mediawiki/core: REL1_44 (log #2202825)

From 3aaf431e4c5c6b17659c66da0529c5d1061964b1 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Thu, 13 Nov 2025 00:34:05 +0000
Subject: [PATCH] build: Updating validator to 13.15.23

* https://github.com/advisories/GHSA-9965-vmph-33xx

Change-Id: I5e96192a3c5737b801b9b8eaed01af8a935c7802
---
 package-lock.json | 73 ++++++++++++++++++++++++-----------------------
 1 file changed, 37 insertions(+), 36 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3de5b48..f33706e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3947,15 +3947,15 @@
 			}
 		},
 		"node_modules/@types/request/node_modules/form-data": {
-			"version": "2.5.3",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.3.tgz",
-			"integrity": "sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==",
+			"version": "2.5.5",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
+			"integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
 			"dev": true,
-			"license": "MIT",
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.35",
 				"safe-buffer": "^5.2.1"
 			},
@@ -9052,14 +9052,15 @@
 			}
 		},
 		"node_modules/form-data": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
-			"integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+			"integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
 			"dev": true,
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.12"
 			},
 			"engines": {
@@ -12757,9 +12758,9 @@
 			}
 		},
 		"node_modules/karma/node_modules/tmp": {
-			"version": "0.2.3",
-			"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-			"integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+			"version": "0.2.5",
+			"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+			"integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
 			"dev": true,
 			"engines": {
 				"node": ">=14.14"
@@ -17448,9 +17449,9 @@
 			}
 		},
 		"node_modules/validator": {
-			"version": "13.7.0",
-			"resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
-			"integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
+			"version": "13.15.23",
+			"resolved": "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz",
+			"integrity": "sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==",
 			"dev": true,
 			"engines": {
 				"node": ">= 0.10"
@@ -17571,8 +17572,13 @@
 			}
 		},
 		"node_modules/wdio-mediawiki": {
-			"resolved": "tests/selenium/wdio-mediawiki",
-			"link": true
+			"version": "2.7.1",
+			"resolved": "file:tests/selenium/wdio-mediawiki",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"mwbot": "2.1.3"
+			}
 		},
 		"node_modules/webdriver": {
 			"version": "7.40.0",
@@ -18217,14 +18223,6 @@
 			"engines": {
 				"node": ">= 10"
 			}
-		},
-		"tests/selenium/wdio-mediawiki": {
-			"version": "2.7.1",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"mwbot": "2.1.3"
-			}
 		}
 	},
 	"dependencies": {
@@ -21144,14 +21142,15 @@
 			},
 			"dependencies": {
 				"form-data": {
-					"version": "2.5.3",
-					"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.3.tgz",
-					"integrity": "sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==",
+					"version": "2.5.5",
+					"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
+					"integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
 					"dev": true,
 					"requires": {
 						"asynckit": "^0.4.0",
 						"combined-stream": "^1.0.8",
 						"es-set-tostringtag": "^2.1.0",
+						"hasown": "^2.0.2",
 						"mime-types": "^2.1.35",
 						"safe-buffer": "^5.2.1"
 					}
@@ -24969,14 +24968,15 @@
 			"dev": true
 		},
 		"form-data": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
-			"integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+			"integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
 			"dev": true,
 			"requires": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.12"
 			}
 		},
@@ -27707,9 +27707,9 @@
 					"dev": true
 				},
 				"tmp": {
-					"version": "0.2.3",
-					"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-					"integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+					"version": "0.2.5",
+					"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+					"integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
 					"dev": true
 				},
 				"yargs": {
@@ -31315,9 +31315,9 @@
 			}
 		},
 		"validator": {
-			"version": "13.7.0",
-			"resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
-			"integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
+			"version": "13.15.23",
+			"resolved": "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz",
+			"integrity": "sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==",
 			"dev": true
 		},
 		"vary": {
@@ -31405,7 +31405,8 @@
 			}
 		},
 		"wdio-mediawiki": {
-			"version": "file:tests/selenium/wdio-mediawiki",
+			"version": "2.7.1",
+			"dev": true,
 			"requires": {
 				"mwbot": "2.1.3"
 			}
-- 
2.47.3

