This run took 39 seconds.
$ date
--- stdout ---
Sun Oct 5 04:14:32 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-EntitySchema.git repo --depth=1 -b REL1_39
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/REL1_39
--- stdout ---
64fb7f1a1c499ed5f579df8c112dd5186c39e379 refs/heads/REL1_39
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"yarn-install"
],
"effects": [],
"range": "5.4.10 - 8.19.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "moderate",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "7.7.4 - 7.19.5",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/lint-staged/node_modules/braces"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"yarn-install"
],
"range": "<6.0.6",
"nodes": [
"node_modules/yarn-install/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"g-status": {
"name": "g-status",
"severity": "critical",
"isDirect": false,
"via": [
"simple-git"
],
"effects": [
"lint-staged"
],
"range": "*",
"nodes": [
"node_modules/g-status"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/inquirer"
],
"fixAvailable": true
},
"lint-staged": {
"name": "lint-staged",
"severity": "critical",
"isDirect": true,
"via": [
"g-status",
"micromatch",
"yup"
],
"effects": [],
"range": "7.0.0 - 8.2.1 || 13.3.0 - 15.2.4",
"nodes": [
"node_modules/lint-staged"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"lint-staged"
],
"range": "<=4.0.7",
"nodes": [
"node_modules/lint-staged/node_modules/micromatch"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"mocha": {
"name": "mocha",
"severity": "moderate",
"isDirect": false,
"via": [
"nanoid",
"serialize-javascript"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "8.2.0 - 10.5.2",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"mwbot": {
"name": "mwbot",
"severity": "high",
"isDirect": false,
"via": [
"request",
"semver"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [
"mocha"
],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"property-expr": {
"name": "property-expr",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089042,
"name": "property-expr",
"dependency": "property-expr",
"title": "Prototype Pollution in property-expr",
"url": "https://github.com/advisories/GHSA-6fw4-hr69-g3rv",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.0.3"
}
],
"effects": [
"yup"
],
"range": "<2.0.3",
"nodes": [
"node_modules/property-expr"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
}
],
"effects": [
"mwbot"
],
"range": "7.0.0 - 7.5.1",
"nodes": [
"node_modules/mwbot/node_modules/semver"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1105261,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Cross-site Scripting (XSS) in serialize-javascript",
"url": "https://github.com/advisories/GHSA-76p7-773f-r4q5",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
},
"range": ">=6.0.0 <6.0.2"
}
],
"effects": [
"mocha"
],
"range": "6.0.0 - 6.0.1",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"simple-git": {
"name": "simple-git",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1088761,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-3f95-r44v-8mrg",
"severity": "high",
"cwe": [
"CWE-74",
"CWE-77"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.3.0"
},
{
"source": 1093008,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-28xr-mwxg-3qc8",
"severity": "high",
"cwe": [
"CWE-88"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.5.0"
},
{
"source": 1093018,
"name": "simple-git",
"dependency": "simple-git",
"title": "simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol",
"url": "https://github.com/advisories/GHSA-9p95-fxvg-qgq2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.15.0"
},
{
"source": 1103707,
"name": "simple-git",
"dependency": "simple-git",
"title": "Remote code execution in simple-git",
"url": "https://github.com/advisories/GHSA-9w5j-4mwv-2wj8",
"severity": "critical",
"cwe": [
"CWE-78",
"CWE-94"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.16.0"
}
],
"effects": [
"g-status"
],
"range": "<=3.15.1",
"nodes": [
"node_modules/simple-git"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/tmp"
],
"fixAvailable": true
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "high",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "1.1.0 - 2.2.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"yarn-install": {
"name": "yarn-install",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"@wdio/cli"
],
"range": "*",
"nodes": [
"node_modules/yarn-install"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"yup": {
"name": "yup",
"severity": "critical",
"isDirect": false,
"via": [
"property-expr"
],
"effects": [
"lint-staged"
],
"range": "<=0.28.1",
"nodes": [
"node_modules/yup"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 4,
"moderate": 5,
"high": 10,
"critical": 7,
"total": 26
},
"dependencies": {
"prod": 1,
"dev": 1050,
"optional": 2,
"peer": 13,
"peerOptional": 0,
"total": 1050
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 37 installs, 0 updates, 0 removals
- Locking composer/pcre (1.0.1)
- Locking composer/semver (3.3.2)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (2.0.5)
- Locking diff/diff (3.4.0)
- Locking doctrine/deprecations (1.1.5)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mediawiki/mediawiki-codesniffer (v39.0.0)
