This run took 126 seconds.
$ date
--- stdout ---
Wed Jun 11 00:03:23 UTC 2025
--- end ---
$ git clone file:///srv/git/VisualEditor-VisualEditor.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
cffbd96ecca1fc2dbdc6e19f904adcb8f3ad851e refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/utils"
],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": true
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "low",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree"
],
"effects": [],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105422,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.1 <=4.0.0"
}
],
"effects": [
"minimatch"
],
"range": ">=2.0.1",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/eslint-plugin-n/node_modules/brace-expansion"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "low",
"isDirect": true,
"via": [
"eslint-plugin-n"
],
"effects": [],
"range": ">=0.28.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint-config-wikimedia"
],
"range": ">=17.0.0-0",
"nodes": [
"node_modules/eslint-plugin-n"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"grunt-css-url-embed": {
"name": "grunt-css-url-embed",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/grunt-css-url-embed"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "low",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@typescript-eslint/typescript-estree",
"eslint-plugin-n"
],
"range": ">=5.0.0",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/eslint-plugin-n/node_modules/minimatch"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"tough-cookie"
],
"effects": [
"grunt-css-url-embed"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 6,
"moderate": 3,
"high": 0,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 713,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 713
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/utils"
],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": true
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "low",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree"
],
"effects": [],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105422,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.1 <=4.0.0"
}
],
"effects": [
"minimatch"
],
"range": ">=2.0.1",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/eslint-plugin-n/node_modules/brace-expansion"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "low",
"isDirect": true,
"via": [
"eslint-plugin-n"
],
"effects": [],
"range": ">=0.28.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint-config-wikimedia"
],
"range": ">=17.0.0-0",
"nodes": [
"node_modules/eslint-plugin-n"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"grunt-css-url-embed": {
"name": "grunt-css-url-embed",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/grunt-css-url-embed"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "low",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@typescript-eslint/typescript-estree",
"eslint-plugin-n"
],
"range": ">=5.0.0",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/eslint-plugin-n/node_modules/minimatch"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"tough-cookie"
],
"effects": [
"grunt-css-url-embed"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 6,
"moderate": 3,
"high": 0,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 713,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 713
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 725,
"removed": 0,
"changed": 0,
"audited": 726,
"funding": 125,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/utils"
],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": true
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "low",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree"
],
"effects": [],
"range": ">=6.16.0",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105422,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.1 <=4.0.0"
}
],
"effects": [
"minimatch"
],
"range": ">=2.0.1",
"nodes": [
"",
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "low",
"isDirect": true,
"via": [
"eslint-plugin-n"
],
"effects": [],
"range": ">=0.28.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "low",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint-config-wikimedia"
],
"range": ">=17.0.0-0",
"nodes": [
""
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"grunt-css-url-embed": {
"name": "grunt-css-url-embed",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/grunt-css-url-embed"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "low",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@typescript-eslint/typescript-estree",
"eslint-plugin-n"
],
"range": ">=5.0.0",
"nodes": [
"",
"",
"node_modules/eslint-plugin-n/node_modules/minimatch"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.27.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"tough-cookie"
],
"effects": [
"grunt-css-url-embed"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "grunt-css-url-embed",
"version": "1.0.4",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 6,
"moderate": 3,
"high": 0,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 725,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 725
}
}
}
}
--- end ---
