Skip to content
This repository has been archived by the owner on Mar 30, 2020. It is now read-only.

[Security] Bump loofah from 2.2.0 to 2.2.2 #79

Merged
merged 1 commit into from Apr 3, 2018
Merged

[Security] Bump loofah from 2.2.0 to 2.2.2 #79

merged 1 commit into from Apr 3, 2018

Conversation

dependabot-preview[bot]
Copy link

Bumps loofah from 2.2.0 to 2.2.2. This update includes security fixes.

Vulnerabilities fixed

Loofah XSS Vulnerability
Loofah allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments.

Patched versions: [">= 2.2.1"]
Unaffected versions: []

Release notes

Sourced from loofah's releases.

v2.2.2

2.2.2 / 2018-03-22

Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.

Changelog

Sourced from loofah's changelog.

2.2.2 / 2018-03-22

Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.

2.2.1 / 2018-03-19

Addresses CVE-2018-8048. Loofah allowed non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

This CVE's public notice is at https://github-redirect.dependabot.com/flavorjones/loofah/issues/144

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot ignore this [minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use [this|these] label[s] will set the current labels as the default for future PRs for this repo and language

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)

Finally, you can contact us by mentioning @dependabot.

@dependabot-support
[Security] Bump loofah from 2.2.0 to 2.2.2
3f107a4 
Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.0 to 2.2.2. **This update includes security fixes.**
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)
- [Commits](flavorjones/loofah@v2.2.0...v2.2.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>
@MarceloAlves MarceloAlves merged commit e2d0fac into develop Apr 3, 2018
@MarceloAlves MarceloAlves deleted the dependabot/bundler/develop/loofah-2.2.2 branch April 3, 2018 02:08
MarceloAlves pushed a commit that referenced this pull request Feb 16, 2019
@dependabot @MarceloAlves
Bump rails from 5.1.4 to 5.1.5 (#38)
7aebedb 
Bumps [rails](https://github.com/rails/rails) from 5.1.4 to 5.1.5.
- [Commits](rails/rails@v5.1.4...v5.1.5)

Bump eslint-plugin-import from 2.8.0 to 2.9.0 (#43)

Bumps [eslint-plugin-import](https://github.com/benmosher/eslint-plugin-import) from 2.8.0 to 2.9.0.
- [Changelog](https://github.com/benmosher/eslint-plugin-import/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.8.0...v2.9.0)

Bump prop-types from 15.6.0 to 15.6.1 (#45)

Bumps [prop-types](https://github.com/facebook/prop-types) from 15.6.0 to 15.6.1.
- [Changelog](https://github.com/facebook/prop-types/blob/master/CHANGELOG.md)
- [Commits](https://github.com/facebook/prop-types/commits/v15.6.1)

Bump selenium-webdriver from 3.9.0 to 3.10.0 (#52)

Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 3.9.0 to 3.10.0.
- [Commits](SeleniumHQ/selenium@selenium-3.9.0...selenium-3.10.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump eslint from 4.17.0 to 4.18.2 (#51)

Bumps [eslint](https://github.com/eslint/eslint) from 4.17.0 to 4.18.2.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](eslint/eslint@v4.17.0...v4.18.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump moment from 2.20.1 to 2.21.0 (#49)

Bumps [moment](https://github.com/moment/moment) from 2.20.1 to 2.21.0.
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.20.1...2.21.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump autoprefixer-rails from 7.2.5 to 8.1.0 (#50)

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 7.2.5 to 8.1.0.
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](ai/autoprefixer-rails@7.2.5...8.1.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump react-waypoint from 8.0.0 to 8.0.1 (#55)

Bumps [react-waypoint](https://github.com/brigade/react-waypoint) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/brigade/react-waypoint/releases/tag/v8.0.1)
- [Changelog](https://github.com/brigade/react-waypoint/blob/master/CHANGELOG.md)
- [Commits](civiccc/react-waypoint@v8.0.0...v8.0.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump puma from 3.11.2 to 3.11.3 (#54)

