This run took 110 seconds.
From 8240d52f411dd8a8bf928d8f80487a40e98d2e57 Mon Sep 17 00:00:00 2001 From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org> Date: Thu, 12 Jun 2025 06:08:22 +0000 Subject: [PATCH] build: Updating brace-expansion to 1.1.12, 2.0.2 * https://github.com/advisories/GHSA-v6h2-p8h4-qcjw Change-Id: If2bdb497854542ae8e3701fd2553c9708788c53b --- package-lock.json | 53 +++++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 29 deletions(-) diff --git a/package-lock.json b/package-lock.json index 09df54d..7a80ddf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3428,11 +3428,10 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3575,11 +3574,10 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3762,11 +3760,10 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3844,11 +3841,10 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -4836,9 +4832,9 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", + "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", "dev": true, "dependencies": { "balanced-match": "^1.0.0", @@ -6265,9 +6261,9 @@ } }, "node_modules/editorconfig/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, "dependencies": { "balanced-match": "^1.0.0" @@ -7009,11 +7005,10 @@ } }, "node_modules/eslint-plugin-n/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -10953,9 +10948,9 @@ } }, "node_modules/js-beautify/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, "dependencies": { "balanced-match": "^1.0.0" -- 2.39.5
$ date --- stdout --- Thu Jun 12 06:06:49 UTC 2025 --- end --- $ git clone file:///srv/git/mediawiki-extensions-CommunityConfiguration.git repo --depth=1 -b REL1_43 --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/REL1_43 --- stdout --- c1e36c13ea8eed18d71929f258727753fdb48a9e refs/heads/REL1_43 --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "brace-expansion": { "name": "brace-expansion", "severity": "low", "isDirect": false, "via": [ { "source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <=1.1.11" }, { "source": 1105444, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <=2.0.1" } ], "effects": [], "range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1", "nodes": [ "node_modules/@typescript-eslint/eslint-plugin/node_modules/brace-expansion", "node_modules/@typescript-eslint/parser/node_modules/brace-expansion", "node_modules/@typescript-eslint/type-utils/node_modules/brace-expansion", "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion", "node_modules/brace-expansion", "node_modules/editorconfig/node_modules/brace-expansion", "node_modules/eslint-plugin-n/node_modules/brace-expansion", "node_modules/js-beautify/node_modules/brace-expansion" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0, "total": 1 }, "dependencies": { "prod": 1, "dev": 1173, "optional": 5, "peer": 3, "peerOptional": 0, "total": 1173 } } } --- end --- $ /usr/bin/composer install --- stderr --- No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information. Loading composer repositories with package information Updating dependencies Lock file operations: 39 installs, 0 updates, 0 removals - Locking composer/pcre (3.3.2) - Locking composer/semver (3.4.3) - Locking composer/spdx-licenses (1.5.9) - Locking composer/xdebug-handler (3.0.5) - Locking dealerdirect/phpcodesniffer-composer-installer (v1.0.0) - Locking doctrine/deprecations (1.1.5) - Locking felixfbecker/advanced-json-rpc (v3.2.1) - Locking justinrainbow/json-schema (5.3.0) - Locking mediawiki/mediawiki-codesniffer (v45.0.0) - Locking mediawiki/mediawiki-phan-config (0.14.0) - Locking mediawiki/minus-x (1.1.3) - Locking mediawiki/phan-taint-check-plugin (6.0.0) - Locking microsoft/tolerant-php-parser (v0.1.2) - Locking netresearch/jsonmapper (v4.5.0) - Locking phan/phan (5.4.3) - Locking php-parallel-lint/php-console-color (v1.0.1) - Locking php-parallel-lint/php-console-highlighter (v1.0.0) - Locking php-parallel-lint/php-parallel-lint (v1.4.0) - Locking