- Locking mediawiki/mediawiki-phan-config (0.11.1)
- Locking mediawiki/minus-x (1.1.1)
- Locking mediawiki/phan-taint-check-plugin (3.3.2)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking phan/phan (5.2.0)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.3.2)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.6.3)
- Locking phpdocumentor/type-resolver (1.10.0)
- Locking phpstan/phpdoc-parser (2.3.0)
- Locking psr/container (2.0.2)
- Locking psr/log (2.0.0)
- Locking sabre/event (5.1.7)
- Locking squizlabs/php_codesniffer (3.6.2)
- Locking symfony/console (v5.4.47)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/polyfill-php73 (v1.33.0)
- Locking symfony/polyfill-php80 (v1.33.0)
- Locking symfony/service-contracts (v3.6.0)
- Locking symfony/string (v6.4.26)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 37 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Installing composer/pcre (1.0.1): Extracting archive
- Installing diff/diff (3.4.0): Extracting archive
- Installing squizlabs/php_codesniffer (3.6.2): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.3.2): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v39.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v6.4.26): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.0): Extracting archive
- Installing symfony/polyfill-php73 (v1.33.0): Extracting archive
- Installing symfony/console (v5.4.47): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing webmozart/assert (1.11.0): Extracting archive
- Installing phpstan/phpdoc-parser (2.3.0): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.5): Extracting archive
- Installing phpdocumentor/type-resolver (1.10.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.6.3): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (2.0.0): Extracting archive
- Installing composer/xdebug-handler (2.0.5): Extracting archive
- Installing phan/phan (5.2.0): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (3.3.2): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.11.1): Extracting archive
- Installing mediawiki/minus-x (1.1.1): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive
0/37 [>---------------------------] 0%
26/37 [===================>--------] 70%
36/37 [===========================>] 97%
37/37 [============================] 100%
3 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
15 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"yarn-install"
],
"effects": [],
"range": "5.4.10 - 8.19.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "moderate",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "7.7.4 - 7.19.5",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/lint-staged/node_modules/braces"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"yarn-install"
],
"range": "<6.0.6",
"nodes": [
"node_modules/yarn-install/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"g-status": {
"name": "g-status",
"severity": "critical",
"isDirect": false,
"via": [
"simple-git"
],
"effects": [
"lint-staged"
],
"range": "*",
"nodes": [
"node_modules/g-status"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/inquirer"
],
"fixAvailable": true
},
"lint-staged": {
"name": "lint-staged",
"severity": "critical",
"isDirect": true,
"via": [
"g-status",
"micromatch",
"yup"
],
"effects": [],
"range": "7.0.0 - 8.2.1 || 13.3.0 - 15.2.4",
"nodes": [
"node_modules/lint-staged"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"lint-staged"
],
"range": "<=4.0.7",
"nodes": [
"node_modules/lint-staged/node_modules/micromatch"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": true
},
"mocha": {
"name": "mocha",
"severity": "moderate",
"isDirect": false,
"via": [
"nanoid",
"serialize-javascript"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "8.2.0 - 10.5.2",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"mwbot": {
"name": "mwbot",
"severity": "high",
"isDirect": false,
"via": [
"request",
"semver"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [
"mocha"
],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"property-expr": {
"name": "property-expr",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089042,
"name": "property-expr",
"dependency": "property-expr",
"title": "Prototype Pollution in property-expr",
"url": "https://github.com/advisories/GHSA-6fw4-hr69-g3rv",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.0.3"
}
],
"effects": [
"yup"
],
"range": "<2.0.3",
"nodes": [
"node_modules/property-expr"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
}
],
"effects": [
"mwbot"
],
"range": "7.0.0 - 7.5.1",
"nodes": [
"node_modules/mwbot/node_modules/semver"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1105261,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Cross-site Scripting (XSS) in serialize-javascript",
"url": "https://github.com/advisories/GHSA-76p7-773f-r4q5",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
},
"range": ">=6.0.0 <6.0.2"
}
],
"effects": [
"mocha"
],
"range": "6.0.0 - 6.0.1",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"simple-git": {
"name": "simple-git",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1088761,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-3f95-r44v-8mrg",
"severity": "high",