Bumps [puma](https://github.com/puma/puma) from 3.11.2 to 3.11.3.
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](puma/puma@v3.11.2...v3.11.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump autoprefixer-rails from 8.1.0 to 8.1.0.1 (#56)

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 8.1.0 to 8.1.0.1.
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](ai/autoprefixer-rails@8.1.0...8.1.0.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump uglifier from 4.1.6 to 4.1.7 (#58)

Bumps [uglifier](https://github.com/lautis/uglifier) from 4.1.6 to 4.1.7.
- [Changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md)
- [Commits](lautis/uglifier@v4.1.6...v4.1.7)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump coffeescript from 2.2.2 to 2.2.3 (#57)

Bumps [coffeescript](https://github.com/jashkenas/coffeescript) from 2.2.2 to 2.2.3.
- [Commits](jashkenas/coffeescript@2.2.2...2.2.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump rubocop from 0.53.0 to 0.54.0 (#65)

Bumps [rubocop](https://github.com/bbatsov/rubocop) from 0.53.0 to 0.54.0.
- [Release notes](https://github.com/bbatsov/rubocop/releases)
- [Changelog](https://github.com/bbatsov/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v0.53.0...v0.54.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump eslint from 4.18.2 to 4.19.0 (#64)

Bumps [eslint](https://github.com/eslint/eslint) from 4.18.2 to 4.19.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](eslint/eslint@v4.18.2...v4.19.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump webpack-dev-server from 2.11.1 to 3.1.1 (#59)

Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 2.11.1 to 3.1.1.
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Commits](webpack/webpack-dev-server@v2.11.1...v3.1.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump uglifier from 4.1.7 to 4.1.8 (#63)

Bumps [uglifier](https://github.com/lautis/uglifier) from 4.1.7 to 4.1.8.
- [Release notes](https://github.com/lautis/uglifier/releases)
- [Changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md)
- [Commits](lautis/uglifier@v4.1.7...v4.1.8)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump selenium-webdriver from 3.10.0 to 3.11.0 (#62)

Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 3.10.0 to 3.11.0.
- [Commits](SeleniumHQ/selenium@selenium-3.10.0...selenium-3.11.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump byebug from 10.0.0 to 10.0.1 (#68)

Bumps [byebug](https://github.com/deivid-rodriguez/byebug) from 10.0.0 to 10.0.1.
- [Release notes](https://github.com/deivid-rodriguez/byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/byebug/blob/master/CHANGELOG.md)
- [Commits](deivid-rodriguez/byebug@v10.0.0...v10.0.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump autoprefixer-rails from 8.1.0.1 to 8.2.0 (#66)

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 8.1.0.1 to 8.2.0.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](ai/autoprefixer-rails@8.1.0.1...8.2.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump eslint from 4.19.0 to 4.19.1 (#67)

Bumps [eslint](https://github.com/eslint/eslint) from 4.19.0 to 4.19.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](eslint/eslint@v4.19.0...v4.19.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

[Security] Bump rails-html-sanitizer from 1.0.3 to 1.0.4 (#80)

Bumps [rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer) from 1.0.3 to 1.0.4. **This update includes security fixes.**
- [Release notes](https://github.com/rails/rails-html-sanitizer/releases)
- [Changelog](https://github.com/rails/rails-html-sanitizer/blob/master/CHANGELOG.md)
- [Commits](rails/rails-html-sanitizer@v1.0.3...v1.0.4)

Signed-off-by: dependabot[bot] <support@dependabot.com>

[Security] Bump loofah from 2.2.0 to 2.2.2 (#79)

Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.0 to 2.2.2. **This update includes security fixes.**
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)
- [Commits](flavorjones/loofah@v2.2.0...v2.2.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump rails from 5.1.5 to 5.1.6 (#73)

Bumps [rails](https://github.com/rails/rails) from 5.1.5 to 5.1.6.
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v5.1.5...v5.1.6)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump coffeescript from 2.2.3 to 2.2.4 (#75)

