payload: {"action":"created","issue":{"url":"https://api.github.com/repos/2fd/2fd.github.io/issues/7","repository_url":"https://api.github.com/repos/2fd/2fd.github.io","labels_url":"https://api.github.com/repos/2fd/2fd.github.io/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/2fd/2fd.github.io/issues/7/comments","events_url":"https://api.github.com/repos/2fd/2fd.github.io/issues/7/events","html_url":"https://github.com/2fd/2fd.github.io/pull/7","id":519903837,"node_id":"MDExOlB1bGxSZXF1ZXN0MzM4NTg1NDc5","number":7,"title":"[Security] Bump handlebars from 3.0.7 to 4.5.1","user":{"login":"dependabot-preview[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot-preview%5Bbot%5D","html_url":"https://github.com/apps/dependabot-preview","followers_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1630069996,"node_id":"MDU6TGFiZWwxNjMwMDY5OTk2","url":"https://api.github.com/repos/2fd/2fd.github.io/labels/dependencies","name":"dependencies","color":"0366d6","default":false},{"id":1665040563,"node_id":"MDU6TGFiZWwxNjY1MDQwNTYz","url":"https://api.github.com/repos/2fd/2fd.github.io/labels/security","name":"security","color":"ee0701","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-11-08T09:25:05Z","updated_at":"2019-11-14T09:18:25Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/2fd/2fd.github.io/pulls/7","html_url":"https://github.com/2fd/2fd.github.io/pull/7","diff_url":"https://github.com/2fd/2fd.github.io/pull/7.diff","patch_url":"https://github.com/2fd/2fd.github.io/pull/7.patch"},"body":"Bumps [handlebars](https://github.com/wycats/handlebars.js) from 3.0.7 to 4.5.1. **This update includes a security fix.**\n<details>\n<summary>Vulnerabilities fixed</summary>\n\n*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/61.json).*\n\n> **Quoteless Attributes in Templates can lead to Content Injection**\n> Not using quotes around your attributes in handlebar templates, could lead to content injection.\n> \n> ### Example\n> Template:\n> ```<a href={{foo}}/>```\n> \n> Input:\n> ```{ 'foo' : 'test.com onload=alert(1)'}```\n> \n> Rendered result:\n> ```<a href=test.com onload=alert(1)/>```\n> \n> Affected versions: <4.0.0\n\n</details>\n<details>\n<summary>Changelog</summary>\n\n*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/v4.5.1/release-notes.md).*\n\n> ## v4.5.1 - October 29th, 2019\n> Bugfixs\n> \n> - fix: move \"eslint-plugin-compat\" to devDependencies - 5e9d17f ([#1589](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1589))\n> \n> Compatibility notes:\n> - No compatibility issues are to be expected\n> \n> \n> [Commits](https://github.com/wycats/handlebars.js/compare/v4.5.0...v4.5.1)\n> \n> ## v4.5.0 - October 28th, 2019\n> Features / Improvements\n> - Add method Handlebars.parseWithoutProcessing ([#1584](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1584)) - 62ed3c2\n> - add guard to if & unless helpers ([#1549](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1549))\n> - show source location for the strict lookup exceptions - feb60f8\n> \n> Bugfixes:\n> - Use objects for hash value tracking - 7fcf9d2\n> \n> Chore:\n> - Resolve deprecation warning message from eslint while running eslint ([#1586](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1586)) - 7052e88\n> - chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618\n> \n> Compatibility notes:\n> - No compatibility issues are to be expected\n> \n> [Commits](https://github.com/wycats/handlebars.js/compare/v4.4.5...v4.5.0)\n> \n> ## v4.4.5 - October 20th, 2019\n> Bugfixes: \n> \n> - Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, [#1579](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1579)\n> \n> \n> \n> [Commits](https://github.com/wycats/handlebars.js/compare/v4.4.4...v4.4.5)\n> \n> ## v4.4.4 - October 20th, 2019\n> Bugfixes:\n> - fix: prevent zero length tokens in raw-blocks ([#1577](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1577), [#1578](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1578)) - f1752fe\n> \n> Chore: \n> - chore: link to s3 bucket with https, add \"npm ci\" to build instructions - 0b593bf\n> \n> Compatibility notes:\n> - no compatibility issues are