payload: {"action":"created","issue":{"url":"https://api.github.com/repos/elabftw/elabftw/issues/1600","repository_url":"https://api.github.com/repos/elabftw/elabftw","labels_url":"https://api.github.com/repos/elabftw/elabftw/issues/1600/labels{/name}","comments_url":"https://api.github.com/repos/elabftw/elabftw/issues/1600/comments","events_url":"https://api.github.com/repos/elabftw/elabftw/issues/1600/events","html_url":"https://github.com/elabftw/elabftw/pull/1600","id":519180096,"node_id":"MDExOlB1bGxSZXF1ZXN0MzM3OTY3NDM4","number":1600,"title":"[Security] Bump robrichards/xmlseclibs from 3.0.3 to 3.0.4","user":{"login":"dependabot-preview[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot-preview%5Bbot%5D","html_url":"https://github.com/apps/dependabot-preview","followers_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":680422832,"node_id":"MDU6TGFiZWw2ODA0MjI4MzI=","url":"https://api.github.com/repos/elabftw/elabftw/labels/dependencies","name":"dependencies","color":"0025ff","default":false},{"id":1038647036,"node_id":"MDU6TGFiZWwxMDM4NjQ3MDM2","url":"https://api.github.com/repos/elabftw/elabftw/labels/php","name":"php","color":"45229e","default":false},{"id":1193584844,"node_id":"MDU6TGFiZWwxMTkzNTg0ODQ0","url":"https://api.github.com/repos/elabftw/elabftw/labels/security","name":"security","color":"ee0701","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2019-11-07T10:34:16Z","updated_at":"2019-11-07T10:38:30Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/elabftw/elabftw/pulls/1600","html_url":"https://github.com/elabftw/elabftw/pull/1600","diff_url":"https://github.com/elabftw/elabftw/pull/1600.diff","patch_url":"https://github.com/elabftw/elabftw/pull/1600.patch"},"body":"Bumps [robrichards/xmlseclibs](https://github.com/robrichards/xmlseclibs) from 3.0.3 to 3.0.4. **This update includes a security fix.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from [The PHP Security Advisories Database](https://github.com/FriendsOfPHP/security-advisories/blob/master/robrichards/xmlseclibs/CVE-2019-3465.yaml).*\n\n> **Critical signature bypass**\n> \n> Affected versions: >=1.0.0, <2.0.0; >=2.0.0, <2.1.1; >=3.0.0, <3.0.4\n\n</details>\n<details>\n<summary>Release notes</summary>\n\n*Sourced from [robrichards/xmlseclibs's releases](https://github.com/robrichards/xmlseclibs/releases).*\n\n> ## 3.0.4\n> Security Release for   CVE-2019-3465\n</details>\n<details>\n<summary>Changelog</summary>\n\n*Sourced from [robrichards/xmlseclibs's changelog](https://github.com/robrichards/xmlseclibs/blob/master/CHANGELOG.txt).*\n\n> xmlseclibs.php\n> |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||\n> ??, ??? 2018, 3.0.5-dev\n> \n> 06, Nov 2019, 3.0.4\n> Security Improvements:\n> - Insure only a single SignedInfo element exists within a signature during \n>   verification. Refs CVE-2019-3465.\n> Bug Fixes:\n> - Fix variable casing.\n> \n> 15, Nov 2018, 3.0.3\n> Bug Fixes:\n> - Fix casing of class name. (Willem Stuursma-Ruwen)\n> - Fix Xpath casing. (Tim van Dijen)\n> \n> Improvements:\n> - Make PCRE2 compliant. (Stefan Winter)\n> - Add PHP 7.3 support. (Stefan Winter)\n> \n> 27, Sep 2018, 3.0.2\n> Security Improvements:\n> - OpenSSL is now a requirement rather than suggestion. (Slaven Bacelic)\n> - Filter input to avoid XPath injection. (Jaime Pérez)\n> \n> Bug Fixes:\n> - Fix missing parentheses (Tim van Dijen)\n> \n> Improvements:\n> - Use strict comparison operator to compare digest values. (Jaime Pérez)\n> - Remove call to file_get_contents that doesn't even work. (Jaime Pérez)\n> - Document potentially dangerous return value behaviour. (Thijs Kinkhorst)\n> \n> 31, Aug 2017, 3.0.1\n> Bug Fixes:\n> - Fixed missing () in function call. (Dennis Væversted)\n> \n> Improvements:\n> - Add OneLogin to supported software.