Bumps [coffeescript](https://github.com/jashkenas/coffeescript) from 2.2.3 to 2.2.4.
- [Release notes](https://github.com/jashkenas/coffeescript/releases)
- [Commits](jashkenas/coffeescript@2.2.3...2.2.4)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump byebug from 10.0.1 to 10.0.2 (#76)

Bumps [byebug](https://github.com/deivid-rodriguez/byebug) from 10.0.1 to 10.0.2.
- [Release notes](https://github.com/deivid-rodriguez/byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/byebug/blob/master/CHANGELOG.md)
- [Commits](deivid-rodriguez/byebug@v10.0.1...v10.0.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump eslint-plugin-import from 2.9.0 to 2.10.0 (#77)

Bumps [eslint-plugin-import](https://github.com/benmosher/eslint-plugin-import) from 2.9.0 to 2.10.0.
- [Release notes](https://github.com/benmosher/eslint-plugin-import/releases)
- [Changelog](https://github.com/benmosher/eslint-plugin-import/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.9.0...v2.10.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump react-transition-group from 2.2.1 to 2.3.0 (#71)

Bumps [react-transition-group](https://github.com/reactjs/react-transition-group) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/reactjs/react-transition-group/releases)
- [Changelog](https://github.com/reactjs/react-transition-group/blob/master/CHANGELOG.md)
- [Commits](reactjs/react-transition-group@v2.2.1...v2.3.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump webpacker from 3.2.1 to 3.4.1 (#70)

Bumps [webpacker](https://github.com/rails/webpacker) from 3.2.1 to 3.4.1.
- [Release notes](https://github.com/rails/webpacker/releases)
- [Changelog](https://github.com/rails/webpacker/blob/master/CHANGELOG.md)
- [Commits](rails/webpacker@v3.2.1...v3.4.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump @rails/webpacker from 3.2.1 to 3.4.1 (#69)

Bumps [@rails/webpacker](https://github.com/rails/webpacker) from 3.2.1 to 3.4.1.
- [Release notes](https://github.com/rails/webpacker/releases)
- [Changelog](https://github.com/rails/webpacker/blob/master/CHANGELOG.md)
- [Commits](rails/webpacker@v3.2.1...v3.4.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump react from 16.2.0 to 16.3.0 (#72)

Bumps [react](https://github.com/facebook/react) from 16.2.0 to 16.3.0.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/master/CHANGELOG.md)
- [Commits](facebook/react@v16.2.0...v16.3.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump react-dom from 16.2.0 to 16.3.0 (#74)

Bumps [react-dom](https://github.com/facebook/react) from 16.2.0 to 16.3.0.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/master/CHANGELOG.md)
- [Commits](facebook/react@v16.2.0...v16.3.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump moment from 2.21.0 to 2.22.0 (#78)

Bumps [moment](https://github.com/moment/moment) from 2.21.0 to 2.22.0.
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.21.0...2.22.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump turbolinks from 5.1.0 to 5.1.1 (#92)

Bumps [turbolinks](https://github.com/turbolinks/turbolinks) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/turbolinks/turbolinks/releases)
- [Changelog](https://github.com/turbolinks/turbolinks/blob/master/CHANGELOG.md)
- [Commits](turbolinks/turbolinks@v5.1.0...v5.1.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump moment from 2.22.0 to 2.22.1 (#96)

Bumps [moment](https://github.com/moment/moment) from 2.22.0 to 2.22.1.
- [Release notes](https://github.com/moment/moment/releases)
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.22.0...2.22.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump jquery-rails from 4.3.1 to 4.3.3 (#105)

Bumps [jquery-rails](https://github.com/rails/jquery-rails) from 4.3.1 to 4.3.3.
- [Release notes](https://github.com/rails/jquery-rails/releases)
- [Changelog](https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md)
- [Commits](rails/jquery-rails@v4.3.1...v4.3.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump puma from 3.11.3 to 3.11.4 (#94)

