{"action":"created","issue":{"url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/214","repository_url":"https://api.github.com/repos/prettier/tslint-config-prettier","labels_url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/214/labels{/name}","comments_url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/214/comments","events_url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/214/events","html_url":"https://github.com/prettier/tslint-config-prettier/pull/214","id":380555339,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMwNzI0OTcw","number":214,"title":"chore(deps): [security] bump sshpk from 1.13.1 to 1.15.2","user":{"login":"dependabot[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot%5Bbot%5D","html_url":"https://github.com/apps/dependabot","followers_url":"https://api.github.com/users/dependabot%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1125010659,"node_id":"MDU6TGFiZWwxMTI1MDEwNjU5","url":"https://api.github.com/repos/prettier/tslint-config-prettier/labels/dependencies","name":"dependencies","color":"0025ff","default":false},{"id":1125019242,"node_id":"MDU6TGFiZWwxMTI1MDE5MjQy","url":"https://api.github.com/repos/prettier/tslint-config-prettier/labels/security","name":"security","color":"ee0701","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-14T06:31:52Z","updated_at":"2018-11-27T14:38:20Z","closed_at":"2018-11-14T06:34:34Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/prettier/tslint-config-prettier/pulls/214","html_url":"https://github.com/prettier/tslint-config-prettier/pull/214","diff_url":"https://github.com/prettier/tslint-config-prettier/pull/214.diff","patch_url":"https://github.com/prettier/tslint-config-prettier/pull/214.patch"},"body":"Bumps [sshpk](https://github.com/joyent/node-sshpk) from 1.13.1 to 1.15.2. **This update includes security fixes.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from The GitHub Security Advisory Database.*\n\n> **Moderate severity vulnerability that affects sshpk**\n> The sshpk NPM package is vulnerable to ReDoS when parsing crafted invalid public keys.\n> \n> Affected versions: < 1.13.2\n\n*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/fc393f9f-282f-4bc9-953b-d7e4b48352e9).*\n\n> **CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')**\n> The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.\n> \n> Affected versions: <1.14.1\n\n*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/401.json).*\n\n> **Denial of Service**\n> `sshpk` is vulnerable to ReDoS when parsing crafted invalid public keys\n> \n> Affected versions: <=1.13.1\n\n</details>\n<details>\n<summary>Release notes</summary>\n\n*Sourced from [sshpk's releases](https://github.com/joyent/node-sshpk/releases).*\n\n> ## v1.14.1\n>  * Remove all remaining usage of jodid25519 (abandoned dep)\r\n>  * Add support for DNSSEC key format\r\n>  * Add support for Ed25519 keys in PEM format (according to draft-curdle-pkix)\r\n>  * Fixes for X.509 encoding issues (asn.1 NULLs in RSA certs, cert string type mangling)\r\n>  * Performance issues parsing long SSH public keys\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`c7a6c68`](https://github.com/joyent/node-sshpk/commit/c7a6c6833370f69322c47e73e9f4cfdedaf4e8f4) joyent/node-sshpk#58 des-ede3-cbc encrypted keys broken\n- [`2ab4f2a`](https://github.com/joyent/node-sshpk/commit/2ab4f2a018766559252f2c3426a3735f0860ac0d) joyent/node-sshpk#56 md5 fingerprints not quite right\n- [`026ef47`](https://github.com/joyent/node-sshpk/commit/026ef4764a55648dd15f45f7f14ff9da5d1fe2ad) joyent/node-sshpk#53 stop using optional deps to fix webpack\n- [`53e23fe`](https://github.com/joyent/node-sshpk/commit/53e23feff41226826b45293bc4a9fc45f2e44afe) joyent/node-sshpk#50 Support PKCS#5 AES-256-CBC encrypted private keys\n- [`6b68d49`](https://github.com/joyent/node-sshpk/commit/6b68d49abc7876d81cfa2f3947024f4a84c21a94) joyent/node-sshpk#54 want API for accessing x509 extensions\n- [`1088992`](https://github.com/joyent/node-sshpk/commit/10889924a536c3e3a839c00a31727d60f6d55756) joyent/node-sshpk#52 Buffer no longer performs length check for hex strings i...\n- [`6ec6f9d`](https://github.com/joyent/node-sshpk/commit/6ec6f9db719dabcfaf1771dffcaff8aa56077b88) joyent/node-sshpk#38 want support for more obscure DN OIDs\n- [`1cc4c99`](https://github.com/joyent/node-sshpk/commit/1cc4c99dc6ebeb4c6be46fa56e3ec70086f19c49) joyent/node-sshpk#51 package.json repository does not point to Joyent\n- [`175758a`](https://github.com/joyent/node-sshpk/commit/175758a9473523409339e6c519c470c808ca03de) joyent/node-sshpk#46 Use Buffer.(from|alloc) instead of deprecated Buffer API\n- [`6edb37c`](https://github.com/joyent/node-sshpk/commit/6edb37cb986b7ddaf0d346440d37287cc059bfee) Release 1.14.0\n- Additional commits viewable in [compare view](https://github.com/joyent/node-sshpk/compare/v1.13.1...v1.15.2)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=sshpk&package-manager=npm_and_yarn&previous-version=1.13.1&new-version=1.15.2)](https://dependabot.com/compatibility-score.html?dependency-name=sshpk&package-manager=npm_and_yarn&previous-version=1.13.1&new-version=1.15.2)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n---\n\n**Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.\n\nYou can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\nFinally, you can contact us by mentioning @dependabot.\n\n</details>"},"comment":{"url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/comments/442080963","html_url":"https://github.com/prettier/tslint-config-prettier/pull/214#issuecomment-442080963","issue_url":"https://api.github.com/repos/prettier/tslint-config-prettier/issues/214","id":442080963,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjA4MDk2Mw==","user":{"login":"alexjoverm","id":5701162,"node_id":"MDQ6VXNlcjU3MDExNjI=","avatar_url":"https://avatars3.githubusercontent.com/u/5701162?v=4","gravatar_id":"","url":"https://api.github.com/users/alexjoverm","html_url":"https://github.com/alexjoverm","followers_url":"https://api.github.com/users/alexjoverm/followers","following_url":"https://api.github.com/users/alexjoverm/following{/other_user}","gists_url":"https://api.github.com/users/alexjoverm/gists{/gist_id}","starred_url":"https://api.github.com/users/alexjoverm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexjoverm/subscriptions","organizations_url":"https://api.github.com/users/alexjoverm/orgs","repos_url":"https://api.github.com/users/alexjoverm/repos","events_url":"https://api.github.com/users/alexjoverm/events{/privacy}","received_events_url":"https://api.github.com/users/alexjoverm/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T14:38:20Z","updated_at":"2018-11-27T14:38:20Z","author_association":"CONTRIBUTOR","body":":tada: This PR is included in version 1.17.0 :tada:\n\nThe release is available on:\n- [npm package (@latest dist-tag)](https://www.npmjs.com/package/tslint-config-prettier)\n- [GitHub release](https://github.com/prettier/tslint-config-prettier/releases/tag/v1.17.0)\n\nYour **[semantic-release](https://github.com/semantic-release/semantic-release)** bot :package::rocket:"}}
{"actor":{"display_login":"alexjoverm"}}