This run took 15 seconds.
$ date
--- stdout ---
Wed May 7 02:16:35 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-services-kartotherian.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stderr ---
Submodule 'vendor/node-mapnik' (https://github.com/mapnik/node-mapnik.git) registered for path 'vendor/node-mapnik'
Cloning into '/src/repo/vendor/node-mapnik'...
--- stdout ---
Submodule path 'vendor/node-mapnik': checked out 'c17f136fedaa6173b31a87e8c9e00e87ed69eed7'
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
304a26449ce338e10d904fb27574edcaf32be8ab refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@mapbox/tilejson": {
"name": "@mapbox/tilejson",
"severity": "high",
"isDirect": true,
"via": [
"requestretry"
],
"effects": [
"tilelive-http"
],
"range": "*",
"nodes": [
"node_modules/@mapbox/tilejson"
],
"fixAvailable": false
},
"@mapbox/tilelive-vector": {
"name": "@mapbox/tilelive-vector",
"severity": "critical",
"isDirect": false,
"via": [
"request",
"tar",
"underscore"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@mapbox/tilelive-vector"
],
"fixAvailable": true
},
"@wikimedia/tilelive-vector": {
"name": "@wikimedia/tilelive-vector",
"severity": "critical",
"isDirect": true,
"via": [
"request",
"tar",
"underscore"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@wikimedia/tilelive-vector"
],
"fixAvailable": false
},
"ajv": {
"name": "ajv",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097685,
"name": "ajv",
"dependency": "ajv",
"title": "Prototype Pollution in Ajv",
"url": "https://github.com/advisories/GHSA-v88g-cgmw-v5xw",
"severity": "moderate",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 5.6,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<6.12.3"
}
],
"effects": [
"har-validator"
],
"range": "<6.12.3",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/ajv",
"node_modules/@wikimedia/tilelive-vector/node_modules/ajv"
],
"fixAvailable": false
},
"boom": {
"name": "boom",
"severity": "high",
"isDirect": false,
"via": [
"hoek"
],
"effects": [
"cryptiles",
"hawk"
],
"range": "*",
"nodes": [
"node_modules/boom",
"node_modules/cryptiles/node_modules/boom"
],
"fixAvailable": false
},
"carto": {
"name": "carto",
"severity": "high",
"isDirect": false,
"via": [
"js-yaml",
"semver",
"yargs"
],
"effects": [
"tilelive-tmstyle"
],
"range": ">=0.17.2",
"nodes": [
"node_modules/carto"
],
"fixAvailable": false
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100562,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1100563,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"execa"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/cross-spawn",
"node_modules/os-locale/node_modules/cross-spawn"
],
"fixAvailable": false
},
"cryptiles": {
"name": "cryptiles",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1102325,
"name": "cryptiles",
"dependency": "cryptiles",
"title": "Insufficient Entropy in cryptiles",
"url": "https://github.com/advisories/GHSA-rq8g-5pc5-wrhr",
"severity": "critical",
"cwe": [
"CWE-331"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=3.1.0 <4.1.2"
},
"boom"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/cryptiles"
],
"fixAvailable": true
},
"elliptic": {
"name": "elliptic",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1102901,
"name": "elliptic",
"dependency": "elliptic",
"title": "Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",
"url": "https://github.com/advisories/GHSA-vjh7-7g9h-fjfh",
"severity": "critical",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.6.0"
}
],
"effects": [],
"range": "<=6.6.0",
"nodes": [
"node_modules/elliptic"
],
"fixAvailable": true
},
"execa": {
"name": "execa",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"os-locale"
],
"range": "0.5.0 - 0.9.0",
"nodes": [
"node_modules/os-locale/node_modules/execa"
],
"fixAvailable": false
},
"express": {
"name": "express",
"severity": "high",
"isDirect": true,
"via": [
"path-to-regexp"
],
"effects": [],
"range": "4.0.0-rc1 - 4.21.1 || 5.0.0-alpha.1 - 5.0.0-beta.3",
"nodes": [
"node_modules/express"
],
"fixAvailable": true
},
"har-validator": {
"name": "har-validator",
"severity": "moderate",
"isDirect": false,
"via": [
"ajv"
],
"effects": [
"request"
],
"range": "3.3.0 - 5.1.0",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/har-validator",
"node_modules/@wikimedia/tilelive-vector/node_modules/har-validator"
],
"fixAvailable": false
},
"hawk": {
"name": "hawk",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095062,
"name": "hawk",
"dependency": "hawk",
"title": "Uncontrolled Resource Consumption in Hawk",
"url": "https://github.com/advisories/GHSA-44pw-h2cw-w3vq",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"
},
"range": "<9.0.1"
