Bumps [handlebars](https://github.com/wycats/handlebars.js) from 4.0.12 to 4.1.0. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The npm Advisory Database](https://npmjs.com/advisories/755).*
> **Prototype Pollusion**
> All versions of `handlebars` are vulnerable to Prototype Pollusion. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.
>
> Affected versions: <=4.0.12
</details>
<details>
<summary>Changelog</summary>
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/v4.1.0/release-notes.md).*
> ## v4.1.0 - February 7th, 2019
> New Features
>
> - import TypeScript typings - 27ac1ee
>
> Security fixes:
>
> - disallow access to the constructor in templates to prevent RCE - 42841c4, [#1495](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495)
>
> Housekeeping
>
> - chore: fix components/handlebars package.json and auto-update on release - bacd473
> - chore: Use node 10 to build handlebars - 78dd89c
> - chore/doc: Add more release docs - 6b87c21
>
> Compatibility notes:
>
> Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
> Remote Code Execution. This means that following construct will no work anymore:
>
> ```
> class SomeClass {
> }
>
> SomeClass.staticProperty = 'static'
>
> var template = Handlebars.compile('{{constructor.staticProperty}}');
> document.getElementById('output').innerHTML = template(new SomeClass());
> // expected: 'static', but now this is empty.
> ```
>
> This kind of access is not the intended use of Handlebars and leads to the vulnerability described in [#1495](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
>
>
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.1.0)
</details>
<details>
<summary>Commits</summary>
- [`7caca94`](7caca944b1) v4.1.0
- [`7bd34fb`](7bd34fb466) Update release notes
- [`56fc676`](56fc6768d1) test: run appveyor tests in Node 10
- [`ee30222`](ee3022228b) chore: disable sauce-labs
- [`05e6293`](05e6293bb3) chore: bump version of grunt-saucelabs
- [`2db0d12`](2db0d123c8) chore: add .idea and yarn-error.log to .gitignore
- [`edc6220`](edc6220d51) fix: disallow access to the constructor in templates to prevent RCE
- [`bacd473`](bacd473fe6) chore: fix components/handlebars package.json and auto-update on release
- [`27ac1ee`](27ac1ee396) Feat: Import TypeScript typings
- [`78dd89c`](78dd89c13a) chore: Use node 10 to build handlebars
- Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.1.0)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=handlebars&package-manager=npm_and_yarn&previous-version=4.0.12&new-version=4.1.0)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [aetna](https://github.com/pressbooks/aetna) from 1.0.0-alpha.22 to 1.0.0-alpha.24.
<details>
<summary>Commits</summary>
- See full diff in [compare view](https://github.com/pressbooks/aetna/commits)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=aetna&package-manager=npm_and_yarn&previous-version=1.0.0-alpha.22&new-version=1.0.0-alpha.24)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [atob](https://github.com/coolaj86/node-browser-compat) from 2.0.3 to 2.1.2. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/e391a58d-4a81-448b-8ffc-e19016807d73).*
> **CWE-125: Out-of-bounds Read**
> The software reads data past the end, or before the beginning, of the intended buffer.
>
> Affected versions: <=2.0.3
*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/403.json).*
> **Out-of-bounds Read**
> `atob` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below
>
> Affected versions: <=2.0.3
</details>
<details>
<summary>Commits</summary>
- See full diff in [compare view](https://github.com/coolaj86/node-browser-compat/commits)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=atob&package-manager=npm_and_yarn&previous-version=2.0.3&new-version=2.1.2)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [marked](https://github.com/markedjs/marked) from 0.3.6 to 0.3.19. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/9ad1891d-443b-4ea0-b2f4-8fea2745533c).*
> **[CVE-2017-1000427] marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI...**
> marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
>
> Affected versions: <=0.3.6
*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/934cfc24-3eba-4ebb-8bac-b53b7ed08c59).*
> **CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')**
> The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
>
> Affected versions: <=0.3.6
*Sourced from The GitHub Security Advisory Database.*
> **High severity vulnerability that affects marked**
> The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
>
> Affected versions: <0.3.9
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects marked**
> A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
>
> Affected versions: < 0.3.9
</details>
<details>
<summary>Release notes</summary>
*Sourced from [marked's releases](https://github.com/markedjs/marked/releases).*
> ## 0.3.18 minified required new release
> 0.3.18 did not have changes to min.