phpcsstandards/phpcsextra (1.2.1) - Locking phpcsstandards/phpcsutils (1.0.12) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.6.2) - Locking phpdocumentor/type-resolver (1.10.0) - Locking phpstan/phpdoc-parser (2.1.0) - Locking psr/container (2.0.2) - Locking psr/log (3.0.2) - Locking sabre/event (5.1.7) - Locking squizlabs/php_codesniffer (3.10.3) - Locking symfony/console (v7.3.0) - Locking symfony/deprecation-contracts (v3.6.0) - Locking symfony/polyfill-ctype (v1.32.0) - Locking symfony/polyfill-intl-grapheme (v1.32.0) - Locking symfony/polyfill-intl-normalizer (v1.32.0) - Locking symfony/polyfill-mbstring (v1.32.0) - Locking symfony/polyfill-php80 (v1.32.0) - Locking symfony/service-contracts (v3.6.0) - Locking symfony/string (v7.3.0) - Locking tysonandre/var_representation_polyfill (0.1.3) - Locking webmozart/assert (1.11.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 39 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] - Installing squizlabs/php_codesniffer (3.10.3): Extracting archive - Installing dealerdirect/phpcodesniffer-composer-installer (v1.0.0): Extracting archive - Installing composer/pcre (3.3.2): Extracting archive - Installing justinrainbow/json-schema (5.3.0): Extracting archive - Installing symfony/polyfill-php80 (v1.32.0): Extracting archive - Installing phpcsstandards/phpcsutils (1.0.12): Extracting archive - Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive - Installing symfony/polyfill-mbstring (v1.32.0): Extracting archive - Installing composer/spdx-licenses (1.5.9): Extracting archive - Installing composer/semver (3.4.3): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v45.0.0): Extracting archive - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.32.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.32.0): Extracting archive - Installing symfony/polyfill-ctype (v1.32.0): Extracting archive - Installing symfony/string (v7.3.0): Extracting archive - Installing symfony/deprecation-contracts (v3.6.0): Extracting archive - Installing psr/container (2.0.2): Extracting archive - Installing symfony/service-contracts (v3.6.0): Extracting archive - Installing symfony/console (v7.3.0): Extracting archive - Installing sabre/event (5.1.7): Extracting archive - Installing netresearch/jsonmapper (v4.5.0): Extracting archive - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive - Installing webmozart/assert (1.11.0): Extracting archive - Installing phpstan/phpdoc-parser (2.1.0): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing doctrine/deprecations (1.1.5): Extracting archive - Installing phpdocumentor/type-resolver (1.10.0): Extracting archive - Installing phpdocumentor/reflection-docblock (5.6.2): Extracting archive - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive - Installing psr/log (3.0.2): Extracting archive - Installing composer/xdebug-handler (3.0.5): Extracting archive - Installing phan/phan (5.4.3): Extracting archive - Installing mediawiki/phan-taint-check-plugin (6.0.0): Extracting archive - Installing mediawiki/mediawiki-phan-config (0.14.0): Extracting archive - Installing mediawiki/minus-x (1.1.3): Extracting archive - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive 0/37 [>---------------------------] 0% 20/37 [===============>------------] 54% 35/37 [==========================>-] 94% 37/37 [============================] 100% Generating autoload files 16 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "brace-expansion": { "name": "brace-expansion", "severity": "low", "isDirect": false, "via": [ { "source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <=1.1.11" }, { "source": 1105444, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <=2.0.1" } ], "effects": [], "range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1", "nodes": [ "node_modules/@typescript-eslint/eslint-plugin/node_modules/brace-expansion", "node_modules/@typescript-eslint/parser/node_modules/brace-expansion", "node_modules/@typescript-eslint/type-utils/node_modules/brace-expansion", "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion", "node_modules/brace-expansion", "node_modules/editorconfig/node_modules/brace-expansion", "node_modules/eslint-plugin-n/node_modules/brace-expansion", "node_modules/js-beautify/node_modules/brace-expansion" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0, "total": 1 }, "dependencies": { "prod": 1, "dev": 1173, "optional": 5, "peer": 3, "peerOptional": 0, "total": 1173 } } } --- end --- Attempting to npm audit fix $ /usr/bin/npm audit fix --dry-run --only=dev --json --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production --- stdout --- { "added": 1173, "removed": 0, "changed": 0, "audited": 1174, "funding": 196, "audit": { "auditReportVersion": 2, "vulnerabilities": { "brace-expansion": { "name": "brace-expansion", "severity": "low", "isDirect": false, "via": [ { "source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=1.0.0 <=1.1.11" }, { "source": 1105444, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <=2.0.1" } ], "effects": [], "range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1", "nodes": [ "", "", "", "", "", "", "", "" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0, "total": 1 }, "dependencies": { "prod": 1, "dev": 1173, "optional": 5, "peer": 3, "peerOptional": 0, "total": 1173 } } } } --- end --- {"added": 1173, "removed": 0, "changed": 0, "audited": 1174, "funding": 196, "audit": {"auditReportVersion": 2, "vulnerabilities": {"brace-expansion": {"name": "brace-expansion", "severity": "low", "isDirect": false, "via": [{"source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=1.0.0 <=1.1.11"}, {"source": 1105444, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <=2.0.1"}], "effects": [], "range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1", "nodes": ["", "", "", "", "", "", "", ""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0, "total": 1}, "dependencies": {"prod": 1, "dev": 1173, "optional": 5, "peer": 3, "peerOptional": 0, "total": 1173}}}} $ /usr/bin/npm audit fix --only=dev --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead npm WARN tarball tarball data for @wikimedia/codex-icons@https://registry.npmjs.org/@wikimedia/codex-icons/-/codex-icons-1.11.1.tgz (sha512-/CfVPeyYEc2/AsS0puajAqgloWRZgg74Mh+0XEpePU6NY98cuT0T12Ilyxui+w+RJ4UtOZ0SzKcvi0dVz5ZxjA==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @wikimedia/codex@https://registry.npmjs.org/@wikimedia/codex/-/codex-1.11.1.tgz (sha512-7qRn8xFJPp0fP2FEF5IJszLq1vFzAslATvsqHf4ZEUOzuv5DqepUQZ+1ZcEj3sdXxpjInkfLvF6S+uZHg1EOHA==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @typescript-eslint/typescript-estree@https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.6.0.tgz (sha512-MOVAzsKJIPIlLK239l5s06YXjNqpKTVhBVDnqUumQJja5+Y94V3+4VUFRA0G60y2jNnTVwRCkhyGQpavfsbq/g==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @typescript-eslint/utils@https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.6.0.tgz (sha512-eNp9cWnYf36NaOVjkEUznf6fEgVy1TWpE0o52e4wtojjBx7D1UV2WAWGzR+8Y5lVFtpMLPwNbC67T83DWSph4A==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @typescript-eslint/visitor-keys@https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.6.0.tgz (sha512-wapVFfZg9H0qOYh4grNVQiMklJGluQrOUiOhYRrQWhx7BY/+I1IYb8BczWNbbUpO+pqy0rDciv3lQH5E1bCLrg==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @typescript-eslint/types@https://registry.npmjs.org/@typescript-eslint/types/-/types-8.6.0.tgz (sha512-rojqFZGd4MQxw33SrOy09qIDS8WEldM8JWtKQLAjf/X5mGSeEFh5ixQlxssMNyPslVIk9yzWqXCsV2eFhYrYUw==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @typescript-eslint/scope-manager@https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.6.0.tgz (sha512-ZuoutoS5y9UOxKvpc/GkvF4cuEmpokda4wRg64JEia27wX+PysIE9q+lzDtlHHgblwUWwo5/Qn+/WyTUvDwBHw==) seems to be corrupted. Trying again. npm WARN tarball tarball data for @types/node@https://registry.npmjs.org/@types/node/-/node-22.5.5.tgz (sha512-Xjs4y5UPO/CLdzpgR6GirZJx36yScjh73+2NlLlkFRSoQN8B0DpfXPdZGnvVmLRLOsqDpOfTNv7D9trgGhmOIA==) seems to be corrupted. Trying again. npm WARN deprecated superagent@6.1.0: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net --- stdout --- added 1172 packages, and audited 1173 packages in 30s 196 packages are looking for funding run `npm fund` for details found 0 vulnerabilities --- end --- Verifying that tests still pass $ /usr/bin/npm ci --- stderr --- npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead npm WARN deprecated superagent@6.1.0: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net --- stdout --- added 1172 packages, and audited 1173 packages in 24s 196 packages are looking for funding run `npm fund` for details found 0 vulnerabilities --- end --- $ /usr/bin/npm test --- stderr --- PASS resources/ext.communityConfiguration.Editor/lib/json-form/core/__tests__/i18n.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/form/composables/useValidationErrors.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/core/__tests__/uischema.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/ArrayControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/StringControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/EnumControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/form/composables/useJsonForm.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/MultiselectEnumControl.test.js PASS resources/ext.communityConfiguration.Editor/app/App.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/PageTitleControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/NumberControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/BooleanControl.test.js PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/api.test.js PASS resources/ext.communityConfiguration.Editor/app/components/ClientErrorMessage.test.js Test Suites: 14 passed, 14 total Tests: 75 passed, 75 total Snapshots: 1 passed, 1 total Time: 7.926 s Ran all test suites. --- stdout --- > test > npm-run-all test:* > test:lint > eslint --cache --no-fix --max-warnings 0 . > test:lintcss > stylelint "**/*.{css,less,vue}" > test:linti18n > banana-checker i18n/ Checked 1 message directory. > test:jest > jest --------------------------------------------------|---------|----------|---------|---------|--------------------------------------- File | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s --------------------------------------------------|---------|----------|---------|---------|--------------------------------------- All files | 76.14 | 65.37 | 66.43 | 76.83 | app | 60.65 | 72.34 | 50 | 60.65 | App.vue | 86.04 | 82.92 | 73.33 | 86.04 | 69,77,95,133-134,164-175,249-253 MwApiCommunityConfigurationWritingRepository.js | 0 | 100 | 0 | 0 | 1-15 init.js | 0 | 0 | 0 | 0 | 1-66 app/components | 88.7 | 55 | 63.33 | 88.61 | ClientErrorMessage.vue | 100 | 66.66 | 100 | 100 | 49 EditSummaryDialog.vue | 68.96 | 50 | 27.27 | 67.85 | 41-45,75-100 EditorMessage.vue | 100 | 100 | 100 | 100 | GenericSubmitErrorMessage.vue | 100 | 50 | 100 | 100 | 49-54 MissingPermissionsNoticeMessage.vue | 100 | 100 | 100 | 100 | NetworkErrorMessage.vue | 100 | 100 | 100 | 100 | PermissionsErrorMessage.vue | 100 | 100 | 100 | 100 | SuccessMessage.vue | 100 | 100 | 100 | 100 | ValidationErrorMessage.vue | 64.28 | 0 | 0 | 64.28 | 32-40 lib/json-form/controls-codex/config | 100 | 100 | 100 | 100 | index.js | 100 | 100 | 100 | 100 | lib/json-form/controls-codex/src | 100 | 100 | 100 | 100 | index.js | 100 | 100 | 100 | 100 | utils.js | 100 | 100 | 100 | 100 | lib/json-form/controls-codex/src/complex | 91.56 | 80.76 | 82.69 | 92.35 | ArrayControl.vue | 100 | 70 | 100 | 100 | 74-122 ChipStringsControl.vue | 50 | 0 | 0 | 55 | 29-36,51-58 EnumControl.vue | 100 | 100 | 100 | 100 | MultiselectEnumControl.vue | 96.87 | 92.3 | 94.73 | 96.61 | 103,155 ObjectControl.vue | 95.65 | 75 | 87.5 | 95.65 | 86 index.js | 100 | 100 | 100 | 100 | lib/json-form/controls-codex/src/controls | 94.11 | 88.46 | 92.3 | 94.87 | BooleanControl.vue | 90.9 | 75 | 100 | 90.9 | 31-32 ControlWrapper.vue | 93.33 | 100 | 83.33 | 93.33 | 42 NumberControl.vue | 97.29 | 87.5 | 100 | 97.29 | 57 StringControl.vue | 94.44 | 91.66 | 100 | 94.44 | 42-43 index.js | 88.88 | 0 | 50 | 100 | 17 lib/json-form/controls-codex/src/mediawiki | 43.58 | 20.83 | 21.21 | 45 | CommonsFileControl.vue | 21.42 | 0 | 0 | 21.42 | 31-119,141-157 NamespacesControl.vue | 19.69 | 0 | 0 | 21.31 | 21-24,37-114,127-154 PageTitleControl.vue | 93.47 | 83.33 | 90 | 93.33 | 51,72,91 PageTitlesControl.vue | 21.21 | 0 | 0 | 23.33 | 24,41-125,138-164 api.js | 89.47 | 62.5 | 100 | 89.47 | 17,45 constants.js | 100 | 100 | 100 | 100 | index.js | 100 | 100 | 100 | 100 | lib/json-form/core | 86.13 | 70.58 | 80.64 | 86.86 | i18n.js | 98.18 | 95.45 | 100 | 98.14 | 104 index.js | 100 | 100 | 100 | 100 | testers.js | 50 | 6.25 | 40 | 52 | 14-18,31-50,70 uischema.js | 100 | 62.5 | 100 | 100 | 15,19 lib/json-form/form | 100 | 100 | 100 | 100 | index.js | 100 | 100 | 100 | 100 | lib/json-form/form/components | 90.74 | 70 | 69.23 | 90.56 | DispatchRenderer.vue | 95.65 | 83.33 | 83.33 | 95.45 | 44 FormLayout.vue | 90.9 | 100 | 50 | 90.9 | 24 JsonForm.vue | 85 | 50 | 60 | 85 | 47-48,80 lib/json-form/form/composables | 90.72 | 75.75 | 100 | 90.54 | props.js | 100 | 100 | 100 | 100 | useJsonForm.js | 86.04 | 69.23 | 100 | 86.04 | 31-34,56,76,91-92,101,135,182,200,262 useValidationErrors.js | 96.77 | 85.18 | 100 | 96.66 | 46,195 --------------------------------------------------|---------|----------|---------|---------|--------------------------------------- --- end --- {"1105443": {"source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=1.0.0 <=1.1.11"}, "1105444": {"source": 1105444, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <=2.0.1"}} Upgrading n:brace-expansion from 1.1.11, 2.0.1 -> 1.1.12, 2.0.2 $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- build: Updating brace-expansion to 1.1.12, 2.0.2 * https://github.com/advisories/GHSA-v6h2-p8h4-qcjw $ git add . --- stdout --- --- end --- $ git commit -F /tmp/tmph829ijuj --- stdout --- [REL1_43 8240d52] build: Updating brace-expansion to 1.1.12, 2.0.2 1 file changed, 24 insertions(+), 29 deletions(-) --- end --- $ git format-patch HEAD~1 --stdout --- stdout --- From 8240d52f411dd8a8bf928d8f80487a40e98d2e57 Mon Sep 17 00:00:00 2001 From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org> Date: Thu, 12 Jun 2025 06:08:22 +0000 Subject: [PATCH] build: Updating brace-expansion to 1.1.12, 2.0.2 * https://github.com/advisories/GHSA-v6h2-p8h4-qcjw Change-Id: If2bdb497854542ae8e3701fd2553c9708788c53b --- package-lock.json | 53 +++++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 29 deletions(-) diff --git a/package-lock.json b/package-lock.json index 09df54d..7a80ddf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3428,11 +3428,10 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3575,11 +3574,10 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3762,11 +3760,10 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -3844,11 +3841,10 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -4836,9 +4832,9 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", + "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", "dev": true, "dependencies": { "balanced-match": "^1.0.0", @@ -6265,9 +6261,9 @@ } }, "node_modules/editorconfig/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, "dependencies": { "balanced-match": "^1.0.0" @@ -7009,11 +7005,10 @@ } }, "node_modules/eslint-plugin-n/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, - "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" } @@ -10953,9 +10948,9 @@ } }, "node_modules/js-beautify/node_modules/brace-expansion": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz", - "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", "dev": true, "dependencies": { "balanced-match": "^1.0.0" -- 2.39.5 --- end ---