$ date
--- stdout ---
Thu Nov 13 00:29:43 UTC 2025

--- end ---
$ git clone file:///srv/git/mediawiki-core.git repo --depth=1 -b REL1_44
--- stderr ---
Cloning into 'repo'...
Updating files:  68% (7841/11430)
Updating files:  69% (7887/11430)
Updating files:  70% (8001/11430)
Updating files:  71% (8116/11430)
Updating files:  72% (8230/11430)
Updating files:  73% (8344/11430)
Updating files:  74% (8459/11430)
Updating files:  75% (8573/11430)
Updating files:  76% (8687/11430)
Updating files:  77% (8802/11430)
Updating files:  78% (8916/11430)
Updating files:  79% (9030/11430)
Updating files:  80% (9144/11430)
Updating files:  81% (9259/11430)
Updating files:  82% (9373/11430)
Updating files:  83% (9487/11430)
Updating files:  84% (9602/11430)
Updating files:  85% (9716/11430)
Updating files:  86% (9830/11430)
Updating files:  87% (9945/11430)
Updating files:  88% (10059/11430)
Updating files:  89% (10173/11430)
Updating files:  90% (10287/11430)
Updating files:  91% (10402/11430)
Updating files:  92% (10516/11430)
Updating files:  93% (10630/11430)
Updating files:  94% (10745/11430)
Updating files:  95% (10859/11430)
Updating files:  96% (10973/11430)
Updating files:  97% (11088/11430)
Updating files:  98% (11202/11430)
Updating files:  99% (11316/11430)
Updating files: 100% (11430/11430)
Updating files: 100% (11430/11430), done.
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stderr ---
Submodule 'extensions/AbuseFilter' (https://gerrit.wikimedia.org/r/mediawiki/extensions/AbuseFilter) registered for path 'extensions/AbuseFilter'
Submodule 'extensions/CategoryTree' (https://gerrit.wikimedia.org/r/mediawiki/extensions/CategoryTree) registered for path 'extensions/CategoryTree'
Submodule 'extensions/CheckUser' (https://gerrit.wikimedia.org/r/mediawiki/extensions/CheckUser) registered for path 'extensions/CheckUser'
Submodule 'extensions/Cite' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Cite) registered for path 'extensions/Cite'
Submodule 'extensions/CiteThisPage' (https://gerrit.wikimedia.org/r/mediawiki/extensions/CiteThisPage) registered for path 'extensions/CiteThisPage'
Submodule 'extensions/CodeEditor' (https://gerrit.wikimedia.org/r/mediawiki/extensions/CodeEditor) registered for path 'extensions/CodeEditor'
Submodule 'extensions/ConfirmEdit' (https://gerrit.wikimedia.org/r/mediawiki/extensions/ConfirmEdit) registered for path 'extensions/ConfirmEdit'
Submodule 'extensions/DiscussionTools' (https://gerrit.wikimedia.org/r/mediawiki/extensions/DiscussionTools) registered for path 'extensions/DiscussionTools'
Submodule 'extensions/Echo' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Echo) registered for path 'extensions/Echo'
Submodule 'extensions/Gadgets' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Gadgets) registered for path 'extensions/Gadgets'
Submodule 'extensions/ImageMap' (https://gerrit.wikimedia.org/r/mediawiki/extensions/ImageMap) registered for path 'extensions/ImageMap'
Submodule 'extensions/InputBox' (https://gerrit.wikimedia.org/r/mediawiki/extensions/InputBox) registered for path 'extensions/InputBox'
Submodule 'extensions/Interwiki' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Interwiki) registered for path 'extensions/Interwiki'
Submodule 'extensions/Linter' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Linter) registered for path 'extensions/Linter'
Submodule 'extensions/LoginNotify' (https://gerrit.wikimedia.org/r/mediawiki/extensions/LoginNotify) registered for path 'extensions/LoginNotify'
Submodule 'extensions/Math' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Math) registered for path 'extensions/Math'
Submodule 'extensions/MultimediaViewer' (https://gerrit.wikimedia.org/r/mediawiki/extensions/MultimediaViewer) registered for path 'extensions/MultimediaViewer'
Submodule 'extensions/Nuke' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Nuke) registered for path 'extensions/Nuke'
Submodule 'extensions/OATHAuth' (https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth) registered for path 'extensions/OATHAuth'
Submodule 'extensions/PageImages' (https://gerrit.wikimedia.org/r/mediawiki/extensions/PageImages) registered for path 'extensions/PageImages'
Submodule 'extensions/ParserFunctions' (https://gerrit.wikimedia.org/r/mediawiki/extensions/ParserFunctions) registered for path 'extensions/ParserFunctions'
Submodule 'extensions/PdfHandler' (https://gerrit.wikimedia.org/r/mediawiki/extensions/PdfHandler) registered for path 'extensions/PdfHandler'
Submodule 'extensions/Poem' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Poem) registered for path 'extensions/Poem'
Submodule 'extensions/ReplaceText' (https://gerrit.wikimedia.org/r/mediawiki/extensions/ReplaceText) registered for path 'extensions/ReplaceText'
Submodule 'extensions/Scribunto' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Scribunto) registered for path 'extensions/Scribunto'
Submodule 'extensions/SecureLinkFixer' (https://gerrit.wikimedia.org/r/mediawiki/extensions/SecureLinkFixer) registered for path 'extensions/SecureLinkFixer'
Submodule 'extensions/SpamBlacklist' (https://gerrit.wikimedia.org/r/mediawiki/extensions/SpamBlacklist) registered for path 'extensions/SpamBlacklist'
Submodule 'extensions/SyntaxHighlight_GeSHi' (https://gerrit.wikimedia.org/r/mediawiki/extensions/SyntaxHighlight_GeSHi) registered for path 'extensions/SyntaxHighlight_GeSHi'
Submodule 'extensions/TemplateData' (https://gerrit.wikimedia.org/r/mediawiki/extensions/TemplateData) registered for path 'extensions/TemplateData'
Submodule 'extensions/TemplateStyles' (https://gerrit.wikimedia.org/r/mediawiki/extensions/TemplateStyles) registered for path 'extensions/TemplateStyles'
Submodule 'extensions/TextExtracts' (https://gerrit.wikimedia.org/r/mediawiki/extensions/TextExtracts) registered for path 'extensions/TextExtracts'
Submodule 'extensions/Thanks' (https://gerrit.wikimedia.org/r/mediawiki/extensions/Thanks) registered for path 'extensions/Thanks'
Submodule 'extensions/TitleBlacklist' (https://gerrit.wikimedia.org/r/mediawiki/extensions/TitleBlacklist) registered for path 'extensions/TitleBlacklist'
Submodule 'extensions/VisualEditor' (https://gerrit.wikimedia.org/r/mediawiki/extensions/VisualEditor) registered for path 'extensions/VisualEditor'
Submodule 'extensions/WikiEditor' (https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiEditor) registered for path 'extensions/WikiEditor'
Submodule 'skins/MinervaNeue' (https://gerrit.wikimedia.org/r/mediawiki/skins/MinervaNeue) registered for path 'skins/MinervaNeue'
Submodule 'skins/MonoBook' (https://gerrit.wikimedia.org/r/mediawiki/skins/MonoBook) registered for path 'skins/MonoBook'
Submodule 'skins/Timeless' (https://gerrit.wikimedia.org/r/mediawiki/skins/Timeless) registered for path 'skins/Timeless'
Submodule 'skins/Vector' (https://gerrit.wikimedia.org/r/mediawiki/skins/Vector) registered for path 'skins/Vector'
Submodule 'vendor' (https://gerrit.wikimedia.org/r/mediawiki/vendor) registered for path 'vendor'
Cloning into '/src/repo/extensions/AbuseFilter'...
Cloning into '/src/repo/extensions/CategoryTree'...
Cloning into '/src/repo/extensions/CheckUser'...
Cloning into '/src/repo/extensions/Cite'...
Cloning into '/src/repo/extensions/CiteThisPage'...
Cloning into '/src/repo/extensions/CodeEditor'...
Cloning into '/src/repo/extensions/ConfirmEdit'...
Cloning into '/src/repo/extensions/DiscussionTools'...
Cloning into '/src/repo/extensions/Echo'...
Cloning into '/src/repo/extensions/Gadgets'...
Cloning into '/src/repo/extensions/ImageMap'...
Cloning into '/src/repo/extensions/InputBox'...
Cloning into '/src/repo/extensions/Interwiki'...
Cloning into '/src/repo/extensions/Linter'...
Cloning into '/src/repo/extensions/LoginNotify'...
Cloning into '/src/repo/extensions/Math'...
Cloning into '/src/repo/extensions/MultimediaViewer'...
Cloning into '/src/repo/extensions/Nuke'...
Cloning into '/src/repo/extensions/OATHAuth'...
Cloning into '/src/repo/extensions/PageImages'...
Cloning into '/src/repo/extensions/ParserFunctions'...
Cloning into '/src/repo/extensions/PdfHandler'...
Cloning into '/src/repo/extensions/Poem'...
Cloning into '/src/repo/extensions/ReplaceText'...
Cloning into '/src/repo/extensions/Scribunto'...
Cloning into '/src/repo/extensions/SecureLinkFixer'...
Cloning into '/src/repo/extensions/SpamBlacklist'...
Cloning into '/src/repo/extensions/SyntaxHighlight_GeSHi'...
Cloning into '/src/repo/extensions/TemplateData'...
Cloning into '/src/repo/extensions/TemplateStyles'...
Cloning into '/src/repo/extensions/TextExtracts'...
Cloning into '/src/repo/extensions/Thanks'...
Cloning into '/src/repo/extensions/TitleBlacklist'...
Cloning into '/src/repo/extensions/VisualEditor'...
Cloning into '/src/repo/extensions/WikiEditor'...
Cloning into '/src/repo/skins/MinervaNeue'...
Cloning into '/src/repo/skins/MonoBook'...
Cloning into '/src/repo/skins/Timeless'...
Cloning into '/src/repo/skins/Vector'...
Cloning into '/src/repo/vendor'...
--- stdout ---
Submodule path 'extensions/AbuseFilter': checked out 'e5beb045d9b3b4ca338f3db0479ae3d4d119f647'
Submodule path 'extensions/CategoryTree': checked out '7e007633e652e75c96a066b91d6af72ce60a94bb'
Submodule path 'extensions/CheckUser': checked out 'eeb84d0b513fb72e41f7698f134c512cb094ea2d'
Submodule path 'extensions/Cite': checked out '866a6e6f7630ff3c270d96160234552028578fda'
Submodule path 'extensions/CiteThisPage': checked out '09f0f5ed660cb617ea3a5d95a7d211352d7b6ccf'
Submodule path 'extensions/CodeEditor': checked out '9d057de38cc983e842d63edfa6313c4328a2356a'
Submodule path 'extensions/ConfirmEdit': checked out '423c44d0333addb9680abc71a2504ec2176bf5bb'
Submodule path 'extensions/DiscussionTools': checked out 'dd7cadc6d427b56cefaeccc7468b6da157cf9099'
Submodule path 'extensions/Echo': checked out '2cbce2899212d0f2a9c62b538a7e08c4f6176270'
Submodule path 'extensions/Gadgets': checked out '97cac9897b294c1724b3da68f36d5073ed0f7c0e'
Submodule path 'extensions/ImageMap': checked out '3c86fae682dd3b735e82946a7c3fb37eedca89c2'
Submodule path 'extensions/InputBox': checked out 'fc03f4bd06bedabbb38819cf9cae9eaf0990129c'
Submodule path 'extensions/Interwiki': checked out 'b6c0e35bcc3dbf967c2d70f53b3e0850b12aad8e'
Submodule path 'extensions/Linter': checked out '80a61b2743431d249f30f9f13c6b546ee7b9a4b7'
Submodule path 'extensions/LoginNotify': checked out '59d73c90defb5bac964419a2760c3a102d091da6'
Submodule path 'extensions/Math': checked out '740675c3cd6afc74a6126c8ba844c0ee252e24bb'
Submodule path 'extensions/MultimediaViewer': checked out 'b753a32363d5aa8d013f6057c6c18d7766137df4'
Submodule path 'extensions/Nuke': checked out '65548c40b72ccfed56ff41209453222572b1d51c'
Submodule path 'extensions/OATHAuth': checked out 'bcd9f9bc9fd6df442b6a23d0118b85ff47569c5a'
Submodule path 'extensions/PageImages': checked out 'b546897fef164ef2473c14bbb135a0bc4aa5c224'
Submodule path 'extensions/ParserFunctions': checked out 'e96bc4f95b194766c51175cd390ab593c831beec'
Submodule path 'extensions/PdfHandler': checked out 'd4cae40e6ed9d4948146f4b6e605ca20150fe81b'
Submodule path 'extensions/Poem': checked out '72f1429d36529bee4d6f88d669ded09da0114660'
Submodule path 'extensions/ReplaceText': checked out 'a56a3d1c4d74455e1f29a3424c29e3004f832331'
Submodule path 'extensions/Scribunto': checked out '6d76958c3720eecff2aaa9a7f7c4c84fd89d4737'
Submodule path 'extensions/SecureLinkFixer': checked out '816cebad1ffc635f4bfa2b9c5a761d6d21b88203'
Submodule path 'extensions/SpamBlacklist': checked out '138cd21381f4c5c63e9d7aa4c93432f6cdb4f6b9'
Submodule path 'extensions/SyntaxHighlight_GeSHi': checked out 'ae3f3a82e30ae731ca850ded8eae47414a014894'
Submodule path 'extensions/TemplateData': checked out '574d91c783adf279c0e0e7d44b4d5159dfd62738'
Submodule path 'extensions/TemplateStyles': checked out '59c2918f358584eeef85a96811304e5ae9de80d4'
Submodule path 'extensions/TextExtracts': checked out '338756a1a744b04090e9a7d4894382615b8f0768'
Submodule path 'extensions/Thanks': checked out 'dae518bce44d12e41db752842f4ad599a76bc285'
Submodule path 'extensions/TitleBlacklist': checked out 'a0f6678453ad8fa947f6032f9bdf26c7a0c18a2c'
Submodule path 'extensions/VisualEditor': checked out '56c62797040823cf1a0a6448285e6cb84d6101b4'
Submodule path 'extensions/WikiEditor': checked out '07301729f978b0c31a6417808f86995fe65bd36d'
Submodule path 'skins/MinervaNeue': checked out '07616b99ea3e61e7241852316a9d2741974c5cb7'
Submodule path 'skins/MonoBook': checked out '2fa181394771335b0f757bc689f82fb23b5391ef'
Submodule path 'skins/Timeless': checked out 'd4c890c356686f733e6912cbca193d1a2c69e133'
Submodule path 'skins/Vector': checked out 'b8150d4fc6102a93920cec1335a385816e8f83f3'
Submodule path 'vendor': checked out '4e5d87288b600ff40f272b3627ece4f5409da930'

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_44
--- stdout ---
418c77b7b377397bffb02cede6d466dfe7d00dcd refs/heads/REL1_44

