This run took 408 seconds.
$ date --- stdout --- Sun May 19 16:01:08 UTC 2024 --- end --- $ git clone file:///srv/git/mediawiki-extensions-Wikibase.git repo --depth=1 -b REL1_40 --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stderr --- Submodule 'lib/resources/wikibase-api' (https://gerrit.wikimedia.org/r/wikibase/javascript-api) registered for path 'lib/resources/wikibase-api' Submodule 'view/lib/wikibase-data-model' (https://phabricator.wikimedia.org/source/wikibase-data-model.git) registered for path 'view/lib/wikibase-data-model' Submodule 'view/lib/wikibase-data-values' (https://phabricator.wikimedia.org/source/datavalues-javascript.git) registered for path 'view/lib/wikibase-data-values' Submodule 'view/lib/wikibase-data-values-value-view' (https://gerrit.wikimedia.org/r/data-values/value-view) registered for path 'view/lib/wikibase-data-values-value-view' Submodule 'view/lib/wikibase-serialization' (https://phabricator.wikimedia.org/source/wikibase-serialization.git) registered for path 'view/lib/wikibase-serialization' Submodule 'view/lib/wikibase-termbox' (https://gerrit.wikimedia.org/r/wikibase/termbox) registered for path 'view/lib/wikibase-termbox' Cloning into '/src/repo/lib/resources/wikibase-api'... Cloning into '/src/repo/view/lib/wikibase-data-model'... Cloning into '/src/repo/view/lib/wikibase-data-values'... Cloning into '/src/repo/view/lib/wikibase-data-values-value-view'... Cloning into '/src/repo/view/lib/wikibase-serialization'... Cloning into '/src/repo/view/lib/wikibase-termbox'... --- stdout --- Submodule path 'lib/resources/wikibase-api': checked out 'b755658e33e23688e47e08fb8451c3c4ae029f8a' Submodule path 'view/lib/wikibase-data-model': checked out '6b304daeb804591ddc4520925337429ac086515c' Submodule path 'view/lib/wikibase-data-values': checked out '457733ebe7b0d090a67e2623350be2e4286077fe' Submodule path 'view/lib/wikibase-data-values-value-view': checked out '66f76142c6df10937524b5eb475933f4f5b4a6c6' Submodule path 'view/lib/wikibase-serialization': checked out 'e9b9a736f19e42497bfe45cb6f323781b00b5023' Submodule path 'view/lib/wikibase-termbox': checked out 'ba6eb18ec9840a1384b1e8f5a88d63e5d0743faf' --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/REL1_40 --- stdout --- 39aa9be3ea108db164ffbb1daac177907a81e90d refs/heads/REL1_40 --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "node_modules/@babel/traverse" ], "fixAvailable": true }, "cookiejar": { "name": "cookiejar", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088659, "name": "cookiejar", "dependency": "cookiejar", "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function", "url": "https://github.com/advisories/GHSA-h452-7996-h45h", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<2.1.4" } ], "effects": [], "range": "<2.1.4", "nodes": [ "node_modules/cookiejar" ], "fixAvailable": true }, "ejs": { "name": "ejs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097210, "name": "ejs", "dependency": "ejs", "title": "ejs lacks certain pollution protection", "url": "https://github.com/advisories/GHSA-ghr5-ch3p-vcr6", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.10" } ], "effects": [], "range": "<3.1.10", "nodes": [ "node_modules/ejs" ], "fixAvailable": true }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": true }, "get-func-name": { "name": "get-func-name", "severity": "high", "isDirect": false, "via": [ { "source": 1094574, "name": "get-func-name", "dependency": "get-func-name", "title": "Chaijs/get-func-name vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [], "range": "<2.0.1", "nodes": [ "node_modules/get-func-name" ], "fixAvailable": true }, "got": { "name": "got", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<11.8.5" } ], "effects": [], "range": "<11.8.5", "nodes": [ "node_modules/got" ], "fixAvailable": true }, "http-cache-semantics": { "name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [ { "source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.1.1" } ], "effects": [], "range": "<4.1.1", "nodes": [ "node_modules/http-cache-semantics" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "node_modules/json5" ], "fixAvailable": true }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "recursive-readdir" ], "range": "<3.0.5", "nodes": [ "node_modules/recursive-readdir/node_modules/minimatch" ], "fixAvailable": true }, "mwbot": { "name": "mwbot", "severity": "moderate", "isDirect": false, "via": [ "request", "semver" ], "effects": [ "wdio-mediawiki" ], "range": ">=0.1.6", "nodes": [ "node_modules/mwbot" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "postcss": { "name": "postcss", "severity": "moderate", "isDirect": false, "via": [ { "source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" } ], "effects": [], "range": "<8.4.31", "nodes": [ "node_modules/postcss" ], "fixAvailable": true }, "recursive-readdir": { "name": "recursive-readdir", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [], "range": "1.2.0 - 2.2.2", "nodes": [ "node_modules/recursive-readdir" ], "fixAvailable": true }, "request": { "name": "request", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" }, "tough-cookie" ], "effects": [ "mwbot" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" }, { "source": 1096483, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.7.2" }, { "source": 1096484, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.0.0 <6.3.1" } ], "effects": [ "eslint-plugin-compat", "mwbot" ], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": [ "node_modules/@babel/core/node_modules/semver", "node_modules/@babel/helper-compilation-targets/node_modules/semver", "node_modules/eslint-plugin-compat/node_modules/semver", "node_modules/eslint-plugin-mediawiki/node_modules/semver", "node_modules/eslint-plugin-node/node_modules/semver", "node_modules/istanbul-lib-instrument/node_modules/semver", "node_modules/make-dir/node_modules/semver", "node_modules/mwbot/node_modules/semver", "node_modules/normalize-package-data/node_modules/semver", "node_modules/npm-run-all/node_modules/semver", "node_modules/semver" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096643, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [ "request" ], "range": "<4.1.3", "nodes": [ "node_modules/tough-cookie" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "ua-parser-js": { "name": "ua-parser-js", "severity": "high", "isDirect": false, "via": [ { "source": 1092302, "name": "ua-parser-js", "dependency": "ua-parser-js", "title": "ReDoS Vulnerability in ua-parser-js version", "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=0.8.0 <1.0.33" } ], "effects": [], "range": "0.8.1 - 1.0.32", "nodes": [ "node_modules/ua-parser-js" ], "fixAvailable": true }, "wdio-mediawiki": { "name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": [ "mwbot" ], "effects": [ "wdio-wikibase" ], "range": "1.1.0 - 2.2.0", "nodes": [ "node_modules/wdio-mediawiki" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "wdio-wikibase": { "name": "wdio-wikibase", "severity": "moderate", "isDirect": true, "via": [ "wdio-mediawiki" ], "effects": [], "range": "5.1.0 - 5.2.0", "nodes": [ "node_modules/wdio-wikibase" ], "fixAvailable": { "name": "wdio-wikibase", "version": "6.0.1", "isSemVerMajor": true } }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 12, "high": 6, "critical": 1, "total": 19 }, "dependencies": { "prod": 1, "dev": 1136, "optional": 2, "peer": 8, "peerOptional": 0, "total": 1136 } } } --- end --- $ /usr/bin/composer install --- stderr --- No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information. Loading composer repositories with package information Updating dependencies Lock file operations: 57 installs, 0 updates, 0 removals - Locking composer/installers (v1.12.0) - Locking composer/pcre (3.1.3) - Locking composer/semver (3.3.2) - Locking composer/spdx-licenses (1.5.8) - Locking composer/xdebug-handler (3.0.5) - Locking data-values/common (1.1.0) - Locking data-values/data-values (3.1.0) - Locking data-values/geo (4.4.0) - Locking data-values/interfaces (1.0.0) - Locking data-values/number (0.12.3) - Locking data-values/serialization (1.2.5) - Locking data-values/time (1.1.2) - Locking dealerdirect/phpcodesniffer-composer-installer (v0.7.2) - Locking diff/diff (3.3.1) - Locking felixfbecker/advanced-json-rpc (v3.2.1) - Locking mediawiki/mediawiki-codesniffer (v41.0.0) - Locking mediawiki/mediawiki-phan-config (0.12.2) - Locking mediawiki/minus-x (1.1.1) - Locking mediawiki/phan-taint-check-plugin (5.0.0) - Locking microsoft/tolerant-php-parser (v0.1.2) - Locking monolog/monolog (2.9.3) - Locking netresearch/jsonmapper (v4.4.1) - Locking onoi/message-reporter (1.4.2) - Locking phan/phan (5.4.2) - Locking php-parallel-lint/php-console-color (v0.3) - Locking php-parallel-lint/php-console-highlighter (v0.5) - Locking php-parallel-lint/php-parallel-lint (v1.3.1) - Locking phpat/phpat (0.10.16) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.3.0) - Locking phpdocumentor/type-resolver (1.6.2) - Locking phpstan/phpdoc-parser (0.4.9) - Locking phpstan/phpstan (1.11.1) - Locking psr/container (2.0.2) - Locking psr/http-message (1.1) - Locking psr/log (1.1.4) - Locking psr/simple-cache (1.0.1) - Locking sabre/event (5.1.4) - Locking serialization/serialization (4.0.0) - Locking slevomat/coding-standard (6.4.1) - Locking squizlabs/php_codesniffer (3.7.2) - Locking swaggest/json-diff (v3.10.5) - Locking symfony/console (v5.4.39) - Locking symfony/deprecation-contracts (v3.5.0) - Locking symfony/polyfill-ctype (v1.29.0) - Locking symfony/polyfill-intl-grapheme (v1.29.0) - Locking symfony/polyfill-intl-normalizer (v1.29.0) - Locking symfony/polyfill-mbstring (v1.29.0) - Locking symfony/polyfill-php73 (v1.29.0) - Locking symfony/polyfill-php80 (v1.29.0) - Locking symfony/service-contracts (v3.5.0) - Locking symfony/string (v6.4.7) - Locking tysonandre/var_representation_polyfill (0.1.3) - Locking webmozart/assert (1.11.0) - Locking wikimedia/at-ease (v2.1.0) - Locking wikimedia/purtle (v1.0.8) - Locking wikimedia/timestamp (v4.1.1) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 57 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] - Installing