This run took 613 seconds.
$ date
--- stdout ---
Fri Nov 28 00:13:53 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-Wikibase.git repo --depth=1 -b REL1_45
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stderr ---
Submodule 'lib/resources/wikibase-api' (https://gerrit.wikimedia.org/r/wikibase/javascript-api) registered for path 'lib/resources/wikibase-api'
Submodule 'view/lib/wikibase-data-model' (https://phabricator.wikimedia.org/source/wikibase-data-model.git) registered for path 'view/lib/wikibase-data-model'
Submodule 'view/lib/wikibase-data-values' (https://phabricator.wikimedia.org/source/datavalues-javascript.git) registered for path 'view/lib/wikibase-data-values'
Submodule 'view/lib/wikibase-data-values-value-view' (https://gerrit.wikimedia.org/r/data-values/value-view) registered for path 'view/lib/wikibase-data-values-value-view'
Submodule 'view/lib/wikibase-serialization' (https://phabricator.wikimedia.org/source/wikibase-serialization.git) registered for path 'view/lib/wikibase-serialization'
Submodule 'view/lib/wikibase-termbox' (https://gerrit.wikimedia.org/r/wikibase/termbox) registered for path 'view/lib/wikibase-termbox'
Cloning into '/src/repo/lib/resources/wikibase-api'...
Cloning into '/src/repo/view/lib/wikibase-data-model'...
Cloning into '/src/repo/view/lib/wikibase-data-values'...
Cloning into '/src/repo/view/lib/wikibase-data-values-value-view'...
Cloning into '/src/repo/view/lib/wikibase-serialization'...
Cloning into '/src/repo/view/lib/wikibase-termbox'...
--- stdout ---
Submodule path 'lib/resources/wikibase-api': checked out '7f076e3534686ab35f7807462539fcef08b6e9f2'
Submodule path 'view/lib/wikibase-data-model': checked out '6b304daeb804591ddc4520925337429ac086515c'
Submodule path 'view/lib/wikibase-data-values': checked out '457733ebe7b0d090a67e2623350be2e4286077fe'
Submodule path 'view/lib/wikibase-data-values-value-view': checked out '7d7ff681d26da4ae7947bf444d28f507982064c8'
Submodule path 'view/lib/wikibase-serialization': checked out 'e9b9a736f19e42497bfe45cb6f323781b00b5023'
Submodule path 'view/lib/wikibase-termbox': checked out '87f5df732da97a7acd29b20bfd4f1aedff509fbf'
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/REL1_45
--- stdout ---
63dcfe5b3c72086185c243323635541f24757468 refs/heads/REL1_45
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@puppeteer/browsers": {
"name": "@puppeteer/browsers",
"severity": "high",
"isDirect": false,
"via": [
"tar-fs"
],
"effects": [
"@wdio/utils",
"puppeteer-core"
],
"range": "1.4.2 - 2.2.3",
"nodes": [
"node_modules/@puppeteer/browsers"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"inquirer",
"webdriverio"
],
"effects": [],
"range": "<=7.0.8 || 7.12.6 - 9.0.0-alpha.426 || 9.16.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/config": {
"name": "@wdio/config",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/config",
"node_modules/@wdio/globals/node_modules/@wdio/config",
"node_modules/@wdio/runner/node_modules/@wdio/config",
"node_modules/devtools/node_modules/@wdio/config",
"node_modules/expect-webdriverio/node_modules/@wdio/config"
],
"fixAvailable": true
},
"@wdio/globals": {
"name": "@wdio/globals",
"severity": "high",
"isDirect": false,
"via": [
"expect-webdriverio",
"webdriverio"
],
"effects": [
"@wdio/cli",
"@wdio/runner"
],
"range": "<=9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/globals"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/local-runner": {
"name": "@wdio/local-runner",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/runner"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/local-runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/runner": {
"name": "@wdio/runner",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"expect-webdriverio",
"webdriver",
"webdriverio"
],
"effects": [
"@wdio/local-runner"
],
"range": "7.16.5 - 9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/utils": {
"name": "@wdio/utils",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers"
],
"effects": [
"@wdio/cli",
"@wdio/config",
"@wdio/mocha-framework",
"@wdio/runner",
"devtools",
"webdriver",
"webdriverio"
],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/utils",
"node_modules/@wdio/globals/node_modules/@wdio/utils",
"node_modules/@wdio/mocha-framework/node_modules/@wdio/utils",
"node_modules/@wdio/runner/node_modules/@wdio/utils",
"node_modules/devtools/node_modules/@wdio/utils",
"node_modules/expect-webdriverio/node_modules/@wdio/utils"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"devtools": {
"name": "devtools",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"puppeteer-core"
],
"effects": [],
"range": ">=7.16.5",
"nodes": [
"node_modules/devtools"
],
"fixAvailable": true
},
