This run took 43 seconds.
$ date --- stdout --- Sun Nov 3 18:49:09 UTC 2024 --- end --- $ git clone file:///srv/git/mediawiki-skins-2018.git repo --depth=1 -b REL1_43 --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/REL1_43 --- stdout --- 1e4b2addc83b4d7cdac0ff4d368895aa02a1b466 refs/heads/REL1_43 --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@braintree/sanitize-url": { "name": "@braintree/sanitize-url", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088745, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "Cross-site Scripting in sanitize-url", "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": "<6.0.0" }, { "source": 1091262, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "@braintree/sanitize-url Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<6.0.1" } ], "effects": [ "mermaid" ], "range": "<=6.0.0", "nodes": [ "node_modules/@braintree/sanitize-url" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3": { "name": "d3", "severity": "high", "isDirect": false, "via": [ "d3-brush", "d3-color", "d3-interpolate", "d3-scale", "d3-transition", "d3-zoom" ], "effects": [ "dagre-d3" ], "range": "4.0.0-alpha.1 - 6.7.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-brush": { "name": "d3-brush", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.1.0 - 2.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-brush" ], "fixAvailable": true }, "d3-color": { "name": "d3-color", "severity": "high", "isDirect": false, "via": [ { "source": 1088594, "name": "d3-color", "dependency": "d3-color", "title": "d3-color vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.0" } ], "effects": [ "d3", "d3-interpolate", "d3-scale-chromatic", "d3-transition" ], "range": "<3.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-color" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-interpolate": { "name": "d3-interpolate", "severity": "high", "isDirect": false, "via": [ "d3-color" ], "effects": [ "d3-scale", "d3-scale-chromatic", "d3-transition" ], "range": "0.1.3 - 2.0.1", "nodes": [ "node_modules/dagre-d3/node_modules/d3-interpolate" ], "fixAvailable": true }, "d3-scale": { "name": "d3-scale", "severity": "high", "isDirect": false, "via": [ "d3-interpolate" ], "effects": [], "range": "0.1.5 - 3.3.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale" ], "fixAvailable": true }, "d3-scale-chromatic": { "name": "d3-scale-chromatic", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.1.0 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale-chromatic" ], "fixAvailable": true }, "d3-transition": { "name": "d3-transition", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [ "d3-brush", "d3-zoom" ], "range": "0.0.7 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-transition" ], "fixAvailable": true }, "d3-zoom": { "name": "d3-zoom", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.0.2 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-zoom" ], "fixAvailable": true }, "dagre-d3": { "name": "dagre-d3", "severity": "high", "isDirect": false, "via": [ "d3" ], "effects": [ "mermaid" ], "range": ">=0.5.0", "nodes": [ "node_modules/dagre-d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "dompurify": { "name": "dompurify", "severity": "critical", "isDirect": false, "via": [ { "source": 1099597, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify allows tampering by prototype pollution", "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674", "severity": "high", "cwe": [ "CWE-1321", "CWE-1333" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<2.5.4" }, { "source": 1100056, "name": "dompurify", "dependency": "dompurify", "title": "DOMpurify has a nesting-based mXSS", "url": "https://github.com/advisories/GHSA-gx9m-whjm-85jf", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H" }, "range": "<2.5.0" }, { "source": 1100302, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify vulnerable to tampering by prototype polution", "url": "https://github.com/advisories/GHSA-p3vf-v8qc-cwcr", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<2.4.2" } ], "effects": [ "mermaid" ], "range": "<=2.5.3", "nodes": [ "node_modules/dompurify" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "mermaid": { "name": "mermaid", "severity": "high", "isDirect": true, "via": [ "@braintree/sanitize-url", { "source": 1092622, "name": "mermaid", "dependency": "mermaid", "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML", "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf", "severity": "moderate", "cwe": [ "CWE-74", "CWE-79" ], "cvss": { "score": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N" }, "range": ">=8.0.0 <9.1.2" }, { "source": 1100231, "name": "mermaid", "dependency": "mermaid", "title": "Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify", "url": "https://github.com/advisories/GHSA-m4gq-x24j-jpmf", "severity": "high", "cwe": [ "CWE-1321", "CWE-1395" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<=10.9.2" }, "dagre-d3", "dompurify" ], "effects": [], "range": "<=10.9.2", "nodes": [ "node_modules/mermaid" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 1, "high": 10, "critical": 3, "total": 14 }, "dependencies": { "prod": 90, "dev": 624, "optional": 7, "peer": 1, "peerOptional": 0, "total": 713 } } } --- end --- $ /usr/bin/composer install --- stderr --- No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information. Loading composer repositories with package information Updating dependencies Lock file operations: 38 installs, 0 updates, 0 removals - Locking composer/pcre (3.3.1) - Locking composer/semver (3.4.2) - Locking composer/spdx-licenses (1.5.8) - Locking composer/xdebug-handler (3.0.5) - Locking dealerdirect/phpcodesniffer-composer-installer (v1.0.0) - Locking doctrine/deprecations (1.1.3) - Locking felixfbecker/advanced-json-rpc (v3.2.1) - Locking mediawiki/mediawiki-codesniffer (v44.0.0) - Locking mediawiki/mediawiki-phan-config (0.14.0) - Locking mediawiki/minus-x (1.1.3) - Locking mediawiki/phan-taint-check-plugin (6.0.0) - Locking microsoft/tolerant-php-parser (v0.1.2) - Locking netresearch/jsonmapper (v4.5.0) - Locking phan/phan (5.4.3) - Locking php-parallel-lint/php-console-color (v1.0.1) - Locking php-parallel-lint/php-console-highlighter (v1.0.0) - Locking php-parallel-lint/php-parallel-lint (v1.4.0) - Locking phpcsstandards/phpcsextra (1.2.1) - Locking phpcsstandards/phpcsutils (1.0.11) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.4.1) - Locking phpdocumentor/type-resolver (1.8.2) - Locking phpstan/phpdoc-parser (1.33.0) - Locking psr/container (2.0.2) - Locking psr/log (3.0.2) - Locking sabre/event (5.1.7) - Locking squizlabs/php_codesniffer (3.9.0) - Locking symfony/console (v7.1.6) - Locking symfony/deprecation-contracts (v3.5.0) - Locking symfony/polyfill-ctype (v1.31.0) - Locking symfony/polyfill-intl-grapheme (v1.31.0) - Locking symfony/polyfill-intl-normalizer (v1.31.0) - Locking symfony/polyfill-mbstring (v1.31.0) - Locking symfony/polyfill-php80 (v1.31.0) - Locking symfony/service-contracts (v3.5.0) - Locking symfony/string (v7.1.6) - Locking tysonandre/var_representation_polyfill (0.1.3) - Locking webmozart/assert (1.11.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 38 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] - Installing squizlabs/php_codesniffer (3.9.0): Extracting archive - Installing dealerdirect/phpcodesniffer-composer-installer (v1.0.0): Extracting archive - Installing composer/pcre (3.3.1): Extracting archive - Installing symfony/polyfill-php80 (v1.31.0): Extracting archive - Installing phpcsstandards/phpcsutils (1.0.11): Extracting archive - Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive - Installing symfony/polyfill-mbstring (v1.31.0): Extracting archive - Installing composer/spdx-licenses (1.5.8): Extracting archive - Installing composer/semver (3.4.2): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v44.0.0): Extracting archive - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.31.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.31.0): Extracting archive - Installing symfony/polyfill-ctype (v1.31.0): Extracting archive - Installing symfony/string (v7.1.6): Extracting archive - Installing symfony/deprecation-contracts (v3.5.0): Extracting archive - Installing psr/container (2.0.2): Extracting archive - Installing symfony/service-contracts (v3.5.0): Extracting archive - Installing symfony/console (v7.1.6): Extracting archive - Installing sabre/event (5.1.7): Extracting archive - Installing netresearch/jsonmapper (v4.5.0): Extracting archive - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive - Installing webmozart/assert (1.11.0): Extracting archive - Installing phpstan/phpdoc-parser (1.33.0): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing doctrine/deprecations (1.1.3): Extracting archive - Installing phpdocumentor/type-resolver (1.8.2): Extracting archive - Installing phpdocumentor/reflection-docblock (5.4.1): Extracting archive - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive - Installing psr/log (3.0.2): Extracting archive - Installing composer/xdebug-handler (3.0.5): Extracting archive - Installing phan/phan (5.4.3): Extracting archive - Installing mediawiki/phan-taint-check-plugin (6.0.0): Extracting archive - Installing mediawiki/mediawiki-phan-config (0.14.0): Extracting archive - Installing mediawiki/minus-x (1.1.3): Extracting archive - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive 0/36 [>---------------------------] 0% 20/36 [===============>------------] 55% 30/36 [=======================>----] 83% 36/36 [============================] 100% Generating autoload files 16 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@braintree/sanitize-url": { "name": "@braintree/sanitize-url", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088745, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "Cross-site Scripting in sanitize-url", "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": "<6.0.0" }, { "source": 1091262, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "@braintree/sanitize-url Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<6.0.1" } ], "effects": [ "mermaid" ], "range": "<=6.0.0", "nodes": [ "node_modules/@braintree/sanitize-url" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3": { "name": "d3", "severity": "high", "isDirect": false, "via": [ "d3-brush", "d3-color", "d3-interpolate", "d3-scale", "d3-transition", "d3-zoom" ], "effects": [ "dagre-d3" ], "range": "4.0.0-alpha.1 - 6.7.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-brush": { "name": "d3-brush", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.1.0 - 2.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-brush" ], "fixAvailable": true }, "d3-color": { "name": "d3-color", "severity": "high", "isDirect": false, "via": [ { "source": 1088594, "name": "d3-color", "dependency": "d3-color", "title": "d3-color vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.0" } ], "effects": [ "d3", "d3-interpolate", "d3-scale-chromatic", "d3-transition" ], "range": "<3.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-color" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-interpolate": { "name": "d3-interpolate", "severity": "high", "isDirect": false, "via": [ "d3-color" ], "effects": [ "d3-scale", "d3-scale-chromatic", "d3-transition" ], "range": "0.1.3 - 2.0.1", "nodes": [ "node_modules/dagre-d3/node_modules/d3-interpolate" ], "fixAvailable": true }, "d3-scale": { "name": "d3-scale", "severity": "high", "isDirect": false, "via": [ "d3-interpolate" ], "effects": [], "range": "0.1.5 - 3.3.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale" ], "fixAvailable": true }, "d3-scale-chromatic": { "name": "d3-scale-chromatic", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.1.0 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale-chromatic" ], "fixAvailable": true }, "d3-transition": { "name": "d3-transition", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [ "d3-brush", "d3-zoom" ], "range": "0.0.7 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-transition" ], "fixAvailable": true }, "d3-zoom": { "name": "d3-zoom", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.0.2 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-zoom" ], "fixAvailable": true }, "dagre-d3": { "name": "dagre-d3", "severity": "high", "isDirect": false, "via": [ "d3" ], "effects": [ "mermaid" ], "range": ">=0.5.0", "nodes": [ "node_modules/dagre-d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "dompurify": { "name": "dompurify", "severity": "critical", "isDirect": false, "via": [ { "source": 1099597, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify allows tampering by prototype pollution", "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674", "severity": "high", "cwe": [ "CWE-1321", "CWE-1333" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<2.5.4" }, { "source": 1100056, "name": "dompurify", "dependency": "dompurify", "title": "DOMpurify has a nesting-based mXSS", "url": "https://github.com/advisories/GHSA-gx9m-whjm-85jf", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H" }, "range": "<2.5.0" }, { "source": 1100302, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify vulnerable to tampering by prototype polution", "url": "https://github.com/advisories/GHSA-p3vf-v8qc-cwcr", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<2.4.2" } ], "effects": [ "mermaid" ], "range": "<=2.5.3", "nodes": [ "node_modules/dompurify" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "mermaid": { "name": "mermaid", "severity": "high", "isDirect": true, "via": [ "@braintree/sanitize-url", { "source": 1092622, "name": "mermaid", "dependency": "mermaid", "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML", "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf", "severity": "moderate", "cwe": [ "CWE-74", "CWE-79" ], "cvss": { "score": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N" }, "range": ">=8.0.0 <9.1.2" }, { "source": 1100231, "name": "mermaid", "dependency": "mermaid", "title": "Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify", "url": "https://github.com/advisories/GHSA-m4gq-x24j-jpmf", "severity": "high", "cwe": [ "CWE-1321", "CWE-1395" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<=10.9.2" }, "dagre-d3", "dompurify" ], "effects": [], "range": "<=10.9.2", "nodes": [ "node_modules/mermaid" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 1, "high": 10, "critical": 3, "total": 14 }, "dependencies": { "prod": 90, "dev": 624, "optional": 7, "peer": 1, "peerOptional": 0, "total": 713 } } } --- end --- Attempting to npm audit fix $ /usr/bin/npm audit fix --dry-run --only=dev --json --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production --- stdout --- { "added": 713, "removed": 0, "changed": 0, "audited": 714, "funding": 100, "audit": { "auditReportVersion": 2, "vulnerabilities": { "@braintree/sanitize-url": { "name": "@braintree/sanitize-url", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088745, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "Cross-site Scripting in sanitize-url", "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": "<6.0.0" }, { "source": 1091262, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "@braintree/sanitize-url Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<6.0.1" } ], "effects": [ "mermaid" ], "range": "<=6.0.0", "nodes": [ "node_modules/@braintree/sanitize-url" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3": { "name": "d3", "severity": "high", "isDirect": false, "via": [ "d3-brush", "d3-color", "d3-interpolate", "d3-scale", "d3-transition", "d3-zoom" ], "effects": [ "dagre-d3" ], "range": "4.0.0-alpha.1 - 6.7.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-brush": { "name": "d3-brush", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.1.0 - 2.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-brush" ], "fixAvailable": true }, "d3-color": { "name": "d3-color", "severity": "high", "isDirect": false, "via": [ { "source": 1088594, "name": "d3-color", "dependency": "d3-color", "title": "d3-color vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.0" } ], "effects": [ "d3", "d3-interpolate", "d3-scale-chromatic", "d3-transition" ], "range": "<3.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-color" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "d3-interpolate": { "name": "d3-interpolate", "severity": "high", "isDirect": false, "via": [ "d3-color" ], "effects": [ "d3-brush", "d3-scale", "d3-scale-chromatic", "d3-transition", "d3-zoom" ], "range": "0.1.3 - 2.0.1", "nodes": [ "node_modules/dagre-d3/node_modules/d3-interpolate" ], "fixAvailable": true }, "d3-scale": { "name": "d3-scale", "severity": "high", "isDirect": false, "via": [ "d3-interpolate" ], "effects": [], "range": "0.1.5 - 3.3.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale" ], "fixAvailable": true }, "d3-scale-chromatic": { "name": "d3-scale-chromatic", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.1.0 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale-chromatic" ], "fixAvailable": true }, "d3-transition": { "name": "d3-transition", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.0.7 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-transition" ], "fixAvailable": true }, "d3-zoom": { "name": "d3-zoom", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.0.2 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-zoom" ], "fixAvailable": true }, "dagre-d3": { "name": "dagre-d3", "severity": "high", "isDirect": false, "via": [ "d3" ], "effects": [ "mermaid" ], "range": ">=0.5.0", "nodes": [ "node_modules/dagre-d3" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "dompurify": { "name": "dompurify", "severity": "critical", "isDirect": false, "via": [ { "source": 1099597, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify allows tampering by prototype pollution", "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674", "severity": "high", "cwe": [ "CWE-1321", "CWE-1333" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<2.5.4" }, { "source": 1100056, "name": "dompurify", "dependency": "dompurify", "title": "DOMpurify has a nesting-based mXSS", "url": "https://github.com/advisories/GHSA-gx9m-whjm-85jf", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H" }, "range": "<2.5.0" }, { "source": 1100302, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify vulnerable to tampering by prototype polution", "url": "https://github.com/advisories/GHSA-p3vf-v8qc-cwcr", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<2.4.2" } ], "effects": [ "mermaid" ], "range": "<=2.5.3", "nodes": [ "node_modules/dompurify" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "mermaid": { "name": "mermaid", "severity": "high", "isDirect": true, "via": [ "@braintree/sanitize-url", { "source": 1092622, "name": "mermaid", "dependency": "mermaid", "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML", "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf", "severity": "moderate", "cwe": [ "CWE-74", "CWE-79" ], "cvss": { "score": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N" }, "range": ">=8.0.0 <9.1.2" }, { "source": 1100231, "name": "mermaid", "dependency": "mermaid", "title": "Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify", "url": "https://github.com/advisories/GHSA-m4gq-x24j-jpmf", "severity": "high", "cwe": [ "CWE-1321", "CWE-1395" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<=10.9.2" }, "dagre-d3", "dompurify" ], "effects": [], "range": "<=10.9.2", "nodes": [ "node_modules/mermaid" ], "fixAvailable": { "name": "mermaid", "version": "11.4.0", "isSemVerMajor": true } }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 1, "high": 10, "critical": 3, "total": 14 }, "dependencies": { "prod": 90, "dev": 624, "optional": 7, "peer": 1, "peerOptional": 0, "total": 713 } } } } --- end --- {"added": 713, "removed": 0, "changed": 0, "audited": 714, "funding": 100, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@braintree/sanitize-url": {"name": "@braintree/sanitize-url", "severity": "moderate", "isDirect": false, "via": [{"source": 1088745, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "Cross-site Scripting in sanitize-url", "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}, "range": "<6.0.0"}, {"source": 1091262, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "@braintree/sanitize-url Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<6.0.1"}], "effects": ["mermaid"], "range": "<=6.0.0", "nodes": ["node_modules/@braintree/sanitize-url"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "d3": {"name": "d3", "severity": "high", "isDirect": false, "via": ["d3-brush", "d3-color", "d3-interpolate", "d3-scale", "d3-transition", "d3-zoom"], "effects": ["dagre-d3"], "range": "4.0.0-alpha.1 - 6.7.0", "nodes": ["node_modules/dagre-d3/node_modules/d3"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "d3-brush": {"name": "d3-brush", "severity": "high", "isDirect": false, "via": ["d3-interpolate", "d3-transition"], "effects": [], "range": "0.1.0 - 2.1.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-brush"], "fixAvailable": true}, "d3-color": {"name": "d3-color", "severity": "high", "isDirect": false, "via": [{"source": 1088594, "name": "d3-color", "dependency": "d3-color", "title": "d3-color vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.0"}], "effects": ["d3", "d3-interpolate", "d3-scale-chromatic", "d3-transition"], "range": "<3.1.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-color"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "d3-interpolate": {"name": "d3-interpolate", "severity": "high", "isDirect": false, "via": ["d3-color"], "effects": ["d3-brush", "d3-scale", "d3-scale-chromatic", "d3-transition", "d3-zoom"], "range": "0.1.3 - 2.0.1", "nodes": ["node_modules/dagre-d3/node_modules/d3-interpolate"], "fixAvailable": true}, "d3-scale": {"name": "d3-scale", "severity": "high", "isDirect": false, "via": ["d3-interpolate"], "effects": [], "range": "0.1.5 - 3.3.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-scale"], "fixAvailable": true}, "d3-scale-chromatic": {"name": "d3-scale-chromatic", "severity": "high", "isDirect": false, "via": ["d3-color", "d3-interpolate"], "effects": [], "range": "0.1.0 - 2.0.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-scale-chromatic"], "fixAvailable": true}, "d3-transition": {"name": "d3-transition", "severity": "high", "isDirect": false, "via": ["d3-color", "d3-interpolate"], "effects": [], "range": "0.0.7 - 2.0.