{"action":"closed","number":6153,"pull_request":{"url":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153","id":226964375,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI2OTY0Mzc1","html_url":"https://github.com/openSUSE/open-build-service/pull/6153","diff_url":"https://github.com/openSUSE/open-build-service/pull/6153.diff","patch_url":"https://github.com/openSUSE/open-build-service/pull/6153.patch","issue_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6153","number":6153,"state":"closed","locked":false,"title":"🚨 [security] [src/api - 2.8] Update loofah: 2.2.2 → 2.2.3 (patch)","user":{"login":"depfu[bot]","id":23717796,"node_id":"MDM6Qm90MjM3MTc3OTY=","avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"body":"\n\n\n<hr>\n\n🚨 <b>Your version of loofah has known security vulnerabilities</b> 🚨\n\nAdvisory: CVE-2018-16468\nDisclosed: October 30, 2018\nURL: [https://github.com/flavorjones/loofah/issues/154](https://bounce.depfu.com/github.com/flavorjones/loofah/issues/154)\n\n<details>\n<summary>Loofah XSS Vulnerability</summary>\n<blockquote>\n  <p>In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.</p>\n<p>Loofah maintainers have evaluated this as Medium (CVSS3 6.4).</p>\n</blockquote>\n</details>\n<br>\n🚨 <b>We recommend to merge and deploy this update as soon as possible!</b> 🚨\n<hr>\n\n\nWe've updated a dependency and here is what you need to know:\n\n| name | version specification | old version | new version |\n| --- | --- | --- | --- |\n| loofah | _indirect dependency_ | 2.2.2 | 2.2.3 |\n\nAdditionally, the update changed a few other dependencies as well:\n\n| action | name | old version | new version |\n| --- | --- | --- | --- |\n| updated | nokogiri | 1.8.1 | 1.8.5 |\n\n\nYou should probably take a good look at the info here and the test results before merging this pull request, of course.\n\n### What changed?\n\n\n#### ↗️ loofah (_indirect_, 2.2.2 → 2.2.3) · [Repo](http://github.com/flavorjones/loofah) · [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/flavorjones/loofah/compare/37af4ee08f9e9531e24287c2783a79d331fc9243...cb3dbfa604195b99b3a811e040584daec7663504\">See the full diff on Github</a>. The new version differs by 5 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/cb3dbfa604195b99b3a811e040584daec7663504\"><code>version bump to v2.2.3 and update CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/71e4b5434fbcb2ad87643f0c9fecfc3a847943c4\"><code>remove the svg animate attribute `from` from the allowlist</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/3556e2b44f7401aaccbb10e2abac4e044391267a\"><code>add formatting to CHANGELOG</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/ac7c50de12398c90ffba907bf132af66bcc242be\"><code>updated mailing list to a new Google Group</code></a></li>\n<li><a href=\"https://github.com/flavorjones/loofah/commit/de6b0f33cde92b6028c1ef973e5fc24478890fc9\"><code>extract msword html data into an asset file</code></a></li>\n</ul>\n</details>\n\n\n\n#### ✳️ nokogiri (1.8.1 → 1.8.5) · [Repo](https://github.com/sparklemotion/nokogiri/) · [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/sparklemotion/nokogiri/compare/1fa9d1853a6ca0a20c8086907318263022d5a42c...e28fa4bb2ed6844c3c63f58062d034e7b99fc90c\">See the full diff on Github</a>. The new version differs by more commits than we can show here.</p>\n</details>\n\n\n\n\n---\n![Depfu Status](https://depfu.com/badges/d25aaa7c14fa5dfbd174dab1e5373d54/stats.svg)\n\n[Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`.\n\n<details><summary>All Depfu comment commands</summary>\n<blockquote><dl>\n<dt>@​depfu rebase</dt><dd>Rebases against your default branch and redoes this update</dd>\n<dt>@​depfu merge</dt><dd>Merges this PR once your tests are passing and conflicts are resolved</dd>\n<dt>@​depfu reopen</dt><dd>Restores the branch and reopens this PR (if it's closed)</dd>\n<dt>@​depfu pause</dt><dd>Ignores all future updates for this dependency and closes this PR</dd>\n<dt>@​depfu pause [minor|major]</dt><dd>Ignores all future minor/major updates for this dependency and closes this PR</dd>\n<dt>@​depfu resume</dt><dd>Future versions of this dependency will create PRs again (leaves this PR as