Skip to content

Bump handlebars from 4.0.11 to 4.1.2#48

Merged
iamogbz merged 1 commit into
masterfrom
dependabot/npm_and_yarn/handlebars-4.1.2
Jul 11, 2019
Merged

Bump handlebars from 4.0.11 to 4.1.2#48
iamogbz merged 1 commit into
masterfrom
dependabot/npm_and_yarn/handlebars-4.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 11, 2019

Copy link
Copy Markdown
Contributor

Bumps handlebars from 4.0.11 to 4.1.2.

Changelog

Sourced from handlebars's changelog.

v4.1.2 - April 13th, 2019

Chore/Test:

  • #1515 - Port over linting and test for typings (@​zimmi88)
  • chore: add missing typescript dependency, add package-lock.json - 594f1e3
  • test: remove safari from saucelabs - 871accc

Bugfixes:

  • fix: prevent RCE through the "lookup"-helper - cd38583

Compatibility notes:

Access to the constructor of a class thought {{lookup obj "constructor" }} is now prohibited. This closes
a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described
in #1495. We will not increase the major version, because such use is not intended or documented,
and because of the potential impact of the issue (we fear that most people won't use a new major version
and the issue may not be resolved on many systems).

Commits

v4.1.1 - March 16th, 2019

Bugfixes:

  • fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62

Refactorings:

  • replace "async" with "neo-async" - 048f2ce
  • use "substring"-function instead of "substr" - 445ae12

Compatibility notes:

  • This is a bugfix release. There are no breaking change and no new features.

Commits

v4.1.0 - February 7th, 2019

New Features

  • import TypeScript typings - 27ac1ee

Security fixes:

  • disallow access to the constructor in templates to prevent RCE - 42841c4, #1495

Housekeeping

  • chore: fix components/handlebars package.json and auto-update on release - bacd473
  • chore: Use node 10 to build handlebars - 78dd89c
  • chore/doc: Add more release docs - 6b87c21
... (truncated)
Commits
  • 10b5fcf v4.1.2
  • dd0144c Update release notes
  • 594f1e3 chore: add missing typescript dependency, add package-lock.json
  • 871accc test: remove safari from saucelabs
  • cd38583 fix: prevent RCE through the "lookup"-helper
  • c454d94 Merge pull request #1515 from zimmi88/4.x-typings-lint
  • 9cfb5dd Merge pull request #1516 from phil-davis/revert-double-release-notes
  • be44246 Remove triplicate of v4.0.12 release notes
  • 002561b Revert "Update release notes"
  • 3fb6687 Port over linting and test for typings
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 11, 2019
@iamogbz iamogbz merged commit 1a451ff into master Jul 11, 2019
@iamogbz iamogbz deleted the dependabot/npm_and_yarn/handlebars-4.1.2 branch July 11, 2019 11:31
@coveralls

coveralls commented Jul 11, 2019

Copy link
Copy Markdown

Pull Request Test Coverage Report for Build 320

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 4 unchanged lines in 1 file lost coverage.
  • Overall coverage decreased (-1.6%) to 77.53%
Files with Coverage Reduction New Missed Lines %
src/app/reporting/BundleWatchService/index.js 4 74.07%
Totals Coverage Status
Change from base Build 314: -1.6%
Covered Lines: 258
Relevant Lines: 318
💛 - Coveralls

kkrishguptaa referenced this pull request in kkrishguptaa/reseter.css Aug 2, 2024
@renovate
chore(deps): update dependencies (#274)
116e804 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[@semantic-release/github](https://togithub.com/semantic-release/github)
| [`10.1.0` ->
`10.1.3`](https://renovatebot.com/diffs/npm/@semantic-release%2fgithub/10.1.0/10.1.3)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@semantic-release%2fgithub/10.1.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@semantic-release%2fgithub/10.1.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@semantic-release%2fgithub/10.1.0/10.1.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@semantic-release%2fgithub/10.1.0/10.1.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [bundlewatch](https://togithub.com/bundlewatch/bundlewatch) | [`0.3.3`
-> `0.4.0`](https://renovatebot.com/diffs/npm/bundlewatch/0.3.3/0.4.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/bundlewatch/0.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/bundlewatch/0.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/bundlewatch/0.3.3/0.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/bundlewatch/0.3.3/0.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [postcss](https://postcss.org/)
([source](https://togithub.com/postcss/postcss)) | [`8.4.39` ->
`8.4.40`](https://renovatebot.com/diffs/npm/postcss/8.4.39/8.4.40) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.4.40?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/postcss/8.4.40?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/postcss/8.4.39/8.4.40?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.4.39/8.4.40?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>semantic-release/github
(@&#8203;semantic-release/github)</summary>

###
[`v10.1.3`](https://togithub.com/semantic-release/github/releases/tag/v10.1.3)

[Compare
Source](https://togithub.com/semantic-release/github/compare/v10.1.2...v10.1.3)

##### Bug Fixes

- Revert "fix: failing release due to renamed repository
([#&#8203;878](https://togithub.com/semantic-release/github/issues/878))"
([#&#8203;887](https://togithub.com/semantic-release/github/issues/887))
([325952e](https://togithub.com/semantic-release/github/commit/325952e3a9fab8e728ba250890587f6af85cfa9e))

###
[`v10.1.2`](https://togithub.com/semantic-release/github/releases/tag/v10.1.2)

[Compare
Source](https://togithub.com/semantic-release/github/compare/v10.1.1...v10.1.2)