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "inquirer",
        "webdriverio",
        "yarn-install"
      ],
      "effects": [
        "@wdio/junit-reporter",
        "@wdio/local-runner",
        "@wdio/spec-reporter"
      ],
      "range": "<=9.0.0-alpha.426",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/junit-reporter": {
      "name": "@wdio/junit-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/junit-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/junit-reporter",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "effects": [],
      "range": "6.0.4 - 8.46.0",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "7.16.5 - 8.46.0",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/spec-reporter": {
      "name": "@wdio/spec-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/spec-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/spec-reporter",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "axios": {
      "name": "axios",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1097679,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios Cross-Site Request Forgery Vulnerability",
          "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
          "severity": "moderate",
          "cwe": [
            "CWE-352"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": ">=0.8.1 <0.28.0"
        },
        {
          "source": 1103617,
          "name": "axios",
          "dependency": "axios",
          "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
          "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
          "severity": "high",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.30.0"
        },
        {
          "source": 1108262,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios is vulnerable to DoS attack through lack of data size check",
          "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
          "severity": "high",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.30.2"
        }
      ],
      "effects": [
        "openapi-validator"
      ],
      "range": "<=0.30.1",
      "nodes": [
        "node_modules/axios"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "chai-openapi-response-validator": {
      "name": "chai-openapi-response-validator",
      "severity": "high",
      "isDirect": true,
      "via": [
        "openapi-validator"
      ],
      "effects": [],
      "range": "0.11.2 || >=0.14.2-alpha.0",
      "nodes": [
        "node_modules/chai-openapi-response-validator"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104663,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        }
      ],
      "effects": [
        "yarn-install"
      ],
      "range": "<6.0.6",
      "nodes": [
        "node_modules/yarn-install/node_modules/cross-spawn"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": ">=7.16.5",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "external-editor": {
      "name": "external-editor",
      "severity": "low",
      "isDirect": false,
      "via": [
        "tmp"
      ],
      "effects": [
        "inquirer"
      ],
      "range": ">=1.1.1",
      "nodes": [
        "node_modules/external-editor"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109538,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=4.0.0 <4.0.4"
        },
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": ">=4.0.0 <4.0.4 || <2.5.4",
      "nodes": [
        "node_modules/@types/request/node_modules/form-data",
        "node_modules/form-data",
        "node_modules/request/node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "inquirer": {
      "name": "inquirer",
      "severity": "low",
      "isDirect": false,
      "via": [
        "external-editor"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
      "nodes": [
        "node_modules/inquirer"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "openapi-validator": {
      "name": "openapi-validator",
      "severity": "high",
      "isDirect": false,
      "via": [
        "axios"
      ],
      "effects": [
        "chai-openapi-response-validator"
      ],
      "range": ">=0.14.2-alpha.0",
      "nodes": [
        "node_modules/openapi-validator"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "tar-fs",
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "10.0.0 - 22.11.1",
      "nodes": [
        "node_modules/devtools/node_modules/puppeteer-core",
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109532,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1109543,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1109552,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
          "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=2.0.0 <2.1.2"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "2.0.0 - 2.1.3",
      "nodes": [
        "node_modules/tar-fs"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        }
      ],
      "effects": [
        "external-editor"
      ],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/karma/node_modules/tmp",
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "validator": {
      "name": "validator",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1109241,
          "name": "validator",
          "dependency": "validator",
          "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
          "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<13.15.20"
        }
      ],
      "effects": [],
      "range": "<13.15.20",
      "nodes": [
        "node_modules/validator"
      ],
      "fixAvailable": true
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.16.5 - 8.46.0",
      "nodes": [
        "node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/devtools/node_modules/ws",
        "node_modules/puppeteer-core/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "yarn-install": {
      "name": "yarn-install",
      "severity": "high",
      "isDirect": false,
      "via": [
        "cross-spawn"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "*",
      "nodes": [
        "node_modules/yarn-install"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 3,
      "moderate": 3,
      "high": 15,
      "critical": 2,
      "total": 23
    },
    "dependencies": {
      "prod": 1,
      "dev": 1484,
      "optional": 4,
      "peer": 1,
      "peerOptional": 0,
      "total": 1484
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
> MediaWiki\Composer\VersionChecker::onEvent
Loading composer repositories with package information
Updating dependencies
Lock file operations: 137 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.3.2)
  - Locking composer/semver (3.4.3)
  - Locking composer/spdx-licenses (1.5.8)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking cssjanus/cssjanus (v2.3.0)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
  - Locking doctrine/cache (2.2.0)
  - Locking doctrine/dbal (3.9.4)
  - Locking doctrine/deprecations (1.1.5)
  - Locking doctrine/event-manager (2.0.1)
  - Locking doctrine/instantiator (2.0.0)
  - Locking doctrine/sql-formatter (1.3.0)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking giorgiosironi/eris (0.14.1)
  - Locking guzzlehttp/guzzle (7.9.3)
  - Locking guzzlehttp/promises (2.3.0)
  - Locking guzzlehttp/psr7 (2.8.0)
  - Locking hamcrest/hamcrest-php (v2.1.1)
  - Locking johnkary/phpunit-speedtrap (v4.0.1)
  - Locking justinrainbow/json-schema (5.3.0)
  - Locking liuggio/statsd-php-client (v1.0.18)
  - Locking mck89/peast (v1.17.0)
  - Locking mediawiki/mediawiki-codesniffer (v46.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.15.1)
  - Locking mediawiki/minus-x (1.1.3)
  - Locking mediawiki/phan-taint-check-plugin (6.1.0)
  - Locking microsoft/tolerant-php-parser (v0.1.2)
  - Locking monolog/monolog (2.9.3)
  - Locking myclabs/deep-copy (1.13.4)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking nikic/php-parser (v5.6.2)
  - Locking oojs/oojs-ui (v0.51.7)
  - Locking pear/console_getopt (v1.4.3)
  - Locking pear/mail (v2.0.0)
  - Locking pear/mail_mime (1.10.12)
  - Locking pear/net_smtp (1.12.1)
  - Locking pear/net_socket (v1.2.2)
  - Locking pear/net_url2 (v2.2.3)
  - Locking pear/pear-core-minimal (v1.10.16)
  - Locking pear/pear_exception (v1.0.2)
  - Locking phan/phan (5.4.5)
  - Locking phar-io/manifest (2.0.4)
  - Locking phar-io/version (3.2.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.2.1)
  - Locking phpcsstandards/phpcsutils (1.0.12)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.6.3)
  - Locking phpdocumentor/type-resolver (1.10.0)
  - Locking phpstan/phpdoc-parser (2.3.0)
  - Locking phpunit/php-code-coverage (9.2.32)
  - Locking phpunit/php-file-iterator (3.0.6)
  - Locking phpunit/php-invoker (3.1.1)
  - Locking phpunit/php-text-template (2.0.4)
  - Locking phpunit/php-timer (5.0.3)
  - Locking phpunit/phpunit (9.6.21)
  - Locking psr/cache (3.0.0)
  - Locking psr/container (1.1.2)
  - Locking psr/http-client (1.0.3)
  - Locking psr/http-factory (1.1.0)
  - Locking psr/http-message (1.1)
  - Locking psr/log (1.1.4)
  - Locking psy/psysh (v0.12.14)
  - Locking ralouphie/getallheaders (3.0.3)
  - Locking sabre/event (5.1.7)
  - Locking sebastian/cli-parser (1.0.2)
  - Locking sebastian/code-unit (1.0.8)
  - Locking sebastian/code-unit-reverse-lookup (2.0.3)
  - Locking sebastian/comparator (4.0.9)
  - Locking sebastian/complexity (2.0.3)
  - Locking sebastian/diff (4.0.6)
  - Locking sebastian/environment (5.1.5)
  - Locking sebastian/exporter (4.0.8)
  - Locking sebastian/global-state (5.0.8)
  - Locking sebastian/lines-of-code (1.0.4)
  - Locking sebastian/object-enumerator (4.0.4)
  - Locking sebastian/object-reflector (2.0.4)
  - Locking sebastian/recursion-context (4.0.6)
  - Locking sebastian/resource-operations (3.0.4)
  - Locking sebastian/type (3.2.1)
  - Locking sebastian/version (3.0.2)
  - Locking seld/jsonlint (1.11.0)
  - Locking squizlabs/php_codesniffer (3.11.3)
  - Locking symfony/console (v7.3.6)
  - Locking symfony/deprecation-contracts (v3.6.0)
  - Locking symfony/polyfill-php82 (v1.32.0)
  - Locking symfony/polyfill-php83 (v1.32.0)
  - Locking symfony/polyfill-php84 (v1.32.0)
  - Locking symfony/polyfill-php85 (v1.33.0)
  - Locking symfony/service-contracts (v3.6.1)
  - Locking symfony/string (v7.3.4)
  - Locking symfony/var-dumper (v7.3.5)
  - Locking symfony/yaml (v5.4.45)
  - Locking theseer/tokenizer (1.2.3)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (1.12.1)
  - Locking wikimedia/alea (1.0.0)
  - Locking wikimedia/assert (v0.5.1)
  - Locking wikimedia/at-ease (v3.0.0)
  - Locking wikimedia/base-convert (v2.0.2)
  - Locking wikimedia/bcp-47-code (v2.0.1)
  - Locking wikimedia/cdb (3.0.0)
  - Locking wikimedia/cldr-plural-rule-parser (v2.0.0)
  - Locking wikimedia/common-passwords (v0.5.1)
  - Locking wikimedia/composer-merge-plugin (v2.1.0)
  - Locking wikimedia/css-sanitizer (v5.5.0)
  - Locking wikimedia/html-formatter (4.1.0)
  - Locking wikimedia/idle-dom (v2.0.1)
  - Locking wikimedia/ip-utils (5.0.0)
  - Locking wikimedia/json-codec (v3.0.3)
  - Locking wikimedia/langconv (0.5.0)
  - Locking wikimedia/less.php (v5.2.1)
  - Locking wikimedia/minify (2.9.0)
  - Locking wikimedia/normalized-exception (v2.1.1)
  - Locking wikimedia/object-factory (v5.0.1)
  - Locking wikimedia/parsoid (v0.21.1)
  - Locking wikimedia/php-session-serializer (3.0.1)
  - Locking wikimedia/purtle (v2.0.0)
  - Locking wikimedia/relpath (4.0.2)
  - Locking wikimedia/remex-html (4.1.2)
  - Locking wikimedia/request-timeout (v2.0.2)
  - Locking wikimedia/running-stat (v2.1.0)
  - Locking wikimedia/scoped-callback (v5.0.0)
  - Locking wikimedia/services (4.0.0)
  - Locking wikimedia/shellbox (4.2.0)
  - Locking wikimedia/testing-access-wrapper (3.0.0)
  - Locking wikimedia/timestamp (v4.2.0)
  - Locking wikimedia/utfnormal (4.0.0)
  - Locking wikimedia/wait-condition-loop (v2.0.2)
  - Locking wikimedia/wikipeg (4.0.2)
  - Locking wikimedia/wrappedstring (v4.0.1)
  - Locking wikimedia/xmp-reader (0.9.4)
  - Locking wikimedia/zest-css (3.0.4)
  - Locking wmde/hamcrest-html-matchers (v1.1.0)
  - Locking zordius/lightncandy (v1.2.6)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 72 installs, 4 updates, 7 removals
  - Downloading squizlabs/php_codesniffer (3.11.3)
  - Downloading doctrine/dbal (3.9.4)
  - Downloading doctrine/sql-formatter (1.3.0)
  - Downloading mediawiki/mediawiki-codesniffer (v46.0.0)
  - Downloading wikimedia/langconv (0.5.0)
 0/5 [>---------------------------]   0%
 3/5 [================>-----------]  60%
 4/5 [======================>-----]  80%
 5/5 [============================] 100%
  - Removing wikimedia/equivset (1.7.1)
  - Removing jakobo/hotp-php (v2.0.0)
  - Removing firebase/php-jwt (v6.10.0)
  - Removing endroid/qr-code (5.1.0)
  - Removing dasprid/enum (1.0.6)
  - Removing christian-riesen/base32 (1.6.0)
  - Removing bacon/bacon-qr-code (v3.0.1)
  - Installing squizlabs/php_codesniffer (3.11.3): Extracting archive
 0/1 [>---------------------------]   0%
 1/1 [============================] 100%
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
  - Installing composer/pcre (3.3.2): Extracting archive
  - Installing psr/cache (3.0.0): Extracting archive
  - Installing doctrine/event-manager (2.0.1): Extracting archive
  - Installing doctrine/deprecations (1.1.5): Extracting archive
  - Installing doctrine/cache (2.2.0): Extracting archive
  - Installing doctrine/dbal (3.9.4): Extracting archive
  - Installing doctrine/sql-formatter (1.3.0): Extracting archive
  - Installing giorgiosironi/eris (0.14.1): Extracting archive
  - Upgrading guzzlehttp/promises (2.0.4 => 2.3.0): Extracting archive
  - Upgrading guzzlehttp/psr7 (2.7.0 => 2.8.0): Extracting archive
  - Installing sebastian/version (3.0.2): Extracting archive
  - Installing sebastian/type (3.2.1): Extracting archive
  - Installing sebastian/resource-operations (3.0.4): Extracting archive
  - Installing sebastian/recursion-context (4.0.6): Extracting archive
  - Installing sebastian/object-reflector (2.0.4): Extracting archive
  - Installing sebastian/object-enumerator (4.0.4): Extracting archive
  - Installing sebastian/global-state (5.0.8): Extracting archive
  - Installing sebastian/exporter (4.0.8): Extracting archive
  - Installing sebastian/environment (5.1.5): Extracting archive
  - Installing sebastian/diff (4.0.6): Extracting archive
  - Installing sebastian/comparator (4.0.9): Extracting archive
  - Installing sebastian/code-unit (1.0.8): Extracting archive
  - Installing sebastian/cli-parser (1.0.2): Extracting archive
  - Installing phpunit/php-timer (5.0.3): Extracting archive
  - Installing phpunit/php-text-template (2.0.4): Extracting archive
  - Installing phpunit/php-invoker (3.1.1): Extracting archive
  - Installing phpunit/php-file-iterator (3.0.6): Extracting archive
  - Installing theseer/tokenizer (1.2.3): Extracting archive
  - Installing nikic/php-parser (v5.6.2): Extracting archive
  - Installing sebastian/lines-of-code (1.0.4): Extracting archive
  - Installing sebastian/complexity (2.0.3): Extracting archive
  - Installing sebastian/code-unit-reverse-lookup (2.0.3): Extracting archive
  - Installing phpunit/php-code-coverage (9.2.32): Extracting archive
  - Installing phar-io/version (3.2.1): Extracting archive
  - Installing phar-io/manifest (2.0.4): Extracting archive
  - Installing myclabs/deep-copy (1.13.4): Extracting archive
  - Installing doctrine/instantiator (2.0.0): Extracting archive
  - Installing phpunit/phpunit (9.6.21): Extracting archive
  - Installing johnkary/phpunit-speedtrap (v4.0.1): Extracting archive
  - Installing phpcsstandards/phpcsutils (1.0.12): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive
  - Installing composer/spdx-licenses (1.5.8): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v46.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/string (v7.3.4): Extracting archive
  - Upgrading symfony/deprecation-contracts (v2.5.4 => v3.6.0): Extracting archive
  - Installing symfony/service-contracts (v3.6.1): Extracting archive
  - Installing symfony/console (v7.3.6): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
  - Installing webmozart/assert (1.12.1): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.0): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing phpdocumentor/type-resolver (1.10.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.6.3): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.4.5): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (6.1.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.15.1): Extracting archive
  - Installing mediawiki/minus-x (1.1.3): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  - Installing symfony/var-dumper (v7.3.5): Extracting archive
  - Installing psy/psysh (v0.12.14): Extracting archive
  - Installing seld/jsonlint (1.11.0): Extracting archive
  - Installing wikimedia/alea (1.0.0): Extracting archive
  - Installing wikimedia/langconv (0.5.0): Extracting archive
  - Upgrading wikimedia/zest-css (3.0.2 => 3.0.4): Extracting archive
  - Installing wikimedia/testing-access-wrapper (3.0.0): Extracting archive
  - Installing hamcrest/hamcrest-php (v2.1.1): Extracting archive
  - Installing wmde/hamcrest-html-matchers (v1.1.0): Extracting archive
  0/74 [>---------------------------]   0%
 19/74 [=======>--------------------]  25%
 30/74 [===========>----------------]  40%
 39/74 [==============>-------------]  52%
 49/74 [==================>---------]  66%
 58/74 [=====================>------]  78%
 68/74 [=========================>--]  91%
 74/74 [============================] 100%
21 package suggestions were added by new dependencies, use `composer suggest` to see details.
Package cssjanus/cssjanus is abandoned, you should avoid using it. Use wikimedia/cssjanus instead.
Package doctrine/cache is abandoned, you should avoid using it. No replacement was suggested.
Generating optimized autoload files
52 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> MediaWiki\Composer\ComposerVendorHtaccessCreator::onEvent
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "inquirer",
        "webdriverio",
        "yarn-install"
      ],
      "effects": [
        "@wdio/junit-reporter",
        "@wdio/local-runner",
        "@wdio/spec-reporter"
      ],
      "range": "<=9.0.0-alpha.426",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/junit-reporter": {
      "name": "@wdio/junit-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/junit-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/junit-reporter",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "effects": [],
      "range": "6.0.4 - 8.46.0",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "7.16.5 - 8.46.0",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/spec-reporter": {
      "name": "@wdio/spec-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/spec-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/spec-reporter",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "axios": {
      "name": "axios",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1097679,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios Cross-Site Request Forgery Vulnerability",
          "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
