Update dependency mustache to v2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mustache	0.8.2 -> 2.2.1

GitHub Vulnerability Alerts

CVE-2015-8862

Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.

Example

Template:
<a href=/>

Input:
{ 'foo' : 'test.com onload=alert(1)'}

Rendered result:
<a href=test.com onload=alert(1)/>

Recommendation

Update to version 2.2.1 or later.
Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.

---

Release Notes

janl/mustache.js (mustache)

v2.2.1

Compare Source

Fixes

• Improve HTML escaping, by [@​phillipj].
• Fix inconsistency in defining global mustache object, by [@​simast].
• Fix switch-case indent error, by [@​norfish].
• Unpin chai and eslint versions, by [@​dasilvacontin].
• Update README.md with proper grammar, by [@​EvanLovely].
• Update mjackson username in README, by [@​mjackson].
• Remove syntax highlighting in README code sample, by [@​imagentleman].
• Fix typo in README, by [@​Xcrucifier].
• Fix link typo in README, by [@​keirog].

v2.2.0

Compare Source

Added

• Add Partials support to CLI, by [@​palkan].

Changed

• Move install instructions to README's top, by [@​mateusortiz]
• Improved devhook install output, by [@​ShashankaNataraj].
• Clarifies and improves language in documentation, by [@​jfmercer].
• Linting CLI tool, by [@​phillipj].
• npm 2.x and node v4 on Travis, by [@​phillipj].

Fixes

• Fix README spelling error to "aforementioned", by [@​djchie].
• Equal error message test in .render() for server and browser, by [@​phillipj].

Dependencies

• chai -> 3.3.0
• eslint -> 1.6.0

v2.1.3

Compare Source

Added

• Throw error when providing .render() with invalid template type, by [@​phillipj].
• Documents use of string literals containing double quotes, by [@​jfmercer].

Changed

• Move mustache gif to githubusercontent, by [@​Andersos].

Fixed

• Update UMD Shim to be resilient to HTMLElement global pollution, by [@​mikesherov].

v2.1.2

Compare Source

Added

• Mustache global definition ([#​466]) by [@​yousefcisco].

v2.1.1

Compare Source

Added

• State that we use semver on the change log, by [@​dasilvacontin].
• Added version links to change log, by [@​dasilvacontin].

Fixed

• Bugfix for using values from view's context prototype, by [@​phillipj].
• Improve test with undefined/null lookup hit using dot notation, by [@​dasilvacontin].
• Bugfix for null/undefined lookup hit when using dot notation, by [@​phillipj].
• Remove moot version property from bower.json, by [@​kkirsche].
• bower.json doesn't require a version bump via hook, by [@​dasilvacontin].

v2.1.0

Compare Source

• Added license attribute to package.json, by [@​pgilad].
• Minor changes to make mustache.js compatible with both WSH and ASP, by [@​nagaozen].
• Improve CLI view parsing error, by [@​phillipj].
• Bugfix for view context cache, by [@​phillipj].

v2.0.0

Compare Source

• Fixed lookup not stopping upon finding undefined or null values, by [@​dasilvacontin].
• Refactored pre-commit hook, by [@​dasilvacontin].

v1.2.0

Compare Source

• Added -v option to CLI, by [@​phillipj].
• Bugfix for rendering Number when it serves as the Context, by [@​phillipj].
• Specified files in package.json for a cleaner install, by [@​phillipj].

v1.1.0

Compare Source

• Refactor Writer.renderTokens() for better readability, by [@​phillipj].
• Cleanup tests section in readme, by [@​phillipj].
• Added JSHint to tests/CI, by [@​phillipj].
• Added node v0.12 on travis, by [@​phillipj].
• Created command line tool, by [@​phillipj].
• Added falsy to Inverted Sections description in README, by [@​kristijanmatic].

v1.0.0

Compare Source

• Inline tag compilation, by [@​mjackson].
  • Fixed AMD registration, volo package.json entry, by [@​jrburke].
  • Added spm support, by [@​afc163].
  • Only access properties of objects on Context.lookup, by [@​cmbuckley].

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.