Bumps [puma](https://github.com/puma/puma) from 3.11.3 to 3.11.4.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](puma/puma@v3.11.3...v3.11.4)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump autoprefixer-rails from 8.2.0 to 8.4.1 (#109)

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 8.2.0 to 8.4.1.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](ai/autoprefixer-rails@8.2.0...8.4.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump rubocop from 0.54.0 to 0.55.0 (#103)

Bumps [rubocop](https://github.com/bbatsov/rubocop) from 0.54.0 to 0.55.0.
- [Release notes](https://github.com/bbatsov/rubocop/releases)
- [Changelog](https://github.com/bbatsov/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v0.54.0...v0.55.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump bootswatch from 4.0.0 to 4.1.0 (#90)

Bumps [bootswatch](https://github.com/mkhairi/bootswatch-sass) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/mkhairi/bootswatch-sass/releases)
- [Commits](https://github.com/mkhairi/bootswatch-sass/commits)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump uglifier from 4.1.8 to 4.1.10 (#107)

Bumps [uglifier](https://github.com/lautis/uglifier) from 4.1.8 to 4.1.10.
- [Release notes](https://github.com/lautis/uglifier/releases)
- [Changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md)
- [Commits](lautis/uglifier@v4.1.8...v4.1.10)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump coffeescript from 2.2.4 to 2.3.0 (#111)

Bumps [coffeescript](https://github.com/jashkenas/coffeescript) from 2.2.4 to 2.3.0.
- [Release notes](https://github.com/jashkenas/coffeescript/releases)
- [Commits](jashkenas/coffeescript@2.2.4...2.3.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump capybara from 2.18.0 to 3.0.3 (#116)

Bumps [capybara](https://github.com/teamcapybara/capybara) from 2.18.0 to 3.0.3.
- [Release notes](https://github.com/teamcapybara/capybara/releases)
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](teamcapybara/capybara@2.18.0...3.0.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump react-transition-group from 2.3.0 to 2.3.1 (#97)

Bumps [react-transition-group](https://github.com/reactjs/react-transition-group) from 2.3.0 to 2.3.1.
- [Release notes](https://github.com/reactjs/react-transition-group/releases)
- [Changelog](https://github.com/reactjs/react-transition-group/blob/master/CHANGELOG.md)
- [Commits](reactjs/react-transition-group@v2.3.0...v2.3.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump eslint-plugin-import from 2.10.0 to 2.11.0 (#95)

Bumps [eslint-plugin-import](https://github.com/benmosher/eslint-plugin-import) from 2.10.0 to 2.11.0.
- [Release notes](https://github.com/benmosher/eslint-plugin-import/releases)
- [Changelog](https://github.com/benmosher/eslint-plugin-import/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.10.0...v2.11.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump web-console from 3.5.1 to 3.6.2 (#112)

Bumps [web-console](https://github.com/rails/web-console) from 3.5.1 to 3.6.2.
- [Release notes](https://github.com/rails/web-console/releases)
- [Changelog](https://github.com/rails/web-console/blob/master/CHANGELOG.markdown)
- [Commits](rails/web-console@v3.5.1...v3.6.2)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump bootstrap from 4.0.0 to 4.1.1 (#115)

Bumps [bootstrap](https://github.com/twbs/bootstrap-rubygem) from 4.0.0 to 4.1.1.
- [Release notes](https://github.com/twbs/bootstrap-rubygem/releases)
- [Changelog](https://github.com/twbs/bootstrap-rubygem/blob/master/CHANGELOG.md)
- [Commits](twbs/bootstrap-rubygem@v4.0.0...v4.1.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Bump rails from 5.1.6 to 5.2.0 (#89)

Bumps [rails](https://github.com/rails/rails) from 5.1.6 to 5.2.0.
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v5.1.6...v5.2.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@MarceloAlves @dependabot-support