          "severity": "moderate",
          "cwe": [
            "CWE-352"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": ">=0.8.1 <0.28.0"
        },
        {
          "source": 1103617,
          "name": "axios",
          "dependency": "axios",
          "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
          "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
          "severity": "high",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.30.0"
        },
        {
          "source": 1108262,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios is vulnerable to DoS attack through lack of data size check",
          "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
          "severity": "high",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.30.2"
        }
      ],
      "effects": [
        "openapi-validator"
      ],
      "range": "<=0.30.1",
      "nodes": [
        "node_modules/axios"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "chai-openapi-response-validator": {
      "name": "chai-openapi-response-validator",
      "severity": "high",
      "isDirect": true,
      "via": [
        "openapi-validator"
      ],
      "effects": [],
      "range": "0.11.2 || >=0.14.2-alpha.0",
      "nodes": [
        "node_modules/chai-openapi-response-validator"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104663,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        }
      ],
      "effects": [
        "yarn-install"
      ],
      "range": "<6.0.6",
      "nodes": [
        "node_modules/yarn-install/node_modules/cross-spawn"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": ">=7.16.5",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "external-editor": {
      "name": "external-editor",
      "severity": "low",
      "isDirect": false,
      "via": [
        "tmp"
      ],
      "effects": [
        "inquirer"
      ],
      "range": ">=1.1.1",
      "nodes": [
        "node_modules/external-editor"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109538,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=4.0.0 <4.0.4"
        },
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": ">=4.0.0 <4.0.4 || <2.5.4",
      "nodes": [
        "node_modules/@types/request/node_modules/form-data",
        "node_modules/form-data",
        "node_modules/request/node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "inquirer": {
      "name": "inquirer",
      "severity": "low",
      "isDirect": false,
      "via": [
        "external-editor"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
      "nodes": [
        "node_modules/inquirer"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "openapi-validator": {
      "name": "openapi-validator",
      "severity": "high",
      "isDirect": false,
      "via": [
        "axios"
      ],
      "effects": [
        "chai-openapi-response-validator"
      ],
      "range": ">=0.14.2-alpha.0",
      "nodes": [
        "node_modules/openapi-validator"
      ],
      "fixAvailable": {
        "name": "chai-openapi-response-validator",
        "version": "0.14.1",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "tar-fs",
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "10.0.0 - 22.11.1",
      "nodes": [
        "node_modules/devtools/node_modules/puppeteer-core",
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109532,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1109543,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1109552,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
          "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=2.0.0 <2.1.2"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "2.0.0 - 2.1.3",
      "nodes": [
        "node_modules/tar-fs"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        }
      ],
      "effects": [
        "external-editor"
      ],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/karma/node_modules/tmp",
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "0.1.5",
        "isSemVerMajor": true
      }
    },
    "validator": {
      "name": "validator",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1109241,
          "name": "validator",
          "dependency": "validator",
          "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
          "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<13.15.20"
        }
      ],
      "effects": [],
      "range": "<13.15.20",
      "nodes": [
        "node_modules/validator"
      ],
      "fixAvailable": true
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.16.5 - 8.46.0",
      "nodes": [
        "node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/devtools/node_modules/ws",
        "node_modules/puppeteer-core/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    },
    "yarn-install": {
      "name": "yarn-install",
      "severity": "high",
      "isDirect": false,
      "via": [
        "cross-spawn"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "*",
      "nodes": [
        "node_modules/yarn-install"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.20.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 3,
      "moderate": 3,
      "high": 15,
      "critical": 2,
      "total": 23
    },
    "dependencies": {
      "prod": 1,
      "dev": 1484,
      "optional": 4,
      "peer": 1,
      "peerOptional": 0,
      "total": 1484
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
  "added": 1483,
  "removed": 0,
  "changed": 0,
  "audited": 1484,
  "funding": 168,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@wdio/cli": {
        "name": "@wdio/cli",
        "severity": "high",
        "isDirect": true,
        "via": [
          "inquirer",
          "webdriverio",
          "yarn-install"
        ],
        "effects": [
          "@wdio/junit-reporter",
          "@wdio/local-runner",
          "@wdio/spec-reporter"
        ],
        "range": "<=9.0.0-alpha.426",
        "nodes": [
          "node_modules/@wdio/cli"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/junit-reporter": {
        "name": "@wdio/junit-reporter",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli"
        ],
        "effects": [],
        "range": "6.0.4 - 8.0.0-alpha.631",
        "nodes": [
          "node_modules/@wdio/junit-reporter"
        ],
        "fixAvailable": {
          "name": "@wdio/junit-reporter",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/local-runner": {
        "name": "@wdio/local-runner",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli",
          "@wdio/runner"
        ],
        "effects": [],
        "range": "6.0.4 - 8.46.0",
        "nodes": [
          "node_modules/@wdio/local-runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/runner": {
        "name": "@wdio/runner",
        "severity": "high",
        "isDirect": false,
        "via": [
          "webdriverio"
        ],
        "effects": [
          "@wdio/local-runner"
        ],
        "range": "7.16.5 - 8.46.0",
        "nodes": [
          "node_modules/@wdio/runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/spec-reporter": {
        "name": "@wdio/spec-reporter",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli"
        ],
        "effects": [],
        "range": "6.0.4 - 8.0.0-alpha.631",
        "nodes": [
          "node_modules/@wdio/spec-reporter"
        ],
        "fixAvailable": {
          "name": "@wdio/spec-reporter",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "axios": {
        "name": "axios",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1097679,
            "name": "axios",
            "dependency": "axios",
            "title": "Axios Cross-Site Request Forgery Vulnerability",
            "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
            "severity": "moderate",
            "cwe": [
              "CWE-352"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
            },
            "range": ">=0.8.1 <0.28.0"
          },
          {
            "source": 1103617,
            "name": "axios",
            "dependency": "axios",
            "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
            "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
            "severity": "high",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<0.30.0"
          },
          {
            "source": 1108262,
            "name": "axios",
            "dependency": "axios",
            "title": "Axios is vulnerable to DoS attack through lack of data size check",
            "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
            "severity": "high",
            "cwe": [
              "CWE-770"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<0.30.2"
          }
        ],
        "effects": [
          "openapi-validator"
        ],
        "range": "<=0.30.1",
        "nodes": [
          "node_modules/axios"
        ],
        "fixAvailable": {
          "name": "chai-openapi-response-validator",
          "version": "0.14.1",
          "isSemVerMajor": true
        }
      },
      "chai-openapi-response-validator": {
        "name": "chai-openapi-response-validator",
        "severity": "high",
        "isDirect": true,
        "via": [
          "openapi-validator"
        ],
        "effects": [],
        "range": "0.11.2 || >=0.14.2-alpha.0",
        "nodes": [
          "node_modules/chai-openapi-response-validator"
        ],
        "fixAvailable": {
          "name": "chai-openapi-response-validator",
          "version": "0.14.1",
          "isSemVerMajor": true
        }
      },
      "cross-spawn": {
        "name": "cross-spawn",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1104663,
            "name": "cross-spawn",
            "dependency": "cross-spawn",
            "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
            "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<6.0.6"
          }
        ],
        "effects": [
          "yarn-install"
        ],
        "range": "<6.0.6",
        "nodes": [
          "node_modules/yarn-install/node_modules/cross-spawn"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "devtools": {
        "name": "devtools",
        "severity": "high",
        "isDirect": false,
        "via": [
          "puppeteer-core"
        ],
        "effects": [],
        "range": ">=7.16.5",
        "nodes": [
          "node_modules/devtools"
        ],
        "fixAvailable": true
      },
      "external-editor": {
        "name": "external-editor",
        "severity": "low",
        "isDirect": false,
        "via": [
          "tmp"
        ],
        "effects": [
          "inquirer"
        ],
        "range": ">=1.1.1",
        "nodes": [
          "node_modules/external-editor"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "form-data": {
        "name": "form-data",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1109538,
            "name": "form-data",
            "dependency": "form-data",
            "title": "form-data uses unsafe random function in form-data for choosing boundary",
            "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
            "severity": "critical",
            "cwe": [
              "CWE-330"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=4.0.0 <4.0.4"
          },
          {
            "source": 1109540,
            "name": "form-data",
            "dependency": "form-data",
            "title": "form-data uses unsafe random function in form-data for choosing boundary",
            "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
            "severity": "critical",
            "cwe": [
              "CWE-330"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<2.5.4"
          }
        ],
        "effects": [
          "request"
        ],
        "range": ">=4.0.0 <4.0.4 || <2.5.4",
        "nodes": [
          "",
          "",
          "node_modules/request/node_modules/form-data"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "0.1.5",
          "isSemVerMajor": true
        }
      },
      "inquirer": {
        "name": "inquirer",
        "severity": "low",
        "isDirect": false,
        "via": [
          "external-editor"
        ],
        "effects": [
          "@wdio/cli"
        ],
        "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
        "nodes": [
          "node_modules/inquirer"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "mwbot": {
        "name": "mwbot",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "request"
        ],
        "effects": [],
        "range": ">=0.1.6",
        "nodes": [
          "node_modules/mwbot"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "0.1.5",
          "isSemVerMajor": true
        }
      },
      "openapi-validator": {
        "name": "openapi-validator",
        "severity": "high",
        "isDirect": false,
        "via": [
          "axios"
        ],
        "effects": [
          "chai-openapi-response-validator"
        ],
        "range": ">=0.14.2-alpha.0",
        "nodes": [
          "node_modules/openapi-validator"
        ],
        "fixAvailable": {
          "name": "chai-openapi-response-validator",
          "version": "0.14.1",
          "isSemVerMajor": true
        }
      },
      "puppeteer-core": {
        "name": "puppeteer-core",
        "severity": "high",
        "isDirect": false,
        "via": [
          "tar-fs",
          "ws"
        ],
        "effects": [
          "devtools",
          "webdriverio"
        ],
        "range": "10.0.0 - 22.11.1",
        "nodes": [
          "node_modules/devtools/node_modules/puppeteer-core",
          "node_modules/puppeteer-core"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "request": {
        "name": "request",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1096727,
            "name": "request",
            "dependency": "request",
            "title": "Server-Side Request Forgery in Request",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "severity": "moderate",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<=2.88.2"
          },
          "form-data",
          "tough-cookie"
        ],
        "effects": [
          "mwbot"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "0.1.5",
          "isSemVerMajor": true
        }
      },
      "tar-fs": {
        "name": "tar-fs",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1109532,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
            "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
            "severity": "high",
            "cwe": [
              "CWE-22",
              "CWE-61"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=2.0.0 <2.1.4"
          },
          {
            "source": 1109543,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs can extract outside the specified dir with a specific tarball",
            "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=2.0.0 <2.1.3"
          },
          {
            "source": 1109552,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
            "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": ">=2.0.0 <2.1.2"
          }
        ],
        "effects": [
          "puppeteer-core"
        ],
        "range": "2.0.0 - 2.1.3",
        "nodes": [
          "node_modules/tar-fs"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "tmp": {
        "name": "tmp",
        "severity": "low",
        "isDirect": false,
        "via": [
          {
            "source": 1109537,
            "name": "tmp",
            "dependency": "tmp",
            "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
            "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
            "severity": "low",
            "cwe": [
              "CWE-59"
            ],
            "cvss": {
              "score": 2.5,
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
            },
            "range": "<=0.2.3"
          }
        ],
        "effects": [
          "external-editor"
        ],
        "range": "<=0.2.3",
        "nodes": [
          "",
          "node_modules/tmp"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "tough-cookie": {
        "name": "tough-cookie",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1097682,
            "name": "tough-cookie",
            "dependency": "tough-cookie",
            "title": "tough-cookie Prototype Pollution vulnerability",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "range": "<4.1.3"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<4.1.3",
        "nodes": [
          "node_modules/tough-cookie"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "0.1.5",
          "isSemVerMajor": true
        }
      },
      "validator": {
        "name": "validator",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1109241,
            "name": "validator",
            "dependency": "validator",
            "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
            "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
            "severity": "moderate",
            "cwe": [
              "CWE-79"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<13.15.20"
          }
        ],
        "effects": [],
        "range": "<13.15.20",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "webdriverio": {
        "name": "webdriverio",
        "severity": "high",
        "isDirect": false,
        "via": [
          "devtools",
          "puppeteer-core"
        ],
        "effects": [
          "@wdio/cli",
          "@wdio/runner"
        ],
        "range": "7.16.5 - 8.46.0",
        "nodes": [
          "node_modules/webdriverio"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "ws": {
        "name": "ws",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1098392,
            "name": "ws",
            "dependency": "ws",
            "title": "ws affected by a DoS when handling a request with many HTTP headers",
            "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
            "severity": "high",
            "cwe": [
              "CWE-476"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=8.0.0 <8.17.1"
          }
        ],
        "effects": [
          "puppeteer-core"
        ],
        "range": "8.0.0 - 8.17.0",
        "nodes": [
          "node_modules/devtools/node_modules/ws",
          "node_modules/puppeteer-core/node_modules/ws"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      },
      "yarn-install": {
        "name": "yarn-install",
        "severity": "high",
        "isDirect": false,
        "via": [
          "cross-spawn"
        ],
        "effects": [
          "@wdio/cli"
        ],
        "range": "*",
        "nodes": [
          "node_modules/yarn-install"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.20.0",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 3,
        "moderate": 3,
        "high": 15,
        "critical": 2,
        "total": 23
      },
      "dependencies": {
        "prod": 1,
        "dev": 1483,
        "optional": 4,
        "peer": 1,
        "peerOptional": 0,
        "total": 1483
      }
    }
  }
}