\n> - Add .gitattributes to remove unneeded files. (Filippo Tessarotto)\n> - Fix bug in example code. (Dan Church)\n> - Travis: add PHP 7.1, move hhvm to allowed failures. (Thijs Kinkhorst)\n> - Drop failing extract-win-cert test (Thijs Kinkhorst). (Thijs Kinkhorst)\n> - Add comments to warn about return values of verify(). (Thijs Kinkhorst)\n> - Fix tests to properly check return code of verify(). (Thijs Kinkhorst)\n> - Restore support for PHP >= 5.4. (Jaime Pérez)\n> \n> 25, May 2017, 3.0.0\n> Improvements:\n> - Remove use of mcrypt (skymeyer)\n></tr></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`0a53d3c`](https://github.com/robrichards/xmlseclibs/commit/0a53d3c3aa87564910cae4ed01416441d3ae0db5) Release 3.0.4. Security release for CVE-2019-3465\n- [`0f54660`](https://github.com/robrichards/xmlseclibs/commit/0f5466070e2a0f2d5d7f41968afdbbf982eea69c) Update year\n- [`5a02126`](https://github.com/robrichards/xmlseclibs/commit/5a021262fc75184be30595d2e5474eff31a2db57) No longer supporting 2.x branch\n- [`f1ef070`](https://github.com/robrichards/xmlseclibs/commit/f1ef0709646284ecd08bbe01f963035f5c90972d) Back to dev\n- See full diff in [compare view](https://github.com/robrichards/xmlseclibs/compare/3.0.3...3.0.4)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=robrichards/xmlseclibs&package-manager=composer&previous-version=3.0.3&new-version=3.0.4)](https://dependabot.com/compatibility-score.html?dependency-name=robrichards/xmlseclibs&package-manager=composer&previous-version=3.0.3&new-version=3.0.4)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Pull request limits (per update run and/or open at any time)\n- Automerge options (never/patch/minor, and dev/runtime dependencies)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\n\n\n</details>"},"comment":{"url":"https://api.github.com/repos/elabftw/elabftw/issues/comments/551022954","html_url":"https://github.com/elabftw/elabftw/pull/1600#issuecomment-551022954","issue_url":"https://api.github.com/repos/elabftw/elabftw/issues/1600","id":551022954,"node_id":"MDEyOklzc3VlQ29tbWVudDU1MTAyMjk1NA==","user":{"login":"codecov-io","id":8655789,"node_id":"MDQ6VXNlcjg2NTU3ODk=","avatar_url":"https://avatars0.githubusercontent.com/u/8655789?v=4","gravatar_id":"","url":"https://api.github.com/users/codecov-io","html_url":"https://github.com/codecov-io","followers_url":"https://api.github.com/users/codecov-io/followers","following_url":"https://api.github.com/users/codecov-io/following{/other_user}","gists_url":"https://api.github.com/users/codecov-io/gists{/gist_id}","starred_url":"https://api.github.com/users/codecov-io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codecov-io/subscriptions","organizations_url":"https://api.github.com/users/codecov-io/orgs","repos_url":"https://api.github.com/users/codecov-io/repos","events_url":"https://api.github.com/users/codecov-io/events{/privacy}","received_events_url":"https://api.github.com/users/codecov-io/received_events","type":"User","site_admin":false},"created_at":"2019-11-07T10:38:30Z","updated_at":"2019-11-07T10:38:30Z","author_association":"NONE","body":"# [Codecov](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=h1) Report\n> Merging [#1600](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=desc) into [hypernext](https://codecov.io/gh/elabftw/elabftw/commit/834c884c539c9dccc9d0e4792f496ab077c6a72d?src=pr&el=desc) will **not change** coverage.\n> The diff coverage is `n/a`.\n\n[![Impacted file tree graph](https://codecov.io/gh/elabftw/elabftw/pull/1600/graphs/tree.svg?width=650&token=SHSZuaxt17&height=150&src=pr)](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=tree)\n\n```diff\n@@             Coverage Diff              @@\n##             hypernext    #1600   +/-   ##\n============================================\n  Coverage        44.13%   44.13%           \n  Complexity        1111     1111           \n============================================\n  Files               57       57           \n  Lines             3881     3881           \n============================================\n  Hits              1713     1713           \n  Misses            2168     2168\n```\n\n\n\n------\n\n[Continue to review full report at Codecov](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=continue).\n> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)\n> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`\n> Powered by [Codecov](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=footer). Last update [834c884...81955ca](https://codecov.io/gh/elabftw/elabftw/pull/1600?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).\n"}}
other: {"actor":{"display_login":"codecov-io"}}