"expect-webdriverio": {
"name": "expect-webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/globals",
"webdriverio"
],
"effects": [
"@wdio/globals",
"@wdio/runner"
],
"range": "4.0.0-alpha.0 - 4.0.0-alpha.6 || 4.0.1 - 5.0.0-alpha.2",
"nodes": [
"node_modules/expect-webdriverio"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": false
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"@wdio/cli"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/inquirer"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki",
"wdio-wikibase"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": false
},
"puppeteer-core": {
"name": "puppeteer-core",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers",
"ws"
],
"effects": [
"devtools",
"webdriverio"
],
"range": "11.0.0 - 22.13.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/puppeteer-core",
"node_modules/@wdio/globals/node_modules/puppeteer-core",
"node_modules/@wdio/runner/node_modules/puppeteer-core",
"node_modules/devtools/node_modules/puppeteer-core",
"node_modules/expect-webdriverio/node_modules/puppeteer-core"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1109534,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.1.1"
},
{
"source": 1109542,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.9"
},
{
"source": 1109551,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=3.0.0 <3.0.7"
}
],
"effects": [
"@puppeteer/browsers"
],
"range": "3.0.0 - 3.1.0",
"nodes": [
"node_modules/@puppeteer/browsers/node_modules/tar-fs"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1109537,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/tmp"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"wdio-wikibase": {
"name": "wdio-wikibase",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot",
"wdio-mediawiki"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/wdio-wikibase"
],
"fixAvailable": false
},
"webdriver": {
"name": "webdriver",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriver",
"node_modules/@wdio/globals/node_modules/webdriver",
"node_modules/@wdio/runner/node_modules/webdriver",
"node_modules/expect-webdriverio/node_modules/webdriver"
],
"fixAvailable": true
},
"webdriverio": {
"name": "webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"devtools",
"puppeteer-core",
"webdriver"
],
"effects": [
"@wdio/cli",
"@wdio/globals",
"@wdio/runner",
"expect-webdriverio"
],
"range": "7.16.5 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriverio",
"node_modules/@wdio/globals/node_modules/webdriverio",
"node_modules/@wdio/runner/node_modules/webdriverio",
"node_modules/expect-webdriverio/node_modules/webdriverio"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098392,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=8.0.0 <8.17.1"
}
],
"effects": [
"puppeteer-core"
],
"range": "8.0.0 - 8.17.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/ws",
"node_modules/@wdio/globals/node_modules/ws",
"node_modules/@wdio/runner/node_modules/ws",
"node_modules/devtools/node_modules/ws",
"node_modules/expect-webdriverio/node_modules/ws"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 4,
"high": 15,
"critical": 2,
"total": 24
},
"dependencies": {
"prod": 1,
"dev": 1641,
"optional": 122,
"peer": 112,
"peerOptional": 0,
"total": 1641
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 61 installs, 0 updates, 0 removals
- Locking composer/installers (v2.3.0)
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (3.0.5)
- Locking data-values/common (1.2.0)
- Locking data-values/data-values (3.1.0)
- Locking data-values/geo (4.6.0)
- Locking data-values/interfaces (1.2.0)
- Locking data-values/number (0.13.0)
- Locking data-values/serialization (1.2.5)
- Locking data-values/time (1.2.0)
- Locking dealerdirect/phpcodesniffer-composer-installer (v0.7.2)
- Locking diff/diff (3.4.0)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mck89/peast (v1.17.4)
- Locking mediawiki/mediawiki-codesniffer (v48.0.0)
- Locking mediawiki/mediawiki-phan-config (0.17.0)
- Locking mediawiki/minus-x (1.1.3)
- Locking mediawiki/phan-taint-check-plugin (7.0.0)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking onoi/message-reporter (1.4.2)
- Locking phan/phan (5.5.1)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpat/phpat (0.11.10)
- Locking phpcsstandards/phpcsextra (1.4.0)
- Locking phpcsstandards/phpcsutils (1.1.1)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.3.0)
- Locking phpdocumentor/type-resolver (1.6.2)
- Locking phpstan/phpdoc-parser (0.4.9)
- Locking phpstan/phpstan (2.1.32)
- Locking psr/clock (1.0.0)
- Locking psr/container (2.0.2)
- Locking psr/http-message (1.1)
- Locking psr/log (1.1.4)
- Locking psr/simple-cache (1.0.1)
- Locking sabre/event (5.1.7)