--- end ---
{"added": 1483, "removed": 0, "changed": 0, "audited": 1484, "funding": 168, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@wdio/cli": {"name": "@wdio/cli", "severity": "high", "isDirect": true, "via": ["inquirer", "webdriverio", "yarn-install"], "effects": ["@wdio/junit-reporter", "@wdio/local-runner", "@wdio/spec-reporter"], "range": "<=9.0.0-alpha.426", "nodes": ["node_modules/@wdio/cli"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "@wdio/junit-reporter": {"name": "@wdio/junit-reporter", "severity": "high", "isDirect": true, "via": ["@wdio/cli"], "effects": [], "range": "6.0.4 - 8.0.0-alpha.631", "nodes": ["node_modules/@wdio/junit-reporter"], "fixAvailable": {"name": "@wdio/junit-reporter", "version": "9.20.0", "isSemVerMajor": true}}, "@wdio/local-runner": {"name": "@wdio/local-runner", "severity": "high", "isDirect": true, "via": ["@wdio/cli", "@wdio/runner"], "effects": [], "range": "6.0.4 - 8.46.0", "nodes": ["node_modules/@wdio/local-runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.20.0", "isSemVerMajor": true}}, "@wdio/runner": {"name": "@wdio/runner", "severity": "high", "isDirect": false, "via": ["webdriverio"], "effects": ["@wdio/local-runner"], "range": "7.16.5 - 8.46.0", "nodes": ["node_modules/@wdio/runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.20.0", "isSemVerMajor": true}}, "@wdio/spec-reporter": {"name": "@wdio/spec-reporter", "severity": "high", "isDirect": true, "via": ["@wdio/cli"], "effects": [], "range": "6.0.4 - 8.0.0-alpha.631", "nodes": ["node_modules/@wdio/spec-reporter"], "fixAvailable": {"name": "@wdio/spec-reporter", "version": "9.20.0", "isSemVerMajor": true}}, "axios": {"name": "axios", "severity": "high", "isDirect": false, "via": [{"source": 1097679, "name": "axios", "dependency": "axios", "title": "Axios Cross-Site Request Forgery Vulnerability", "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx", "severity": "moderate", "cwe": ["CWE-352"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "range": ">=0.8.1 <0.28.0"}, {"source": 1103617, "name": "axios", "dependency": "axios", "title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL", "url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6", "severity": "high", "cwe": ["CWE-918"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.30.0"}, {"source": 1108262, "name": "axios", "dependency": "axios", "title": "Axios is vulnerable to DoS attack through lack of data size check", "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj", "severity": "high", "cwe": ["CWE-770"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.30.2"}], "effects": ["openapi-validator"], "range": "<=0.30.1", "nodes": ["node_modules/axios"], "fixAvailable": {"name": "chai-openapi-response-validator", "version": "0.14.1", "isSemVerMajor": true}}, "chai-openapi-response-validator": {"name": "chai-openapi-response-validator", "severity": "high", "isDirect": true, "via": ["openapi-validator"], "effects": [], "range": "0.11.2 || >=0.14.2-alpha.0", "nodes": ["node_modules/chai-openapi-response-validator"], "fixAvailable": {"name": "chai-openapi-response-validator", "version": "0.14.1", "isSemVerMajor": true}}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}], "effects": ["yarn-install"], "range": "<6.0.6", "nodes": ["node_modules/yarn-install/node_modules/cross-spawn"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "devtools": {"name": "devtools", "severity": "high", "isDirect": false, "via": ["puppeteer-core"], "effects": [], "range": ">=7.16.5", "nodes": ["node_modules/devtools"], "fixAvailable": true}, "external-editor": {"name": "external-editor", "severity": "low", "isDirect": false, "via": ["tmp"], "effects": ["inquirer"], "range": ">=1.1.1", "nodes": ["node_modules/external-editor"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109538, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": ">=4.0.0 <4.0.4"}, {"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": ">=4.0.0 <4.0.4 || <2.5.4", "nodes": ["", "", "node_modules/request/node_modules/form-data"], "fixAvailable": {"name": "mwbot", "version": "0.1.5", "isSemVerMajor": true}}, "inquirer": {"name": "inquirer", "severity": "low", "isDirect": false, "via": ["external-editor"], "effects": ["@wdio/cli"], "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7", "nodes": ["node_modules/inquirer"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": [], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "mwbot", "version": "0.1.5", "isSemVerMajor": true}}, "openapi-validator": {"name": "openapi-validator", "severity": "high", "isDirect": false, "via": ["axios"], "effects": ["chai-openapi-response-validator"], "range": ">=0.14.2-alpha.0", "nodes": ["node_modules/openapi-validator"], "fixAvailable": {"name": "chai-openapi-response-validator", "version": "0.14.1", "isSemVerMajor": true}}, "puppeteer-core": {"name": "puppeteer-core", "severity": "high", "isDirect": false, "via": ["tar-fs", "ws"], "effects": ["devtools", "webdriverio"], "range": "10.0.0 - 22.11.1", "nodes": ["node_modules/devtools/node_modules/puppeteer-core", "node_modules/puppeteer-core"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "mwbot", "version": "0.1.5", "isSemVerMajor": true}}, "tar-fs": {"name": "tar-fs", "severity": "high", "isDirect": false, "via": [{"source": 1109532, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.4"}, {"source": 1109543, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.3"}, {"source": 1109552, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": ">=2.0.0 <2.1.2"}], "effects": ["puppeteer-core"], "range": "2.0.0 - 2.1.3", "nodes": ["node_modules/tar-fs"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "low", "isDirect": false, "via": [{"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}], "effects": ["external-editor"], "range": "<=0.2.3", "nodes": ["", "node_modules/tmp"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "mwbot", "version": "0.1.5", "isSemVerMajor": true}}, "validator": {"name": "validator", "severity": "moderate", "isDirect": false, "via": [{"source": 1109241, "name": "validator", "dependency": "validator", "title": "validator.js has a URL validation bypass vulnerability in its isURL function", "url": "https://github.com/advisories/GHSA-9965-vmph-33xx", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<13.15.20"}], "effects": [], "range": "<13.15.20", "nodes": [""], "fixAvailable": true}, "webdriverio": {"name": "webdriverio", "severity": "high", "isDirect": false, "via": ["devtools", "puppeteer-core"], "effects": ["@wdio/cli", "@wdio/runner"], "range": "7.16.5 - 8.46.0", "nodes": ["node_modules/webdriverio"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "ws": {"name": "ws", "severity": "high", "isDirect": false, "via": [{"source": 1098392, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": ["CWE-476"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=8.0.0 <8.17.1"}], "effects": ["puppeteer-core"], "range": "8.0.0 - 8.17.0", "nodes": ["node_modules/devtools/node_modules/ws", "node_modules/puppeteer-core/node_modules/ws"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}, "yarn-install": {"name": "yarn-install", "severity": "high", "isDirect": false, "via": ["cross-spawn"], "effects": ["@wdio/cli"], "range": "*", "nodes": ["node_modules/yarn-install"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.0", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 3, "moderate": 3, "high": 15, "critical": 2, "total": 23}, "dependencies": {"prod": 1, "dev": 1483, "optional": 4, "peer": 1, "peerOptional": 0, "total": 1483}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated @types/easy-table@1.2.0: This is a stub types definition. easy-table provides its own type definitions, so you do not need this installed.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated date-format@0.0.2: 0.x is no longer supported. Please upgrade to 4.x or higher.
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
--- stdout ---