},
"boom",
"hoek",
"sntp"
],
"effects": [
"request"
],
"range": "<=9.0.0",
"nodes": [
"node_modules/hawk"
],
"fixAvailable": false
},
"hoek": {
"name": "hoek",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096410,
"name": "hoek",
"dependency": "hoek",
"title": "hoek subject to prototype pollution via the clone function.",
"url": "https://github.com/advisories/GHSA-c429-5p7v-vgjp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=6.1.3"
}
],
"effects": [
"boom",
"hawk",
"sntp"
],
"range": "*",
"nodes": [
"node_modules/hoek"
],
"fixAvailable": false
},
"js-yaml": {
"name": "js-yaml",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1085724,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "Denial of Service in js-yaml",
"url": "https://github.com/advisories/GHSA-2pr6-76vf-7546",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.13.0"
},
{
"source": 1095058,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "Code Injection in js-yaml",
"url": "https://github.com/advisories/GHSA-8j8c-7jfh-h6hx",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.13.1"
}
],
"effects": [],
"range": "<=3.13.0",
"nodes": [
"node_modules/carto/node_modules/js-yaml"
],
"fixAvailable": true
},
"libxmljs": {
"name": "libxmljs",
"severity": "critical",
"isDirect": true,
"via": [
{
"source": 1100552,
"name": "libxmljs",
"dependency": "libxmljs",
"title": "libxmljs vulnerable to type confusion when parsing specially crafted XML ",
"url": "https://github.com/advisories/GHSA-mg49-jqgw-gcj6",
"severity": "critical",
"cwe": [
"CWE-843"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=1.0.11"
},
{
"source": 1100659,
"name": "libxmljs",
"dependency": "libxmljs",
"title": "libxmljs vulnerable to type confusion when parsing specially crafted XML",
"url": "https://github.com/advisories/GHSA-6433-x5p4-8jc7",
"severity": "critical",
"cwe": [
"CWE-843"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=1.0.11"
}
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/libxmljs"
],
"fixAvailable": false
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [
"service-runner"
],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"mem": {
"name": "mem",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1085685,
"name": "mem",
"dependency": "mem",
"title": "Denial of Service in mem",
"url": "https://github.com/advisories/GHSA-4xcv-9jjx-gfj3",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 5.1,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<4.0.0"
}
],
"effects": [
"os-locale"
],
"range": "<4.0.0",
"nodes": [
"node_modules/mem"
],
"fixAvailable": false
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094419,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"mwapi": {
"name": "mwapi",
"severity": "moderate",
"isDirect": true,
"via": [
"preq"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/mwapi"
],
"fixAvailable": false
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": true
},
"os-locale": {
"name": "os-locale",
"severity": "high",
"isDirect": false,
"via": [
"execa",
"mem"
],
"effects": [
"yargs"
],
"range": "2.0.0 - 3.0.0",
"nodes": [
"node_modules/os-locale"
],
"fixAvailable": false
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101844,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "Unpatched `path-to-regexp` ReDoS in 0.1.x",
"url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.1.12"
}
],
"effects": [
"express"
],
"range": "<0.1.12",
"nodes": [
"node_modules/path-to-regexp"
],
"fixAvailable": true
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [
"mwapi"
],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"request": {
"name": "request",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"har-validator",
"hawk",
"tough-cookie"
],
"effects": [
"@mapbox/tilelive-vector",
"@wikimedia/tilelive-vector",
"preq",
"request-promise",
"request-promise-core",
"requestretry",
"tilelive-http"
],
"range": "*",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/request",
"node_modules/@wikimedia/tilelive-vector/node_modules/request",
"node_modules/request"
],
"fixAvailable": false
},
"request-promise": {
"name": "request-promise",
"severity": "moderate",
"isDirect": true,
"via": [
"request",
"request-promise-core",
"tough-cookie"
],
"effects": [],
"range": ">=0.0.2",
"nodes": [
"node_modules/request-promise"
],
"fixAvailable": {
"name": "request-promise",
"version": "0.0.1",
"isSemVerMajor": true
}
},
"request-promise-core": {
"name": "request-promise-core",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"request-promise"
],
"range": "*",
"nodes": [
"node_modules/request-promise-core"
],
"fixAvailable": {
"name": "request-promise",
"version": "0.0.1",
"isSemVerMajor": true
}
