Bump handlebars from 3.0.3 to 3.0.7 in /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp

[dependabot]

Bumps handlebars from 3.0.3 to 3.0.7.

Changelog

Sourced from handlebars's changelog.

v3.0.7 - June 30th, 2019

Security fixes:

• #1532 - Backport security fixes to 3.x branch (@​mattolson)

Housekeeping

• disable saucelabs-tests since the tunnel is not working - 95f33b1
• update grunt-saucelabs and aws dependency - 09aaa56
• fix package.json of components/handlebars.js repo - 7cf753b
• Fix Travis by updating git tag retrieval - 7c3944015d30a4348ae66ec1736b752cd864d5c1
• Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 7820b207e123babd0bda0b4871790f2ea6b36b01

Tests:

• test: run appveyor tests in Node 10 - 420ac171a01b8777ebce0a777221754fcc72a5a8
• Fix build on Windows - 47adcda48530ab1504b8019fe17eaedd4f4c943f

Compatibility notes:

Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:

class SomeClass {
}

SomeClass.staticProperty = 'static'

var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

Commits

v3.0.6 - January 2nd, 2019

Chore:

• prevent tagging 3.x versions as "latest" in npm - df403ed, #1486
• ignore idea config - af919d2
• fix travis build - 9283205
• update components/handlebars package.json on release - 9679fe6
• add active NodeJS versions to travis - d207ad0

... (truncated)

Commits

• 55e4d9d v3.0.7
• bae88eb Update release notes
• c131bab chore: remove TODO comment from Gruntfile to enable clean build
• 95f33b1 chore: disable saucelabs-tests since the tunnel is not working
• 09aaa56 chore: update grunt-saucelabs and aws dependency
• 0d6d8c3 Merge pull request #1532 from mattolson/backport-security-fixes
• 7c39440 Fix Travis by updating git tag retrieval
• 7820b20 Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul
• 420ac17 test: run appveyor tests in Node 10
• 47adcda Fix build on Windows
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by knappi, a new releaser for handlebars since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[hadoop-yetus]

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	1m 52s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
		_ trunk Compile Tests _
+1 💚	mvninstall	22m 19s	trunk passed
+1 💚	shadedclient	36m 9s	branch has no errors when building and testing our client artifacts.
		_ Patch Compile Tests _
+1 💚	mvninstall	0m 12s	the patch passed
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	shadedclient	15m 1s	patch has no errors when building and testing our client artifacts.
		_ Other Tests _
+1 💚	asflicense	0m 29s	The patch does not generate ASF License warnings.
		55m 27s

Subsystem	Report/Notes
Docker	Client=19.03.5 Server=19.03.5 base: https://builds.apache.org/job/hadoop-multibranch/job/PR-1744/1/artifact/out/Dockerfile
GITHUB PR	#1744
Optional Tests	dupname asflicense shadedclient
uname	Linux ea4d5a11a1ee 4.15.0-66-generic #75-Ubuntu SMP Tue Oct 1 05:24:09 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	personality/hadoop.sh
git revision	trunk / e9c5bb8
Max. process+thread count	307 (vs. ulimit of 5500)
modules	C: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui U: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui
Console output	https://builds.apache.org/job/hadoop-multibranch/job/PR-1744/1/console
versions	git=2.7.4 maven=3.3.9
Powered by	Apache Yetus 0.11.1 https://yetus.apache.org

This message was automatically generated.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.