is)</dd>\n</dl></blockquote>\n</details>\n\n","created_at":"2018-10-30T15:15:50Z","updated_at":"2018-10-31T11:49:50Z","closed_at":"2018-10-31T11:49:50Z","merged_at":"2018-10-31T11:49:50Z","merge_commit_sha":"c3c68a609bcefb882de90d543d0312ab231ea132","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":538280186,"node_id":"MDU6TGFiZWw1MzgyODAxODY=","url":"https://api.github.com/repos/openSUSE/open-build-service/labels/2.8","name":"2.8","color":"1d76db","default":false},{"id":867348466,"node_id":"MDU6TGFiZWw4NjczNDg0NjY=","url":"https://api.github.com/repos/openSUSE/open-build-service/labels/depfu","name":"depfu","color":"0000ff","default":false},{"id":1039731306,"node_id":"MDU6TGFiZWwxMDM5NzMxMzA2","url":"https://api.github.com/repos/openSUSE/open-build-service/labels/security","name":"security","color":"ee0701","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153/commits","review_comments_url":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153/comments","review_comment_url":"https://api.github.com/repos/openSUSE/open-build-service/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6153/comments","statuses_url":"https://api.github.com/repos/openSUSE/open-build-service/statuses/dc6d8dffa0835aeecf560de72743ac778a4605f5","head":{"label":"openSUSE:depfu/update/srcapi-2.8/loofah-2.2.3","ref":"depfu/update/srcapi-2.8/loofah-2.2.3","sha":"dc6d8dffa0835aeecf560de72743ac778a4605f5","user":{"login":"openSUSE","id":623819,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzgxOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/623819?v=4","gravatar_id":"","url":"https://api.github.com/users/openSUSE","html_url":"https://github.com/openSUSE","followers_url":"https://api.github.com/users/openSUSE/followers","following_url":"https://api.github.com/users/openSUSE/following{/other_user}","gists_url":"https://api.github.com/users/openSUSE/gists{/gist_id}","starred_url":"https://api.github.com/users/openSUSE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openSUSE/subscriptions","organizations_url":"https://api.github.com/users/openSUSE/orgs","repos_url":"https://api.github.com/users/openSUSE/repos","events_url":"https://api.github.com/users/openSUSE/events{/privacy}","received_events_url":"https://api.github.com/users/openSUSE/received_events","type":"Organization","site_admin":false},"repo":{"id":2046192,"node_id":"MDEwOlJlcG9zaXRvcnkyMDQ2MTky","name":"open-build-service","full_name":"openSUSE/open-build-service","private":false,"owner":{"login":"openSUSE","id":623819,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzgxOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/623819?v=4","gravatar_id":"","url":"https://api.github.com/users/openSUSE","html_url":"https://github.com/openSUSE","followers_url":"https://api.github.com/users/openSUSE/followers","following_url":"https://api.github.com/users/openSUSE/following{/other_user}","gists_url":"https://api.github.com/users/openSUSE/gists{/gist_id}","starred_url":"https://api.github.com/users/openSUSE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openSUSE/subscriptions","organizations_url":"https://api.github.com/users/openSUSE/orgs","repos_url":"https://api.github.com/users/openSUSE/repos","events_url":"https://api.github.com/users/openSUSE/events{/privacy}","received_events_url":"https://api.github.com/users/openSUSE/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/openSUSE/open-build-service","description":"A generic system to build and distribute packages from sources in an automatic, consistent and reproducible way. Release your software for a wide range of operating systems and hardware architectures.","fork":false,"url":"https://api.github.com/repos/openSUSE/open-build-service","forks_url":"https://api.github.com/repos/openSUSE/open-build-service/forks","keys_url":"https://api.github.com/repos/openSUSE/open-build-service/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openSUSE/open-build-service/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openSUSE/open-build-service/teams","hooks_url":"https://api.github.com/repos/openSUSE/open-build-service/hooks","issue_events_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/events{/number}","events_url":"https://api.github.com/repos/openSUSE/open-build-service/events","assignees_url":"https://api.github.com/repos/openSUSE/open-build-service/assignees{/user}","branches_url":"https://api.github.com/repos/openSUSE/open-build-service/branches{/branch}","tags_url":"https://api.github.com/repos/openSUSE/open-build-service/tags","blobs_url":"https://api.github.com/repos/openSUSE/open-build-service/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openSUSE/open-build-service/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openSUSE/open-build-service/git/refs{/sha}","trees_url":"https://api.github.com/repos/openSUSE/open-build-service/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openSUSE/open-build-service/statuses/{sha}","languages_url":"https://api.github.com/repos/openSUSE/open-build-service/languages","stargazers_url":"https://api.github.com/repos/openSUSE/open-build-service/stargazers","contributors_url":"https://api.github.com/repos/openSUSE/open-build-service/contributors","subscribers_url":"https://api.github.com/repos/openSUSE/open-build