemented function `rationalize`. Thanks [**paulobuchsbaum**](https://github.com/paulobuchsbaum).
> - Upgraded dependencies:
> ```
> decimal.js 7.2.3 → 9.0.1 (no breaking changes affecting mathjs)
> fraction.js 4.0.2 → 4.0.4
> ... (truncated)
Commits
- [`20f317c`](https://github.com/josdejong/mathjs/commit/20f317c5243c95c3eedb62e30c8202d73da64a7e) Released mathjs v3.20.2
- [`84b7ff0`](https://github.com/josdejong/mathjs/commit/84b7ff0efa25bf9eb7529eed97e9ff239c1686af) Merge branch 'master' into develop
- [`2d212c4`](https://github.com/josdejong/mathjs/commit/2d212c45970faa1601ca9fef1ce6308820a8cd60) Update maintenance image
- [`c576c64`](https://github.com/josdejong/mathjs/commit/c576c6451ace9de358cf718fe7c43a3a716fab65) Updated history
- [`17f2a8d`](https://github.com/josdejong/mathjs/commit/17f2a8d80f1e32dc9f502aa2c52c545b4051c5ef) Merge pull request [#1022](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1022) from FSMaxB/tex-string-improvements
- [`9126130`](https://github.com/josdejong/mathjs/commit/9126130794a70ee58c0215fee476b66e4054bf65) toTex: Escape special characters in strings
- [`94ab164`](https://github.com/josdejong/mathjs/commit/94ab1642389fbc79589f06df2350d9ec139794a7) Add escape-latex as dependency
- [`a00b333`](https://github.com/josdejong/mathjs/commit/a00b333e0037dd80fb7a48951ecae210c5e1fbbf) Fixed some broken links and an example output
- [`40b9703`](https://github.com/josdejong/mathjs/commit/40b9703c048347f51afbe9f911666c720c13428a) Updated history
- [`ac59bc8`](https://github.com/josdejong/mathjs/commit/ac59bc8fa1451176e7bc70966c41f21e63c5304d) Merge pull request [#1029](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1029) from HarrySarson/forgotten-implicit2
- Additional commits viewable in [compare view](https://github.com/josdejong/mathjs/compare/v3.13.1...v3.20.2)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.
You can always request more updates by clicking Bump now in your Dependabot dashboard.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
Bumps mathjs from 3.13.1 to 3.20.2. This update includes security fixes.
Vulnerabilities fixed
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/51031497-800c-43b4-a798-95c20e0d17e9).* > **[CVE-2017-1001003] Improper Input Validation** > math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. > > Affected versions: <3.17.0 *Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/1e6c8e7a-4371-43fe-8772-1aedc76baca1).* > **[CVE-2017-1001002] math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. ...** > math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution. > > Affected versions: <3.17.0; <=3.17.0Changelog
*Sourced from [mathjs's changelog](https://github.com/josdejong/mathjs/blob/develop/HISTORY.md).* > ## 2018-02-07, version 3.20.2 > > - Upgraded to `typed-function@0.10.7` (bug-fix release). > - Fixed option `implicit` not being copied from an `OperatorNode` > when applying function `map`. Thanks [**HarrySarson**](https://github.com/HarrySarson). > - Fixed [#995](https://github-redirect.dependabot.com/josdejong/mathjs/issues/995): spaces and underscores not property being escaped > in `toTex()`. Thanks [**FSMaxB**](https://github.com/FSMaxB). > > > ## 2018-01-17, version 3.20.1 > > - Fixed [#1018](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1018): `simplifyCore` failing in some cases with parentheses. > Thanks [**firepick1**](https://github.com/firepick1). > > > ## 2018-01-14, version 3.20.0 > > - Implement support for 3 or more arguments for operators `+` and `*` in > `derivative`. Thanks [**HarrySarson**](https://github.com/HarrySarson). See [#1002](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1002). > - Fixed `simplify` evalution of `simplify` of functions with more than two > arguments wrongly: `simplify('f(x, y, z)') evaluated to `f(f(x, y), z)` > instead of `f(x, y, z)`. Thanks [**joelhoover**](https://github.com/joelhoover). > - Fixed `simplify` throwing an error in some cases when simplifying unknown > functions, for example `simplify('f(4)')`. Thanks [**joelhoover**](https://github.com/joelhoover). > - Fixed [#1013](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1013): `simplify` wrongly simplifing some expressions containing unary > minus, like `0 - -x`. Thanks [**joelhoover**](https://github.com/joelhoover). > - Fixed an error in an example in the documentation of `xor`. Thanks [**denisx**](https://github.com/denisx). > > > ## 2018-01-06, version 3.19.0 > > - Extended functions `distance` and `intersect` with support for BigNumbers. > Thanks [**ovk**](https://github.com/ovk). > - Improvements in function `simplify`: added a rule that allows combining > of like terms in embedded quantities. Thanks [**joelhoover**](https://github.com/joelhoover). > > > ## 2017-12-28, version 3.18.1 > > - Fixed [#998](https://github-redirect.dependabot.com/josdejong/mathjs/issues/998): An issue with simplifying an expression containing a subtraction. > Thanks [**firepick1**](https://github.com/firepick1). > > > ## 2017-12-16, version 3.18.0 > > - Implemented function `rationalize`. Thanks [**paulobuchsbaum**](https://github.com/paulobuchsbaum). > - Upgraded dependencies: > ``` > decimal.js 7.2.3 → 9.0.1 (no breaking changes affecting mathjs) > fraction.js 4.0.2 → 4.0.4 > ... (truncated)Commits
- [`20f317c`](https://github.com/josdejong/mathjs/commit/20f317c5243c95c3eedb62e30c8202d73da64a7e) Released mathjs v3.20.2 - [`84b7ff0`](https://github.com/josdejong/mathjs/commit/84b7ff0efa25bf9eb7529eed97e9ff239c1686af) Merge branch 'master' into develop - [`2d212c4`](https://github.com/josdejong/mathjs/commit/2d212c45970faa1601ca9fef1ce6308820a8cd60) Update maintenance image - [`c576c64`](https://github.com/josdejong/mathjs/commit/c576c6451ace9de358cf718fe7c43a3a716fab65) Updated history - [`17f2a8d`](https://github.com/josdejong/mathjs/commit/17f2a8d80f1e32dc9f502aa2c52c545b4051c5ef) Merge pull request [#1022](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1022) from FSMaxB/tex-string-improvements - [`9126130`](https://github.com/josdejong/mathjs/commit/9126130794a70ee58c0215fee476b66e4054bf65) toTex: Escape special characters in strings - [`94ab164`](https://github.com/josdejong/mathjs/commit/94ab1642389fbc79589f06df2350d9ec139794a7) Add escape-latex as dependency - [`a00b333`](https://github.com/josdejong/mathjs/commit/a00b333e0037dd80fb7a48951ecae210c5e1fbbf) Fixed some broken links and an example output - [`40b9703`](https://github.com/josdejong/mathjs/commit/40b9703c048347f51afbe9f911666c720c13428a) Updated history - [`ac59bc8`](https://github.com/josdejong/mathjs/commit/ac59bc8fa1451176e7bc70966c41f21e63c5304d) Merge pull request [#1029](https://github-redirect.dependabot.com/josdejong/mathjs/issues/1029) from HarrySarson/forgotten-implicit2 - Additional commits viewable in [compare view](https://github.com/josdejong/mathjs/compare/v3.13.1...v3.20.2)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.
You can always request more updates by clicking
Bump nowin your Dependabot dashboard.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.