This run took 38 seconds.
From ab5700fbf8a48731babe8c1729e72dd427e44c55 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 13 Apr 2025 00:17:19 +0000
Subject: [PATCH] build: Updating vite to 6.2.6
* https://github.com/advisories/GHSA-356w-63v5-8wf4
Change-Id: I6dac4435cab0311b623fd73067e7d7abfa040caa
---
package-lock.json | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 7a8957e..c48b89c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5838,9 +5838,9 @@
}
},
"node_modules/vite": {
- "version": "6.2.5",
- "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.5.tgz",
- "integrity": "sha512-j023J/hCAa4pRIUH6J9HemwYfjB5llR2Ps0CWeikOtdR8+pAURAk0DoJC5/mm9kd+UgdnIy7d6HE4EAvlYhPhA==",
+ "version": "6.2.6",
+ "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.6.tgz",
+ "integrity": "sha512-9xpjNl3kR4rVDZgPNdTL0/c6ao4km69a/2ihNQbcANz8RuCOK3hQBmLSJf3bRKVQjVMda+YvizNE8AwvogcPbw==",
"dependencies": {
"esbuild": "^0.25.0",
"postcss": "^8.5.3",
--
2.39.2
$ date
--- stdout ---
Sun Apr 13 00:16:55 UTC 2025
--- end ---
$ git clone file:///srv/git/labs-striker.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
72d546dc00781a36a1648f70bb8081697289c539 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1103887,
"name": "vite",
"dependency": "vite",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"url": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.2.0 <6.2.6"
}
],
"effects": [],
"range": "6.2.0 - 6.2.5",
"nodes": [
"node_modules/vite"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 30,
"dev": 392,
"optional": 54,
"peer": 18,
"peerOptional": 0,
"total": 493
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1103887,
"name": "vite",
"dependency": "vite",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"url": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.2.0 <6.2.6"
}
],
"effects": [],
"range": "6.2.0 - 6.2.5",
"nodes": [
"node_modules/vite"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 30,
"dev": 392,
"optional": 54,
"peer": 18,
"peerOptional": 0,
"total": 493
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 493,
"removed": 0,
"changed": 0,
"audited": 494,
"funding": 95,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1103887,
"name": "vite",
"dependency": "vite",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"url": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.2.0 <6.2.6"
}
],
"effects": [],
"range": "6.2.0 - 6.2.5",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 30,
"dev": 392,
"optional": 54,
"peer": 18,
"peerOptional": 0,
"total": 493
}
}
}
}
--- end ---
{"added": 493, "removed": 0, "changed": 0, "audited": 494, "funding": 95, "audit": {"auditReportVersion": 2, "vulnerabilities": {"vite": {"name": "vite", "severity": "moderate", "isDirect": false, "via": [{"source": 1103887, "name": "vite", "dependency": "vite", "title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`", "url": "https://github.com/advisories/GHSA-356w-63v5-8wf4", "severity": "moderate", "cwe": ["CWE-200"], "cvss": {"score": 0, "vectorString": null}, "range": ">=6.2.0 <6.2.6"}], "effects": [], "range": "6.2.0 - 6.2.5", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 1, "high": 0, "critical": 0, "total": 1}, "dependencies": {"prod": 30, "dev": 392, "optional": 54, "peer": 18, "peerOptional": 0, "total": 493}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 451 packages, and audited 452 packages in 6s
95 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 451 packages, and audited 452 packages in 6s
95 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
$ /usr/bin/npm test
--- stdout ---
> test
> grunt test
Running "eslint:all" (eslint) task
Running "stylelint:all" (stylelint) task
>> Linted 3 files without errors
Done.
--- end ---
{"1103887": {"source": 1103887, "name": "vite", "dependency": "vite", "title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`", "url": "https://github.com/advisories/GHSA-356w-63v5-8wf4", "severity": "moderate", "cwe": ["CWE-200"], "cvss": {"score": 0, "vectorString": null}, "range": ">=6.2.0 <6.2.6"}}
Upgrading n:vite from 6.2.5 -> 6.2.6
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
build: Updating vite to 6.2.6
* https://github.com/advisories/GHSA-356w-63v5-8wf4
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmpxgxgrrat
--- stdout ---
[master ab5700f] build: Updating vite to 6.2.6
1 file changed, 3 insertions(+), 3 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From ab5700fbf8a48731babe8c1729e72dd427e44c55 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 13 Apr 2025 00:17:19 +0000
Subject: [PATCH] build: Updating vite to 6.2.6
* https://github.com/advisories/GHSA-356w-63v5-8wf4
Change-Id: I6dac4435cab0311b623fd73067e7d7abfa040caa
---
package-lock.json | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 7a8957e..c48b89c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5838,9 +5838,9 @@
}
},
"node_modules/vite": {
- "version": "6.2.5",
- "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.5.tgz",
- "integrity": "sha512-j023J/hCAa4pRIUH6J9HemwYfjB5llR2Ps0CWeikOtdR8+pAURAk0DoJC5/mm9kd+UgdnIy7d6HE4EAvlYhPhA==",
+ "version": "6.2.6",
+ "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.6.tgz",
+ "integrity": "sha512-9xpjNl3kR4rVDZgPNdTL0/c6ao4km69a/2ihNQbcANz8RuCOK3hQBmLSJf3bRKVQjVMda+YvizNE8AwvogcPbw==",
"dependencies": {
"esbuild": "^0.25.0",
"postcss": "^8.5.3",
--
2.39.2
--- end ---