-service/subscribers","subscription_url":"https://api.github.com/repos/openSUSE/open-build-service/subscription","commits_url":"https://api.github.com/repos/openSUSE/open-build-service/commits{/sha}","git_commits_url":"https://api.github.com/repos/openSUSE/open-build-service/git/commits{/sha}","comments_url":"https://api.github.com/repos/openSUSE/open-build-service/comments{/number}","issue_comment_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/comments{/number}","contents_url":"https://api.github.com/repos/openSUSE/open-build-service/contents/{+path}","compare_url":"https://api.github.com/repos/openSUSE/open-build-service/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openSUSE/open-build-service/merges","archive_url":"https://api.github.com/repos/openSUSE/open-build-service/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openSUSE/open-build-service/downloads","issues_url":"https://api.github.com/repos/openSUSE/open-build-service/issues{/number}","pulls_url":"https://api.github.com/repos/openSUSE/open-build-service/pulls{/number}","milestones_url":"https://api.github.com/repos/openSUSE/open-build-service/milestones{/number}","notifications_url":"https://api.github.com/repos/openSUSE/open-build-service/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openSUSE/open-build-service/labels{/name}","releases_url":"https://api.github.com/repos/openSUSE/open-build-service/releases{/id}","deployments_url":"https://api.github.com/repos/openSUSE/open-build-service/deployments","created_at":"2011-07-14T06:52:57Z","updated_at":"2018-10-31T11:47:02Z","pushed_at":"2018-10-31T11:49:50Z","git_url":"git://github.com/openSUSE/open-build-service.git","ssh_url":"git@github.com:openSUSE/open-build-service.git","clone_url":"https://github.com/openSUSE/open-build-service.git","svn_url":"https://github.com/openSUSE/open-build-service","homepage":"http://openbuildservice.org/","size":63473,"stargazers_count":392,"watchers_count":392,"language":"Ruby","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":250,"mirror_url":null,"archived":false,"open_issues_count":540,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0","node_id":"MDc6TGljZW5zZTg="},"forks":250,"open_issues":540,"watchers":392,"default_branch":"master"}},"base":{"label":"openSUSE:2.8","ref":"2.8","sha":"f9e0265aab705da2406c7e09139e14e967339588","user":{"login":"openSUSE","id":623819,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzgxOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/623819?v=4","gravatar_id":"","url":"https://api.github.com/users/openSUSE","html_url":"https://github.com/openSUSE","followers_url":"https://api.github.com/users/openSUSE/followers","following_url":"https://api.github.com/users/openSUSE/following{/other_user}","gists_url":"https://api.github.com/users/openSUSE/gists{/gist_id}","starred_url":"https://api.github.com/users/openSUSE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openSUSE/subscriptions","organizations_url":"https://api.github.com/users/openSUSE/orgs","repos_url":"https://api.github.com/users/openSUSE/repos","events_url":"https://api.github.com/users/openSUSE/events{/privacy}","received_events_url":"https://api.github.com/users/openSUSE/received_events","type":"Organization","site_admin":false},"repo":{"id":2046192,"node_id":"MDEwOlJlcG9zaXRvcnkyMDQ2MTky","name":"open-build-service","full_name":"openSUSE/open-build-service","private":false,"owner":{"login":"openSUSE","id":623819,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzgxOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/623819?v=4","gravatar_id":"","url":"https://api.github.com/users/openSUSE","html_url":"https://github.com/openSUSE","followers_url":"https://api.github.com/users/openSUSE/followers","following_url":"https://api.github.com/users/openSUSE/following{/other_user}","gists_url":"https://api.github.com/users/openSUSE/gists{/gist_id}","starred_url":"https://api.github.com/users/openSUSE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openSUSE/subscriptions","organizations_url":"https://api.github.com/users/openSUSE/orgs","repos_url":"https://api.github.com/users/openSUSE/repos","events_url":"https://api.github.com/users/openSUSE/events{/privacy}","received_events_url":"https://api.github.com/users/openSUSE/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/openSUSE/open-build-service","description":"A generic system to build and distribute packages from sources in an automatic, consistent and reproducible way. Release your software for a wide range of operating systems and hardware