>
> ## Minor fixes and updated docs
> - Supported Markdown flavors: CommonMark 0.28 and GitHub Flavored Markdown 0.28
> - Updates to our CI pipeline; we're all green! [#1098](https://github-redirect.dependabot.com/markedjs/marked/issues/1098) with the caveat that there is a test that needs to get sorted (help us out [#1092](https://github-redirect.dependabot.com/markedjs/marked/issues/1092))
> - Start ordered lists using the initial numbers from markdown lists ([#1144](https://github-redirect.dependabot.com/markedjs/marked/issues/1144))
> - Added GitHub Pages site for documentation https://marked.js.org/ ([#1138](https://github-redirect.dependabot.com/markedjs/marked/issues/1138))
>
> ## Processes and tools
> - The elephant in the room: A security vulnerability was discovered and fixed. Please note, if something breaks due to these changes, it was not our intent, and please let us know by submitting a PR or issue to course correct (the nature of the zero-major release and having security as a number one priority) [#1083](https://github-redirect.dependabot.com/markedjs/marked/issues/1083)
> - The other elephant in the room: We missed publishing a 0.3.16 release to GitHub; so, trying to make up for that a bit.
> - Updates to the project documentation and operations, you should check it out, just start with the README and you should be good.
> - New release PR template available [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076)
> - Updates to default PR and Issue templates [#1076](https://github-redirect.dependabot.com/markedjs/marked/issues/1076)
> - Lint checks + tests + continuous integration using Travis [#1020](https://github-redirect.dependabot.com/markedjs/marked/issues/1020)
> - Updated testing output [#1085](https://github-redirect.dependabot.com/markedjs/marked/issues/1085) & [#1087](https://github-redirect.dependabot.com/markedjs/marked/issues/1087)
>
> ## Fix capturing parens
> Fixes unintended breaking change from v0.3.14
>
> ## New year, new home
> - Marked has a new home under the MarkedJS org! Other advances soon to come.
> - Updated minifier.
> - Various parser fixes
>
> ## New Year, new Marked!
> - Addresses issue where some users might not have been able to update due to missing `use strict` [#991](https://github-redirect.dependabot.com/markedjs/marked/issues/991)
> - Parser fix [#977](https://github-redirect.dependabot.com/markedjs/marked/issues/977)
> - New way to perform tests with options and running individual tests [#1002](https://github-redirect.dependabot.com/markedjs/marked/issues/1002)
> - Improved test cases
> - Improved links
>
> ## Merry XSSmas
> We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.
>
> ## XSS
> Should fix XSS issue discovered.
</details>
<details>
<summary>Commits</summary>
- [`5d1baa4`](5d1baa4d7c) Merge pull request [#1157](https://github-redirect.dependabot.com/markedjs/marked/issues/1157) from markedjs/release-0.3.19
- [`a089991`](a089991fe3) Merge pull request [#64](https://github-redirect.dependabot.com/markedjs/marked/issues/64) from fidian/master
- [`ad6c7f9`](ad6c7f9125) Merge pull request [#1156](https://github-redirect.dependabot.com/markedjs/marked/issues/1156) from UziTech/docs-navigation
- [`03e015c`](03e015ca91) 0.3.19
- [`cf2def0`](cf2def076f) minify
- [`29f4190`](29f4190117) Ignore DS_Store on macos
- [`f29bceb`](f29bceb025) Update publishing template ([#1154](https://github-redirect.dependabot.com/markedjs/marked/issues/1154))
- [`210eed7`](210eed715b) Update badge template ([#1155](https://github-redirect.dependabot.com/markedjs/marked/issues/1155))
- [`9c01b83`](9c01b83370) link to README.md
- [`fd9f444`](fd9f444133) add github ribbon
- Additional commits viewable in [compare view](https://github.com/markedjs/marked/compare/v0.3.6...v0.3.19)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=marked&package-manager=npm_and_yarn&previous-version=0.3.6&new-version=0.3.19)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Bumps [stringstream](https://github.com/mhart/StringStream) from 0.0.5 to 0.0.6. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>
*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/422.json).*
> **Out-of-bounds Read**
> `stringstream` allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below
>
> Affected versions: <=0.0.5
*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/422.json).*
> **Out-of-bounds Read**
> `stringstream` allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below
>
> Affected versions: <=0.0.5
</details>
<details>
<summary>Commits</summary>
- [`fee31c5`](fee31c5c4a) 0.0.6
- [`2f4a9d4`](2f4a9d496f) Merge pull request [#9](https://github-redirect.dependabot.com/mhart/StringStream/issues/9) from mhart/fix-buffer-constructor-vuln
- [`afbc744`](afbc744222) Ensure data is not a number in Buffer constructor
- See full diff in [compare view](https://github.com/mhart/StringStream/compare/v0.0.5...v0.0.6)
</details>
<br />
[](https://dependabot.com/compatibility-score.html?dependency-name=stringstream&package-manager=npm_and_yarn&previous-version=0.0.5&new-version=0.0.6)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
</details>
Ned Zimmerman