Added an article to favorites in Pocket:
The Lie That Helped Build Nintendo
12 10, 2019
Added an article to favorites in Pocket:
12 10, 2019
Added an article to favorites in Pocket:
Inside the “largest launch of a produce item in American history”
11 25, 2019
Added an article to favorites in Pocket:
A Bitter End For Regular Joe? Scientists Engineer A Smooth, Beanless Coffee
11 24, 2019
dependabot[bot] created a pull request in webrender/popupvid.ioBump mongoose from 3.8.40 to 5.7.12
Bumps [mongoose](https://github.com/Automattic/mongoose) from 3.8.40 to 5.7.12.Changelog
*Sourced from [mongoose's changelog](https://github.com/Automattic/mongoose/blob/master/History.md).* > 5.7.12 / 2019-11-19 > =================== > * fix: avoid throwing error if calling `push()` on a doc array with no parent [#8351](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8351) [#8317](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8317) [#8312](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8312) [AbdelrahmanHafez](https://github.com/AbdelrahmanHafez) > * fix(connection): only buffer for "open" events when calling connection helper while connecting [#8319](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8319) > * fix(connection): pull default database from connection string if specified [#8355](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8355) [#8354](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8354) [zachazar](https://github.com/zachazar) > * fix(populate+discriminator): handle populating document whose discriminator value is different from discriminator model name [#8324](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8324) > * fix: add `mongoose.isValidObjectId()` function to test whether Mongoose can cast a value to an objectid [#3823](https://github-redirect.dependabot.com/Automattic/mongoose/issues/3823) > * fix(model): support setting `excludeIndexes` as schema option for subdocs [#8343](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8343) > * fix: add SchemaMapOptions class for options to map schematype [#8318](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8318) > * docs(query): remove duplicate omitUndefined options [#8349](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8349) [mdumandag](https://github.com/mdumandag) > * docs(schema): add Schema#paths docs to public API docs [#8340](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8340) > > 5.7.11 / 2019-11-14 > =================== > * fix: update mongodb driver -> 3.3.4 [#8276](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8276) > * fix(model): throw readable error when casting bulkWrite update without a 'filter' or 'update' [#8332](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8332) [#8331](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8331) [AbdelrahmanHafez](https://github.com/AbdelrahmanHafez) > * fix(connection): bubble up connected/disconnected events with unified topology [#8338](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8338) [#8337](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8337) > * fix(model): delete $versionError after saving [#8326](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8326) [#8048](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8048) [Fonger](https://github.com/Fonger) > * test(model): add test for issue [#8040](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8040) [#8341](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8341) [Fonger](https://github.com/Fonger) > > 5.7.10 / 2019-11-11 > =================== > * perf(cursor): remove unnecessary `setTimeout()` in `eachAsync()`, 4x speedup in basic benchmarks [#8310](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8310) > * docs(README): re-order sections for better readability [#8321](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8321) [dandv](https://github.com/dandv) > * chore: make npm test not hard-code file paths [#8322](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8322) [stieg](https://github.com/stieg) > > 5.7.9 / 2019-11-08 > ================== > * fix(schema): support setting schema path to an instance of SchemaTypeOptions to fix integration with mongoose-i18n-localize [#8297](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8297) [#8292](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8292) > * fix(populate): make `retainNullValues` set array element to `null` if foreign doc with that id was not found [#8293](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8293) > * fix(document): support getter setting virtual on manually populated doc when calling toJSON() [#8295](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8295) > * fix(model): allow objects with `toBSON()` to make it to `save()` [#8299](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8299) > > 5.7.8 / 2019-11-04 > ================== > * fix(document): allow manually populating path within document array [#8273](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8273) > * fix(populate): update top-level `populated()` when updating document array with populated subpaths [#8265](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8265) > * fix(cursor): throw error when using aggregation cursor as async iterator [#8280](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8280) > * fix(schema): retain `_id: false` in schema after nesting in another schema [#8274](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8274) > * fix(document): make Document class an event emitter to support defining documents without models in node [#8272](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8272) > * docs: document return types for `.discriminator()` [#8287](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8287) > * docs(connection): add note about exporting schemas, not models, in multi connection paradigm [#8275](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8275) > * docs: clarify that transforms defined in `toObject()` options are applied to subdocs [#8260](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8260) > > 5.7.7 / 2019-10-24 > ================== > * fix(populate): make populate virtual consistently an empty array if local field is only empty arrays [#8230](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8230) > * fix(query): allow findOne(objectid) and find(objectid) [#8268](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8268) > > 5.7.6 / 2019-10-21 > ... (truncated)Commits
- [`33412d9`](https://github.com/Automattic/mongoose/commit/33412d91d044daade5a135c7f35f607591c75a09) chore: release 5.7.12 - [`b946225`](https://github.com/Automattic/mongoose/commit/b946225a95db9f6298c229dc9b1dbab7ae631679) Merge pull request [#8351](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8351) from AbdelrahmanHafez/[gh-8317](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8317) - [`63c2f1e`](https://github.com/Automattic/mongoose/commit/63c2f1efe21f4a0f0615008440df212d7ceaf9fa) Remove filter test - [`4599877`](https://github.com/Automattic/mongoose/commit/4599877d99b7c8f824acba6e520f4efdf8a1f616) Revert making map return vanilla JS Array - [`9509b47`](https://github.com/Automattic/mongoose/commit/9509b47326c800d71b3e61c3d14b8c0525a3c627) style: fix lint - [`757579d`](https://github.com/Automattic/mongoose/commit/757579d54c285ed438eedf664e1980e70e32658c) fix(connection): only buffer for "open" events when calling connection helper... - [`ff3d36f`](https://github.com/Automattic/mongoose/commit/ff3d36ffd13e5308dd52d54b0b970aa1e63a508d) fix(populate+discriminator): handle populating document whose discriminator v... - [`a32d9a8`](https://github.com/Automattic/mongoose/commit/a32d9a823f9da8d8067c2a4ce8848cf6f0abd833) test(populate): repro [#8324](https://github-redirect.dependabot.com/Automattic/mongoose/issues/8324) - [`ba38d1d`](https://github.com/Automattic/mongoose/commit/ba38d1de8ec94d72d2730d6186fc01301f2258ea) Add test to fiter - [`ba2c353`](https://github.com/Automattic/mongoose/commit/ba2c35377d5f48eca2d338eb10ab66de68ec237c) Make DocumentArray#map return a regular JS array - Additional commits viewable in [compare view](https://github.com/Automattic/mongoose/compare/3.8.40...5.7.12)
[](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/webrender/popupvid.io/network/alerts).
November 23, 2019
dependabot[bot] created a pull request in webrender/popupvid.ioBump method-override from 2.0.2 to 3.0.0
Bumps [method-override](https://github.com/expressjs/method-override) from 2.0.2 to 3.0.0.Release notes