##### Bug Fixes

- failing release due to renamed repository
([#&#8203;878](https://togithub.com/semantic-release/github/issues/878))
([76fdaa3](https://togithub.com/semantic-release/github/commit/76fdaa31cd623a3df1c4e51ae1ed4434a24a2c3e))

###
[`v10.1.1`](https://togithub.com/semantic-release/github/releases/tag/v10.1.1)

[Compare
Source](https://togithub.com/semantic-release/github/compare/v10.1.0...v10.1.1)

##### Bug Fixes

- invalid GraphQL query generated when no release commits are found
([#&#8203;876](https://togithub.com/semantic-release/github/issues/876))
([8ee2744](https://togithub.com/semantic-release/github/commit/8ee2744905e73137b3e24b2f56b37ff4451c32f7))

</details>

<details>
<summary>bundlewatch/bundlewatch (bundlewatch)</summary>

###
[`v0.4.0`](https://togithub.com/bundlewatch/bundlewatch/releases/tag/v0.4.0)

[Compare
Source](https://togithub.com/bundlewatch/bundlewatch/compare/v0.3.3...v0.4.0)

#### What's Changed

> \[!WARNING]
> The minimum Node version supported is now **16**, but it may work fine
with older versions.

##### Features

- feat: support mjs and cjs extensions by
[@&#8203;EdieLemoine](https://togithub.com/EdieLemoine) in
[https://github.com/bundlewatch/bundlewatch/pull/460](https://togithub.com/bundlewatch/bundlewatch/pull/460)

##### Bug Fixes and Chores

- chore: fix linter by [@&#8203;charpeni](https://togithub.com/charpeni)
in
[https://github.com/bundlewatch/bundlewatch/pull/467](https://togithub.com/bundlewatch/bundlewatch/pull/467)
- chore: bump node to `20.15.1` (LTS) by
[@&#8203;charpeni](https://togithub.com/charpeni) in
[https://github.com/bundlewatch/bundlewatch/pull/468](https://togithub.com/bundlewatch/bundlewatch/pull/468)
- fix: normalizing file paths accidentally returning empty file path by
[@&#8203;cheapsteak](https://togithub.com/cheapsteak) in
[https://github.com/bundlewatch/bundlewatch/pull/453](https://togithub.com/bundlewatch/bundlewatch/pull/453)
- chore: bump `babel` by
[@&#8203;charpeni](https://togithub.com/charpeni) in
[https://github.com/bundlewatch/bundlewatch/pull/469](https://togithub.com/bundlewatch/bundlewatch/pull/469)
- `s/messsage/message` by
[@&#8203;charpeni](https://togithub.com/charpeni) in
[https://github.com/bundlewatch/bundlewatch/pull/48](https://togithub.com/bundlewatch/bundlewatch/pull/48)

##### CVEs

- build(deps): bump minimist from 1.2.5 to 1.2.8 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/461](https://togithub.com/bundlewatch/bundlewatch/pull/461)
- build(deps): bump json5 from 1.0.1 to 1.0.2 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/459](https://togithub.com/bundlewatch/bundlewatch/pull/459)
- build(deps): bump qs from 6.5.2 to 6.5.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/458](https://togithub.com/bundlewatch/bundlewatch/pull/458)
- build(deps): bump axios from 0.24.0 to 0.28.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/472](https://togithub.com/bundlewatch/bundlewatch/pull/472)
- build(deps): bump braces from 3.0.2 to 3.0.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/471](https://togithub.com/bundlewatch/bundlewatch/pull/471)
- build(deps): bump semver from 5.7.1 to 5.7.2 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/473](https://togithub.com/bundlewatch/bundlewatch/pull/473)
- build(deps): bump word-wrap from 1.2.3 to 1.2.5 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/474](https://togithub.com/bundlewatch/bundlewatch/pull/474)
- build(deps): bump ws from 7.5.6 to 7.5.10 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/475](https://togithub.com/bundlewatch/bundlewatch/pull/475)
- build(deps): bump
[@&#8203;babel/traverse](https://togithub.com/babel/traverse) from
7.16.8 to 7.24.8 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/476](https://togithub.com/bundlewatch/bundlewatch/pull/476)
- build(deps): bump minimatch from 3.0.4 to 3.1.2 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/477](https://togithub.com/bundlewatch/bundlewatch/pull/477)
- build(deps): bump hosted-git-info from 2.7.1 to 2.8.9 in the
npm_and_yarn group by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/bundlewatch/bundlewatch/pull/478](https://togithub.com/bundlewatch/bundlewatch/pull/478)

#### New Contributors

- [@&#8203;EdieLemoine](https://togithub.com/EdieLemoine) made their
first contribution in
[https://github.com/bundlewatch/bundlewatch/pull/460](https://togithub.com/bundlewatch/bundlewatch/pull/460)
🎉

**Full Changelog**:
bundlewatch/bundlewatch@v0.3.3...v0.4.0

</details>

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.4.40`](https://togithub.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8440)

[Compare
Source](https://togithub.com/postcss/postcss/compare/8.4.39...8.4.40)

- Moved to getter/setter in nodes types to help Sass team (by
[@&#8203;nex3](https://togithub.com/nex3)).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View the
[repository job
log](https://developer.mend.io/github/kkrishguptaa/reseter.css).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iamogbz iamogbz iamogbz approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@coveralls @iamogbz