"cwe": [
"CWE-74",
"CWE-77"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.3.0"
},
{
"source": 1093008,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-28xr-mwxg-3qc8",
"severity": "high",
"cwe": [
"CWE-88"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.5.0"
},
{
"source": 1093018,
"name": "simple-git",
"dependency": "simple-git",
"title": "simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol",
"url": "https://github.com/advisories/GHSA-9p95-fxvg-qgq2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.15.0"
},
{
"source": 1103707,
"name": "simple-git",
"dependency": "simple-git",
"title": "Remote code execution in simple-git",
"url": "https://github.com/advisories/GHSA-9w5j-4mwv-2wj8",
"severity": "critical",
"cwe": [
"CWE-78",
"CWE-94"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.16.0"
}
],
"effects": [
"g-status"
],
"range": "<=3.15.1",
"nodes": [
"node_modules/simple-git"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/tmp"
],
"fixAvailable": true
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "high",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "1.1.0 - 2.2.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"yarn-install": {
"name": "yarn-install",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"@wdio/cli"
],
"range": "*",
"nodes": [
"node_modules/yarn-install"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"yup": {
"name": "yup",
"severity": "critical",
"isDirect": false,
"via": [
"property-expr"
],
"effects": [
"lint-staged"
],
"range": "<=0.28.1",
"nodes": [
"node_modules/yup"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 4,
"moderate": 5,
"high": 10,
"critical": 7,
"total": 26
},
"dependencies": {
"prod": 1,
"dev": 1050,
"optional": 2,
"peer": 13,
"peerOptional": 0,
"total": 1050
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.18.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.7.1',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
"added": 1052,
"removed": 0,
"changed": 0,
"audited": 1053,
"funding": 31,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"yarn-install"
],
"effects": [],
"range": "5.4.10 - 8.19.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "moderate",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "7.7.4 - 7.19.5",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11",
"nodes": [
""
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/lint-staged/node_modules/braces"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"yarn-install"
],
"range": "<6.0.6",
"nodes": [
"node_modules/yarn-install/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
""
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"g-status": {
"name": "g-status",
"severity": "critical",
"isDirect": false,
"via": [
"simple-git"
],
"effects": [
"lint-staged"
],
"range": "*",
"nodes": [
"node_modules/g-status"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
""
],
"fixAvailable": true
},
"lint-staged": {
"name": "lint-staged",
"severity": "critical",
"isDirect": true,
"via": [
"g-status",
"micromatch",
"yup"
],
"effects": [],
"range": "7.0.0 - 8.2.1 || 13.3.0 - 15.2.4",
"nodes": [
"node_modules/lint-staged"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
},
"braces"
],
"effects": [
"lint-staged"
],
"range": "<=4.0.7",
"nodes": [
"node_modules/lint-staged/node_modules/micromatch"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096485,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [],
"range": "<3.0.5",
"nodes": [
""
],
"fixAvailable": true
},
"mocha": {
"name": "mocha",
"severity": "moderate",
"isDirect": false,
"via": [
"nanoid",
"serialize-javascript"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "8.2.0 - 10.5.2",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"mwbot": {
"name": "mwbot",
"severity": "high",
"isDirect": false,
"via": [
"request",
"semver"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [
"mocha"
],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"property-expr": {
"name": "property-expr",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089042,
"name": "property-expr",
"dependency": "property-expr",
"title": "Prototype Pollution in property-expr",
"url": "https://github.com/advisories/GHSA-6fw4-hr69-g3rv",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.0.3"
}
],
"effects": [
"yup"
],
"range": "<2.0.3",
"nodes": [
"node_modules/property-expr"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"semver": {
"name": "semver",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101088,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.5.2"
}
],
"effects": [
"mwbot"
],
"range": "7.0.0 - 7.5.1",
"nodes": [
"node_modules/mwbot/node_modules/semver"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1105261,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Cross-site Scripting (XSS) in serialize-javascript",
"url": "https://github.com/advisories/GHSA-76p7-773f-r4q5",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
},
"range": ">=6.0.0 <6.0.2"
}
],
"effects": [
"mocha"
],
"range": "6.0.0 - 6.0.1",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "7.40.0",
"isSemVerMajor": false
}
},
"simple-git": {
"name": "simple-git",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1088761,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-3f95-r44v-8mrg",
