{"action":"created","issue":{"url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/140","repository_url":"https://api.github.com/repos/NdagiStanley/vue-django","labels_url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/140/labels{/name}","comments_url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/140/comments","events_url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/140/events","html_url":"https://github.com/NdagiStanley/vue-django/pull/140","id":308951435,"number":140,"title":"Scheduled daily dependency update on tuesday","user":{"login":"pyup-bot","id":16239342,"avatar_url":"https://avatars0.githubusercontent.com/u/16239342?v=4","gravatar_id":"","url":"https://api.github.com/users/pyup-bot","html_url":"https://github.com/pyup-bot","followers_url":"https://api.github.com/users/pyup-bot/followers","following_url":"https://api.github.com/users/pyup-bot/following{/other_user}","gists_url":"https://api.github.com/users/pyup-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/pyup-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pyup-bot/subscriptions","organizations_url":"https://api.github.com/users/pyup-bot/orgs","repos_url":"https://api.github.com/users/pyup-bot/repos","events_url":"https://api.github.com/users/pyup-bot/events{/privacy}","received_events_url":"https://api.github.com/users/pyup-bot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-27T12:40:11Z","updated_at":"2018-03-28T12:40:16Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/NdagiStanley/vue-django/pulls/140","html_url":"https://github.com/NdagiStanley/vue-django/pull/140","diff_url":"https://github.com/NdagiStanley/vue-django/pull/140.diff","patch_url":"https://github.com/NdagiStanley/vue-django/pull/140.patch"},"body":"\n\n\n\n\n### Update [coverage](https://pypi.python.org/pypi/coverage) from **4.4.2** to **4.5.1**.\n\n\n<details>\n  <summary>Changelog</summary>\n  \n  \n   ### 4.5.1\n   ```\n   ----------------------------\n\n- Now that 4.5 properly separated the ``[run] omit`` and ``[report] omit``\n  settings, an old bug has become apparent.  If you specified a package name\n  for ``[run] source``, then omit patterns weren&#39;t matched inside that package.\n  This bug (`issue 638`_) is now fixed.\n\n- On Python 3.7, reporting about a decorated function with no body other than a\n  docstring would crash coverage.py with an IndexError (`issue 640`_).  This is\n  now fixed.\n\n- Configurer plugins are now reported in the output of ``--debug=sys``.\n\n.. _issue 638: https://bitbucket.org/ned/coveragepy/issues/638/run-omit-is-ignored-since-45\n.. _issue 640: https://bitbucket.org/ned/coveragepy/issues/640/indexerror-reporting-on-an-empty-decorated\n\n\n.. _changes_45:\n   ```\n   \n  \n  \n   ### 4.5\n   ```\n   --------------------------\n\n- A new kind of plugin is supported: configurators are invoked at start-up to\n  allow more complex configuration than the .coveragerc file can easily do.\n  See :ref:`api_plugin` for details.  This solves the complex configuration\n  problem described in `issue 563`_.\n\n- The ``fail_under`` option can now be a float.  Note that you must specify the\n  ``[report] precision`` configuration option for the fractional part to be\n  used.  Thanks to Lars Hupfeldt Nielsen for help with the implementation.\n  Fixes `issue 631`_.\n\n- The ``include`` and ``omit`` options can be specified for both the ``[run]``\n  and ``[report]`` phases of execution.  4.4.2 introduced some incorrect\n  interactions between those phases, where the options for one were confused\n  for the other.  This is now corrected, fixing `issue 621`_ and `issue 622`_.\n  Thanks to Daniel Hahler for seeing more clearly than I could.\n\n- The ``coverage combine`` command used to always overwrite the data file, even\n  when no data had been read from apparently combinable files.  Now, an error\n  is raised if we thought there were files to combine, but in fact none of them\n  could be used.  Fixes `issue 629`_.\n\n- The ``coverage combine`` command could get confused about path separators\n  when combining data collected on Windows with data collected on Linux, as\n  described in `issue 618`_.  This is now fixed: the result path always uses\n  the path separator specified in the ``[paths]`` result.