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-transition"], "fixAvailable": true}, "d3-zoom": {"name": "d3-zoom", "severity": "high", "isDirect": false, "via": ["d3-interpolate", "d3-transition"], "effects": [], "range": "0.0.2 - 2.0.0", "nodes": ["node_modules/dagre-d3/node_modules/d3-zoom"], "fixAvailable": true}, "dagre-d3": {"name": "dagre-d3", "severity": "high", "isDirect": false, "via": ["d3"], "effects": ["mermaid"], "range": ">=0.5.0", "nodes": ["node_modules/dagre-d3"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "dompurify": {"name": "dompurify", "severity": "critical", "isDirect": false, "via": [{"source": 1099597, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify allows tampering by prototype pollution", "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674", "severity": "high", "cwe": ["CWE-1321", "CWE-1333"], "cvss": {"score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L"}, "range": "<2.5.4"}, {"source": 1100056, "name": "dompurify", "dependency": "dompurify", "title": "DOMpurify has a nesting-based mXSS", "url": "https://github.com/advisories/GHSA-gx9m-whjm-85jf", "severity": "high", "cwe": ["CWE-79"], "cvss": {"score": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H"}, "range": "<2.5.0"}, {"source": 1100302, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify vulnerable to tampering by prototype polution", "url": "https://github.com/advisories/GHSA-p3vf-v8qc-cwcr", "severity": "critical", "cwe": ["CWE-1321"], "cvss": {"score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "range": "<2.4.2"}], "effects": ["mermaid"], "range": "<=2.5.3", "nodes": ["node_modules/dompurify"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "mermaid": {"name": "mermaid", "severity": "high", "isDirect": true, "via": ["@braintree/sanitize-url", {"source": 1092622, "name": "mermaid", "dependency": "mermaid", "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML", "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf", "severity": "moderate", "cwe": ["CWE-74", "CWE-79"], "cvss": {"score": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N"}, "range": ">=8.0.0 <9.1.2"}, {"source": 1100231, "name": "mermaid", "dependency": "mermaid", "title": "Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify", "url": "https://github.com/advisories/GHSA-m4gq-x24j-jpmf", "severity": "high", "cwe": ["CWE-1321", "CWE-1395"], "cvss": {"score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L"}, "range": "<=10.9.2"}, "dagre-d3", "dompurify"], "effects": [], "range": "<=10.9.2", "nodes": ["node_modules/mermaid"], "fixAvailable": {"name": "mermaid", "version": "11.4.0", "isSemVerMajor": true}}, "nomnom": {"name": "nomnom", "severity": "critical", "isDirect": false, "via": ["underscore"], "effects": [], "range": ">=1.6.0", "nodes": ["node_modules/nomnom"], "fixAvailable": true}, "underscore": {"name": "underscore", "severity": "critical", "isDirect": false, "via": [{"source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": ["CWE-94"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.3.2 <1.12.1"}], "effects": ["nomnom"], "range": "1.3.2 - 1.12.0", "nodes": ["node_modules/underscore"], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 1, "high": 10, "critical": 3, "total": 14}, "dependencies": {"prod": 90, "dev": 624, "optional": 7, "peer": 1, "peerOptional": 0, "total": 713}}}} $ /usr/bin/npm audit fix --only=dev --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production npm WARN deprecated @braintree/sanitize-url@3.1.0: Potential XSS vulnerability patched in v6.0.0. npm WARN deprecated nomnom@1.8.1: Package no longer supported. Contact support@npmjs.com for more info. --- stdout --- added 712 packages, and audited 713 packages in 7s 100 packages are looking for funding run `npm fund` for details # npm audit report @braintree/sanitize-url <=6.0.0 Severity: moderate Cross-site Scripting in sanitize-url - https://github.com/advisories/GHSA-hqq7-2q2v-82xq @braintree/sanitize-url Cross-site Scripting vulnerability - https://github.com/advisories/GHSA-q8gg-vj6m-hgmj fix available via `npm audit fix --force` Will install mermaid@11.4.0, which is a breaking change node_modules/@braintree/sanitize-url mermaid <=10.9.2 Depends on vulnerable versions of @braintree/sanitize-url Depends on vulnerable versions of dagre-d3 Depends on vulnerable versions of dompurify node_modules/mermaid d3-color <3.1.0 Severity: high d3-color vulnerable to ReDoS - https://github.com/advisories/GHSA-36jr-mh4h-2g58 fix available via `npm audit fix --force` Will install mermaid@11.4.0, which is a breaking change node_modules/dagre-d3/node_modules/d3-color d3 4.0.0-alpha.1 - 6.7.0 Depends on vulnerable versions of d3-brush Depends on vulnerable versions of d3-color Depends on vulnerable versions of d3-interpolate Depends on vulnerable versions of d3-scale Depends on vulnerable versions of d3-transition Depends on vulnerable versions of d3-zoom node_modules/dagre-d3/node_modules/d3 dagre-d3 >=0.5.0 Depends on vulnerable versions of d3 node_modules/dagre-d3 d3-interpolate 