"severity": "high",
"cwe": [
"CWE-74",
"CWE-77"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.3.0"
},
{
"source": 1093008,
"name": "simple-git",
"dependency": "simple-git",
"title": "Command injection in simple-git",
"url": "https://github.com/advisories/GHSA-28xr-mwxg-3qc8",
"severity": "high",
"cwe": [
"CWE-88"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.5.0"
},
{
"source": 1093018,
"name": "simple-git",
"dependency": "simple-git",
"title": "simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol",
"url": "https://github.com/advisories/GHSA-9p95-fxvg-qgq2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.15.0"
},
{
"source": 1103707,
"name": "simple-git",
"dependency": "simple-git",
"title": "Remote code execution in simple-git",
"url": "https://github.com/advisories/GHSA-9w5j-4mwv-2wj8",
"severity": "critical",
"cwe": [
"CWE-78",
"CWE-94"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.16.0"
}
],
"effects": [
"g-status"
],
"range": "<=3.15.1",
"nodes": [
"node_modules/simple-git"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1108293,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3",
"nodes": [
""
],
"fixAvailable": true
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106849,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
""
],
"fixAvailable": true
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "high",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "1.1.0 - 2.2.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "5.1.0",
"isSemVerMajor": true
}
},
"yarn-install": {
"name": "yarn-install",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"@wdio/cli"
],
"range": "*",
"nodes": [
"node_modules/yarn-install"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.0",
"isSemVerMajor": true
}
},
"yup": {
"name": "yup",
"severity": "critical",
"isDirect": false,
"via": [
"property-expr"
],
"effects": [
"lint-staged"
],
"range": "<=0.28.1",
"nodes": [
"node_modules/yup"
],
"fixAvailable": {
"name": "lint-staged",
"version": "16.2.3",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 4,
"moderate": 5,
"high": 10,
"critical": 7,
"total": 26
},
"dependencies": {
"prod": 1,
"dev": 1052,
"optional": 2,
"peer": 13,
"peerOptional": 0,
"total": 1052
}
}
}
}
--- end ---
{"added": 1052, "removed": 0, "changed": 0, "audited": 1053, "funding": 31, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@wdio/cli": {"name": "@wdio/cli", "severity": "high", "isDirect": true, "via": ["yarn-install"], "effects": [], "range": "5.4.10 - 8.19.0", "nodes": ["node_modules/@wdio/cli"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "@wdio/mocha-framework": {"name": "@wdio/mocha-framework", "severity": "moderate", "isDirect": true, "via": ["mocha"], "effects": [], "range": "7.7.4 - 7.19.5", "nodes": ["node_modules/@wdio/mocha-framework"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.40.0", "isSemVerMajor": false}}, "brace-expansion": {"name": "brace-expansion", "severity": "low", "isDirect": false, "via": [{"source": 1105443, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw", "severity": "low", "cwe": ["CWE-400"], "cvss": {"score": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=1.0.0 <=1.1.11"}], "effects": [], "range": "1.0.0 - 1.1.11", "nodes": [""], "fixAvailable": true}, "braces": {"name": "braces", "severity": "high", "isDirect": false, "via": [{"source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": ["CWE-400", "CWE-1050"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.3"}], "effects": ["micromatch"], "range": "<3.0.3", "nodes": ["node_modules/lint-staged/node_modules/braces"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}], "effects": ["yarn-install"], "range": "<6.0.6", "nodes": ["node_modules/yarn-install/node_modules/cross-spawn"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "external-editor": {"name": "external-editor", "severity": "low", "isDirect": false, "via": ["tmp"], "effects": ["inquirer"], "range": ">=1.1.1", "nodes": [""], "fixAvailable": true}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1106509, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "g-status": {"name": "g-status", "severity": "critical", "isDirect": false, "via": ["simple-git"], "effects": ["lint-staged"], "range": "*", "nodes": ["node_modules/g-status"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "inquirer": {"name": "inquirer", "severity": "low", "isDirect": false, "via": ["external-editor"], "effects": [], "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7", "nodes": [""], "fixAvailable": true}, "lint-staged": {"name": "lint-staged", "severity": "critical", "isDirect": true, "via": ["g-status", "micromatch", "yup"], "effects": [], "range": "7.0.0 - 8.2.1 || 13.3.0 - 15.2.4", "nodes": ["node_modules/lint-staged"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "micromatch": {"name": "micromatch", "severity": "high", "isDirect": false, "via": [{"source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<4.0.8"}, "braces"], "effects": ["lint-staged"], "range": "<=4.0.7", "nodes": ["node_modules/lint-staged/node_modules/micromatch"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.5"}], "effects": [], "range": "<3.0.5", "nodes": [""], "fixAvailable": true}, "mocha": {"name": "mocha", "severity": "moderate", "isDirect": false, "via": ["nanoid", "serialize-javascript"], "effects": ["@wdio/mocha-framework"], "range": "8.2.0 - 10.5.2", "nodes": ["node_modules/mocha"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.40.0", "isSemVerMajor": false}}, "mwbot": {"name": "mwbot", "severity": "high", "isDirect": false, "via": ["request", "semver"], "effects": ["wdio-mediawiki"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "nanoid": {"name": "nanoid", "severity": "moderate", "isDirect": false, "via": [{"source": 1101163, "name": "nanoid", "dependency": "nanoid", "title": "Predictable results in nanoid generation when given non-integer values", "url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55", "severity": "moderate", "cwe": ["CWE-835"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<3.3.8"}], "effects": ["mocha"], "range": "<3.3.8", "nodes": ["node_modules/nanoid"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.40.0", "isSemVerMajor": false}}, "property-expr": {"name": "property-expr", "severity": "critical", "isDirect": false, "via": [{"source": 1089042, "name": "property-expr", "dependency": "property-expr", "title": "Prototype Pollution in property-expr", "url": "https://github.com/advisories/GHSA-6fw4-hr69-g3rv", "severity": "critical", "cwe": ["CWE-915", "CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<2.0.3"}], "effects": ["yup"], "range": "<2.0.3", "nodes": ["node_modules/property-expr"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "semver": {"name": "semver", "severity": "high", "isDirect": false, "via": [{"source": 1101088, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <7.5.2"}], "effects": ["mwbot"], "range": "7.0.0 - 7.5.1", "nodes": ["node_modules/mwbot/node_modules/semver"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "serialize-javascript": {"name": "serialize-javascript", "severity": "moderate", "isDirect": false, "via": [{"source": 1105261, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Cross-site Scripting (XSS) in serialize-javascript", "url": "https://github.com/advisories/GHSA-76p7-773f-r4q5", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}, "range": ">=6.0.0 <6.0.2"}], "effects": ["mocha"], "range": "6.0.0 - 6.0.1", "nodes": ["node_modules/serialize-javascript"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.40.0", "isSemVerMajor": false}}, "simple-git": {"name": "simple-git", "severity": "critical", "isDirect": false, "via": [{"source": 1088761, "name": "simple-git", "dependency": "simple-git", "title": "Command injection in simple-git", "url": "https://github.com/advisories/GHSA-3f95-r44v-8mrg", "severity": "high", "cwe": ["CWE-74", "CWE-77"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<3.3.0"}, {"source": 1093008, "name": "simple-git", "dependency": "simple-git", "title": "Command injection in simple-git", "url": "https://github.com/advisories/GHSA-28xr-mwxg-3qc8", "severity": "high", "cwe": ["CWE-88"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<3.5.0"}, {"source": 1093018, "name": "simple-git", "dependency": "simple-git", "title": "simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol", "url": "https://github.com/advisories/GHSA-9p95-fxvg-qgq2", "severity": "high", "cwe": ["CWE-78"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<3.15.0"}, {"source": 1103707, "name": "simple-git", "dependency": "simple-git", "title": "Remote code execution in simple-git", "url": "https://github.com/advisories/GHSA-9w5j-4mwv-2wj8", "severity": "critical", "cwe": ["CWE-78", "CWE-94"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<3.16.0"}], "effects": ["g-status"], "range": "<=3.15.1", "nodes": ["node_modules/simple-git"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}, "tar-fs": {"name": "tar-fs", "severity": "high", "isDirect": false, "via": [{"source": 1108293, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.4"}], "effects": [], "range": "2.0.0 - 2.1.3", "nodes": [""], "fixAvailable": true}, "tmp": {"name": "tmp", "severity": "low", "isDirect": false, "via": [{"source": 1106849, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}], "effects": ["external-editor"], "range": "<=0.2.3", "nodes": [""], "fixAvailable": true}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "high", "isDirect": true, "via": ["mwbot"], "effects": [], "range": "1.1.0 - 2.2.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "5.1.0", "isSemVerMajor": true}}, "yarn-install": {"name": "yarn-install", "severity": "high", "isDirect": false, "via": ["cross-spawn"], "effects": ["@wdio/cli"], "range": "*", "nodes": ["node_modules/yarn-install"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "yup": {"name": "yup", "severity": "critical", "isDirect": false, "via": ["property-expr"], "effects": ["lint-staged"], "range": "<=0.28.1", "nodes": ["node_modules/yup"], "fixAvailable": {"name": "lint-staged", "version": "16.2.3", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 4, "moderate": 5, "high": 10, "critical": 7, "total": 26}, "dependencies": {"prod": 1, "dev": 1052, "optional": 2, "peer": 13, "peerOptional": 0, "total": 1052}}}}
{}
Upgrading n:@wdio/mocha-framework from 7.13.2 -> 7.40.0