expected\n> \n> [Commits](https://github.com/wycats/handlebars.js/compare/v4.4.3...v4.4.4)\n> \n></tr></table> ... (truncated)\n</details>\n<details>\n<summary>Commits</summary>\n\n- [`7ef8617`](https://github.com/wycats/handlebars.js/commit/7ef86173abb446cf564ad6dc2646a4c361e2ab9f) v4.5.1\n- [`b75e3e1`](https://github.com/wycats/handlebars.js/commit/b75e3e1f403f0564a43fc9ffa759fbe1afccd1c1) Update release notes\n- [`5e9d17f`](https://github.com/wycats/handlebars.js/commit/5e9d17f8faf770efb892a526603a728e480a9349) fix: move \"eslint-plugin-compat\" to devDependencies\n- [`b24797d`](https://github.com/wycats/handlebars.js/commit/b24797da01afd4e849fdb315dea8335792974522) v4.5.0\n- [`a243067`](https://github.com/wycats/handlebars.js/commit/a2430678830fa4f2fc207fac1453e805908f60de) Update release notes\n- [`088e618`](https://github.com/wycats/handlebars.js/commit/088e61812a111f5c0ebf1e583852bc6640efcc3a) chore: add eslint-plugin-compat and eslint-plugin-es5\n- [`7052e88`](https://github.com/wycats/handlebars.js/commit/7052e88068025aa5547f3c96d740283045bbbc2c) Resolve deprecation warning message from eslint while running eslint ([#1586](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1586))\n- [`b8913fc`](https://github.com/wycats/handlebars.js/commit/b8913fcc6598ee7e6d1ef5f1dec98a002f0c36c6) Add missing types for the Exception class properties ([#1583](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1583))\n- [`62ed3c2`](https://github.com/wycats/handlebars.js/commit/62ed3c25c76445deb8c51a5b36ce52f7f1be3411) Add Handlebars.parseWithoutProcessing ([#1584](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1584))\n- [`7fcf9d2`](https://github.com/wycats/handlebars.js/commit/7fcf9d24f8f4aa8de331f8bda13690ba5b85eff1) Use objects for hash value tracking\n- Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v3.0.7...v4.5.1)\n</details>\n<br />\n\n[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=handlebars&package-manager=npm_and_yarn&previous-version=3.0.7&new-version=4.5.1)](https://dependabot.com/compatibility-score.html?dependency-name=handlebars&package-manager=npm_and_yarn&previous-version=3.0.7&new-version=4.5.1)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot merge` will merge this PR after your CI passes on it\n- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it\n- `@dependabot cancel merge` will cancel a previously requested merge and block automerging\n- `@dependabot reopen` will reopen this PR if it is closed\n- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language\n- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language\n- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language\n- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language\n- `@dependabot badge me` will comment on this PR with code to add a \"Dependabot enabled\" badge to your readme\n\nAdditionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):\n- Update frequency (including time of day and day of week)\n- Pull request limits (per update run and/or open at any time)\n- Out-of-range updates (receive only lockfile updates, if desired)\n- Security updates (receive only security updates, if desired)\n\n\n\n</details>"},"comment":{"url":"https://api.github.com/repos/2fd/2fd.github.io/issues/comments/553798191","html_url":"https://github.com/2fd/2fd.github.io/pull/7#issuecomment-553798191","issue_url":"https://api.github.com/repos/2fd/2fd.github.io/issues/7","id":553798191,"node_id":"MDEyOklzc3VlQ29tbWVudDU1Mzc5ODE5MQ==","user":{"login":"dependabot-preview[bot]","id":27856297,"node_id":"MDM6Qm90Mjc4NTYyOTc=","avatar_url":"https://avatars3.githubusercontent.com/in/2141?v=4","gravatar_id":"","url":"https://api.github.com/users/dependabot-preview%5Bbot%5D","html_url":"https://github.com/apps/dependabot-preview","followers_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/followers","following_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/repos","events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/dependabot-preview%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2019-11-14T09:18:24Z","updated_at":"2019-11-14T09:18:24Z","author_association":"NONE","body":"Superseded by #8."}}
other: {"actor":{"display_login":"dependabot-preview"}}