composer/installers (v1.12.0): Extracting archive - Installing squizlabs/php_codesniffer (3.7.2): Extracting archive - Installing dealerdirect/phpcodesniffer-composer-installer (v0.7.2): Extracting archive - Installing composer/pcre (3.1.3): Extracting archive - Installing symfony/polyfill-php80 (v1.29.0): Extracting archive - Installing data-values/interfaces (1.0.0): Extracting archive - Installing data-values/data-values (3.1.0): Extracting archive - Installing data-values/geo (4.4.0): Extracting archive - Installing data-values/common (1.1.0): Extracting archive - Installing data-values/number (0.12.3): Extracting archive - Installing serialization/serialization (4.0.0): Extracting archive - Installing data-values/serialization (1.2.5): Extracting archive - Installing data-values/time (1.1.2): Extracting archive - Installing diff/diff (3.3.1): Extracting archive - Installing symfony/polyfill-mbstring (v1.29.0): Extracting archive - Installing composer/spdx-licenses (1.5.8): Extracting archive - Installing composer/semver (3.3.2): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.29.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.29.0): Extracting archive - Installing symfony/polyfill-ctype (v1.29.0): Extracting archive - Installing symfony/string (v6.4.7): Extracting archive - Installing symfony/deprecation-contracts (v3.5.0): Extracting archive - Installing psr/container (2.0.2): Extracting archive - Installing symfony/service-contracts (v3.5.0): Extracting archive - Installing symfony/polyfill-php73 (v1.29.0): Extracting archive - Installing symfony/console (v5.4.39): Extracting archive - Installing sabre/event (5.1.4): Extracting archive - Installing netresearch/jsonmapper (v4.4.1): Extracting archive - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive - Installing webmozart/assert (1.11.0): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing phpdocumentor/type-resolver (1.6.2): Extracting archive - Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive - Installing psr/log (1.1.4): Extracting archive - Installing composer/xdebug-handler (3.0.5): Extracting archive - Installing phan/phan (5.4.2): Extracting archive - Installing mediawiki/phan-taint-check-plugin (5.0.0): Extracting archive - Installing mediawiki/mediawiki-phan-config (0.12.2): Extracting archive - Installing mediawiki/minus-x (1.1.1): Extracting archive - Installing monolog/monolog (2.9.3): Extracting archive - Installing onoi/message-reporter (1.4.2): Extracting archive - Installing php-parallel-lint/php-console-color (v0.3): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v0.5): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.3.1): Extracting archive - Installing phpstan/phpstan (1.11.1): Extracting archive - Installing phpat/phpat (0.10.16): Extracting archive - Installing psr/http-message (1.1): Extracting archive - Installing psr/simple-cache (1.0.1): Extracting archive - Installing phpstan/phpdoc-parser (0.4.9): Extracting archive - Installing slevomat/coding-standard (6.4.1): Extracting archive - Installing swaggest/json-diff (v3.10.5): Extracting archive - Installing wikimedia/at-ease (v2.1.0): Extracting archive - Installing wikimedia/purtle (v1.0.8): Extracting archive - Installing wikimedia/timestamp (v4.1.1): Extracting archive 0/54 [>---------------------------] 0% 22/54 [===========>----------------] 40% 34/54 [=================>----------] 62% 47/54 [========================>---] 87% 54/54 [============================] 100% 13 package suggestions were added by new dependencies, use `composer suggest` to see details. Generating autoload files 22 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- PHP CodeSniffer Config installed_paths set to ../../../repo,../../mediawiki/mediawiki-codesniffer,../../slevomat/coding-standard --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "node_modules/@babel/traverse" ], "fixAvailable": true }, "cookiejar": { "name": "cookiejar", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088659, "name": "cookiejar", "dependency": "cookiejar", "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function", "url": "https://github.com/advisories/GHSA-h452-7996-h45h", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<2.1.4" } ], "effects": [], "range": "<2.1.4", "nodes": [ "node_modules/cookiejar" ], "fixAvailable": true }, "ejs": { "name": "ejs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097210, "name": "ejs", "dependency": "ejs", "title": "ejs lacks certain pollution protection", "url": "https://github.com/advisories/GHSA-ghr5-ch3p-vcr6", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.10" } ], "effects": [], "range": "<3.1.10", "nodes": [ "node_modules/ejs" ], "fixAvailable": true }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": true }, "get-func-name": { "name": "get-func-name", "severity": "high", "isDirect": false, "via": [ { "source": 1094574, "name": "get-func-name", "dependency": "get-func-name", "title": "Chaijs/get-func-name vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [], "range": "<2.0.1", "nodes": [ "node_modules/get-func-name" ], "fixAvailable": true }, "got": { "name": "got", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<11.8.5" } ], "effects": [], "range": "<11.8.5", "nodes": [ "node_modules/got" ], "fixAvailable": true }, "http-cache-semantics": { "name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [ { "source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.1.1" } ], "effects": [], "range": "<4.1.1", "nodes": [ "node_modules/http-cache-semantics" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "node_modules/json5" ], "fixAvailable": true }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "recursive-readdir" ], "range": "<3.0.5", "nodes": [ "node_modules/recursive-readdir/node_modules/minimatch" ], "fixAvailable": true }, "mwbot": { "name": "mwbot", "severity": "moderate", "isDirect": false, "via": [ "request", "semver" ], "effects": [ "wdio-mediawiki" ], "range": ">=0.1.6", "nodes": [ "node_modules/mwbot" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "postcss": { "name": "postcss", "severity": "moderate", "isDirect": false, "via": [ { "source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" } ], "effects": [], "range": "<8.4.31", "nodes": [ "node_modules/postcss" ], "fixAvailable": true }, "recursive-readdir": { "name": "recursive-readdir", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [], "range": "1.2.0 - 2.2.2", "nodes": [ "node_modules/recursive-readdir" ], "fixAvailable": true }, "request": { "name": "request", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" }, "tough-cookie" ], "effects": [ "mwbot" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" }, { "source": 1096483, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.7.2" }, { "source": 1096484, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.0.0 <6.3.1" } ], "effects": [ "eslint-plugin-compat", "mwbot" ], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": [ "node_modules/@babel/core/node_modules/semver", "node_modules/@babel/helper-compilation-targets/node_modules/semver", "node_modules/eslint-plugin-compat/node_modules/semver", "node_modules/eslint-plugin-mediawiki/node_modules/semver", "node_modules/eslint-plugin-node/node_modules/semver", "node_modules/istanbul-lib-instrument/node_modules/semver", "node_modules/make-dir/node_modules/semver", "node_modules/mwbot/node_modules/semver", "node_modules/normalize-package-data/node_modules/semver", "node_modules/npm-run-all/node_modules/semver", "node_modules/semver" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096643, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [ "request" ], "range": "<4.1.3", "nodes": [ "node_modules/tough-cookie" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "ua-parser-js": { "name": "ua-parser-js", "severity": "high", "isDirect": false, "via": [ { "source": 1092302, "name": "ua-parser-js", "dependency": "ua-parser-js", "title": "ReDoS Vulnerability in ua-parser-js version", "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=0.8.0 <1.0.33" } ], "effects": [], "range": "0.8.1 - 1.0.32", "nodes": [ "node_modules/ua-parser-js" ], "fixAvailable": true }, "wdio-mediawiki": { "name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": [ "mwbot" ], "effects": [ "wdio-wikibase" ], "range": "1.1.0 - 2.2.0", "nodes": [ "node_modules/wdio-mediawiki" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "wdio-wikibase": { "name": "wdio-wikibase", "severity": "moderate", "isDirect": true, "via": [ "wdio-mediawiki" ], "effects": [], "range": "5.1.0 - 5.2.0", "nodes": [ "node_modules/wdio-wikibase" ], "fixAvailable": { "name": "wdio-wikibase", "version": "6.0.1", "isSemVerMajor": true } }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 12, "high": 6, "critical": 1, "total": 19 }, "dependencies": { "prod": 1, "dev": 1136, "optional": 2, "peer": 8, "peerOptional": 0, "total": 1136 } } } --- end --- Attempting to npm audit fix $ /usr/bin/npm audit fix --dry-run --only=dev --json --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.20.1', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@wdio/sync@7.19.5', npm WARN EBADENGINE required: { node: '>=12.0.0 <16' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.9.7', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } --- stdout --- { "added": 1132, "removed": 0, "changed": 0, "audited": 1133, "funding": 135, "audit": { "auditReportVersion": 2, "vulnerabilities": { "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "" ], "fixAvailable": true }, "cookiejar": { "name": "cookiejar", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088659, "name": "cookiejar", "dependency": "cookiejar", "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function", "url": "https://github.com/advisories/GHSA-h452-7996-h45h", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<2.1.4" } ], "effects": [], "range": "<2.1.4", "nodes": [ "" ], "fixAvailable": true }, "ejs": { "name": "ejs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097210, "name": "ejs", "dependency": "ejs", "title": "ejs lacks certain pollution