{"action":"created","issue":{"url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/137","repository_url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk","labels_url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/137/labels{/name}","comments_url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/137/comments","events_url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/137/events","html_url":"https://github.com/Thorium-Sim/thorium-kiosk/pull/137","id":364314906,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE4NTMxNjAw","number":137,"title":"[Security] Bump electron from 1.8.4 to 3.0.1","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":782919902,"node_id":"MDU6TGFiZWw3ODI5MTk5MDI=","url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/labels/dependencies","name":"dependencies","color":"0025ff","default":false},{"id":1052658043,"node_id":"MDU6TGFiZWwxMDUyNjU4MDQz","url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/labels/security","name":"security","color":"ee0701","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-27T05:53:07Z","updated_at":"2018-09-28T05:41:47Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/pulls/137","html_url":"https://github.com/Thorium-Sim/thorium-kiosk/pull/137","diff_url":"https://github.com/Thorium-Sim/thorium-kiosk/pull/137.diff","patch_url":"https://github.com/Thorium-Sim/thorium-kiosk/pull/137.patch"},"body":"Bumps [electron](https://github.com/electron/electron) from 1.8.4 to 3.0.1. **This update includes security fixes.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from The GitHub Vulnerability Alert Database.*\n\n> **CVE-2018-15685**\n> See https://electronjs.org/blog/web-preferences-fix.\n> \n> Affected versions: >= 1.8.0 < 1.8.8\n\n*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/466.json).*\n\n> **Command Injection**\n> [electron] A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windows on Electron versions (3.0.0-beta.6, 2.0.7, 1.8.7, and 1.7.15).\n> \n> Affected versions: >=1.7.0 <1.7.16 || >=1.8.0 <1.8.8 || >=2.0.0 <2.0.8 || >=3.0.0-beta.1 <3.0.0-beta.7\n\n</details>\n<details>\n<summary>Release notes</summary>\n\n*Sourced from [electron's releases](https://github.com/electron/electron/releases).*\n\n> ## electron v3.0.1\n> ## Bug Fixes/Changes \n> \n> * chore: fix await in cleanup script (backport: 3-0-x). [#14696](https://github-redirect.dependabot.com/electron/electron/issues/14696) \n> \n> * docs: specify BrowserWindow features passable to window.open. [#14702](https://github-redirect.dependabot.com/electron/electron/issues/14702) \n> \n> * Fix second-instance handler signature. [#14748](https://github-redirect.dependabot.com/electron/electron/issues/14748) \n> \n> * fix: do not set layer explicitly for frameless window. [#14736](https://github-redirect.dependabot.com/electron/electron/issues/14736) \n> \n> * fix: actually return appmetrics. [#14750](https://github-redirect.dependabot.com/electron/electron/issues/14750) \n> \n> * fix: initialize tracing controller before starting platform (3-0-x). [#14503](https://github-redirect.dependabot.com/electron/electron/issues/14503) \n> \n> * docs: clarify allowable background colors for BrowserWindow transparency (backport: 3-0-x). [#14781](https://github-redirect.dependabot.com/electron/electron/issues/14781) \n> \n> * fix: inconsistent titleBarStyle on transparent fullscreen. [#14790](https://github-redirect.dependabot.com/electron/electron/issues/14790) \n> \n> * chore: bump libcc (3-0-x). [#14809](https://github-redirect.dependabot.com/electron/electron/issues/14809) \n> \n> * fix: get background color from GtkMenuBar#menubar. [#14812](https://github-redirect.dependabot.com/electron/electron/issues/14812) \n> \n> ## electron v3.0.0\n> `v3.0.0` would not have been possible without our [App Feedback Program](https://github.com/electron/electron/blob/3-0-x/docs/tutorial/app-feedback-program.md) partners, who provided early testing and feedback during the beta cycle. Thanks to Atlassian, Atom, Microsoft Teams, Oculus, OpenFin, Slack, Symphony, VS Code, and other program members for their work. If you'd like to participate in future betas, please mail us at [info@electronjs.org](mailto:info@electronjs.org).\r\n> \r\n> ## Changes / New Features\r\n> \r\n> Major bumps to several important parts of Electron's toolchain, including Chrome `v66.0.3359.181`, Node `v10.2.0`, and V8 `v6.6.346.23.`\r\n> \r\n> * [[#12656](https://github-redirect.dependabot.com/electron/electron/pull/12656)] feat: `app.isPackaged`\r\n> * [[#12652](https://github-redirect.dependabot.com/electron/electron/pull/12652)] feat: `app.whenReady()`\r\n> * [[#13183](https://github-redirect.dependabot.com/electron/electron/pull/13183)] feat: `process.getHeapStatistics()`\r\n> * [[#12485](https://github-redirect.dependabot.com/electron/electron/pull/12485)] feat: `win.moveTop()` to move window z-order to top\r\n> * [[#13110](https://github-redirect.dependabot.com/electron/electron/pull/13110)] feat: TextField and Button APIs\r\n> * [[#13068](https://github-redirect.dependabot.com/electron/electron/pull/13068)] feat: netLog API for dynamic logging control\r\n> * [[#13539](https://github-redirect.dependabot.com/electron/electron/pull/13539)] feat: enable `webview` in sandbox renderer\r\n> * [[#14118](https://github-redirect.dependabot.com/electron/electron/pull/14118)] feat: `fs.readSync` now works with massive