payload: {"action":"created","issue":{"url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/80","repository_url":"https://api.github.com/repos/mifrej/dashboard-prototype","labels_url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/80/labels{/name}","comments_url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/80/comments","events_url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/80/events","html_url":"https://github.com/mifrej/dashboard-prototype/pull/80","id":548700460,"node_id":"MDExOlB1bGxSZXF1ZXN0MzYxOTI3ODIy","number":80,"title":"[Security] Bump handlebars from 4.1.1 to 4.7.1","user":{"login":"dependabot-preview[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot-preview%5Bbot%5D","html_url":"https://github.com/apps/dependabot-preview","followers_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1502360472,"node_id":"MDU6TGFiZWwxNTAyMzYwNDcy","url":"https://api.github.com/repos/mifrej/dashboard-prototype/labels/dependencies","name":"dependencies","color":"0366d6","default":false,"description":"Pull requests that update a dependency file"},{"id":1502360750,"node_id":"MDU6TGFiZWwxNTAyMzYwNzUw","url":"https://api.github.com/repos/mifrej/dashboard-prototype/labels/security","name":"security","color":"ee0701","default":false,"description":"Pull requests that address a security vulnerability"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2020-01-13T04:41:43Z","updated_at":"2020-01-14T04:43:46Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/mifrej/dashboard-prototype/pulls/80","html_url":"https://github.com/mifrej/dashboard-prototype/pull/80","diff_url":"https://github.com/mifrej/dashboard-prototype/pull/80.diff","patch_url":"https://github.com/mifrej/dashboard-prototype/pull/80.patch"},"body":"Bumps [handlebars](https://github.com/wycats/handlebars.js) from 4.1.1 to 4.7.1. **This update includes a security fix.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n<p><em>Sourced from <a href=\"https://github.com/advisories/GHSA-w457-6q6x-cgp9\">The GitHub Security Advisory Database</a>.</em></p>\n<blockquote>\n<p><strong>High severity vulnerability that affects handlebars</strong>\nVersions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's <strong>proto</strong> and <strong>defineGetter</strong> properties, which may allow an attacker to execute arbitrary code through crafted payloads.</p>\n<p>Affected versions: &lt; 4.3.0</p>\n</blockquote>\n</details>\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a href=\"https://github.com/wycats/handlebars.js/blob/v4.7.1/release-notes.md\">handlebars's changelog</a>.</em></p>\n<blockquote>\n<h2>v4.7.1 - January 12th, 2020</h2>\n<p>Bugfixes:</p>\n<ul>\n<li>fix: fix log output in case of illegal property access - f152dfc</li>\n<li>fix: log error for illegal property access only once per property - 3c1e252</li>\n</ul>\n<p>Compatibility notes:</p>\n<ul>\n<li>no incompatibilities are to be expected.</li>\n</ul>\n<p><a href=\"https://github.com/wycats/handlebars.js/compare/v4.7.0...v4.7.1\">Commits</a></p>\n<h2>v4.7.0 - January 10th, 2020</h2>\n<p>Features:</p>\n<ul>\n<li>feat: default options for controlling proto access - 7af1c12, <a href=\"https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1635\">#1635</a>\n<ul>\n<li>This makes it possible to disable the prototype access restrictions added in 4.6.0</li>\n<li>an error is logged in the console, if access to prototype properties is attempted and denied\nand no explicit configuration has taken place.</li>\n</ul>\n</li>\n</ul>\n<p>Compatibility notes:</p>\n<ul>\n<li>no compatibilities are expected</li>\n</ul>\n<p><a href=\"https://github.com/wycats/handlebars.js/compare/v4.6.0...v4.7.0\">Commits</a></p>\n<h2>v4.6.0 - January 8th, 2020</h2>\n<p>Features:</p>\n<ul>\n<li>feat: access control to prototype properties via whitelist (<a href=\"https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1633\">#1633</a>)- d03b6ec</li>\n</ul>\n<p>Bugfixes:</p>\n<ul>\n<li>fix(runtime.js): partials compile not caching (<a href=\"https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1600\">#1600</a>) - 23d58e7</li>\n</ul>\n<p>Chores, docs:</p>\n<ul>\n<li>various refactorings and improvements to tests - d7f0dcf, 187d611, d337f40</li>\n<li>modernize the build-setup\n<ul>\n<li>use prettier to format and eslint to verify - c40d9f3, 8901c28, e97685e, 1f61f21</li>\n<li>use nyc instead of istanbul to collect coverage - 164b7ff, 1ebce2b</li>\n<li>update build code to use modern javascript and make it cleaner - 14b621c, 1ec1737, 3a5b65e, dde108e, 04b1984, 587e7a3</li>\n<li>restructur build commands - e913dc5,</li>\n</ul>\n</li>\n<li>eslint rule changes - ac4655e, dc54952</li>\n<li>Update (C) year in the LICENSE file - d1fb07b</li>\n<li>chore: try to fix saucelabs credentials (<a href=\"https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1627\">#1627</a>) -</li>\n<li>Update readme.md with updated links (<a href=\"https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1620\">#1620</a>) - edcc84f</li>\n</ul>\n</tr></table> ... (truncated)\n</blockquote>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/14ba3d0c43d75bcfcdbfb7c95c9fac99d88a17c8\"><code>14ba3d0</code></a> v4.7.1</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/4cddfe7017c28235ccad98f3434deb3725258da8\"><code>4cddfe7</code></a> Update release notes</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/f152dfc89204e8c117605d602dac4fdc174ddcd9\"><code>f152dfc</code></a> fix: fix log output in case of illegal property access</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/3c1e2521694583bc1d8bade1ed5b162f5bfb065a\"><code>3c1e252</code></a> fix: log error for illegal property access only once per property</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/0d5c807017f8ba6c6d947f9d6852033c8faa2e49\"><code>0d5c807</code></a> v4.7.0</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/1f0834b1a2937150923f9de849b9612bd1969d11\"><code>1f0834b</code></a> Update release notes</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/575d8772e2ccf05da235c596dd3405ae74194e1b\"><code>575d877</code></a> fix: use &quot;logger&quot; instead of console.error</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/7af1c12db6222ab4b689bb60820628209d295049\"><code>7af1c12</code></a> feat: default options for controlling proto access</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/91a1b5d2f456cb733cbd88149fc9270973db79d7\"><code>91a1b5d</code></a> v4.6.0</li>\n<li><a href=\"https://github.com/wycats/handlebars.js/commit/770d746e600eb1939501ab91d4bc81ed6b4cde94\"><code>770d746</code></a> Update release notes</li>\n<li>Additional commits viewable in <a href=\"https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.7.1\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=handlebars&package-manager=npm_and_yarn&previous-version=4.1.1&new-version=4.7.1)](https://dependabot.com/compatibility-score.html?dependency-name=handlebars&package-manager=npm_and_yarn&previous-version=4.1.1&new-version=4.7.1)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\n\n\n</details>"},"comment":{"url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/comments/573998128","html_url":"https://github.com/mifrej/dashboard-prototype/pull/80#issuecomment-573998128","issue_url":"https://api.github.com/repos/mifrej/dashboard-prototype/issues/80","id":573998128,"node_id":"MDEyOklzc3VlQ29tbWVudDU3Mzk5ODEyOA==","user":{"login":"dependabot-preview[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot-preview%5Bbot%5D","html_url":"https://github.com/apps/dependabot-preview","followers_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2020-01-14T04:43:46Z","updated_at":"2020-01-14T04:43:46Z","author_association":"NONE","body":"Superseded by #82."}}
other: {"actor":{"display_login":"dependabot-preview"}}