protection", "url": "https://github.com/advisories/GHSA-ghr5-ch3p-vcr6", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.10" } ], "effects": [], "range": "<3.1.10", "nodes": [ "" ], "fixAvailable": true }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [ "" ], "fixAvailable": true }, "get-func-name": { "name": "get-func-name", "severity": "high", "isDirect": false, "via": [ { "source": 1094574, "name": "get-func-name", "dependency": "get-func-name", "title": "Chaijs/get-func-name vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [], "range": "<2.0.1", "nodes": [ "" ], "fixAvailable": true }, "got": { "name": "got", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<11.8.5" } ], "effects": [], "range": "<11.8.5", "nodes": [ "" ], "fixAvailable": true }, "http-cache-semantics": { "name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [ { "source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.1.1" } ], "effects": [], "range": "<4.1.1", "nodes": [ "" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "" ], "fixAvailable": true }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "recursive-readdir" ], "range": "<3.0.5", "nodes": [ "" ], "fixAvailable": true }, "mwbot": { "name": "mwbot", "severity": "moderate", "isDirect": false, "via": [ "request", "semver" ], "effects": [ "wdio-mediawiki" ], "range": ">=0.1.6", "nodes": [ "node_modules/mwbot" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "postcss": { "name": "postcss", "severity": "moderate", "isDirect": false, "via": [ { "source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" } ], "effects": [], "range": "<8.4.31", "nodes": [ "" ], "fixAvailable": true }, "recursive-readdir": { "name": "recursive-readdir", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [], "range": "1.2.0 - 2.2.2", "nodes": [ "" ], "fixAvailable": true }, "request": { "name": "request", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" }, "tough-cookie" ], "effects": [ "mwbot" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" }, { "source": 1096483, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.7.2" }, { "source": 1096484, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.0.0 <6.3.1" } ], "effects": [ "eslint-plugin-compat", "mwbot" ], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": [ "", "", "", "", "", "", "", "", "", "", "node_modules/mwbot/node_modules/semver" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096643, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [ "request" ], "range": "<4.1.3", "nodes": [ "node_modules/tough-cookie" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "ua-parser-js": { "name": "ua-parser-js", "severity": "high", "isDirect": false, "via": [ { "source": 1092302, "name": "ua-parser-js", "dependency": "ua-parser-js", "title": "ReDoS Vulnerability in ua-parser-js version", "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=0.8.0 <1.0.33" } ], "effects": [], "range": "0.8.1 - 1.0.32", "nodes": [ "" ], "fixAvailable": true }, "wdio-mediawiki": { "name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": [ "mwbot" ], "effects": [ "wdio-wikibase" ], "range": "1.1.0 - 2.2.0", "nodes": [ "node_modules/wdio-mediawiki" ], "fixAvailable": { "name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true } }, "wdio-wikibase": { "name": "wdio-wikibase", "severity": "moderate", "isDirect": true, "via": [ "wdio-mediawiki" ], "effects": [], "range": "5.1.0 - 5.2.0", "nodes": [ "node_modules/wdio-wikibase" ], "fixAvailable": { "name": "wdio-wikibase", "version": "6.0.1", "isSemVerMajor": true } }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 12, "high": 6, "critical": 1, "total": 19 }, "dependencies": { "prod": 1, "dev": 1132, "optional": 2, "peer": 8, "peerOptional": 0, "total": 1132 } } } } --- end --- {"added": 1132, "removed": 0, "changed": 0, "audited": 1133, "funding": 135, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@babel/traverse": {"name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [{"source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": ["CWE-184", "CWE-697"], "cvss": {"score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "range": "<7.23.2"}], "effects": [], "range": "<7.23.2", "nodes": [""], "fixAvailable": true}, "cookiejar": {"name": "cookiejar", "severity": "moderate", "isDirect": false, "via": [{"source": 1088659, "name": "cookiejar", "dependency": "cookiejar", "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function", "url": "https://github.com/advisories/GHSA-h452-7996-h45h", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<2.1.4"}], "effects": [], "range": "<2.1.4", "nodes": [""], "fixAvailable": true}, "ejs": {"name": "ejs", "severity": "moderate", "isDirect": false, "via": [{"source": 1097210, "name": "ejs", "dependency": "ejs", "title": "ejs lacks certain pollution protection", "url": "https://github.com/advisories/GHSA-ghr5-ch3p-vcr6", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.10"}], "effects": [], "range": "<3.1.10", "nodes": [""], "fixAvailable": true}, "eslint-plugin-compat": {"name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": ["semver"], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [""], "fixAvailable": true}, "get-func-name": {"name": "get-func-name", "severity": "high", "isDirect": false, "via": [{"source": 