0.1.3 - 2.0.1 Depends on vulnerable versions of d3-color node_modules/dagre-d3/node_modules/d3-interpolate d3-brush 0.1.0 - 2.1.0 Depends on vulnerable versions of d3-interpolate Depends on vulnerable versions of d3-transition node_modules/dagre-d3/node_modules/d3-brush d3-scale 0.1.5 - 3.3.0 Depends on vulnerable versions of d3-interpolate node_modules/dagre-d3/node_modules/d3-scale d3-scale-chromatic 0.1.0 - 2.0.0 Depends on vulnerable versions of d3-color Depends on vulnerable versions of d3-interpolate node_modules/dagre-d3/node_modules/d3-scale-chromatic d3-transition 0.0.7 - 2.0.0 Depends on vulnerable versions of d3-color Depends on vulnerable versions of d3-interpolate node_modules/dagre-d3/node_modules/d3-transition d3-zoom 0.0.2 - 2.0.0 Depends on vulnerable versions of d3-interpolate Depends on vulnerable versions of d3-transition node_modules/dagre-d3/node_modules/d3-zoom dompurify <=2.5.3 Severity: critical DOMPurify allows tampering by prototype pollution - https://github.com/advisories/GHSA-mmhx-hmjr-r674 DOMpurify has a nesting-based mXSS - https://github.com/advisories/GHSA-gx9m-whjm-85jf DOMPurify vulnerable to tampering by prototype polution - https://github.com/advisories/GHSA-p3vf-v8qc-cwcr fix available via `npm audit fix --force` Will install mermaid@11.4.0, which is a breaking change node_modules/dompurify underscore 1.3.2 - 1.12.0 Severity: critical Arbitrary Code Execution in underscore - https://github.com/advisories/GHSA-cf4h-3jhx-xvhq fix available via `npm audit fix` node_modules/underscore nomnom >=1.6.0 Depends on vulnerable versions of underscore node_modules/nomnom 14 vulnerabilities (1 moderate, 10 high, 3 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force --- end --- Verifying that tests still pass $ /usr/bin/npm ci --- stderr --- npm WARN deprecated @braintree/sanitize-url@3.1.0: Potential XSS vulnerability patched in v6.0.0. npm WARN deprecated nomnom@1.8.1: Package no longer supported. Contact support@npmjs.com for more info. --- stdout --- added 712 packages, and audited 713 packages in 9s 100 packages are looking for funding run `npm fund` for details 14 vulnerabilities (1 moderate, 10 high, 3 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- $ /usr/bin/npm test --- stdout --- > test > grunt test Running "eslint:all" (eslint) task /src/repo/resources/js/src/contentTransformation.js 15:3 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 25:14 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 26:18 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 43:14 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 44:18 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 53:22 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 69:3 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 70:11 warning Prefer DOM building to parsing HTML literals no-jquery/no-parse-html-literal 73:16 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 77:9 warning jQuery collection names must match the variablePattern no-jquery/variable-pattern 129:12 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 141:6 warning jQuery collection names must match the variablePattern no-jquery/variable-pattern 141:13 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 142:3 warning jQuery collection names must match the variablePattern no-jquery/variable-pattern 142:10 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 152:3 warning jQuery collection names must match the variablePattern no-jquery/variable-pattern 161:16 warning Avoid queries which search the entire DOM. Keep DOM nodes in memory where possible no-jquery/no-global-selector 176:7 warning jQuery collection names must match the variablePattern no-jquery/variable-pattern ✖ 18 problems (0 errors, 18 warnings) Running "jsonlint:all" (jsonlint) task >> 7 files lint free. Running "stylelint:all" (stylelint) task >> Linted 2 files without errors Running "banana:all" (banana) task >> 1 message directory checked. Done. --- end --- {} {} {} {} {} {} {"1095097": {"source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": ["CWE-94"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.3.2 <1.12.1"}} {"1095097": {"source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": ["CWE-94"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.3.2 <1.12.1"}} $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- [DNM] there are no updates $ git add . --- stdout --- --- end --- $ git commit -F /tmp/tmp4mvxewiu --- stdout --- On branch REL1_43 Your branch is up to date with 'origin/REL1_43'. nothing to commit, working tree clean --- end ---