architectures.","fork":false,"url":"https://api.github.com/repos/openSUSE/open-build-service","forks_url":"https://api.github.com/repos/openSUSE/open-build-service/forks","keys_url":"https://api.github.com/repos/openSUSE/open-build-service/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openSUSE/open-build-service/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openSUSE/open-build-service/teams","hooks_url":"https://api.github.com/repos/openSUSE/open-build-service/hooks","issue_events_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/events{/number}","events_url":"https://api.github.com/repos/openSUSE/open-build-service/events","assignees_url":"https://api.github.com/repos/openSUSE/open-build-service/assignees{/user}","branches_url":"https://api.github.com/repos/openSUSE/open-build-service/branches{/branch}","tags_url":"https://api.github.com/repos/openSUSE/open-build-service/tags","blobs_url":"https://api.github.com/repos/openSUSE/open-build-service/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openSUSE/open-build-service/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openSUSE/open-build-service/git/refs{/sha}","trees_url":"https://api.github.com/repos/openSUSE/open-build-service/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openSUSE/open-build-service/statuses/{sha}","languages_url":"https://api.github.com/repos/openSUSE/open-build-service/languages","stargazers_url":"https://api.github.com/repos/openSUSE/open-build-service/stargazers","contributors_url":"https://api.github.com/repos/openSUSE/open-build-service/contributors","subscribers_url":"https://api.github.com/repos/openSUSE/open-build-service/subscribers","subscription_url":"https://api.github.com/repos/openSUSE/open-build-service/subscription","commits_url":"https://api.github.com/repos/openSUSE/open-build-service/commits{/sha}","git_commits_url":"https://api.github.com/repos/openSUSE/open-build-service/git/commits{/sha}","comments_url":"https://api.github.com/repos/openSUSE/open-build-service/comments{/number}","issue_comment_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/comments{/number}","contents_url":"https://api.github.com/repos/openSUSE/open-build-service/contents/{+path}","compare_url":"https://api.github.com/repos/openSUSE/open-build-service/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openSUSE/open-build-service/merges","archive_url":"https://api.github.com/repos/openSUSE/open-build-service/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openSUSE/open-build-service/downloads","issues_url":"https://api.github.com/repos/openSUSE/open-build-service/issues{/number}","pulls_url":"https://api.github.com/repos/openSUSE/open-build-service/pulls{/number}","milestones_url":"https://api.github.com/repos/openSUSE/open-build-service/milestones{/number}","notifications_url":"https://api.github.com/repos/openSUSE/open-build-service/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openSUSE/open-build-service/labels{/name}","releases_url":"https://api.github.com/repos/openSUSE/open-build-service/releases{/id}","deployments_url":"https://api.github.com/repos/openSUSE/open-build-service/deployments","created_at":"2011-07-14T06:52:57Z","updated_at":"2018-10-31T11:47:02Z","pushed_at":"2018-10-31T11:49:50Z","git_url":"git://github.com/openSUSE/open-build-service.git","ssh_url":"git@github.com:openSUSE/open-build-service.git","clone_url":"https://github.com/openSUSE/open-build-service.git","svn_url":"https://github.com/openSUSE/open-build-service","homepage":"http://openbuildservice.org/","size":63473,"stargazers_count":392,"watchers_count":392,"language":"Ruby","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":250,"mirror_url":null,"archived":false,"open_issues_count":540,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0","node_id":"MDc6TGljZW5zZTg="},"forks":250,"open_issues":540,"watchers":392,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153"},"html":{"href":"https://github.com/openSUSE/open-build-service/pull/6153"},"issue":{"href":"https://api.github.com/repos/openSUSE/open-build-service/issues/6153"},"comments":{"href":"https://api.github.com/repos/openSUSE/open-build-service/issues/6153/comments"},"review_comments":{"href":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153/comments"},"review_comment":{"href":"https://api.github.com/repos/openSUSE/open-build-service/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6153/commits"},"statuses":{"href":"https://api.github.com/repos/openSUSE/open-build-service/statuses/dc6d8dffa0835aeecf560de72743ac778a4605f5"}},"author_association":"CONTRIBUTOR","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"depfu[bot]","id":23717796,"node_id":"MDM6Qm90MjM3MTc3OTY=","avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"comments":2,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":2,"deletions":2,"changed_files":1}}
{"actor":{"display_login":"depfu"}}