{"action":"created","issue":{"url":"https://api.github.com/repos/filip373/todolist-api/issues/95","repository_url":"https://api.github.com/repos/filip373/todolist-api","labels_url":"https://api.github.com/repos/filip373/todolist-api/issues/95/labels{/name}","comments_url":"https://api.github.com/repos/filip373/todolist-api/issues/95/comments","events_url":"https://api.github.com/repos/filip373/todolist-api/issues/95/events","html_url":"https://github.com/filip373/todolist-api/pull/95","id":307165065,"number":95,"title":"🚨 [security] Update loofah: 2.2.0 → 2.2.1 (patch)","user":{"login":"depfu[bot]","id":23717796,"avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":855554831,"url":"https://api.github.com/repos/filip373/todolist-api/labels/depfu","name":"depfu","color":"0000ff","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-21T09:11:27Z","updated_at":"2018-04-01T12:27:47Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/filip373/todolist-api/pulls/95","html_url":"https://github.com/filip373/todolist-api/pull/95","diff_url":"https://github.com/filip373/todolist-api/pull/95.diff","patch_url":"https://github.com/filip373/todolist-api/pull/95.patch"},"body":"\n\n<hr>\n\n🚨 <b>Your version of loofah has known security vulnerabilities</b> 🚨\n\nAdvisory: CVE-2018-8048\nDisclosed: March 16, 2018\nURL: [https://github.com/flavorjones/loofah/issues/144](https://bounce.depfu.com/github.com/flavorjones/loofah/issues/144)\n\n<details>\n<summary>Loofah XSS Vulnerability</summary>\n<blockquote>\n  <p>Loofah allows non-whitelisted attributes to be present in sanitized<br>\noutput when input with specially-crafted HTML fragments.</p>\n</blockquote>\n</details>\n<br>\n🚨 <b>We recommend to merge and deploy this update as soon as possible!</b> 🚨\n<hr>\n\n\nWe've updated a dependency and here is what you need to know:\n\n| name | version specification | old version | new version |\n| --- | --- | --- | --- |\n| loofah | _indirect dependency_ | 2.2.0 | 2.2.1 |\n\n\n\nYou should probably take a good look at the info here and the test results before merging this pull request, of course.\n\n### What changed?\n\n\n#### ↗️ loofah (_indirect_, 2.2.0 → 2.2.1) · [Repo](http://github.com/flavorjones/loofah) · [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)\n\n<details>\n<summary>Release Notes</summary>\n<p>From the <a href=\"https://github.com/flavorjones/loofah/releases/tag/v2.2.1\">Github release</a>:</p>\n\n<p>Notably, this release mitigates <a href=\"https://bounce.depfu.com/github.com/flavorjones/loofah/issues/144\">CVE-2018-8048</a>.</p>\n</details>\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/flavorjones/loofah/compare/adc0c3ffd5a704a346a7fb4f7eff4d53a8613303...7541374548ee9be53c463a3172cf4d28356ebe1c\">See the full diff on Github</a>. The new version differs by 8 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/7541374548ee9be53c463a3172cf4d28356ebe1c\"><code>version bump to 2.2.1</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/70bd089c31eac06f6156893aab0b2665fb9cf320\"><code>update Manifest.txt and CHANGELOG.md</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/332ec6a7086fbb38cf08a905aed7c8a3ee43e505\"><code>Merge branch &#39;flavorjones-remediate-attribute-escaping&#39;</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116\"><code>tests and fix for CVE-2018-8048</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/0c97c745aaec27f7bba4edd74be0e7d7cb9b82ad\"><code>SECURITY.md to publish vuln reporting process</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/d64b74d13f6c50c18a9a7168cdcc09b9be5b63d9\"><code>bump the fake gemspec</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/08cc1100ecba81c47184d1b1fe7131f500d2ba15\"><code>fix remaining rdoc format in README</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/de7621e59d89bb2a4f6cc791614c5dc88f178193\"><code>fix Hoe config to use README.md</code></a></li>\n</ul>\n</details>\n\n\n\n\n---\n[Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`.\n\n![Depfu Status](https://depfu.com/badges/7db8d930e4f822c9016113c0204d7cda/stats.svg)\n\n"},"comment":{"url":"https://api.github.com/repos/filip373/todolist-api/issues/comments/377783346","html_url":"https://github.com/filip373/todolist-api/pull/95#issuecomment-377783346","issue_url":"https://api.github.com/repos/filip373/todolist-api/issues/95","id":377783346,"user":{"login":"depfu[bot]","id":23717796,"avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-04-01T12:27:47Z","updated_at":"2018-04-01T12:27:47Z","author_association":"NONE","body":"Closing because this update has already been applied"}}
{"actor":{"display_login":"depfu"}}