\n\n- On Windows, the HTML report could fail when source trees are deeply nested,\n  due to attempting to create HTML filenames longer than the 250-character\n  maximum.  Now filenames will never get much larger than 200 characters,\n  fixing `issue 627`_.  Thanks to Alex Sandro for helping with the fix.\n\n.. _issue 563: https://bitbucket.org/ned/coveragepy/issues/563/platform-specific-configuration\n.. _issue 618: https://bitbucket.org/ned/coveragepy/issues/618/problem-when-combining-windows-generated\n.. _issue 621: https://bitbucket.org/ned/coveragepy/issues/621/include-ignored-warning-when-using\n.. _issue 622: https://bitbucket.org/ned/coveragepy/issues/622/report-omit-overwrites-run-omit\n.. _issue 627: https://bitbucket.org/ned/coveragepy/issues/627/failure-generating-html-reports-when-the\n.. _issue 629: https://bitbucket.org/ned/coveragepy/issues/629/multiple-use-of-combine-leads-to-empty\n.. _issue 631: https://bitbucket.org/ned/coveragepy/issues/631/precise-coverage-percentage-value\n\n\n.. _changes_442:\n   ```\n   \n  \n</details>\n\n\n \n\n<details>\n  <summary>Links</summary>\n  \n  - PyPI: https://pypi.python.org/pypi/coverage\n  - Changelog: https://pyup.io/changelogs/coverage/\n  - Repo: https://bitbucket.org/ned/coveragepy\n</details>\n\n\n\n\n\n### Update [coveralls](https://pypi.python.org/pypi/coveralls) from **1.2.0** to **1.3.0**.\n\n\n<details>\n  <summary>Changelog</summary>\n  \n  \n   ### 1.3.0\n   ```\n   Features\n\n* **ci:**  add Travis PR support (162) ([baf683ee](baf683ee))\n* **cli:**  allow service_name override from cli flag or env var (167) ([e8a98904](e8a98904))\n* **coveralls-enterprise:**  add support for coveralls enterprise (166) ([7383f377](7383f377))\n* **git:**  silently omit git data when git is unavailable (176) ([f9db83cd](f9db83cd))\n* **jenkins:**\n  *  add logic to parse CI_PULL_REQUEST env variable (171) ([34a037f5](34a037f5))\n  *  add support for jenkins (160) ([4e8cd9ec](4e8cd9ec))\n\n\n\n&lt;a name=&quot;1.2.0&quot;&gt;&lt;/a&gt;\n   ```\n   \n  \n</details>\n\n\n \n\n<details>\n  <summary>Links</summary>\n  \n  - PyPI: https://pypi.python.org/pypi/coveralls\n  - Changelog: https://pyup.io/changelogs/coveralls/\n  - Repo: http://github.com/coveralls-clients/coveralls-python\n</details>\n\n\n\n\n\n### Update [Django](https://pypi.python.org/pypi/Django) from **2.0.1** to **2.0.3**.\n\n\n<details>\n  <summary>Changelog</summary>\n  \n  \n   ### 2.0.3\n   ```\n   ==========================\n\n*March 6, 2018*\n\nDjango 2.0.3 fixes two security issues and several bugs in 2.0.2. Also, the\nlatest string translations from Transifex are incorporated.\n\nCVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters\n===============================================================================================\n\nThe ``django.utils.html.urlize()`` function was extremely slow to evaluate\ncertain inputs due to catastrophic backtracking vulnerabilities in two regular\nexpressions. The ``urlize()`` function is used to implement the ``urlize`` and\n``urlizetrunc`` template filters, which were thus vulnerable.\n\nThe problematic regular expressions are replaced with parsing logic that\nbehaves similarly.\n\nCVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters\n==================================================================================================================\n\nIf ``django.utils.text.Truncator``&#39;s ``chars()`` and ``words()`` methods were\npassed the ``html=True`` argument, they were extremely slow to evaluate certain\ninputs due to a catastrophic backtracking vulnerability in a regular\nexpression. The ``chars()`` and ``words()`` methods are used to implement the\n``truncatechars_html`` and ``truncatewords_html`` template filters, which were\nthus vulnerable.\n\nThe backtracking problem in the regular expression is fixed.\n\nBugfixes\n========\n\n* Fixed a regression that caused sliced ``QuerySet.distinct().order_by()``\n  followed by ``count()`` to crash (:ticket:`29108`).\n\n* Prioritized the datetime and time input formats without ``%f`` for the Thai\n  locale to fix the admin time picker widget displaying &quot;undefined&quot;\n  (:ticket:`29109`).\n\n* Fixed crash with ``QuerySet.order_by(Exists(...))`` (:ticket:`29118`).