1094574, "name": "get-func-name", "dependency": "get-func-name", "title": "Chaijs/get-func-name vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<2.0.1"}], "effects": [], "range": "<2.0.1", "nodes": [""], "fixAvailable": true}, "got": {"name": "got", "severity": "moderate", "isDirect": false, "via": [{"source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<11.8.5"}], "effects": [], "range": "<11.8.5", "nodes": [""], "fixAvailable": true}, "http-cache-semantics": {"name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [{"source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<4.1.1"}], "effects": [], "range": "<4.1.1", "nodes": [""], "fixAvailable": true}, "json5": {"name": "json5", "severity": "high", "isDirect": false, "via": [{"source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": ">=2.0.0 <2.2.2"}], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [""], "fixAvailable": true}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.5"}], "effects": ["recursive-readdir"], "range": "<3.0.5", "nodes": [""], "fixAvailable": true}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": false, "via": ["request", "semver"], "effects": ["wdio-mediawiki"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "postcss": {"name": "postcss", "severity": "moderate", "isDirect": false, "via": [{"source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": ["CWE-74", "CWE-144"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<8.4.31"}], "effects": [], "range": "<8.4.31", "nodes": [""], "fixAvailable": true}, "recursive-readdir": {"name": "recursive-readdir", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": [], "range": "1.2.0 - 2.2.2", "nodes": [""], "fixAvailable": true}, "request": {"name": "request", "severity": "moderate", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "semver": {"name": "semver", "severity": "moderate", "isDirect": false, "via": [{"source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=7.0.0 <7.5.2"}, {"source": 1096483, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<5.7.2"}, {"source": 1096484, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=6.0.0 <6.3.1"}], "effects": ["eslint-plugin-compat", "mwbot"], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": ["", "", "", "", "", "", "", "", "", "", "node_modules/mwbot/node_modules/semver"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1096643, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "ua-parser-js": {"name": "ua-parser-js", "severity": "high", "isDirect": false, "via": [{"source": 1092302, "name": "ua-parser-js", "dependency": "ua-parser-js", "title": "ReDoS Vulnerability in ua-parser-js version", "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=0.8.0 <1.0.33"}], "effects": [], "range": "0.8.1 - 1.0.32", "nodes": [""], "fixAvailable": true}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": ["mwbot"], "effects": ["wdio-wikibase"], "range": "1.1.0 - 2.2.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "wdio-wikibase": {"name": "wdio-wikibase", "severity": "moderate", "isDirect": true, "via": ["wdio-mediawiki"], "effects": [], "range": "5.1.0 - 5.2.0", "nodes": ["node_modules/wdio-wikibase"], "fixAvailable": {"name": "wdio-wikibase", "version": "6.0.1", "isSemVerMajor": true}}, "word-wrap": {"name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [{"source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<1.2.4"}], "effects": [], "range": "<1.2.4", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 12, "high": 6, "critical": 1, "total": 19}, "dependencies": {"prod": 1, "dev": 1132, "optional": 2, "peer": 8, "peerOptional": 0, "total": 1132}}}} $ /usr/bin/npm audit fix --only=dev --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.20.1', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@wdio/sync@7.19.5', npm WARN EBADENGINE required: { node: '>=12.0.0 <16' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.9.7', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN deprecated har-validator@5.1.5: this library is no longer supported npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated superagent@6.1.0: Please upgrade to v7.0.2+ of superagent. We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing. See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>. --- stdout --- added 1131 packages, and audited 1132 packages in 16s 135 packages are looking for funding run `npm fund` for details # npm audit report request * Severity: moderate Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6 Depends on vulnerable versions of tough-cookie fix available via `npm audit fix --force` Will install wdio-mediawiki@2.5.0, which is a breaking change node_modules/request mwbot >=0.1.6 Depends on vulnerable versions of request Depends on vulnerable versions of semver node_modules/mwbot wdio-mediawiki 1.1.0 - 2.2.0 Depends on vulnerable versions of mwbot node_modules/wdio-mediawiki wdio-wikibase 5.1.0 - 5.2.0 Depends on vulnerable versions of wdio-mediawiki node_modules/wdio-wikibase semver 7.0.0 - 7.5.1 Severity: moderate semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw fix available via `npm audit fix --force` Will install wdio-mediawiki@2.5.0, which is a breaking change node_modules/mwbot/node_modules/semver tough-cookie <4.1.3 Severity: moderate tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3 fix available via `npm audit fix --force` Will install wdio-mediawiki@2.5.0, which is a breaking change node_modules/tough-cookie 6 moderate severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- Verifying that tests still pass $ /usr/bin/npm ci --- stderr --- npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.20.1', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@wdio/sync@7.19.5', npm WARN EBADENGINE required: { node: '>=12.0.0 <16' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.9.7', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN deprecated har-validator@5.1.5: this library is no longer supported npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated superagent@6.1.0: Please upgrade to v7.0.2+ of superagent. We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing. See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>. npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.22.2', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.20.1', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.9.7', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@38.1.6', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.23.6', npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@39.2.2', npm WARN EBADENGINE required: { node: '^14 || ^16 || ^17' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN ERESOLVE overriding peer dependency npm WARN While resolving: cache-loader@4.1.0 npm WARN Found: webpack@5.66.0 npm WARN node_modules/webpack npm WARN peer webpack@"^4.0.0 || ^5.0.0" from @soda/friendly-errors-webpack-plugin@1.8.1 npm WARN node_modules/@soda/friendly-errors-webpack-plugin npm WARN @soda/friendly-errors-webpack-plugin@"^1.8.0" from @vue/cli-service@5.0.0-rc.2 npm WARN node_modules/@vue/cli-service npm WARN 51 more (@storybook/builder-webpack5, css-loader, ...) npm WARN npm WARN Could not resolve dependency: npm WARN peer webpack@"^4.0.0" from cache-loader@4.1.0 npm WARN node_modules/cache-loader npm WARN cache-loader@"^4.1.0" from @vue/cli-plugin-typescript@5.0.0-rc.2 npm WARN node_modules/@vue/cli-plugin-typescript npm WARN 1 more (@vue/cli-service) npm WARN npm WARN Conflicting peer dependency: webpack@4.47.0 npm WARN node_modules/webpack npm WARN peer webpack@"^4.0.0" from cache-loader@4.1.0 npm WARN node_modules/cache-loader npm WARN cache-loader@"^4.1.0" from @vue/cli-plugin-typescript@5.0.0-rc.2 npm WARN node_modules/@vue/cli-plugin-typescript npm WARN 1 more (@vue/cli-service) npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@wdio/sync@7.16.13', npm WARN EBADENGINE required: { node: '>=12.0.0 <16' }, npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' } npm WARN EBADENGINE } npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated superagent@6.1.0: Please upgrade to v7.0.2+ of superagent. We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing. See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>. npm WARN deprecated stylelint-processor-html@1.0.0: Please use stylelint-processor-arbitrary-tags https://github.com/mapbox/stylelint-processor-arbitrary-tags npm WARN deprecated @stylelint/postcss-markdown@0.36.2: Use the original unforked package instead: postcss-markdown npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated har-validator@5.1.3: this library is no longer supported npm WARN deprecated @types/webpack-dev-server@4.7.2: This is a stub types definition. webpack-dev-server provides its own type definitions, so you do not need this installed. npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated stylelint-processor-html@1.0.0: Please use stylelint-processor-arbitrary-tags https://github.com/mapbox/stylelint-processor-arbitrary-tags npm WARN deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies. npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated @stylelint/postcss-markdown@0.36.2: Use the original unforked package instead: postcss-markdown npm WARN deprecated html-webpack-plugin@3.2.0: 3.x is no longer supported npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated babel-eslint@10.1.0: babel-eslint is now @babel/eslint-parser. This package will no longer receive updates. npm WARN deprecated har-validator@5.1.5: this library is no longer supported npm WARN deprecated @hapi/address@2.1.4: Moved to 'npm install @sideway/address' npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated uuid@3.3.3: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated sane@4.1.0: some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated babel-eslint@10.1.0: babel-eslint is now @babel/eslint-parser. This