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.18.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.7.1',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm ERR! code 1
npm ERR! path /src/repo/node_modules/fibers
npm ERR! command failed
npm ERR! command sh -c node build.js || nodejs build.js
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using node-gyp@11.1.0
npm ERR! gyp info using node@20.19.2 | linux | x64
npm ERR! gyp info find Python using Python version 3.13.5 found at "/usr/bin/python3"
npm ERR! gyp info spawn /usr/bin/python3
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/src/repo/node_modules/fibers/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/include/nodejs/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/usr/include/nodejs',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/share/nodejs/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/usr/include/nodejs/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/src/repo/node_modules/fibers',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp ERR! build error
npm ERR! gyp ERR! stack Error: not found: make
npm ERR! gyp ERR! stack at getNotFoundError (/usr/share/nodejs/which/which.js:10:17)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:57:18
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at step (/usr/share/nodejs/which/which.js:54:21)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:71:22
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at subStep (/usr/share/nodejs/which/which.js:69:33)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:80:22
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/index.js:42:5
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/mode.js:8:5
npm ERR! gyp ERR! System Linux 6.1.0-30-cloud-amd64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/share/nodejs/node-gyp/bin/node-gyp.js" "rebuild" "--release"
npm ERR! gyp ERR! cwd /src/repo/node_modules/fibers
npm ERR! gyp ERR! node -v v20.19.2
npm ERR! gyp ERR! node-gyp -v v11.1.0
npm ERR! gyp ERR! not ok
npm ERR! node-gyp exited with code: 1
npm ERR! Please make sure you are using a supported platform and node version. If you
npm ERR! would like to compile fibers on this machine please make sure you have setup your
npm ERR! build environment--
npm ERR! Windows + OS X instructions here: https://github.com/nodejs/node-gyp
npm ERR! Ubuntu users please run: `sudo apt-get install g++ build-essential`
npm ERR! RHEL users please run: `yum install gcc-c++` and `yum groupinstall 'Development Tools'`
npm ERR! Alpine users please run: `sudo apk add python make g++`
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using node-gyp@11.1.0
npm ERR! gyp info using node@20.19.2 | linux | x64
npm ERR! gyp info find Python using Python version 3.13.5 found at "/usr/bin/python3"
npm ERR! gyp info spawn /usr/bin/python3
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/src/repo/node_modules/fibers/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/include/nodejs/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/usr/include/nodejs',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/share/nodejs/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/usr/include/nodejs/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/src/repo/node_modules/fibers',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp ERR! build error
npm ERR! gyp ERR! stack Error: not found: make
npm ERR! gyp ERR! stack at getNotFoundError (/usr/share/nodejs/which/which.js:10:17)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:57:18
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at step (/usr/share/nodejs/which/which.js:54:21)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:71:22
npm ERR! gyp ERR! stack at new Promise (<anonymous>)
npm ERR! gyp ERR! stack at subStep (/usr/share/nodejs/which/which.js:69:33)
npm ERR! gyp ERR! stack at /usr/share/nodejs/which/which.js:80:22
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/index.js:42:5
npm ERR! gyp ERR! stack at /usr/share/nodejs/isexe/mode.js:8:5
npm ERR! gyp ERR! System Linux 6.1.0-30-cloud-amd64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/share/nodejs/node-gyp/bin/node-gyp.js" "rebuild" "--release"
npm ERR! gyp ERR! cwd /src/repo/node_modules/fibers
npm ERR! gyp ERR! node -v v20.19.2
npm ERR! gyp ERR! node-gyp -v v11.1.0
npm ERR! gyp ERR! not ok
npm ERR! node-gyp exited with code: 1
npm ERR! Please make sure you are using a supported platform and node version. If you
npm ERR! would like to compile fibers on this machine please make sure you have setup your
npm ERR! build environment--
npm ERR! Windows + OS X instructions here: https://github.com/nodejs/node-gyp
npm ERR! Ubuntu users please run: `sudo apt-get install g++ build-essential`
npm ERR! RHEL users please run: `yum install gcc-c++` and `yum groupinstall 'Development Tools'`
npm ERR! Alpine users please run: `sudo apk add python make g++`
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2025-10-05T04_14_43_794Z-debug-0.log
--- stdout ---
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.18.0',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@37.7.1',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm ERR! code EUSAGE
npm ERR!
