{"action":"created","issue":{"url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/63","repository_url":"https://api.github.com/repos/emmaviolet/tictactoe","labels_url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/63/comments","events_url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/63/events","html_url":"https://github.com/emmaviolet/tictactoe/pull/63","id":334341210,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk2MzM3Nzgz","number":63,"title":"[Security] Bump uglifier from 2.5.3 to 4.1.12","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":677909667,"node_id":"MDU6TGFiZWw2Nzc5MDk2Njc=","url":"https://api.github.com/repos/emmaviolet/tictactoe/labels/dependencies","name":"dependencies","color":"0025ff","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-21T05:14:30Z","updated_at":"2018-07-02T05:13:36Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/emmaviolet/tictactoe/pulls/63","html_url":"https://github.com/emmaviolet/tictactoe/pull/63","diff_url":"https://github.com/emmaviolet/tictactoe/pull/63.diff","patch_url":"https://github.com/emmaviolet/tictactoe/pull/63.patch"},"body":"Bumps [uglifier](https://github.com/lautis/uglifier) from 2.5.3 to 4.1.12. **This update includes security fixes.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from [The Ruby Advisory Database](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/OSVDB-126747.yml).*\n\n> **uglifier incorrectly handles non-boolean comparisons during minification**\n> The upstream library for the Ruby uglifier gem, UglifyJS, is\n> affected by a vulnerability that allows a specially crafted \n> Javascript file to have altered functionality after minification.\n> \n> This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated\n> to allow potentially malicious code to be hidden within secure code, \n> and activated by the minification process.\n> \n> For more information, consult: https://zyan.scripts.mit.edu/blog/backdooring-js/\n> \n> Patched versions: >= 2.7.2\n> Unaffected versions: none\n\n</details>\n<details>\n<summary>Changelog</summary>\n\n*Sourced from [uglifier's changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md).*\n\n> ## 4.1.12 (20 June 2018)\n> \n> - update UglifyJS to [3.4.1](https://github.com/mishoo/UglifyJS2/compare/v3.4.0...v3.4.1)\n> \n> ## 4.1.11 (02 June 2018)\n> \n> - update UglifyJS to [3.3.28](https://github.com/mishoo/UglifyJS2/compare/v3.3.22...v3.3.28)\n> \n> ## 4.1.10 (21 April 2018)\n> \n> - update UglifyJS to [3.3.22](https://github.com/mishoo/UglifyJS2/compare/v3.3.20...v3.3.22)\n> \n> ## 4.1.9 (11 April 2018)\n> \n> - update UglifyJS to [3.3.20](https://github.com/mishoo/UglifyJS2/compare/v3.3.16...v3.3.20)\n> \n> ## 4.1.8 (14 March 2018)\n> \n> - update UglifyJS to [3.3.15](https://github.com/mishoo/UglifyJS2/compare/v3.3.14...v3.3.15)\n> \n> ## 4.1.7 (11 March 2018)\n> \n> - update UglifyJS to [3.3.14](https://github.com/mishoo/UglifyJS2/compare/v3.3.10...v3.3.14)\n> \n> ## 4.1.6 (08 February 2018)\n> \n> - update UglifyJS to [3.3.10](https://github.com/mishoo/UglifyJS2/compare/v3.3.9...v3.3.10)\n> - update uglify-es to [3.3.10](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.9...harmony-v3.3.10)\n> \n> ## 4.1.5 (28 January 2018)\n> \n> - update UglifyJS to [3.3.9](https://github.com/mishoo/UglifyJS2/compare/v3.3.8...v3.3.9)\n> - update uglify-es to [3.3.9](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.8...harmony-v3.3.9)\n> \n> ## 4.1.4 (22 January 2018)\n> \n> - update UglifyJS to [3.3.8](https://github.com/mishoo/UglifyJS2/compare/v3.3.5...v3.3.8)\n> - update uglify-es to [3.3.8](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.5...harmony-v3.3.8)\n> \n> ## 4.1.3 (7 January 2018)\n> \n> - update UglifyJS to 3.3.5\n> \n> ## 4.1.2 (30 December 2017)\n> \n> - update UglifyJS to 3.3.4\n> \n> ## 4.1.1 (29 December 2017)\n> \n> - update UglifyJS to 3.3.3\n></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`7acab27`](https://github.com/lautis/uglifier/commit/7acab276f146c4aba038286493c40655bc137025) Bump version to 4.1.12\n- [`2d6669b`](https://github.com/lautis/uglifier/commit/2d6669b00ebb32cef6402150b5b78d3f69a3283b) Update Rubocop to 0.57\n- [`7a5fb99`](https://github.com/lautis/uglifier/commit/7a5fb9919b361c6f90b3a8d08f705d973184113a) Update JRuby version on CI\n- [`4c0dc4f`](https://github.com/lautis/uglifier/commit/4c0dc4ffebb00fccf6c3812337a7a23822997c92) Update UglifyJS to 3.4.1\n- [`2edbb8a`](https://github.com/lautis/uglifier/commit/2edbb8a61629f9d86336c4de170305cb7731fc6b) Update UglifyJS to 3.4.0\n- [`34f1be2`](https://github.com/lautis/uglifier/commit/34f1be2c25f309cacf86c23c57e2a0309cf75630) Bump version to 4.1.11\n- [`ab188f9`](https://github.com/lautis/uglifier/commit/ab188f9c60ec2952a1f442582b85ee3b47e44cdd) Update UglifyJS to 3.3.28\n- [`1accfa8`](https://github.com/lautis/uglifier/commit/1accfa887437da041a5dbd130aac8b4ae55ca23a) Update Rubocop to 0.56.0\n- [`2c4ccb0`](https://github.com/lautis/uglifier/commit/2c4ccb0e7a3e57cff7cb204634d4fc5b66c3ed91) Bump version to 4.1.10\n- [`83d11a6`](https://github.com/lautis/uglifier/commit/83d11a67ff8d36ad1dbafdfdd4c1ece1e21777bb) Update Travis ruby versions\n- Additional commits viewable in [compare view](https://github.com/lautis/uglifier/compare/v2.5.3...v4.1.12)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/ci_status?dependency-name=uglifier&package-manager=bundler&previous-version=2.5.3&new-version=4.1.12)](https://dependabot.com/compatibility-score.html?dependency-name=uglifier&package-manager=bundler&previous-version=2.5.3&new-version=4.1.12)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\nFinally, you can contact us by mentioning @dependabot.\n\n</details>"},"comment":{"url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/comments/401674410","html_url":"https://github.com/emmaviolet/tictactoe/pull/63#issuecomment-401674410","issue_url":"https://api.github.com/repos/emmaviolet/tictactoe/issues/63","id":401674410,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTY3NDQxMA==","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-07-02T05:13:36Z","updated_at":"2018-07-02T05:13:36Z","author_association":"NONE","body":"Superseded by #64."}}
{"actor":{"display_login":"dependabot"}}