files\r\n> * [[#14031](https://github-redirect.dependabot.com/electron/electron/pull/14031)] feat: node `fs` wrappers to make `fs.realpathSync.native` and `fs.realpath.native` available\r\n> \r\n> ## Breaking API changes\r\n> \r\n> * [[#12362](https://github-redirect.dependabot.com/electron/electron/pull/12362)] feat: updates to menu item order control\r\n> * [[#13050](https://github-redirect.dependabot.com/electron/electron/pull/13050)] refactor: removed documented deprecated APIs\r\n>   * See [docs](https://github.com/electron/electron/blob/master/docs/api/breaking-changes.md#breaking-api-changes-30) for more details\r\n> * [[#12477](https://github-redirect.dependabot.com/electron/electron/pull/12477)] refactor: removed `did-get-response-details` and `did-get-redirect-request` events\r\n> * [[#12655](https://github-redirect.dependabot.com/electron/electron/pull/12655)] feat: default to disabling navigating on drag/drop\r\n> * [[#12993](https://github-redirect.dependabot.com/electron/electron/pull/12993)] feat: Node `v4.x` or greater is required use the `electron` npm module\r\n> * [[#12008](https://github-redirect.dependabot.com/electron/electron/pull/12008) [#12140](https://github-redirect.dependabot.com/electron/electron/pull/12140) [#12503](https://github-redirect.dependabot.com/electron/electron/pull/12503) [#12514](https://github-redirect.dependabot.com/electron/electron/pull/12514) [#12584](https://github-redirect.dependabot.com/electron/electron/pull/12584) [#12596](https://github-redirect.dependabot.com/electron/electron/pull/12596) [#12637](https://github-redirect.dependabot.com/electron/electron/pull/12637) [#12660](https://github-redirect.dependabot.com/electron/electron/pull/12660) [#12696](https://github-redirect.dependabot.com/electron/electron/pull/12696) [#12716](https://github-redirect.dependabot.com/electron/electron/pull/12716) [#12750](https://github-redirect.dependabot.com/electron/electron/pull/12750) [#12787](https://github-redirect.dependabot.com/electron/electron/pull/12787) [#12858](https://github-redirect.dependabot.com/electron/electron/pull/12858)] refactor: `NativeWindow`\r\n> * [[#11968](https://github-redirect.dependabot.com/electron/electron/pull/11968)] refactor: `menu.popup()`\r\n></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`3979315`](https://github.com/electron/electron/commit/3979315517f6014d0998c37a58e97b5568861691) Bump v3.0.1\n- [`35cb671`](https://github.com/electron/electron/commit/35cb671529b85ce3ab3430e214b8595950f0e410) fix: get background color from GtkMenuBar#menubar ([#14812](https://github-redirect.dependabot.com/electron/electron/issues/14812))\n- [`0f291f9`](https://github.com/electron/electron/commit/0f291f9d63e8c8353504512fc774c48c0556c038) chore: bump libcc (3-0-x) ([#14809](https://github-redirect.dependabot.com/electron/electron/issues/14809))\n- [`8574a55`](https://github.com/electron/electron/commit/8574a55bd848e98f79d95aecca76b1e2ce561edf) fix: inconsistent titleBarStyle on transparent fullscreen ([#14790](https://github-redirect.dependabot.com/electron/electron/issues/14790))\n- [`05a4290`](https://github.com/electron/electron/commit/05a429075e83a971442e38bad8c635a772b88609) docs: clarify allowable background colors for BrowserWindow transparency (bac...\n- [`7eb1c3f`](https://github.com/electron/electron/commit/7eb1c3fb1b37720b8662556d72eb9f7d7a2338c2) fix: initialize tracing controller before starting platform (3-0-x) ([#14503](https://github-redirect.dependabot.com/electron/electron/issues/14503))\n- [`db03841`](https://github.com/electron/electron/commit/db0384116e7c6ef25dcdf3f973876d3e6830f486) fix: actually return appmetrics ([#14750](https://github-redirect.dependabot.com/electron/electron/issues/14750))\n- [`0f8fb86`](https://github.com/electron/electron/commit/0f8fb86e1b82684f347eda80258a0636066fe18f) fix: do not set layer explicitly for frameless window ([#14736](https://github-redirect.dependabot.com/electron/electron/issues/14736))\n- [`0c3cfc5`](https://github.com/electron/electron/commit/0c3cfc50a777e5084defada5fce0bff0a02e3f7d) Fix second-instance handler signature ([#14748](https://github-redirect.dependabot.com/electron/electron/issues/14748))\n- [`8d87dff`](https://github.com/electron/electron/commit/8d87dffe011118d07bfa2d008d86a55a01dab377) docs: specify BrowserWindow features passable to window.open ([#14702](https://github-redirect.dependabot.com/electron/electron/issues/14702))\n- Additional commits viewable in [compare view](https://github.com/electron/electron/compare/v1.8.4...v3.0.1)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=electron&package-manager=npm_and_yarn&previous-version=1.8.4&new-version=3.0.1)](https://dependabot.com/compatibility-score.html?dependency-name=electron&package-manager=npm_and_yarn&previous-version=1.8.4&new-version=3.0.1)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\nFinally, you can contact us by mentioning @dependabot.\n\n</details>"},"comment":{"url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/comments/425327098","html_url":"https://github.com/Thorium-Sim/thorium-kiosk/pull/137#issuecomment-425327098","issue_url":"https://api.github.com/repos/Thorium-Sim/thorium-kiosk/issues/137","id":425327098,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTMyNzA5OA==","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-09-28T05:41:47Z","updated_at":"2018-09-28T05:41:47Z","author_association":"NONE","body":"Superseded by #138."}}
{"actor":{"display_login":"dependabot"}}