{"added": 725, "removed": 0, "changed": 0, "audited": 726, "funding": 125, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@typescript-eslint/typescript-estree": {"name": "@typescript-eslint/typescript-estree", "severity": "low", "isDirect": false, "via": ["minimatch"], "effects": ["@typescript-eslint/utils"], "range": ">=6.16.0", "nodes": ["node_modules/@typescript-eslint/typescript-estree"], "fixAvailable": true}, "@typescript-eslint/utils": {"name": "@typescript-eslint/utils", "severity": "low", "isDirect": false, "via": ["@typescript-eslint/typescript-estree"], "effects": [], "range": ">=6.16.0", "nodes": ["node_modules/@typescript-eslint/utils"], "fixAvailable": true}, "brace-expansion": {"name": "brace-expansion", "severity": "low", "isDirect": false, "via": [{"source": 1105422, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.1 <=4.0.0"}], "effects": ["minimatch"], "range": ">=2.0.1", "nodes": ["", "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true}}, "eslint-config-wikimedia": {"name": "eslint-config-wikimedia", "severity": "low", "isDirect": true, "via": ["eslint-plugin-n"], "effects": [], "range": ">=0.28.0", "nodes": ["node_modules/eslint-config-wikimedia"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true}}, "eslint-plugin-n": {"name": "eslint-plugin-n", "severity": "low", "isDirect": false, "via": ["minimatch"], "effects": ["eslint-config-wikimedia"], "range": ">=17.0.0-0", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true}}, "grunt-css-url-embed": {"name": "grunt-css-url-embed", "severity": "moderate", "isDirect": true, "via": ["request"], "effects": [], "range": ">=1.1.0", "nodes": ["node_modules/grunt-css-url-embed"], "fixAvailable": {"name": "grunt-css-url-embed", "version": "1.0.4", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "low", "isDirect": false, "via": ["brace-expansion"], "effects": ["@typescript-eslint/typescript-estree", "eslint-plugin-n"], "range": ">=5.0.0", "nodes": ["", "", "node_modules/eslint-plugin-n/node_modules/minimatch"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "moderate", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "tough-cookie"], "effects": ["grunt-css-url-embed"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "grunt-css-url-embed", "version": "1.0.4", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "grunt-css-url-embed", "version": "1.0.4", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 6, "moderate": 3, "high": 0, "critical": 0, "total": 9}, "dependencies": {"prod": 1, "dev": 725, "optional": 13, "peer": 1, "peerOptional": 0, "total": 725}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
--- stdout ---
added 725 packages, and audited 726 packages in 17s
125 packages are looking for funding
run `npm fund` for details
# npm audit report
brace-expansion >=2.0.1
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
fix available via `npm audit fix --force`
Will install eslint-config-wikimedia@0.27.0, which is a breaking change
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/eslint-plugin-n/node_modules/brace-expansion
minimatch >=5.0.0
Depends on vulnerable versions of brace-expansion
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/eslint-plugin-n/node_modules/minimatch
@typescript-eslint/typescript-estree >=6.16.0
Depends on vulnerable versions of minimatch
node_modules/@typescript-eslint/typescript-estree
node_modules/eslint-plugin-n/node_modules/@typescript-eslint/typescript-estree
@typescript-eslint/utils >=6.16.0
Depends on vulnerable versions of @typescript-eslint/typescript-estree
node_modules/@typescript-eslint/utils
node_modules/eslint-plugin-n/node_modules/@typescript-eslint/utils
eslint-plugin-n >=17.0.0-0
Depends on vulnerable versions of @typescript-eslint/utils
Depends on vulnerable versions of minimatch
node_modules/eslint-plugin-n
eslint-config-wikimedia >=0.28.0
Depends on vulnerable versions of eslint-plugin-n
node_modules/eslint-config-wikimedia
request *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
fix available via `npm audit fix --force`
Will install grunt-css-url-embed@1.0.4, which is a breaking change
node_modules/request
grunt-css-url-embed >=1.1.0
Depends on vulnerable versions of request
node_modules/grunt-css-url-embed
tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install grunt-css-url-embed@1.0.4, which is a breaking change
node_modules/tough-cookie
9 vulnerabilities (6 low, 3 moderate)
To address all issues (including breaking changes), run:
npm audit fix --force
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated kad-fs@0.0.4: This package is no longer maintained.
npm WARN deprecated kad-memstore@0.0.1: This package is no longer maintained.
--- stdout ---
> visualeditor@0.0.0 postinstall
> cd rebaser && npm ci
added 191 packages, and audited 192 packages in 7s
10 packages are looking for funding
run `npm fund` for details
24 vulnerabilities (6 low, 7 moderate, 11 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
> visualeditor@0.0.0 prepare
> grunt build
Running "clean:dist" (clean) task
>> 0 paths cleaned.
Running "concat:rebaser.build" (concat) task
Running "concat:visualEditor.rebase.scripts" (concat) task
Running "concat:visualEditor.rebase.styles" (concat) task
Running "concat:js" (concat) task
Running "concat:css-apex" (concat) task
Running "concat:css-wikimediaui" (concat) task
Running "concat:jquery.i18n" (concat) task
Running "concat:jquery.uls.data" (concat) task
Running "less:dist" (less) task
>> 3 stylesheets created.
Running "clean:less" (clean) task
>> 3 paths cleaned.
Running "cssjanus:apex" (cssjanus) task
File "dist/visualEditor-apex.rtl.css" created.