\n\n* Made ``Q.deconstruct()`` deterministic with multiple keyword arguments\n  (:ticket:`29125`). You may need to modify ``Q``&#39;s in existing migrations, or\n  accept an autogenerated migration.\n\n* Fixed a regression where a ``When()`` expression with a list argument crashes\n  (:ticket:`29166`).\n\n* Fixed crash when using a ``Window()`` expression in a subquery\n  (:ticket:`29172`).\n\n* Fixed ``AbstractBaseUser.normalize_username()`` crash if the ``username``\n  argument isn&#39;t a string (:ticket:`29176`).\n\n\n==========================\n   ```\n   \n  \n  \n   ### 2.0.2\n   ```\n   ==========================\n\n*February 1, 2018*\n\nDjango 2.0.2 fixes a security issue and several bugs in 2.0.1.\n\nCVE-2018-6188: Information leakage in ``AuthenticationForm``\n============================================================\n\nA regression in Django 1.11.8 made\n:class:`~django.contrib.auth.forms.AuthenticationForm` run its\n``confirm_login_allowed()`` method even if an incorrect password is entered.\nThis can leak information about a user, depending on what messages\n``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn&#39;t\noverridden, an attacker enter an arbitrary username and see if that user has\nbeen set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,\nmore sensitive details could be leaked.\n\nThis issue is fixed with the caveat that ``AuthenticationForm`` can no longer\nraise the &quot;This account is inactive.&quot; error if the authentication backend\nrejects inactive users (the default authentication backend, ``ModelBackend``,\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\nas a fix to address the caveat will likely be too invasive for inclusion in\nolder versions.\n\nBugfixes\n========\n\n* Fixed hidden content at the bottom of the &quot;The install worked successfully!&quot;\n  page for some languages (:ticket:`28885`).\n\n* Fixed incorrect foreign key nullification if a model has two foreign keys to\n  the same model and a target model is deleted (:ticket:`29016`).\n\n* Fixed regression in the use of ``QuerySet.values_list(..., flat=True)``\n  followed by ``annotate()`` (:ticket:`29067`).\n\n* Fixed a regression where a queryset that annotates with geometry objects\n  crashes (:ticket:`29054`).\n\n* Fixed a regression where ``contrib.auth.authenticate()`` crashes if an\n  authentication backend doesn&#39;t accept ``request`` and a later one does\n  (:ticket:`29071`).\n\n* Fixed a regression where ``makemigrations`` crashes if a migrations directory\n  doesn&#39;t have an ``__init__.py`` file (:ticket:`29091`).\n\n* Fixed crash when entering an invalid uuid in ``ModelAdmin.raw_id_fields``\n  (:ticket:`29094`).\n\n\n==========================\n   ```\n   \n  \n</details>\n\n\n \n\n<details>\n  <summary>Links</summary>\n  \n  - PyPI: https://pypi.python.org/pypi/django\n  - Changelog: https://pyup.io/changelogs/django/\n  - Homepage: https://www.djangoproject.com/\n</details>\n\n\n\n\n\n"},"comment":{"url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/comments/376871902","html_url":"https://github.com/NdagiStanley/vue-django/pull/140#issuecomment-376871902","issue_url":"https://api.github.com/repos/NdagiStanley/vue-django/issues/140","id":376871902,"user":{"login":"pyup-bot","id":16239342,"avatar_url":"https://avatars0.githubusercontent.com/u/16239342?v=4","gravatar_id":"","url":"https://api.github.com/users/pyup-bot","html_url":"https://github.com/pyup-bot","followers_url":"https://api.github.com/users/pyup-bot/followers","following_url":"https://api.github.com/users/pyup-bot/following{/other_user}","gists_url":"https://api.github.com/users/pyup-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/pyup-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pyup-bot/subscriptions","organizations_url":"https://api.github.com/users/pyup-bot/orgs","repos_url":"https://api.github.com/users/pyup-bot/repos","events_url":"https://api.github.com/users/pyup-bot/events{/privacy}","received_events_url":"https://api.github.com/users/pyup-bot/received_events","type":"User","site_admin":false},"created_at":"2018-03-28T12:40:16Z","updated_at":"2018-03-28T12:40:16Z","author_association":"CONTRIBUTOR","body":"Closing this in favor of #141"}}
{"actor":{"display_login":"pyup-bot"}}