added 1482 packages, and audited 1483 packages in 24s

168 packages are looking for funding
  run `npm fund` for details

# npm audit report

axios  <=0.30.1
Severity: high
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Axios is vulnerable to DoS attack through lack of data size check - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
fix available via `npm audit fix --force`
Will install chai-openapi-response-validator@0.14.1, which is a breaking change
node_modules/axios
  openapi-validator  >=0.14.2-alpha.0
  Depends on vulnerable versions of axios
  node_modules/openapi-validator
    chai-openapi-response-validator  0.11.2 || >=0.14.2-alpha.0
    Depends on vulnerable versions of openapi-validator
    node_modules/chai-openapi-response-validator

cross-spawn  <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.0, which is a breaking change
node_modules/yarn-install/node_modules/cross-spawn
  yarn-install  *
  Depends on vulnerable versions of cross-spawn
  node_modules/yarn-install
    @wdio/cli  <=9.0.0-alpha.426
    Depends on vulnerable versions of inquirer
    Depends on vulnerable versions of webdriverio
    Depends on vulnerable versions of yarn-install
    node_modules/@wdio/cli
      @wdio/junit-reporter  6.0.4 - 8.0.0-alpha.631
      Depends on vulnerable versions of @wdio/cli
      node_modules/@wdio/junit-reporter
      @wdio/local-runner  6.0.4 - 8.46.0
      Depends on vulnerable versions of @wdio/cli
      Depends on vulnerable versions of @wdio/runner
      node_modules/@wdio/local-runner
      @wdio/spec-reporter  6.0.4 - 8.0.0-alpha.631
      Depends on vulnerable versions of @wdio/cli
      node_modules/@wdio/spec-reporter

form-data  <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
No fix available
node_modules/request/node_modules/form-data
  request  *
  Depends on vulnerable versions of form-data
  Depends on vulnerable versions of tough-cookie
  node_modules/request
    mwbot  >=0.1.6
    Depends on vulnerable versions of request
    node_modules/mwbot
      wdio-mediawiki  <=5.1.0
      Depends on vulnerable versions of mwbot
      node_modules/wdio-mediawiki


tar-fs  2.0.0 - 2.1.3
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.0, which is a breaking change
node_modules/tar-fs
  puppeteer-core  10.0.0 - 22.11.1
  Depends on vulnerable versions of tar-fs
  Depends on vulnerable versions of ws
  node_modules/devtools/node_modules/puppeteer-core
  node_modules/puppeteer-core
    devtools  >=7.16.5
    Depends on vulnerable versions of puppeteer-core
    node_modules/devtools
    webdriverio  7.16.5 - 8.46.0
    Depends on vulnerable versions of devtools
    Depends on vulnerable versions of puppeteer-core
    node_modules/webdriverio
      @wdio/runner  7.16.5 - 8.46.0
      Depends on vulnerable versions of webdriverio
      node_modules/@wdio/runner

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.0, which is a breaking change
node_modules/tmp
  external-editor  >=1.1.1
  Depends on vulnerable versions of tmp
  node_modules/external-editor
    inquirer  3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
    Depends on vulnerable versions of external-editor
    node_modules/inquirer

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
No fix available
node_modules/tough-cookie

ws  8.0.0 - 8.17.0
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.0, which is a breaking change
node_modules/devtools/node_modules/ws
node_modules/puppeteer-core/node_modules/ws