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
},
"request"
],
"effects": [
"@mapbox/tilejson",
"preq"
],
"range": "*",
"nodes": [
"node_modules/preq/node_modules/requestretry",
"node_modules/requestretry"
],
"fixAvailable": false
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101089,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.7.2"
}
],
"effects": [
"carto"
],
"range": "<5.7.2",
"nodes": [
"node_modules/carto/node_modules/semver"
],
"fixAvailable": false
},
"service-runner": {
"name": "service-runner",
"severity": "moderate",
"isDirect": true,
"via": [
"limitation"
],
"effects": [],
"range": ">=3.1.0",
"nodes": [
"node_modules/service-runner"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"sntp": {
"name": "sntp",
"severity": "high",
"isDirect": false,
"via": [
"hoek"
],
"effects": [
"hawk"
],
"range": "0.0.0 || >=0.1.1",
"nodes": [
"node_modules/sntp"
],
"fixAvailable": false
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089685,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization",
"url": "https://github.com/advisories/GHSA-3jfq-g458-7qm9",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": "<3.2.2"
},
{
"source": 1095117,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization",
"url": "https://github.com/advisories/GHSA-5955-9wpr-37jh",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": "<4.4.18"
},
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
}
],
"effects": [],
"range": "<=6.2.0",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/tar",
"node_modules/@wikimedia/tilelive-vector/node_modules/tar"
],
"fixAvailable": true
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1103613,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.1",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"tilelive-http": {
"name": "tilelive-http",
"severity": "high",
"isDirect": true,
"via": [
"@mapbox/tilejson",
"request"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/tilelive-http"
],
"fixAvailable": false
},
"tilelive-tmstyle": {
"name": "tilelive-tmstyle",
"severity": "critical",
"isDirect": true,
"via": [
"@mapbox/tilelive-vector",
"carto",
"underscore"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/tilelive-tmstyle"
],
"fixAvailable": false
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request",
"request-promise"
],
"range": "<4.1.3",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/tough-cookie",
"node_modules/@wikimedia/tilelive-vector/node_modules/tough-cookie",
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"underscore": {
"name": "underscore",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1095097,
"name": "underscore",
"dependency": "underscore",
"title": "Arbitrary Code Execution in underscore",
"url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq",
"severity": "critical",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.3.2 <1.12.1"
}
],
"effects": [
"tilelive-tmstyle"
],
"range": "1.3.2 - 1.12.0",
"nodes": [
"node_modules/@mapbox/tilelive-vector/node_modules/underscore",
"node_modules/@wikimedia/tilelive-vector/node_modules/underscore",
"node_modules/tilelive-tmstyle/node_modules/underscore"
],
"fixAvailable": false
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"yargs": {
"name": "yargs",
"severity": "moderate",
"isDirect": false,
"via": [
"os-locale",
"yargs-parser"
],
"effects": [
"carto"
],
"range": "8.0.0-candidate.0 - 12.0.5",
"nodes": [
"node_modules/carto/node_modules/yargs"
],
"fixAvailable": false
},
"yargs-parser": {
"name": "yargs-parser",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088811,
"name": "yargs-parser",
"dependency": "yargs-parser",
"title": "yargs-parser Vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-p9pc-299p-vxgp",
"severity": "moderate",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
"range": ">=6.0.0 <13.1.2"
}
],
"effects": [
"yargs"
],
"range": "6.0.0 - 13.1.1",
"nodes": [
"node_modules/carto/node_modules/yargs-parser"
],
"fixAvailable": false
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 15,
"high": 19,
"critical": 7,
"total": 41
},
"dependencies": {
"prod": 599,
"dev": 565,
"optional": 14,
"peer": 19,
"peerOptional": 0,
"total": 1194
}
}
}
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 2026, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1961, in run
plan = planner.check(repo)
^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/httpplan.py", line 38, in check
resp.raise_for_status()
File "/venv/lib/python3.11/site-packages/requests/models.py", line 1021, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 502 Server Error: Bad Gateway for url: https://libup.wmcloud.org/plan.json?repository=mediawiki%2Fservices%2Fkartotherian&branch=master