🚨 [security] Upgrade jekyll: 3.4.1 → 3.6.3 (minor) #46
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![depfu[bot]](https://avatars.githubusercontent.com/in/715?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚨 Your version of jekyll has known security vulnerabilities 🚨
Advisory: CVE-2018-17567
Disclosed: September 28, 2018
URL: https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/
Jekyll _config.yml privilege escalation
🚨 We recommend to merge and deploy this update as soon as possible! 🚨
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ jekyll (3.4.1 → 3.6.3) · Repo · Changelog
Release Notes
3.6.0
3.5.1
3.5.0
3.4.5
3.4.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.6.0 (from changelog)
Does any of this look wrong? Please let us know.
Release Notes
1.11.1 (from changelog)
1.11.0 (from changelog)
1.10.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.5.2
1.5.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 18 commits:
Release :gem: v1.5.2CleanupMove example to docsRun CI before releasingUpdate history to reflect merge of #68 [ci skip]Test against Ruby 2.5 (#68)Update LICENSE.txtUpdate Copyright noticeUpdate History.markdownFix script/releaseRelease :gem: 1.5.1Security: Bump RubocopUpdate history to reflect merge of #60 [ci skip]Define path with __dir__ (#60)Update history to reflect merge of #61 [ci skip]Inherit Jekyll's rubocop config for consistency (#61)Update history to reflect merge of #62 [ci skip]Modernize Travis config (#62)Release Notes
1.5.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 18 commits:
Release :gem: 1.5.1Add script/releaseMove version to its own file for easier bumpingSecurity: Bump RubocopStick to Ruby 2.1Update history to reflect merge of #55 [ci skip]Drop support for old Ruby and old Jekyll (#55)Update history to reflect merge of #53 [ci skip]Update jekyll-watch (#53)Update history to reflect merge of #51 [ci skip]Inherit Jekyll's rubocop config for consistency (#51)Update history to reflect merge of #50 [ci skip]Remove version lock for dependency listen (#50)Update history to reflect merge of #48 [ci skip]Define path with __dir__ (#48)Update history to reflect merge of #43 [ci skip]Merge pull request #43 from ashmaroli/fix-travisupdate versions for TravisRelease Notes
4.0.3 (from changelog)
4.0.2 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
3.1.5
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 18 commits:
:package: v0.16.2Bring back Ruby 2.5 compatibility.Fix Benchmarking.Update .travis.ymlAdd Pathname.Sync development files.Fix deprecation with RubyGems.Update the Gitignore.:package: v0.16.1Add Pathutil#[], so we are compatible with RSpec.:package: v0.16.0Reorganize some stuff.Pathutil added `#empty?` in 2.4.Update Copyright year.Do a little cleanup.Fix #3: Remove `luna-rubocop-formatters`.Drop CodeClimate.Fix the homepage URL in the gemspec. (#2)Release Notes
3.1.1 (from changelog)
3.1.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 20 commits:
Release 3.1.1Reinstate support to Ruby 2.1 and 2.2Update PSLFix version in READMERelease 3.1.0Update definitions list (#160)Upgrade to Rubocop 0.70Fix version mismatchMinimum Ruby version is 2.3Upgrade BundlerMake Travis happyFix typo in comment (#159)Fix offensesSwitch to CodeCovUpdate .travis.ymlRelease 3.0.3Update definitions (#154)Fix Rubocop new warningsUpdate .rubocop_defaults.yml (#153)Update docblockRelease Notes
0.10.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 8 commits:
version bumpMerge pull request #81 from saluzafa/masterMerge branch 'master' of github.com:saluzafa/rb-fseventremove useless part rescue EOFError since it's being catched at line 82 (EOFError is a child class of IOError)remove useless part rescue EOFError since it's being catched at line 82 (EOFError is a child class of IOError)abnormal termination fails silently + burns cpuupdate information about HFS+ corruption bugRubyCocoa hasn't been a thing for many years now. It's no longer worth mentioning.Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.0.5 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 8 commits:
Exclude built *.gem files from version controlBump version to 1.0.5Merge pull request #90 from elifoster/fix-80Fix uninitialized constant DateTimeremoved store.yaml from repoupdated tests for SafeYAML::StoreMerge pull request #68 from blackwinter/add-safe_yaml-storeAdd SafeYAML::Store, a YAML::Store variant that uses SafeYAML.load instead of YAML.load.Sorry, we couldn't find anything useful about this release.
🆕 ruby_dep (added, 1.5.0)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands