{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/33966","repository_url":"https://api.github.com/repos/owncloud/core","labels_url":"https://api.github.com/repos/owncloud/core/issues/33966/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/33966/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/33966/events","html_url":"https://github.com/owncloud/core/pull/33966","id":393934205,"node_id":"MDExOlB1bGxSZXF1ZXN0MjQwODEzODcw","number":33966,"title":"[Security] Bump sshpk from 1.13.1 to 1.16.0 in /build","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":782687432,"node_id":"MDU6TGFiZWw3ODI2ODc0MzI=","url":"https://api.github.com/repos/owncloud/core/labels/dependencies","name":"dependencies","color":"0025ff","default":false},{"id":1030132892,"node_id":"MDU6TGFiZWwxMDMwMTMyODky","url":"https://api.github.com/repos/owncloud/core/labels/javascript","name":"javascript","color":"168700","default":false},{"id":82077581,"node_id":"MDU6TGFiZWw4MjA3NzU4MQ==","url":"https://api.github.com/repos/owncloud/core/labels/security","name":"security","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-24T22:13:19Z","updated_at":"2018-12-24T22:58:10Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/owncloud/core/pulls/33966","html_url":"https://github.com/owncloud/core/pull/33966","diff_url":"https://github.com/owncloud/core/pull/33966.diff","patch_url":"https://github.com/owncloud/core/pull/33966.patch"},"body":"Bumps [sshpk](https://github.com/joyent/node-sshpk) from 1.13.1 to 1.16.0. **This update includes security fixes.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from [The npm Advisory Database](https://npmjs.com/advisories/606).*\n\n> **Regular Expression Denial of Service**\n> Versions of `sshpk` before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.\n> \n> Affected versions: <1.13.2; >=1.14.0 <1.14.1\n\n*Sourced from The GitHub Security Advisory Database.*\n\n> **Moderate severity vulnerability that affects sshpk**\n> The sshpk NPM package is vulnerable to ReDoS when parsing crafted invalid public keys.\n> \n> Affected versions: < 1.13.2\n\n*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/401.json).*\n\n> **Denial of Service**\n> `sshpk` is vulnerable to ReDoS when parsing crafted invalid public keys\n> \n> Affected versions: <=1.13.1\n\n</details>\n<details>\n<summary>Release notes</summary>\n\n*Sourced from [sshpk's releases](https://github.com/joyent/node-sshpk/releases).*\n\n> ## v1.16.0\n>  * Add support for SPKI fingerprints, PuTTY PPK format (public-key only for now), PKCS#8 PBKDF2 encrypted private keys\r\n>  * Fix for [#48](https://github-redirect.dependabot.com/joyent/node-sshpk/issues/48)\n> \n> ## v1.15.2\n>  * New API for accessing x509 extensions in certificates\r\n>  * Fixes for [#52](https://github-redirect.dependabot.com/joyent/node-sshpk/issues/52), [#50](https://github-redirect.dependabot.com/joyent/node-sshpk/issues/50)\n> \n> ## v1.14.1\n>  * Remove all remaining usage of jodid25519 (abandoned dep)\r\n>  * Add support for DNSSEC key format\r\n>  * Add support for Ed25519 keys in PEM format (according to draft-curdle-pkix)\r\n>  * Fixes for X.509 encoding issues (asn.1 NULLs in RSA certs, cert string type mangling)\r\n>  * Performance issues parsing long SSH public keys\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`574ff21`](https://github.com/joyent/node-sshpk/commit/574ff21e77117b478baf4664856bfc4b0aa41a12) joyent/node-sshpk#18 support for PKCS8 encrypted private keys\n- [`f647cf2`](https://github.com/joyent/node-sshpk/commit/f647cf22c3258ef514d2ba098a4a6aad3492f425) joyent/node-sshpk#27 Add support for PuTTY PPK format\n- [`44aec4a`](https://github.com/joyent/node-sshpk/commit/44aec4ad8bcf7324009c92a52e4c81487cbc24b9) joyent/node-sshpk#59 want support for SPKI fingerprint format\n- [`385ff11`](https://github.com/joyent/node-sshpk/commit/385ff11efc4edd201c07f2ceee23746c13122f9c) joyent/node-sshpk#48 wish: add support for x509 certificates in text form\n- [`c7a6c68`](https://github.com/joyent/node-sshpk/commit/c7a6c6833370f69322c47e73e9f4cfdedaf4e8f4) joyent/node-sshpk#58 des-ede3-cbc encrypted keys broken\n- [`2ab4f2a`](https://github.com/joyent/node-sshpk/commit/2ab4f2a018766559252f2c3426a3735f0860ac0d) joyent/node-sshpk#56 md5 fingerprints not