package will no longer receive updates. npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi' npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated intl-messageformat-parser@1.8.1: We've written a new parser that's 6x faster and is backwards compatible. Please use @formatjs/icu-messageformat-parser npm WARN deprecated uuid@3.3.2: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated svgo@1.3.2: This SVGO version is no longer supported. Upgrade to v2.x.x. npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 --- stdout --- > Wikibase@0.1.0 postinstall > npm-run-all -p install:* && bash rm-node16-incompatible-packages.sh > Wikibase@0.1.0 install:bridge > npm --prefix client/data-bridge ci > Wikibase@0.1.0 install:tainted-ref > npm --prefix view/lib/wikibase-tainted-ref ci > Wikibase@0.1.0 install:rest-api > npm --prefix repo/rest-api ci added 879 packages, and audited 880 packages in 3m 150 packages are looking for funding run `npm fund` for details 17 vulnerabilities (12 moderate, 3 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. > tainted-ref@0.1.0 prepare > node build/wikimedia-ui-base.js added 2704 packages, and audited 2705 packages in 3m 148 packages are looking for funding run `npm fund` for details 127 vulnerabilities (2 low, 70 moderate, 43 high, 12 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. > data-bridge@0.1.0 prepare > node build/wikimedia-ui-base.js added 3452 packages, and audited 3453 packages in 4m 350 packages are looking for funding run `npm fund` for details 94 vulnerabilities (43 moderate, 47 high, 4 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. added 1131 packages, and audited 1132 packages in 4m 135 packages are looking for funding run `npm fund` for details 6 moderate severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- $ /usr/bin/npm test --- stderr --- PASS repo/tests/jest/wikibase.vector.searchClient.spec.js Vector Search Client ✓ test construction and fetchByTitle behavior (55 ms) ✓ test construction and loadMore behavior (8 ms) ✓ doesn't show an extra match for a search hit on the label (4 ms) ✓ supports showing a match of a label in a different language (2 ms) Test Suites: 1 passed, 1 total Tests: 4 passed, 4 total Snapshots: 0 total Time: 6.37 s Ran all test suites matching /repo\/tests\/jest\//i. PASS tests/unit/StatementTracker.spec.ts (7.944 s) PASS tests/unit/store/actions.spec.ts PASS tests/unit/MWHookHandler.spec.ts (9.254 s) PASS tests/unit/store/mutations.spec.ts PASS tests/unit/TaintedPopper.spec.ts (10.897 s) PASS tests/unit/TaintedIcon.spec.ts PASS tests/unit/Popper.spec.ts PASS tests/unit/store/getters.spec.ts PASS tests/unit/ReferenceListChangeCounter.spec.ts PASS tests/unit/TaintedChecker.spec.ts PASS tests/unit/store/index.spec.ts PASS tests/unit/App.spec.ts Test Suites: 12 passed, 12 total Tests: 68 passed, 68 total Snapshots: 0 total Time: 16.637 s Ran all test suites. ERROR: "test-fast:grunt" exited with 3. --- stdout --- > Wikibase@0.1.0 test > npm-run-all -p test-fast:* > Wikibase@0.1.0 test-fast:jest-repo > jest repo/tests/jest/ > Wikibase@0.1.0 test-fast:tainted-ref > npm --prefix view/lib/wikibase-tainted-ref test > Wikibase@0.1.0 test-fast:grunt > grunt test > Wikibase@0.1.0 test-fast:rest-api > npm --prefix repo/rest-api test > Wikibase@0.1.0 test-fast:bridge > npm --prefix client/data-bridge test > tainted-ref@0.1.0 test > npm-run-all test:* > data-bridge@0.1.0 test > npm-run-all test:* > wikibase-rest-api-definition@0.1.0 test > npm run lint Running "eslint:all" (eslint) task > wikibase-rest-api-definition@0.1.0 lint > npm-run-all --parallel lint:* > tainted-ref@0.1.0 test:unit > vue-cli-service test:unit -c ./jest.config.js > data-bridge@0.1.0 test:lint > vue-cli-service lint --max-warnings 0 --no-fix . && stylelint --syntax scss 'src/**/*.(vue|scss)' > wikibase-rest-api-definition@0.1.0 lint:eslint > eslint . --max-warnings 0 > wikibase-rest-api-definition@0.1.0 lint:openapi > swagger-cli validate specs/openapi.json specs/openapi.json is valid DONE No lint errors found! > tainted-ref@0.1.0 test:lint > vue-cli-service lint --max-warnings 0 --no-fix . && stylelint --syntax scss 'src/**/*.(vue|scss)' > data-bridge@0.1.0 test:unit > jest -c ./jest.config.unit.js /src/repo/repo/resources/wikibase.vector.searchClient.js 45:14 error Array.includes() is not supported in IE 11 compat/compat ✖ 1 problem (1 error, 0 warnings) Warning: Task "eslint:all" failed. Use --force to continue. Aborted due to warnings. --- end --- Traceback (most recent call last): File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1787, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1732, in run self.npm_audit_fix(new_npm_audit) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 277, in npm_audit_fix self.check_call(["npm", "test"]) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 54, in check_call res.check_returncode() File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode raise CalledProcessError(self.returncode, self.args, self.stdout, subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 1.