This run took 27 seconds.
From 58aa2a34dc73b1876ec3d8d844b9bc03431dbd12 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Tue, 19 Nov 2024 08:21:25 +0000
Subject: [PATCH] build: Updating cross-spawn to 7.0.6
* https://github.com/advisories/GHSA-3xgq-45jj-v275
Change-Id: Id3c2816da787212a33c95b580d6c0c557d9e4e45
---
package-lock.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index ee8e1e5..fac3aa6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1372,9 +1372,9 @@
}
},
"node_modules/cross-spawn": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
- "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
"dev": true,
"dependencies": {
"path-key": "^3.1.0",
@@ -5444,9 +5444,9 @@
}
},
"cross-spawn": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
- "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
"dev": true,
"requires": {
"path-key": "^3.1.0",
--
2.39.2
$ date
--- stdout ---
Tue Nov 19 08:21:08 UTC 2024
--- end ---
$ git clone file:///srv/git/mediawiki-libs-node-cssjanus.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
345ae1fdfb6df0e1304e7e56364b23329790726c refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100467,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.0.5"
}
],
"effects": [],
"range": "<7.0.5",
"nodes": [
"node_modules/cross-spawn"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 1,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 375,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 375
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100467,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.0.5"
}
],
"effects": [],
"range": "<7.0.5",
"nodes": [
"node_modules/cross-spawn"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 1,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 375,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 375
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 375,
"removed": 0,
"changed": 0,
"audited": 376,
"funding": 67,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100467,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.0.5"
}
],
"effects": [],
"range": "<7.0.5",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 1,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 375,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 375
}
}
}
}
--- end ---
{"added": 375, "removed": 0, "changed": 0, "audited": 376, "funding": 67, "audit": {"auditReportVersion": 2, "vulnerabilities": {"cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1100467, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<7.0.5"}], "effects": [], "range": "<7.0.5", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 1, "critical": 0, "total": 1}, "dependencies": {"prod": 1, "dev": 375, "optional": 0, "peer": 1, "peerOptional": 0, "total": 375}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
added 375 packages, and audited 376 packages in 4s
67 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stdout ---
added 375 packages, and audited 376 packages in 4s
67 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
$ /usr/bin/npm test
--- stdout ---
> cssjanus@2.3.0 test
> eslint . && qunit test/unit.js
/src/repo/src/cssjanus.js
79:24 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
/src/repo/test/bench.js
84:10 warning Found readFileSync from package "fs" with non literal argument at index 0 security/detect-non-literal-fs-filename
99:2 warning Found writeFileSync from package "fs" with non literal argument at index 0 security/detect-non-literal-fs-filename
136:2 warning Don't use process.exit(); throw an error instead n/no-process-exit
✖ 4 problems (0 errors, 4 warnings)
TAP version 13
ok 1 preserve comments
ok 2 flip position
ok 3 flip negative values
ok 4 flip four value notation
ok 5 flip direction
ok 6 flip float
ok 7 flip padding
ok 8 flip padding-{edge}
ok 9 flip margin-{edge}
ok 10 flip cursor
ok 11 flip text-align
ok 12 flip text-shadow
ok 13 flip box-shadow
ok 14 flip border-{edge}
ok 15 flip border-{edge}-color
ok 16 flip border-{edge}-style
ok 17 flip border-color
ok 18 flip border-width
ok 19 flip border-style
ok 20 flip border-radius
ok 21 flip border-radius (one-way)
ok 22 flip border-top-{edge}-radius
ok 23 flip border-bottom-{edge}-radius
ok 24 flip transform translate x-axis
ok 25 flip background-position keywords
ok 26 flip background-position percentages
ok 27 do not flip background-position non-percentages
ok 28 flip background percentages
ok 29 flip background-position-x percentages
ok 30 do not flip background-position-y
ok 31 do not flip URLs when url transforms are off
ok 32 flip URLs when url transforms are on
ok 33 do not flip URLs (back-compat boolean argument)
ok 34 flip URLs (back-compat boolean argument)
ok 35 leave class names alone
ok 36 leave unknown properties alone
ok 37 flip multiple rules
ok 38 flip duplicate properties
ok 39 do not flip rules or properties with @noflip comments
ok 40 do not flip gradient notation
ok 41 long content
ok 42 do not touch CSS Logical
ok 43 do not touch dir attribute selector and dir pseudo-class selector
1..43
# pass 43
# skip 0
# todo 0
# fail 0
--- end ---
{"1100467": {"source": 1100467, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<7.0.5"}}
Upgrading n:cross-spawn from 7.0.3 -> 7.0.6
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
build: Updating cross-spawn to 7.0.6
* https://github.com/advisories/GHSA-3xgq-45jj-v275
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmpmmw9ctlg
--- stdout ---
[master 58aa2a3] build: Updating cross-spawn to 7.0.6
1 file changed, 6 insertions(+), 6 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 58aa2a34dc73b1876ec3d8d844b9bc03431dbd12 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Tue, 19 Nov 2024 08:21:25 +0000
Subject: [PATCH] build: Updating cross-spawn to 7.0.6
* https://github.com/advisories/GHSA-3xgq-45jj-v275
Change-Id: Id3c2816da787212a33c95b580d6c0c557d9e4e45
---
package-lock.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index ee8e1e5..fac3aa6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1372,9 +1372,9 @@
}
},
"node_modules/cross-spawn": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
- "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
"dev": true,
"dependencies": {
"path-key": "^3.1.0",
@@ -5444,9 +5444,9 @@
}
},
"cross-spawn": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
- "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
"dev": true,
"requires": {
"path-key": "^3.1.0",
--
2.39.2
--- end ---