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Invalid: lock file's @wdio/mocha-framework@7.13.2 does not satisfy @wdio/mocha-framework@7.40.0
npm ERR! Invalid: lock file's @types/mocha@9.0.0 does not satisfy @types/mocha@10.0.10
npm ERR! Invalid: lock file's @wdio/logger@7.7.0 does not satisfy @wdio/logger@7.26.0
npm ERR! Invalid: lock file's @wdio/types@7.13.2 does not satisfy @wdio/types@7.40.0
npm ERR! Invalid: lock file's @wdio/utils@7.13.2 does not satisfy @wdio/utils@7.40.0
npm ERR! Invalid: lock file's mocha@9.2.2 does not satisfy mocha@10.8.2
npm ERR! Invalid: lock file's ansi-colors@4.1.1 does not satisfy ansi-colors@4.1.3
npm ERR! Invalid: lock file's debug@4.3.3 does not satisfy debug@4.4.3
npm ERR! Invalid: lock file's diff@5.0.0 does not satisfy diff@5.2.0
npm ERR! Missing: glob@8.1.0 from lock file
npm ERR! Invalid: lock file's minimatch@4.2.1 does not satisfy minimatch@5.1.6
npm ERR! Invalid: lock file's ms@2.1.2 does not satisfy ms@2.1.3
npm ERR! Invalid: lock file's serialize-javascript@6.0.0 does not satisfy serialize-javascript@6.0.2
npm ERR! Invalid: lock file's workerpool@6.2.0 does not satisfy workerpool@6.5.1
npm ERR! Invalid: lock file's yargs-parser@20.2.4 does not satisfy yargs-parser@20.2.9
npm ERR! Invalid: lock file's camelcase@6.2.0 does not satisfy camelcase@6.3.0
npm ERR! Invalid: lock file's @types/node@16.11.6 does not satisfy @types/node@18.19.129
npm ERR! Missing: undici-types@5.26.5 from lock file
npm ERR! Missing: brace-expansion@2.0.2 from lock file
npm ERR!
npm ERR! Clean install a project
npm ERR!
npm ERR! Usage:
npm ERR! npm ci
npm ERR!
npm ERR! Options:
npm ERR! [-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer|--save-bundle]
npm ERR! [-E|--save-exact] [-g|--global] [--install-strategy <hoisted|nested|shallow>]
npm ERR! [--legacy-bundling] [--global-style]
npm ERR! [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm ERR! [--strict-peer-deps] [--no-package-lock] [--foreground-scripts]
npm ERR! [--ignore-scripts] [--no-audit] [--no-bin-links] [--no-fund] [--dry-run]
npm ERR! [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm ERR! [-ws|--workspaces] [--include-workspace-root] [--no-install-links]
npm ERR!
npm ERR! aliases: clean-install, ic, install-clean, isntall-clean
npm ERR!
npm ERR! Run "npm help ci" for more info
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2025-10-05T04_15_07_356Z-debug-0.log
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 2030, in main
libup.run(args.repo, args.output, args.branch)
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1972, in run
self.npm_audit_fix(new_npm_audit)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 274, in npm_audit_fix
self.npm_test()
~~~~~~~~~~~~~^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 321, in npm_test
self.check_call(["npm", "ci"])
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/shell2.py", line 63, in check_call
res.check_returncode()
~~~~~~~~~~~~~~~~~~~~^^
File "/usr/lib/python3.13/subprocess.py", line 508, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
self.stderr)
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'ci']' returned non-zero exit status 1.