Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Bump angular from 1.6.10 to 1.7.9 #562

Closed

Conversation

dependabot-preview[bot]
Copy link

Bumps angular from 1.6.10 to 1.7.9. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects angular
In AngularJS before 1.7.9 the function merge() could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Affected versions: < 1.7.9

Changelog

Sourced from angular's changelog.

1.7.9 pollution-eradication (2019-11-19)

Bug Fixes

1.7.8 enthusiastic-oblation (2019-03-11)

Bug Fixes

  • required: correctly validate required on non-input element surrounded by ngIf
    (a4c7bd,
    #16830,
    #16836)

1.7.7 kingly-exiting (2019-02-04)

Bug Fixes

  • ngRequired: set error correctly when inside ngRepeat and false by default
    (5ad4f5,
    #16814,
    #16820)

1.7.6 gravity-manipulation (2019-01-17)

Bug Fixes

  • $compile: fix ng-prop-* with undefined values
    (772440,
    #16797,
    #16798)
  • compile: properly handle false value for boolean attrs with jQuery
    (27486b,
    #16778,
    #16779)
  • ngRepeat:
    • fix reference to last collection value remaining across linkages
      (cf919a)
    • fix trackBy function being invoked with incorrect scope
      (d4d103,
... (truncated)
Commits
  • d257c45 docs: release notes for 1.7.9
  • 1b1684c docs($compile): fix typos and incorrect example
  • 726f49d fix(angular.merge): do not merge proto property
  • 8a187f1 chore(saucelabs): switch to latest version of desktop Safari
  • d97e6f1 chore(saucelabs): upgrade SauceConnect to 4.5.4
  • 26e893a docs(guide/migration): fix typo (misceallenous --> miscellaneous)
  • 5edd253 fix(ngStyle): correctly remove old style when new style value is invalid
  • 019dded chore(*): update jQuery from 3.2.1 to 3.4.0
  • 0007be1 chore(*): make yarn.lock & GitHub templates identical between master & v1.7.x
  • 863528f docs(DEVELOPERS): remove git revert misleading information
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by petebacondarwin, a new releaser for angular since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Bumps [angular](https://github.com/angular/angular.js) from 1.6.10 to 1.7.9. **This update includes a security fix.**
- [Release notes](https://github.com/angular/angular.js/releases)
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](angular/angular.js@v1.6.10...v1.7.9)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Nov 20, 2019
@dependabot-preview
Copy link
Author

Superseded by #573.

@dependabot-preview dependabot-preview bot deleted the dependabot/npm_and_yarn/angular-1.7.9 branch June 18, 2020 17:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants