{"action":"created","issue":{"url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/283","repository_url":"https://api.github.com/repos/thetallgrassnet/pokesite","labels_url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/283/labels{/name}","comments_url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/283/comments","events_url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/283/events","html_url":"https://github.com/thetallgrassnet/pokesite/pull/283","id":293225886,"node_id":"MDExOlB1bGxSZXF1ZXN0MTY2MzExMDU4","number":283,"title":"🚨 [security] Update nokogiri: 1.8.1 → 1.8.2 (patch)","user":{"login":"depfu[bot]","id":23717796,"node_id":"MDM6Qm90MjM3MTc3OTY=","avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":691763914,"node_id":"MDU6TGFiZWw2OTE3NjM5MTQ=","url":"https://api.github.com/repos/thetallgrassnet/pokesite/labels/depfu","name":"depfu","color":"0000ff","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-01-31T16:33:34Z","updated_at":"2018-07-04T02:16:13Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/thetallgrassnet/pokesite/pulls/283","html_url":"https://github.com/thetallgrassnet/pokesite/pull/283","diff_url":"https://github.com/thetallgrassnet/pokesite/pull/283.diff","patch_url":"https://github.com/thetallgrassnet/pokesite/pull/283.patch"},"body":"\n<hr>\n\n🚨 <b>Your version of nokogiri has known security vulnerabilities</b> 🚨\n\nAdvisory: CVE-2017-15412\nDisclosed: January 29, 2018\nURL: [https://github.com/sparklemotion/nokogiri/issues/1714](https://bounce.depfu.com/github.com/sparklemotion/nokogiri/issues/1714)\n\n<details>\n<summary>libxml2 could be made to crash or run arbitrary code if it opened a specially crafted file</summary>\n<blockquote>\n  <p>The update of vendored libxml2 from 2.9.5 to 2.9.7 addresses at least one published vulnerability, CVE-2017-15412. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time.</p>\n<p>Details: It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.</p>\n</blockquote>\n</details>\n<br>\n🚨 <b>We recommend to merge and deploy this update as soon as possible!</b> 🚨\n<hr>\n\n\nWe've updated a dependency and all tests pass. \\o/\n\n| gem name | version specification | old version | new version |\n| --- | --- | --- | --- |\n| nokogiri | >= 1.7.1 | 1.8.1 | 1.8.2 |\n\n\n\nYou should probably take a good look at this before merging this pull request, of course.\n\n### What changed?\n\n\n#### ✳️ nokogiri (1.8.1 → 1.8.2) · [Repo](https://github.com/sparklemotion/nokogiri/) · [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/sparklemotion/nokogiri/compare/1fa9d1853a6ca0a20c8086907318263022d5a42c...f80f4ad9f553811435aa2c40908a49fcd26c4533\">See the full diff on Github</a>. The new version differs by 29 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/f80f4ad9f553811435aa2c40908a49fcd26c4533\"><code>version bump to 1.8.2</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/d35ed46f618e9c41e464a392fbc43df2b6cfa529\"><code>update CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/62b1a5b1a9aa32983d5dc4d09a156241f97c8797\"><code>update CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/6e14afef81a4ecac6aac9b238ec2cedb86bd9bd0\"><code>Merge pull request #1713 from sparklemotion/flavorjones-1238-segfault-reparented-entities</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/b1494e5ae55ad704efb4a7d7d3aca4294f42a0ce\"><code>ensure EntityReferences ignore malformed children</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/d3456e456328e8af9809e216204622a40d012525\"><code>update CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/bf94cf503394edf2e74462e9ff3a6b822c21bf0c\"><code>remove hacks to discover the path to `racc`</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/734d4d4763c1dee9601d7c385990e237a5eee8a9\"><code>Merge pull request #1704 from larskanis/win-ruby-2.5</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/cc80904c9770e83df97548e02f5c829fe24a25bc\"><code>Appveyor: Add ruby-2.4 and ruby-head to build matrix</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/992d81b5bd3a41c4c928700095e2d7dc6663b6d8\"><code>Windows: Add cross build for ruby-2.5</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/53750f78c03e820702a1ab234a035eecfd399baf\"><code>Merge branch '1688-upgrade-libxml-to-2.9.7'</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/b934748148749a553d2353694bc85afe233cd2ae\"><code>update CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/a0c6f9b29184516da9eddf432d12da120039625a\"><code>update libxslt from 1.1.30 to 1.1.32</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/1756096d2cd43b3832812e5ac71ecf7244a8db0c\"><code>update libxml2 from 2.9.5 to 2.9.7</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/d69af24ea5931b62916ce3c93a01e644a656e1e9\"><code>update changelog</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/a098ecb5a9e975567486d97daed62e45481dc628\"><code>Merge pull request #1674 from larskanis/serialize-default-utf8</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/53dba0f47a15169db3e0d6c2c623957dac40a85b\"><code>update changelog</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/d02023546b169239549b76606f080caa242bf9b8\"><code>Merge pull request #1685 from jeremyevans/openbsd</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/6b65ecb5d44cb0477dc02d659dcb9bb442222be5\"><code>Fix a couple of issues on OpenBSD</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/7eb8cf080b3dcea060f13f192f5bed89704529e5\"><code>Merge pull request #1676 from andrew-aladev/character-stack-vs-string-buffer</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/c3914e46b1b5f9463ed778f511bfdfc0a968d07d\"><code>replaced StringBuffer with StringBuilder, because we don't need synchronization in handler</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/66cc8ee1cb84573783b729c909d8e0e87e0a412a\"><code>replaced %i with regular array of symbols to fit ruby-1.9.3</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/be56b1e0084d1fc2ff63bc273ab6f6e7ccfcbea5\"><code>concourse: more coverage for PRs</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/41c6faff8ac575bd370eaf831df49a90908f6b6c\"><code>added tests for html and xml sax parsers that will verify the order of parsed text items</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/91d8e3e0fd7f310414f402b44771c1d0185dfb3f\"><code>added helper document that can test a strict order of items produced by parsers</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/ac7060c7565c3ddedee9e875672e5fdd05d841c4\"><code>replaced character stack with string buffer, fixed characters population mechanism</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/7afdf124a8ed27bc94a19dabc896f15b8a62b853\"><code>concourse: windows 2.4 build</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/6bbc9d7e51eac5f5c0429cf740629300c547d832\"><code>concourse: libxmlruby jobs repositioned ...</code></a></li>\n<li><a href=\"https://github.com/sparklemotion/nokogiri/commit/076a7414e799ac3d2bacd0c78c6ca6f7a8a6265e\"><code>Use UTF-8 as default encoding for Node#serialize</code></a></li>\n</ul>\n</details>\n\n\n\n\n---\n[Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`.\n\n![Depfu Status](https://depfu.com/badges/f867ecc93b8aa127827b4ae0f5d9e848/stats.svg)\n\n"},"comment":{"url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/comments/402343040","html_url":"https://github.com/thetallgrassnet/pokesite/pull/283#issuecomment-402343040","issue_url":"https://api.github.com/repos/thetallgrassnet/pokesite/issues/283","id":402343040,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMjM0MzA0MA==","user":{"login":"depfu[bot]","id":23717796,"node_id":"MDM6Qm90MjM3MTc3OTY=","avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-07-04T02:16:13Z","updated_at":"2018-07-04T02:16:13Z","author_association":"NONE","body":"Closed in favor of #315.\n\n---\nAutomated by [Depfu](https://depfu.com)."}}
{"actor":{"display_login":"depfu"}}