Bump matestack-ui-core from 0.7.0 to 0.7.4

[dependabot]

Bumps matestack-ui-core from 0.7.0 to 0.7.4.

Changelog

Sourced from matestack-ui-core's changelog.

v0.7.4

Merged PRs

Solved Issues

Security Fixes

XSS/Script injection vulnerablilty fixed in 0.7.4

• matestack-ui-core was vulnerable to XSS/Script injection
• matestack-ui-core did not excape strings by default and did not cover this in the docs
• matestack-ui-core should have escaped strings by default in order to prevent XSS/Script injection vulnerability
• 0.7.4 fixes that by performing string escaping by default now
• a new component unescaped (like plain before) allows to render unsecaped strings, but forces the developer to explicitly make a concious decision about that

class Pages::MyApp::MyExamplePage < Matestack::Ui::Page

  class FakeUser < Struct.new(:name)
  end

  def prepare
    @user = FakeUser.new("<script>alert('such hack many wow')</script>")
  end

  def response
    components {
      div do
        heading size: 1, text: "Hello #{@user.name}" # was not escaped , from 0.7.4 on it's escaped
        plain "Hello #{@user.name}" # was not escaped, from 0.7.4 on it's escaped
        unescaped "Hello #{@user.name}" # is not escaped, as intended
      end
    }
  end
end

Affected Versions

<= 0.7.3

Patched Versions

= 0.7.4 --> please update!

Workarounds

escape string explicitly/manually

... (truncated)

Commits

• 795b94a Merge branch 'master' into prepare_0.7.4_release
• a6699b2 Bump matestack-ui-core to 0.7.4
• 7ffbec6 version bump js assets
• 8e744c1 Merge branch 'develop' into prepare_0.7.4_release
• 8f15972 renamed raw component
• b1e4be1 Merge pull request #371 from matestack/sf/webpack-release-documentation
• 0e9aad7 webpack: updating release documentation
• 14a74ae added release note for 0.7.4
• e4df711 Merge remote-tracking branch 'origin/cells-haml-love' into prepare_0.7.4_release
• e01cffb Merge pull request #370 from matestack/sf/webpacker-part-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.