search

whitlockjc / json-refs

Various utilities for JSON Pointers (http://tools.ietf.org/html/rfc6901) and JSON References (http://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03).
MIT License
226 stars 64 forks source link

Bump handlebars from 3.0.6 to 3.0.7 #172

Closed dependabot[bot] closed 4 years ago

dependabot[bot] commented 4 years ago

Bumps handlebars from 3.0.6 to 3.0.7.

Changelog *Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/v3.0.7/release-notes.md).* > ## v3.0.7 - June 30th, 2019 > Security fixes: > > - [#1532](https://github-redirect.dependabot.com/wycats/handlebars.js/pull/1532) - Backport security fixes to 3.x branch ([@​mattolson](https://api.github.com/users/mattolson)) > > Housekeeping > > - disable saucelabs-tests since the tunnel is not working - 95f33b1 > - update grunt-saucelabs and aws dependency - 09aaa56 > - fix package.json of components/handlebars.js repo - 7cf753b > - Fix Travis by updating git tag retrieval - 7c3944015d30a4348ae66ec1736b752cd864d5c1 > - Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 7820b207e123babd0bda0b4871790f2ea6b36b01 > > Tests: > > - test: run appveyor tests in Node 10 - 420ac171a01b8777ebce0a777221754fcc72a5a8 > - Fix build on Windows - 47adcda48530ab1504b8019fe17eaedd4f4c943f > > > Compatibility notes: > > Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent > Remote Code Execution. This means that following construct will no work anymore: > > ``` > class SomeClass { > } > > SomeClass.staticProperty = 'static' > > var template = Handlebars.compile('{{constructor.staticProperty}}'); > document.getElementById('output').innerHTML = template(new SomeClass()); > // expected: 'static', but now this is empty. > ``` > > This kind of access is not the intended use of Handlebars and leads to the vulnerability described in [#1495](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems). > > > > > > [Commits](https://github.com/wycats/handlebars.js/compare/v3.0.6...v3.0.7)
Commits - [`55e4d9d`](https://github.com/wycats/handlebars.js/commit/55e4d9d80d5dd834fcf53c528e7e0aa080f315a5) v3.0.7 - [`bae88eb`](https://github.com/wycats/handlebars.js/commit/bae88ebee929b48f408ca1a5a9b857ed22924934) Update release notes - [`c131bab`](https://github.com/wycats/handlebars.js/commit/c131bab4e8bfd698e13d8b8b1f9d85c111d669b5) chore: remove TODO comment from Gruntfile to enable clean build - [`95f33b1`](https://github.com/wycats/handlebars.js/commit/95f33b1e72f1ae4e46cd1d46a58232e00e813519) chore: disable saucelabs-tests since the tunnel is not working - [`09aaa56`](https://github.com/wycats/handlebars.js/commit/09aaa56dcd4a0ae0df2d8f3a336612f6bf97286f) chore: update grunt-saucelabs and aws dependency - [`0d6d8c3`](https://github.com/wycats/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac) Merge pull request [#1532](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1532) from mattolson/backport-security-fixes - [`7c39440`](https://github.com/wycats/handlebars.js/commit/7c3944015d30a4348ae66ec1736b752cd864d5c1) Fix Travis by updating git tag retrieval - [`7820b20`](https://github.com/wycats/handlebars.js/commit/7820b207e123babd0bda0b4871790f2ea6b36b01) Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - [`420ac17`](https://github.com/wycats/handlebars.js/commit/420ac171a01b8777ebce0a777221754fcc72a5a8) test: run appveyor tests in Node 10 - [`47adcda`](https://github.com/wycats/handlebars.js/commit/47adcda48530ab1504b8019fe17eaedd4f4c943f) Fix build on Windows - Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v3.0.6...v3.0.7)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/whitlockjc/json-refs/network/alerts).
dependabot[bot] commented 4 years ago

Looks like handlebars is no longer updatable, so this is no longer needed.