From c12a20f480a6ec20a8d73b43ea28a7291aa3ad0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Muska=C5=82a?= <michal@muskala.eu>
Date: Mon, 4 May 2020 20:44:04 +0100
Subject: [PATCH] Bump version

---
 CHANGELOG.md | 16 ++++++++++++++++
 mix.exs      |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11fdf32..f5b209b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.2.1 (04.05.2020)
+
+### Security
+
+* Fix `html_safe` escaping in `Jason.encode`
+
+The `<!--` sequence of characters would not be escaped in `Jason.encode`
+with`html_escape` mode, which could lead to DoS attacks when used for
+embedding of arbitrary, user controlled strings into HTML through JSON
+(e.g. inside of `<script>` tags).
+
+If you were not using the `html_safe` option, you are not affected.
+
+Affected versions: < 1.2.1
+Patched versions: >= 1.2.1
+
 ## 1.2.0 (17.03.2020)
 
 ### Enhancements
diff --git a/mix.exs b/mix.exs
index 4d127a9..d7d16a1 100644
--- a/mix.exs
+++ b/mix.exs
@@ -1,7 +1,7 @@
 defmodule Jason.Mixfile do
   use Mix.Project
 
-  @version "1.2.0"
+  @version "1.2.1"
 
   def project() do
     [