{"action":"created","issue":{"url":"https://api.github.com/repos/pauldruziak/eattogether/issues/11","repository_url":"https://api.github.com/repos/pauldruziak/eattogether","labels_url":"https://api.github.com/repos/pauldruziak/eattogether/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/pauldruziak/eattogether/issues/11/comments","events_url":"https://api.github.com/repos/pauldruziak/eattogether/issues/11/events","html_url":"https://github.com/pauldruziak/eattogether/pull/11","id":328895668,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkyMjg4Nzcx","number":11,"title":"[Security] Bump uglifier from 2.3.1 to 4.1.11","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":943699317,"node_id":"MDU6TGFiZWw5NDM2OTkzMTc=","url":"https://api.github.com/repos/pauldruziak/eattogether/labels/dependencies","name":"dependencies","color":"0025ff","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-04T03:18:33Z","updated_at":"2018-06-21T03:16:14Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/pauldruziak/eattogether/pulls/11","html_url":"https://github.com/pauldruziak/eattogether/pull/11","diff_url":"https://github.com/pauldruziak/eattogether/pull/11.diff","patch_url":"https://github.com/pauldruziak/eattogether/pull/11.patch"},"body":"Bumps [uglifier](https://github.com/lautis/uglifier) from 2.3.1 to 4.1.11. **This update includes security fixes.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from [The Ruby Advisory Database](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/OSVDB-126747.yml).*\n\n> **uglifier incorrectly handles non-boolean comparisons during minification**\n> The upstream library for the Ruby uglifier gem, UglifyJS, is\n> affected by a vulnerability that allows a specially crafted \n> Javascript file to have altered functionality after minification.\n> \n> This bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated\n> to allow potentially malicious code to be hidden within secure code, \n> and activated by the minification process.\n> \n> For more information, consult: https://zyan.scripts.mit.edu/blog/backdooring-js/\n> \n> Patched versions: >= 2.7.2\n> Unaffected versions: none\n\n</details>\n<details>\n<summary>Changelog</summary>\n\n*Sourced from [uglifier's changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md).*\n\n> ## 4.1.11 (02 June 2018)\n> \n> - update UglifyJS to [3.3.28](https://github.com/mishoo/UglifyJS2/compare/v3.3.22...v3.3.28)\n> \n> ## 4.1.10 (21 April 2018)\n> \n> - update UglifyJS to [3.3.22](https://github.com/mishoo/UglifyJS2/compare/v3.3.20...v3.3.22)\n> \n> ## 4.1.9 (11 April 2018)\n> \n> - update UglifyJS to [3.3.20](https://github.com/mishoo/UglifyJS2/compare/v3.3.16...v3.3.20)\n> \n> ## 4.1.8 (14 March 2018)\n> \n> - update UglifyJS to [3.3.15](https://github.com/mishoo/UglifyJS2/compare/v3.3.14...v3.3.15)\n> \n> ## 4.1.7 (11 March 2018)\n> \n> - update UglifyJS to [3.3.14](https://github.com/mishoo/UglifyJS2/compare/v3.3.10...v3.3.14)\n> \n> ## 4.1.6 (08 February 2018)\n> \n> - update UglifyJS to [3.3.10](https://github.com/mishoo/UglifyJS2/compare/v3.3.9...v3.3.10)\n> - update uglify-es to [3.3.10](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.9...harmony-v3.3.10)\n> \n> ## 4.1.5 (28 January 2018)\n> \n> - update UglifyJS to [3.3.9](https://github.com/mishoo/UglifyJS2/compare/v3.3.8...v3.3.9)\n> - update uglify-es to [3.3.9](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.8...harmony-v3.3.9)\n> \n> ## 4.1.4 (22 January 2018)\n> \n> - update UglifyJS to [3.3.8](https://github.com/mishoo/UglifyJS2/compare/v3.3.5...v3.3.8)\n> - update uglify-es to [3.3.8](https://github.com/mishoo/UglifyJS2/compare/harmony-v3.3.5...harmony-v3.3.8)\n> \n> ## 4.1.3 (7 January 2018)\n> \n> - update UglifyJS to 3.3.5\n> \n> ## 4.1.2 (30 December 2017)\n> \n> - update UglifyJS to 3.3.4\n> \n> ## 4.1.1 (29 December 2017)\n> \n> - update UglifyJS to 3.3.3\n> \n> ## 4.1.0 (28 December 2017)\n> \n> - update UglifyJS to 3.3.2\n></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`34f1be2`](https://github.com/lautis/uglifier/commit/34f1be2c25f309cacf86c23c57e2a0309cf75630) Bump version to 4.1.11\n- [`ab188f9`](https://github.com/lautis/uglifier/commit/ab188f9c60ec2952a1f442582b85ee3b47e44cdd) Update UglifyJS to 3.3.28\n- [`1accfa8`](https://github.com/lautis/uglifier/commit/1accfa887437da041a5dbd130aac8b4ae55ca23a) Update Rubocop to 0.56.0\n- [`2c4ccb0`](https://github.com/lautis/uglifier/commit/2c4ccb0e7a3e57cff7cb204634d4fc5b66c3ed91) Bump version to 4.1.10\n- [`83d11a6`](https://github.com/lautis/uglifier/commit/83d11a67ff8d36ad1dbafdfdd4c1ece1e21777bb) Update Travis ruby versions\n- [`bc1bdff`](https://github.com/lautis/uglifier/commit/bc1bdffb287c4386165dec0d0e2a494956453f92) Update UglifyJS to 3.3.22\n- [`ad7b703`](https://github.com/lautis/uglifier/commit/ad7b7035f6e6ac86961e20d171b153b08703b60e) Bump version to 4.1.9\n- [`5a92d5c`](https://github.com/lautis/uglifier/commit/5a92d5c236c2101bb554f4f012122c5ef8d5487d) Migrate braces to previous bracketize output option for consistency and backw...\n- [`3181dc6`](https://github.com/lautis/uglifier/commit/3181dc6bfd3c79a9a0a1e4e205195428024b3a8a) Update UglifyJS to 3.3.20\n- [`8072269`](https://github.com/lautis/uglifier/commit/8072269a2b437441ae0eaf08a7f70671b99ffc4a) Bump version to 4.1.8\n- Additional commits viewable in [compare view](https://github.com/lautis/uglifier/compare/v2.3.1...v4.1.11)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/ci_status?dependency-name=uglifier&package-manager=bundler&previous-version=2.3.1&new-version=4.1.11)](https://dependabot.com/compatibility-score.html?dependency-name=uglifier&package-manager=bundler&previous-version=2.3.1&new-version=4.1.11)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n**Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.\n\nYou can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use (this|these) label[s]` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use (this|these) reviewer[s]` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use (this|these) assignee[s]` will set the current assignees as the default for future PRs for this repo and language\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\nFinally, you can contact us by mentioning @dependabot.\n\n</details>"},"comment":{"url":"https://api.github.com/repos/pauldruziak/eattogether/issues/comments/398963273","html_url":"https://github.com/pauldruziak/eattogether/pull/11#issuecomment-398963273","issue_url":"https://api.github.com/repos/pauldruziak/eattogether/issues/11","id":398963273,"node_id":"MDEyOklzc3VlQ29tbWVudDM5ODk2MzI3Mw==","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-06-21T03:16:14Z","updated_at":"2018-06-21T03:16:14Z","author_association":"NONE","body":"Superseded by #12."}}
{"actor":{"display_login":"dependabot"}}