*Sourced from [method-override's releases](https://github.com/expressjs/method-override/releases).* > ## 3.0.0 > * Drop support for Node.js below 0.10 > * deps: [email protected] > - Add `DEBUG_HIDE_DATE` environment variable > - Change timer to per-namespace instead of global > - Change non-TTY date format > - Remove `DEBUG_FD` environment variable support > - Support 256 namespace colors > > ## 2.3.10 > * deps: [email protected] > * deps: [email protected]~1.3.2 > - perf: reduce overhead for full URLs > - perf: unroll the "fast-path" `RegExp` > * deps: [email protected]~1.1.2 > - perf: improve header token parsing speed > * perf: skip unnecessary parsing of entire header > > ## 2.3.9 > * deps: [email protected] > - deps: [email protected] > * deps: [email protected]~1.1.1 > - perf: hoist regular expression > > ## 2.3.8 > * deps: [email protected] > - Allow colors in workers > - Deprecated `DEBUG_FD` environment variable > - Fix: `DEBUG_MAX_ARRAY_LENGTH` > - Use same color for same namespace > > ## 2.3.7 > - deps: [email protected] > - Fix error when running under React Native > - deps: [email protected] > - perf: remove argument reassignment > > ## 2.3.6 > - deps: [email protected]~1.1.2 > - perf: enable strict mode > - deps: [email protected]~1.3.1 > - perf: enable strict mode > - deps: [email protected]~1.1.0 > > ## 2.3.5 > - perf: enable strict mode > > ## 2.3.4 > - deps: [email protected]~1.0.1 > > ... (truncated)Changelog
*Sourced from [method-override's changelog](https://github.com/expressjs/method-override/blob/master/HISTORY.md).* > 3.0.0 / 2018-07-11 > ================== > > * Drop support for Node.js below 0.10 > * deps: [email protected] > - Add `DEBUG_HIDE_DATE` environment variable > - Change timer to per-namespace instead of global > - Change non-TTY date format > - Remove `DEBUG_FD` environment variable support > - Support 256 namespace colors > > 2.3.10 / 2017-09-27 > =================== > > * deps: [email protected] > * deps: [email protected]~1.3.2 > - perf: reduce overhead for full URLs > - perf: unroll the "fast-path" `RegExp` > * deps: [email protected]~1.1.2 > - perf: improve header token parsing speed > * perf: skip unnecessary parsing of entire header > > 2.3.9 / 2017-05-19 > ================== > > * deps: [email protected] > - deps: [email protected] > * deps: [email protected]~1.1.1 > - perf: hoist regular expression > > 2.3.8 / 2017-03-24 > ================== > > * deps: [email protected] > - Allow colors in workers > - Deprecated `DEBUG_FD` environment variable > - Fix: `DEBUG_MAX_ARRAY_LENGTH` > - Use same color for same namespace > > 2.3.7 / 2016-11-19 > ================== > > * deps: [email protected] > - Fix error when running under React Native > - deps: [email protected] > * perf: remove argument reassignment > > 2.3.6 / 2016-05-20 > ================== > > ... (truncated)Commits
- [`5b83d4f`](https://github.com/expressjs/method-override/commit/5b83d4f0dc3db414df6c7e4a5da93dec170153de) 3.0.0 - [`0aef6c8`](https://github.com/expressjs/method-override/commit/0aef6c8fd505bd7a28c25546cdfc5a40fd382a04) deps: [email protected] - [`ddb4bcc`](https://github.com/expressjs/method-override/commit/ddb4bcc48fb265d82c9f65c0cad4c016521556db) build: [email protected] - [`baed633`](https://github.com/expressjs/method-override/commit/baed633ad7cc04649cc909bd418fbf785096e360) build: [email protected] - [`b357d8e`](https://github.com/expressjs/method-override/commit/b357d8ee0a81f0b742e906660160e8ff4575bd0a) Drop support for Node.js below 0.10 - [`09582af`](https://github.com/expressjs/method-override/commit/09582af0d1e2511613324b133cf6f548035a2a9f) build: support Node.js 10.x - [`7579004`](https://github.com/expressjs/method-override/commit/75790041c4854eb0974c2e11526b5da18d39c593) lint: apply standard 11 style - [`00ca04a`](https://github.com/expressjs/method-override/commit/00ca04a3ff63ceeee066c786070b5d4432c3dbdd) build: support Node.js 9.x - [`c92384c`](https://github.com/expressjs/method-override/commit/c92384c847c5965786068b2c76dd5a8ccede9d0e) build: [email protected] - [`4947f58`](https://github.com/expressjs/method-override/commit/4947f5822fe82c2bbe7543a1ca496bfddfea6434) build: [email protected] - Additional commits viewable in [compare view](https://github.com/expressjs/method-override/compare/2.0.2...3.0.0)
[](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/webrender/popupvid.io/network/alerts).