Running "cssjanus:wikimediaui" (cssjanus) task
File "dist/visualEditor-wikimediaui.rtl.css" created.
Running "cssUrlEmbed:dist" (cssUrlEmbed) task
Processing source file "dist/visualEditor-apex.css"
5 embeddable URLs found
Processing source file "dist/visualEditor-apex.rtl.css"
5 embeddable URLs found
Processing source file "dist/visualEditor-wikimediaui.css"
5 embeddable URLs found
Processing source file "dist/visualEditor-wikimediaui.rtl.css"
5 embeddable URLs found
>> "../src/ui/styles/images/resize-nw-se.svg" embedded
>> "../src/ui/styles/images/resize-nw-se.svg" embedded
>> "../src/ui/styles/images/resize-nw-se.svg" embedded
>> "../src/ui/styles/images/resize-nw-se.svg" embedded
>> "../src/ui/styles/images/resize-ne-sw.svg" embedded
>> "../src/ui/styles/images/resize-ne-sw.svg" embedded
>> "../src/ui/styles/images/resize-ne-sw.svg" embedded
>> "../src/ui/styles/images/resize-ne-sw.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr-invert.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr-invert.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr-invert.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr-invert.svg" embedded
>> "../src/ui/styles/images/speechBubbleNotice-ltr-progressive.svg" embedded
File "dist/visualEditor-apex.css" created
>> "../src/ui/styles/images/speechBubbleNotice-ltr-progressive.svg" embedded
File "dist/visualEditor-apex.rtl.css" created
>> "../src/ui/styles/images/speechBubbleNotice-ltr-progressive.svg" embedded
File "dist/visualEditor-wikimediaui.css" created
>> "../src/ui/styles/images/speechBubbleNotice-ltr-progressive.svg" embedded
File "dist/visualEditor-wikimediaui.rtl.css" created
Running "copy:i18n" (copy) task
Copied 232 files
Running "copy:lib" (copy) task
Created 30 directories, copied 1509 files
Running "buildloader:desktopDemoApex" (buildloader) task
>> File "demos/ve/desktop-apex.html" written.
Running "buildloader:desktopDemoApexDist" (buildloader) task
>> File "demos/ve/desktop-apex-dist.html" written.
Running "buildloader:desktopDemoWikimediaUI" (buildloader) task
>> File "demos/ve/desktop.html" written.
Running "buildloader:desktopDemoWikimediaUIDist" (buildloader) task
>> File "demos/ve/desktop-dist.html" written.
Running "buildloader:mobileDemo" (buildloader) task
>> File "demos/ve/mobile.html" written.
Running "buildloader:mobileDemoDist" (buildloader) task
>> File "demos/ve/mobile-dist.html" written.
Running "buildloader:minimalDemo" (buildloader) task
>> File "demos/ve/minimal.html" written.
Running "buildloader:minimalDemoRtl" (buildloader) task
>> File "demos/ve/minimal-rtl.html" written.
Running "buildloader:performanceTest" (buildloader) task
>> File "demos/ve/performance.html" written.
Running "buildloader:test" (buildloader) task
>> File "tests/index.html" written.
Done.
added 725 packages, and audited 726 packages in 33s
125 packages are looking for funding
run `npm fund` for details
9 vulnerabilities (6 low, 3 moderate)
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stdout ---
> visualeditor@0.0.0 test
> grunt test
Running "tyops:src" (tyops) task
>> No typos found; 644 files checked for 21 typos.
Running "eslint:all" (eslint) task
/src/repo/src/dm/ve.dm.Change.js
411:26 error ES2025 'Set.prototype.difference' method is forbidden es-x/no-set-prototype-difference
413:13 error ES2025 'Set.prototype.difference' method is forbidden es-x/no-set-prototype-difference
/src/repo/src/dm/ve.dm.HashValueStore.js
274:1 error ES2025 'Set.prototype.difference' method is forbidden es-x/no-set-prototype-difference
✖ 3 problems (3 errors, 0 warnings)
Warning: Task "eslint:all" failed. Use --force to continue.
Aborted due to warnings.
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 2026, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1968, in run
self.npm_audit_fix(new_npm_audit)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 275, in npm_audit_fix
self.npm_test()
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 325, in npm_test
self.check_call(["npm", "test"])
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 63, in check_call
res.check_returncode()
File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 3.