23 vulnerabilities (3 low, 3 moderate, 15 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@1.23.0',
npm WARN EBADENGINE   required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated @types/easy-table@1.2.0: This is a stub types definition. easy-table provides its own type definitions, so you do not need this installed.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated date-format@0.0.2: 0.x is no longer supported. Please upgrade to 4.x or higher.
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
--- stdout ---

added 1482 packages, and audited 1483 packages in 29s

168 packages are looking for funding
  run `npm fund` for details

23 vulnerabilities (3 low, 3 moderate, 15 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stderr ---
PASS tests/jest/mediawiki.special.block/stores/block.test.js
PASS tests/jest/mediawiki.special.block/BlockLog.test.js
PASS tests/jest/mediawiki.special.block/UserLookup.test.js
PASS tests/jest/mediawiki.special.block/ExpiryField.test.js
PASS tests/jest/mediawiki.skinning.typeaheadSearch/restSearchClient.test.js
PASS tests/jest/mediawiki.special.block/util.test.js
PASS tests/jest/mediawiki.skinning.typeaheadSearch/fetch.test.js
PASS tests/jest/mediawiki.special.block/NamespacesField.test.js
PASS tests/jest/mediawiki.skinning.typeaheadSearch/instrumentation.test.js
PASS tests/jest/mediawiki.special.block/BlockDetailsField.test.js
PASS tests/jest/mediawiki.special.block/ReasonField.test.js
PASS tests/jest/mediawiki.special.block/init.test.js
PASS tests/jest/mediawiki.special.block/AdditionalDetailsField.test.js
PASS tests/jest/mediawiki.skinning.typeaheadSearch/App.test.js
PASS tests/jest/mediawiki.skinning.typeaheadSearch/urlGenerator.test.js
PASS tests/jest/mediawiki.special.block/SpecialBlock.test.js (19.661 s)

Test Suites: 16 passed, 16 total
Tests:       99 passed, 99 total
Snapshots:   1 passed, 1 total
Time:        28.49 s
Ran all test suites.
--- stdout ---

> test
> grunt lint && npm run doc && npm run jest

Running "eslint:all" (eslint) task

/src/repo/resources/src/jquery/jquery.makeCollapsible.js
  425:1  warning  Syntax error in namepath: ~'wikipage.collapsibleContent'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.action.edit/edit.js
  12:1  warning  Syntax error in namepath: ~'wikipage.editform'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.action/mediawiki.action.view.postEdit.js
  21:1  warning  Syntax error in namepath: ~'postEdit'               jsdoc/valid-types
  36:1  warning  Syntax error in namepath: ~'postEdit.afterRemoval'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.authenticationPopup/index.js
  38:1  warning  The type 'userinfo' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.base/errorLogger.js
   8:1  warning  Syntax error in namepath: ~'global.error'  jsdoc/valid-types
  22:1  warning  Syntax error in namepath: ~'error.caught'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.base/log.js
  14:1  warning  Found more than one @return declaration  jsdoc/require-returns
  14:1  warning  Found more than one @return declaration  jsdoc/require-returns-check

/src/repo/resources/src/mediawiki.base/mediawiki.base.js
  217:1  warning  The type 'mediawiki' is undefined  jsdoc/no-undefined-types
  243:1  warning  The type 'mediawiki' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.debug/debug.js
  1:1  warning  Unused eslint-disable directive (no problems were reported from 'es-x/no-array-prototype-includes')

/src/repo/resources/src/mediawiki.diff/inlineFormatToggle.js
  150:1  warning  Syntax error in namepath: ~'wikipage.diff.wikitextDiffBody'  jsdoc/valid-types
  162:1  warning  Syntax error in namepath: ~'wikipage.diff.diffTypeSwitch'    jsdoc/valid-types

/src/repo/resources/src/mediawiki.editRecovery/edit.js
  184:1  warning  Syntax error in namepath: ~'editRecovery.loadEnd'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.htmlform/cond-state.js
  48:1  warning  Found more than one @return declaration  jsdoc/require-returns-check

/src/repo/resources/src/mediawiki.htmlform/htmlform.js
  5:1  warning  Syntax error in namepath: ~'htmlform.enhance'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.inspect.js
   61:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
   91:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
  112:2  warning  Found more than one @return declaration  jsdoc/require-returns
  112:2  warning  Found more than one @return declaration  jsdoc/require-returns-check
  121:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
  152:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
  164:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
  175:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types
  203:1  warning  The type 'mediawiki' is undefined        jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.jqueryMsg/mediawiki.jqueryMsg.js
  142:1  warning  Found more than one @return declaration  jsdoc/require-returns
  142:1  warning  Found more than one @return declaration  jsdoc/require-returns-check

/src/repo/resources/src/mediawiki.language.months/months.js
  44:1  warning  The type 'Months' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.notification.convertmessagebox.js
  13:1  warning  Syntax error in namepath: (require("mediawiki.notification.convertmessagebox"))  jsdoc/valid-types

/src/repo/resources/src/mediawiki.page.preview.js
  416:1  warning  Syntax error in namepath: ~'wikipage.tableOfContents'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.page.ready/ready.js
   96:1  warning  Syntax error in namepath: ~'wikipage.indicators'  jsdoc/valid-types
  116:1  warning  Syntax error in namepath: ~'wikipage.content'     jsdoc/valid-types
  137:1  warning  Syntax error in namepath: ~'wikipage.categories'  jsdoc/valid-types
  153:1  warning  Syntax error in namepath: ~'wikipage.diff'        jsdoc/valid-types
  184:1  warning  Syntax error in namepath: ~'skin.logout'          jsdoc/valid-types

/src/repo/resources/src/mediawiki.page.watch.ajax/watch-ajax.js
  128:1  warning  Syntax error in namepath: ~'wikipage.watchlistChange'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.rcfilters/Controller.js
  330:1  warning  Found more than one @return declaration                  jsdoc/require-returns
  330:1  warning  Found more than one @return declaration                  jsdoc/require-returns-check
  550:1  warning  Syntax error in namepath: ~'RcFilters.highlight.enable'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.rcfilters/dm/FilterItem.js
   81:1  warning  Found more than one @return declaration  jsdoc/require-returns
   81:1  warning  Found more than one @return declaration  jsdoc/require-returns-check
  335:1  warning  The type 'update' is undefined           jsdoc/no-undefined-types
  351:1  warning  The type 'update' is undefined           jsdoc/no-undefined-types
  366:1  warning  The type 'update' is undefined           jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.rcfilters/dm/FiltersViewModel.js
  1185:1  warning  The type 'searchChange' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.rcfilters/mw.rcfilters.js
  176:1  warning  Syntax error in namepath: ~'structuredChangeFilters.ui.initialized'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.rcfilters/ui/FilterTagMultiselectWidget.js
  400:1  warning  Syntax error in namepath: ~'RcFilters.popup.open'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.searchSuggest/searchSuggest.js
  36:1  warning  The type 'ResponseMetaData' is undefined  jsdoc/no-undefined-types
  43:1  warning  The type 'ResponseFunction' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.skinning.typeaheadSearch/App.vue
  221:1  warning  The type 'AbortableSearchFetch' is undefined  jsdoc/no-undefined-types
  256:1  warning  The type 'SearchSubmitEvent' is undefined     jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.skinning.typeaheadSearch/fetch.js
  21:1  warning  The type 'RequestInit' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.skinning.typeaheadSearch/instrumentation.js
   2:1  warning  The type 'FetchEndEvent' is undefined         jsdoc/no-undefined-types
  16:1  warning  The type 'SuggestionClickEvent' is undefined  jsdoc/no-undefined-types
  16:1  warning  The type 'SearchSubmitEvent' is undefined     jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.skinning.typeaheadSearch/restSearchClient.js
   4:1  warning  Syntax error in type: import('./urlGenerator.js').UrlGenerator  jsdoc/valid-types
  11:1  warning  The type 'RestResult' is undefined                              jsdoc/no-undefined-types
  17:1  warning  The type 'SearchResult' is undefined                            jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.skinning.typeaheadSearch/urlGenerator.js
   2:1  warning  The type 'Record' is undefined        jsdoc/no-undefined-types
   9:1  warning  The type 'RestResult' is undefined    jsdoc/no-undefined-types
   9:1  warning  The type 'SearchResult' is undefined  jsdoc/no-undefined-types
  29:1  warning  The type 'RestResult' is undefined    jsdoc/no-undefined-types
  29:1  warning  The type 'SearchResult' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.special.apisandbox/ApiSandboxLayout.js
  44:1  warning  Found more than one @return declaration  jsdoc/require-returns
  44:1  warning  Found more than one @return declaration  jsdoc/require-returns-check

/src/repo/resources/src/mediawiki.special.block/init.js
  26:1  warning  Syntax error in namepath: ~'SpecialBlock.block'  jsdoc/valid-types
  36:1  warning  Syntax error in namepath: ~'SpecialBlock.form'   jsdoc/valid-types

/src/repo/resources/src/mediawiki.template.js
   26:1  warning  The type 'TemplateRenderer' is undefined         jsdoc/no-undefined-types
   40:1  warning  The type 'TemplateRenderFunction' is undefined   jsdoc/no-undefined-types
   45:1  warning  The type 'TemplateCompileFunction' is undefined  jsdoc/no-undefined-types
   61:1  warning  The type 'TemplateCompiler' is undefined         jsdoc/no-undefined-types
   88:1  warning  The type 'TemplateCompiler' is undefined         jsdoc/no-undefined-types
  107:1  warning  The type 'TemplateRenderer' is undefined         jsdoc/no-undefined-types
  125:1  warning  The type 'TemplateRenderer' is undefined         jsdoc/no-undefined-types
  147:1  warning  The type 'TemplateRenderer' is undefined         jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.util/util.js
  626:1  warning  Syntax error in namepath: ~'util.addPortlet'      jsdoc/valid-types
  795:1  warning  Syntax error in namepath: ~'util.addPortletLink'  jsdoc/valid-types

/src/repo/resources/src/mediawiki.widgets.datetime/DateTimeFormatter.js
  268:1  warning  The type 'FieldSpecificationObject' is undefined  jsdoc/no-undefined-types
  632:1  warning  The type 'CalendarGridData' is undefined          jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.widgets.datetime/DiscordianDateTimeFormatter.js
  74:1  warning  The type 'FieldSpecificationObject' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.widgets.datetime/ProlepticGregorianDateTimeFormatter.js
  306:1  warning  The type 'FieldSpecificationObject' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/mediawiki.widgets/mw.widgets.NamespaceInputWidget.js
  50:1  warning  The type 'DropdownOptions' is undefined  jsdoc/no-undefined-types

/src/repo/resources/src/startup/mediawiki.loader.js
  61:1  warning  Syntax error in namepath: ~'resourceloader.exception'  jsdoc/valid-types

/src/repo/resources/src/startup/startup.js
  48:3  warning  Unused eslint-disable directive (no problems were reported from 'es-x/no-promise')
  72:3  warning  Unused eslint-disable directive (no problems were reported from 'es-x/no-regexp-prototype-flags')

/src/repo/tests/qunit/data/testrunner.js
  112:2  warning  Missing JSDoc @return declaration  jsdoc/require-returns

/src/repo/tests/selenium/wdio-mediawiki/Util.js
  35:1  warning  This line has a length of 107. Maximum allowed is 100  max-len

/src/repo/tests/selenium/wdio-mediawiki/wdio-defaults.conf.js
  84:1  warning  This line has a length of 108. Maximum allowed is 100  max-len

✖ 89 problems (0 errors, 89 warnings)
  0 errors and 3 warnings potentially fixable with the `--fix` option.