November 23, 2019
dependabot[bot] created a pull request in webrender/webrender.github.ioBump rubyzip from 1.2.2 to 2.0.0
Bumps [rubyzip](https://github.com/rubyzip/rubyzip) from 1.2.2 to 2.0.0.Release notes
*Sourced from [rubyzip's releases](https://github.com/rubyzip/rubyzip/releases).* > ## v2.0.0 > Security > > - Default the `validate_entry_sizes` option to `true`, so that callers can trust an entry's reported size when using `extract` [#403](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/403) > - This option defaulted to `false` in 1.3.0 for backward compatibility, but it now defaults to `true`. If you are using an older version of ruby and can't yet upgrade to 2.x, you can still use 1.3.0 and set the option to `true`. > > Tooling / Documentation > > - Remove test files from the gem to avoid problems with antivirus detections on the test files [#405](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/405) / [#384](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/384) > - Drop support for unsupported ruby versions [#406](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/406) > > ## v1.3.0 > Security > > - Add `validate_entry_sizes` option so that callers can trust an entry's reported size when using `extract` [#403](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/403) > - This option defaults to `false` for backward compatibility in this release, but you are strongly encouraged to set it to `true`. It will default to `true` in rubyzip 2.0. > > New Feature > > - Add `add_stored` method to simplify adding entries without compression [#366](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/366) > > Tooling / Documentation > > - Add more gem metadata links [#402](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/402) > > ## v1.2.4 > - Do not rewrite zip files opened with `open_buffer` that have not changed [#360](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/360) > > Tooling / Documentation > > - Update `example_recursive.rb` in README [#397](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/397) > - Hold CI at `trusty` for now, automatically pick the latest ruby patch version, use rbx-4 and hold jruby at 9.1 [#399](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/399) > > ## v1.2.3 > * Allow tilde in zip entry names [#391](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/391) (fixes regression in 1.2.2 from [#376](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/376)) > * Support frozen string literals in more files [#390](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/390) > * Require `pathname` explicitly [#388](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/388) (fixes regression in 1.2.2 from [#376](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/376)) > > Tooling / Documentation: > > * CI updates [#392](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/392), [#394](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/394) > * Bump supported ruby versions and add 2.6 > * JRuby failures are no longer ignored (reverts [#375](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/375) / part of [#371](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/371)) > * Add changelog entry that was missing for last release [#387](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/387) > * Comment cleanup [#385](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/385) > > Since the GitHub release information for 1.2.2 is missing, I will also include it here: > > ### 1.2.2 > > ... (truncated)Changelog
*Sourced from [rubyzip's changelog](https://github.com/rubyzip/rubyzip/blob/master/Changelog.md).* > # 2.0.0 (2019-09-25) > > Security > > - Default the `validate_entry_sizes` option to `true`, so that callers can trust an entry's reported size when using `extract` [#403](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/403) > - This option defaulted to `false` in 1.3.0 for backward compatibility, but it now defaults to `true`. If you are using an older version of ruby and can't yet upgrade to 2.x, you can still use 1.3.0 and set the option to `true`. > > Tooling / Documentation > > - Remove test files from the gem to avoid problems with antivirus detections on the test files [#405](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/405) / [#384](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/384) > - Drop support for unsupported ruby versions [#406](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/406) > > # 1.3.0 (2019-09-25) > > Security > > - Add `validate_entry_sizes` option so that callers can trust an entry's reported size when using `extract` [#403](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/403) > - This option defaults to `false` for backward compatibility in this release, but you are strongly encouraged to set it to `true`. It will default to `true` in rubyzip 2.0. > > New Feature > > - Add `add_stored` method to simplify adding entries without compression [#366](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/366) > > Tooling / Documentation > > - Add more gem metadata