quite right\n- [`026ef47`](https://github.com/joyent/node-sshpk/commit/026ef4764a55648dd15f45f7f14ff9da5d1fe2ad) joyent/node-sshpk#53 stop using optional deps to fix webpack\n- [`53e23fe`](https://github.com/joyent/node-sshpk/commit/53e23feff41226826b45293bc4a9fc45f2e44afe) joyent/node-sshpk#50 Support PKCS#5 AES-256-CBC encrypted private keys\n- [`6b68d49`](https://github.com/joyent/node-sshpk/commit/6b68d49abc7876d81cfa2f3947024f4a84c21a94) joyent/node-sshpk#54 want API for accessing x509 extensions\n- [`1088992`](https://github.com/joyent/node-sshpk/commit/10889924a536c3e3a839c00a31727d60f6d55756) joyent/node-sshpk#52 Buffer no longer performs length check for hex strings i...\n- Additional commits viewable in [compare view](https://github.com/joyent/node-sshpk/compare/v1.13.1...v1.16.0)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=sshpk&package-manager=npm_and_yarn&previous-version=1.13.1&new-version=1.16.0)](https://dependabot.com/compatibility-score.html?dependency-name=sshpk&package-manager=npm_and_yarn&previous-version=1.13.1&new-version=1.16.0)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\nFinally, you can contact us by mentioning @dependabot.\n\n</details>"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/449776700","html_url":"https://github.com/owncloud/core/pull/33966#issuecomment-449776700","issue_url":"https://api.github.com/repos/owncloud/core/issues/33966","id":449776700,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0OTc3NjcwMA==","user":{"login":"codecov[bot]","id":22429695,"node_id":"MDM6Qm90MjI0Mjk2OTU=","avatar_url":"https://avatars2.githubusercontent.com/in/254?v=4","gravatar_id":"","url":"https://api.github.com/users/codecov%5Bbot%5D","html_url":"https://github.com/apps/codecov","followers_url":"https://api.github.com/users/codecov%5Bbot%5D/followers","following_url":"https://api.github.com/users/codecov%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/codecov%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/codecov%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codecov%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/codecov%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/codecov%5Bbot%5D/repos","events_url":"https://api.github.com/users/codecov%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/codecov%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-12-24T22:58:10Z","updated_at":"2018-12-24T22:58:10Z","author_association":"NONE","body":"# [Codecov](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=h1) Report\n> Merging [#33966](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=desc) into [stable10](https://codecov.io/gh/owncloud/core/commit/ab686721b53e0324dec71a9c8843a35f8606cd80?src=pr&el=desc) will **not change** coverage.\n> The diff coverage is `n/a`.\n\n[![Impacted file tree graph](https://codecov.io/gh/owncloud/core/pull/33966/graphs/tree.svg?width=650&token=bvPvzqol8M&height=150&src=pr)](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=tree)\n\n```diff\n@@             Coverage Diff             @@\n##             stable10   #33966   +/-   ##\n===========================================\n  Coverage       63.56%   63.56%           \n  Complexity      19113    19113           \n===========================================\n  Files            1264     1264           \n  Lines           75156    75156           \n  Branches         1286     1286           \n===========================================\n  Hits            47774    47774           \n  Misses          27006    27006           \n  Partials          376      376\n```\n\n| Flag | Coverage Δ | Complexity Δ | |\n|---|---|---|---|\n| #javascript | `53.32% <ø> (ø)` | `0 <ø> (ø)` | :arrow_down: |\n| #phpunit | `64.66% <ø> (ø)` | `19113 <ø> (ø)` | :arrow_down: |\n\n\n------\n\n[Continue to review full report at Codecov](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=continue).\n> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)\n> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`\n> Powered by [Codecov](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=footer). Last update [ab68672...ac75063](https://codecov.io/gh/owncloud/core/pull/33966?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).\n"}}
{"actor":{"display_login":"codecov"}}