Running "banana:core" (banana) task
>> 1 message directory checked.

Running "banana:codex" (banana) task
>> 1 message directory checked.

Running "banana:datetime" (banana) task
>> 1 message directory checked.

Running "banana:exif" (banana) task
>> 1 message directory checked.

Running "banana:preferences" (banana) task
>> 1 message directory checked.

Running "banana:api" (banana) task
>> 1 message directory checked.

Running "banana:rest" (banana) task
>> 1 message directory checked.

Running "banana:installer" (banana) task
>> 1 message directory checked.

Running "banana:paramvalidator" (banana) task
>> 1 message directory checked.

Running "stylelint:resources" (stylelint) task
>> resources/src/mediawiki.skinning/content.media-dark.less
>>   32:1  ⚠  Unexpected browser feature "prefers-color-scheme" is not supported by Firefox 49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66, Chrome 49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75, Safari 10,11,12,10.1,11.1, Safari on iOS 10.0-10.2,10.3,11.0-11.2,11.3-11.4,12.0-12.1,12.2-12.5  plugin/no-unsupported-browser-features
>> 
>> ⚠ 1 problem (0 errors, 1 warning)

⚠ 1 warning

>> Linted 213 files without errors

Running "stylelint:config" (stylelint) task
>> Linted 1 files without errors

Done.

> doc
> jsdoc -c jsdoc.json


> jest
> jest --config tests/jest/jest.config.js

------------------------------------|---------|----------|---------|---------|---------------------------------------------------------
File                                | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                                       
------------------------------------|---------|----------|---------|---------|---------------------------------------------------------
All files                           |   93.36 |       90 |   81.05 |   93.36 |                                                         
 mediawiki.skinning.typeaheadSearch |   84.36 |    78.37 |   66.66 |   84.36 |                                                         
  App.vue                           |   76.15 |    66.66 |      40 |   76.15 | 181-194,204-217,225-252,259-261,265,269-270,274-278     
  fetch.js                          |   90.74 |    71.42 |      75 |   90.74 | 38-42                                                   
  instrumentation.js                |   82.82 |      100 |      60 |   82.82 | 4-13,18-24                                              
  restSearchClient.js               |     100 |    76.92 |     100 |     100 | 28,45-49                                                
  urlGenerator.js                   |   88.13 |       80 |     100 |   88.13 | 42-48                                                   
 mediawiki.special.block            |   94.35 |    92.85 |   82.35 |   94.35 |                                                         
  SpecialBlock.vue                  |   93.89 |    93.18 |   72.72 |   93.89 | 245-254,297-302,308-322,440-441,452-454                 
  init.js                           |     100 |      100 |     100 |     100 |                                                         
  util.js                           |   94.64 |     90.9 |     100 |   94.64 | 82-84,86-88                                             
 mediawiki.special.block/components |   95.08 |    92.34 |    87.8 |   95.08 |                                                         
  AdditionalDetailsField.vue        |     100 |       80 |     100 |     100 | 68                                                      
  BlockDetailsField.vue             |     100 |      100 |     100 |     100 |                                                         
  BlockLog.vue                      |   98.94 |      100 |   83.33 |   98.94 | 337-340,401                                             
  BlockTypeField.vue                |   95.04 |       50 |     100 |   95.04 | 73-77                                                   
  ConfirmationDialog.vue            |   96.34 |      100 |      50 |   96.34 | 70-72                                                   
  ExpiryField.vue                   |   95.07 |    89.47 |     100 |   95.07 | 145-146,148-149,177-186,245-246                         
  NamespacesField.vue               |   90.42 |    88.88 |   66.66 |   90.42 | 60-68                                                   
  PagesField.vue                    |   70.06 |       50 |      50 |   70.06 | 46-47,56-57,72-79,88-90,97-118,127-133                  
  ReasonField.vue                   |   97.14 |    93.75 |     100 |   97.14 | 98-101                                                  
  UserLookup.vue                    |   97.68 |    97.43 |     100 |   97.68 | 144-146,195-197,230-231                                 
  ValidatingTextInput.js            |     100 |      100 |     100 |     100 |                                                         
 mediawiki.special.block/stores     |   95.65 |    87.77 |      90 |   95.65 |                                                         
  block.js                          |   95.65 |    87.77 |      90 |   95.65 | 322-323,432-433,435-436,456-457,460-461,464-465,479-494 
------------------------------------|---------|----------|---------|---------|---------------------------------------------------------

--- end ---
{}
{"1109241": {"source": 1109241, "name": "validator", "dependency": "validator", "title": "validator.js has a URL validation bypass vulnerability in its isURL function", "url": "https://github.com/advisories/GHSA-9965-vmph-33xx", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<13.15.20"}}
Upgrading n:validator from 13.7.0 -> 13.15.23
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
build: Updating validator to 13.15.23

* https://github.com/advisories/GHSA-9965-vmph-33xx

$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmprtmo5y0u
--- stdout ---
[REL1_44 3aaf431] build: Updating validator to 13.15.23
 1 file changed, 37 insertions(+), 36 deletions(-)

--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 3aaf431e4c5c6b17659c66da0529c5d1061964b1 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Thu, 13 Nov 2025 00:34:05 +0000
Subject: [PATCH] build: Updating validator to 13.15.23

* https://github.com/advisories/GHSA-9965-vmph-33xx

Change-Id: I5e96192a3c5737b801b9b8eaed01af8a935c7802
---
 package-lock.json | 73 ++++++++++++++++++++++++-----------------------
 1 file changed, 37 insertions(+), 36 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3de5b48..f33706e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3947,15 +3947,15 @@
 			}
 		},
 		"node_modules/@types/request/node_modules/form-data": {
-			"version": "2.5.3",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.3.tgz",
-			"integrity": "sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==",
+			"version": "2.5.5",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
+			"integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
 			"dev": true,
-			"license": "MIT",
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.35",
 				"safe-buffer": "^5.2.1"
 			},
@@ -9052,14 +9052,15 @@
 			}
 		},
 		"node_modules/form-data": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
-			"integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+			"integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
 			"dev": true,
 			"dependencies": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.12"
 			},
 			"engines": {
@@ -12757,9 +12758,9 @@
 			}
 		},
 		"node_modules/karma/node_modules/tmp": {
-			"version": "0.2.3",
-			"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-			"integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+			"version": "0.2.5",
+			"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+			"integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
 			"dev": true,
 			"engines": {
 				"node": ">=14.14"
@@ -17448,9 +17449,9 @@
 			}
 		},
 		"node_modules/validator": {
-			"version": "13.7.0",
-			"resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
-			"integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
+			"version": "13.15.23",
+			"resolved": "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz",
+			"integrity": "sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==",
 			"dev": true,
 			"engines": {
 				"node": ">= 0.10"
@@ -17571,8 +17572,13 @@
 			}
 		},
 		"node_modules/wdio-mediawiki": {
-			"resolved": "tests/selenium/wdio-mediawiki",
-			"link": true
+			"version": "2.7.1",
+			"resolved": "file:tests/selenium/wdio-mediawiki",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"mwbot": "2.1.3"
+			}
 		},
 		"node_modules/webdriver": {
 			"version": "7.40.0",
@@ -18217,14 +18223,6 @@
 			"engines": {
 				"node": ">= 10"
 			}
-		},
-		"tests/selenium/wdio-mediawiki": {
-			"version": "2.7.1",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"mwbot": "2.1.3"
-			}
 		}
 	},
 	"dependencies": {
@@ -21144,14 +21142,15 @@
 			},
 			"dependencies": {
 				"form-data": {
-					"version": "2.5.3",
-					"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.3.tgz",
-					"integrity": "sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==",
+					"version": "2.5.5",
+					"resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
+					"integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
 					"dev": true,
 					"requires": {
 						"asynckit": "^0.4.0",
 						"combined-stream": "^1.0.8",
 						"es-set-tostringtag": "^2.1.0",
+						"hasown": "^2.0.2",
 						"mime-types": "^2.1.35",
 						"safe-buffer": "^5.2.1"
 					}
@@ -24969,14 +24968,15 @@
 			"dev": true
 		},
 		"form-data": {
-			"version": "4.0.2",
-			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.2.tgz",
-			"integrity": "sha512-hGfm/slu0ZabnNt4oaRZ6uREyfCj6P4fT/n6A1rGV+Z0VdGXjfOhVUpkn6qVQONHGIFwmveGXyDs75+nr6FM8w==",
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+			"integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
 			"dev": true,
 			"requires": {
 				"asynckit": "^0.4.0",
 				"combined-stream": "^1.0.8",
 				"es-set-tostringtag": "^2.1.0",
+				"hasown": "^2.0.2",
 				"mime-types": "^2.1.12"
 			}
 		},
@@ -27707,9 +27707,9 @@
 					"dev": true
 				},
 				"tmp": {
-					"version": "0.2.3",
-					"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-					"integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+					"version": "0.2.5",
+					"resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+					"integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
 					"dev": true
 				},
 				"yargs": {
@@ -31315,9 +31315,9 @@
 			}
 		},
 		"validator": {
-			"version": "13.7.0",
-			"resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
-			"integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
+			"version": "13.15.23",
+			"resolved": "https://registry.npmjs.org/validator/-/validator-13.15.23.tgz",
+			"integrity": "sha512-4yoz1kEWqUjzi5zsPbAS/903QXSYp0UOtHsPpp7p9rHAw/W+dkInskAE386Fat3oKRROwO98d9ZB0G4cObgUyw==",
 			"dev": true
 		},
 		"vary": {
@@ -31405,7 +31405,8 @@
 			}
 		},
 		"wdio-mediawiki": {
-			"version": "file:tests/selenium/wdio-mediawiki",
+			"version": "2.7.1",
+			"dev": true,
 			"requires": {
 				"mwbot": "2.1.3"
 			}
-- 
2.47.3


--- end ---