links [#402](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/402) > > # 1.2.4 (2019-09-06) > > - Do not rewrite zip files opened with `open_buffer` that have not changed [#360](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/360) > > Tooling / Documentation > > - Update `example_recursive.rb` in README [#397](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/397) > - Hold CI at `trusty` for now, automatically pick the latest ruby patch version, use rbx-4 and hold jruby at 9.1 [#399](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/399) > > # 1.2.3 > > - Allow tilde in zip entry names [#391](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/391) (fixes regression in 1.2.2 from [#376](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/376)) > - Support frozen string literals in more files [#390](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/390) > - Require `pathname` explicitly [#388](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/388) (fixes regression in 1.2.2 from [#376](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/376)) > > Tooling / Documentation: > > - CI updates [#392](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/392), [#394](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/394) > - Bump supported ruby versions and add 2.6 > - JRuby failures are no longer ignored (reverts [#375](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/375) / part of [#371](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/371)) > - Add changelog entry that was missing for last release [#387](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/387) > - Comment cleanup [#385](https://github-redirect.dependabot.com/rubyzip/rubyzip/pull/385)Commits
- [`2825898`](https://github.com/rubyzip/rubyzip/commit/2825898f69fbf1efe4e43452adae6ac5d074ec1c) Merge pull request [#408](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/408) from rubyzip/v2-0-0 - [`cb407b1`](https://github.com/rubyzip/rubyzip/commit/cb407b106541c345329a017d6eb34026cb372872) Bump version to 2.0.0 - [`e1d9af6`](https://github.com/rubyzip/rubyzip/commit/e1d9af6e46f7eb0d0b728958a57f7e28d60301a4) Merge pull request [#406](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/406) from rubyzip/bump-supported-ruby - [`3641a96`](https://github.com/rubyzip/rubyzip/commit/3641a963ea0c34275562250d7e67380c85fc2570) Merge pull request [#405](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/405) from rubyzip/remove-test-files - [`e79d9ea`](https://github.com/rubyzip/rubyzip/commit/e79d9ea2922be12db121c20f5dc55bba8a35418a) Merge pull request [#407](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/407) from rubyzip/v1-3-0 - [`7c65e1e`](https://github.com/rubyzip/rubyzip/commit/7c65e1e3595031392f1050b81fb2b95b0f2ee764) Bump version to 1.3.0 - [`d65fe7b`](https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e) Merge pull request [#403](https://github-redirect.dependabot.com/rubyzip/rubyzip/issues/403) from rubyzip/check-size - [`35446f4`](https://github.com/rubyzip/rubyzip/commit/35446f467b739d05790356ab86915de76f0120f1) Drop old ruby and JDK versions from CI - [`74d4bec`](https://github.com/rubyzip/rubyzip/commit/74d4bec371158c4c2a9fe965302dc9649c941a73) Remove test files from gem - [`97cb6ae`](https://github.com/rubyzip/rubyzip/commit/97cb6aefe6d12bd2429d7a2e119ccb26f259d71d) Warn when an entry size is invalid - Additional commits viewable in [compare view](https://github.com/rubyzip/rubyzip/compare/v1.2.2...v2.0.0)
[](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/webrender/webrender.github.io/network/alerts).
October 31, 2019
dependabot[bot] created a pull request in webrender/webrender.github.ioBump nokogiri from 1.9.1 to 1.10.4
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.9.1 to 1.10.4.Release notes
*Sourced from [nokogiri's releases](https://github.com/sparklemotion/nokogiri/releases).* > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) > > > ## 1.10.3 / 2019-04-22 > > ### Security Notes > > [MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in [#1892](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1892). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. > > ## 1.10.2 / 2019-03-24 > > ### Security > > * [MRI] Remove support from vendored libxml2 for future script macros. [#1871](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1871) > * [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1877) > > > ### Bug fixes > > * [JRuby] Fix node ownership in duplicated documents. [#1060](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1060) > * [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, [#1872](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1872)] (Thanks, [@adjam](https://github.com/adjam)!) > > > > ## 1.10.1 / 2019-01-13 > > ### Features > > * [MRI] During installation, handle Xcode 10's new library pathOS. [#1801, [#1851](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1851)] (Thanks, [@mlj](https://github.com/mlj) and [@deepj](https://github.com/deepj)!) > * Avoid unnecessary creation of `Proc`s in many methods. [#1776](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1776) (Thanks, [@chopraanmol1](https://github.com/chopraanmol1)!) > > > ### Bug fixes > > * CSS selector `:has()` now correctly matches against any descendant. Previously this selector matched against only direct children). [#350](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/350) (Thanks, [@Phrogz](https://github.com/Phrogz)!) > * `NodeSet#attr` now returns `nil` if it's empty. Previously this raised a NoMethodError. > * [MRI] XPath errors are no longer suppressed during `XSLT::Stylesheet#transform`. Previously these errors were suppressed which led to silent failures and a subsequent segfault. [#1802](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1802) > > > > ... (truncated)Changelog
*Sourced from [nokogiri's changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md).* > ## 1.10.4 / 2019-08-11 > > ### Security > > #### Address CVE-2019-5477 ([#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915)) > > A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. > > This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. > > This CVE's public notice is [sparklemotion/nokogiri#1915](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1915) > > > ## 1.10.3 / 2019-04-22 > > ### Security Notes > > [MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in [#1892](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1892). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. > > > ## 1.10.2 / 2019-03-24 > > ### Security > > * [MRI] Remove support from vendored libxml2 for future script macros. [#1871](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1871) > * [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1877) > > > ### Bug fixes > > * [JRuby] Fix node ownership in duplicated documents. [#1060](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1060) > * [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, [#1872](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1872)] (Thanks, [@adjam](https://github.com/adjam)!) > > > ## 1.10.1 / 2019-01-13 > > ### Features > > * [MRI] During installation, handle Xcode 10's new library path. [#1801, [#1851](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1851)] (Thanks, [@mlj](https://github.com/mlj) and [@deepj](https://github.com/deepj)!) > * Avoid unnecessary creation of `Proc`s in many methods. [#1776](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1776) (Thanks, [@chopraanmol1](https://github.com/chopraanmol1)!) > > > ### Bug fixes > > * CSS selector `:has()` now correctly matches against any descendant. Previously this selector matched against only direct children). [#350](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/350) (Thanks, [@Phrogz](https://github.com/Phrogz)!) > * `NodeSet#attr` now returns `nil` if it's empty. Previously this raised a NoMethodError. > * [MRI] XPath errors are no longer suppressed during `XSLT::Stylesheet#transform`. Previously these errors were suppressed which led to silent failures and a subsequent segfault. [#1802](https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1802) > > > ## 1.10.0 / 2019-01-04 > ... (truncated)Commits
- [`beb832e`](https://github.com/sparklemotion/nokogiri/commit/beb832e3a67ba9aef1b4e83640bc8fd08fbc6da5) version bump to v1.10.4 - [`5d30128`](https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc) Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.x - [`c86b5fc`](https://github.com/sparklemotion/nokogiri/commit/c86b5fc02e5b50308d8de08b9a194aa71b701081) update CHANGELOG - [`5fe449f`](https://github.com/sparklemotion/nokogiri/commit/5fe449fd3ab8cc25a71499128529c821c10dde83) regenerate lexical scanner using rexical 1.0.7 - [`6777008`](https://github.com/sparklemotion/nokogiri/commit/6777008202c1bde0520bb09fd1f02dee64dbcb60) eliminate `eval` from Builder#initialize - [`47a7bc7`](https://github.com/sparklemotion/nokogiri/commit/47a7bc7d905207a9f5ccb2e6618e56d0ea78160a) rufo formatting - [`094ecb1`](https://github.com/sparklemotion/nokogiri/commit/094ecb1f7057ec56f47ed910b0326b17ec88c0fe) rubocop security scan is run as part of the `test` rake target - [`d068cd4`](https://github.com/sparklemotion/nokogiri/commit/d068cd43fe74966095af248410e442d09be3e8e5) add rubocop as a dev dependency - [`45ee92b`](https://github.com/sparklemotion/nokogiri/commit/45ee92bcc0c0ad5195bab5e564704bb1e28aab17) adding a temporary pipeline for v1.10.x - [`8e24af5`](https://github.com/sparklemotion/nokogiri/commit/8e24af59af22c0bf61376d8c9ae6a85e5b2ba3bd) version bump to v1.10.3 - Additional commits viewable in [compare view](https://github.com/sparklemotion/nokogiri/compare/v1.9.1...v1.10.4)
[](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/webrender/webrender.github.io/network/alerts).
October 31, 2019
Added an article to favorites in Pocket:
Why Walking is the Key to Being More Productive
10 18, 2019
discovered via @triptych's link which talks about the premise behind beaker and the p2p web some more: https://t.co/LyAWP1DDXl
— Jeremy Laskar (@webrender_) June 4, 2019
subscribe via RSS