- Locking serialization/serialization (4.1.0)
- Locking slevomat/coding-standard (6.4.1)
- Locking squizlabs/php_codesniffer (3.13.2)
- Locking swaggest/json-diff (v3.12.1)
- Locking symfony/console (v7.4.0)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/polyfill-php80 (v1.33.0)
- Locking symfony/service-contracts (v3.6.1)
- Locking symfony/string (v8.0.0)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (1.12.1)
- Locking webonyx/graphql-php (v15.26.0)
- Locking wikimedia/at-ease (v3.0.0)
- Locking wikimedia/purtle (v2.0.0)
- Locking wikimedia/timestamp (v5.0.0)
- Locking wmde/php-vuejs-templating (2.2.0-beta.8)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 61 installs, 0 updates, 0 removals
- Downloading webonyx/graphql-php (v15.26.0)
- Downloading wmde/php-vuejs-templating (2.2.0-beta.8)
0/2 [>---------------------------] 0%
1/2 [==============>-------------] 50%
2/2 [============================] 100%
- Installing composer/installers (v2.3.0): Extracting archive
- Installing squizlabs/php_codesniffer (3.13.2): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v0.7.2): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing data-values/interfaces (1.2.0): Extracting archive
- Installing data-values/data-values (3.1.0): Extracting archive
- Installing data-values/geo (4.6.0): Extracting archive
- Installing data-values/common (1.2.0): Extracting archive
- Installing data-values/number (0.13.0): Extracting archive
- Installing serialization/serialization (4.1.0): Extracting archive
- Installing data-values/serialization (1.2.5): Extracting archive
- Installing data-values/time (1.2.0): Extracting archive
- Installing diff/diff (3.4.0): Extracting archive
- Installing phpcsstandards/phpcsutils (1.1.1): Extracting archive
- Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v48.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v8.0.0): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.1): Extracting archive
- Installing symfony/console (v7.4.0): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing webmozart/assert (1.12.1): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing phpdocumentor/type-resolver (1.6.2): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (1.1.4): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (5.5.1): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (7.0.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.17.0): Extracting archive
- Installing mediawiki/minus-x (1.1.3): Extracting archive
- Installing onoi/message-reporter (1.4.2): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
- Installing phpstan/phpstan (2.1.32): Extracting archive
- Installing phpat/phpat (0.11.10): Extracting archive
- Installing psr/http-message (1.1): Extracting archive
- Installing psr/simple-cache (1.0.1): Extracting archive
- Installing phpstan/phpdoc-parser (0.4.9): Extracting archive
- Installing slevomat/coding-standard (6.4.1): Extracting archive
- Installing swaggest/json-diff (v3.12.1): Extracting archive
- Installing webonyx/graphql-php (v15.26.0): Extracting archive
- Installing wikimedia/at-ease (v3.0.0): Extracting archive
- Installing wikimedia/purtle (v2.0.0): Extracting archive
- Installing psr/clock (1.0.0): Extracting archive
- Installing wikimedia/timestamp (v5.0.0): Extracting archive
- Installing mck89/peast (v1.17.4): Extracting archive
- Installing wmde/php-vuejs-templating (2.2.0-beta.8): Extracting archive
0/58 [>---------------------------] 0%
28/58 [=============>--------------] 48%
39/58 [==================>---------] 67%
52/58 [=========================>--] 89%
58/58 [============================] 100%
3 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
23 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils,../../slevomat/coding-standard
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@puppeteer/browsers": {
"name": "@puppeteer/browsers",
"severity": "high",
"isDirect": false,
"via": [
"tar-fs"
],
"effects": [
"@wdio/utils",
"puppeteer-core"
],
"range": "1.4.2 - 2.2.3",
"nodes": [
"node_modules/@puppeteer/browsers"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"inquirer",
"webdriverio"
],
"effects": [],
"range": "<=7.0.8 || 7.12.6 - 9.0.0-alpha.426 || 9.16.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/config": {
"name": "@wdio/config",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/config",
"node_modules/@wdio/globals/node_modules/@wdio/config",
"node_modules/@wdio/runner/node_modules/@wdio/config",
"node_modules/devtools/node_modules/@wdio/config",
"node_modules/expect-webdriverio/node_modules/@wdio/config"
],
"fixAvailable": true
},
"@wdio/globals": {
"name": "@wdio/globals",
"severity": "high",
"isDirect": false,
"via": [
"expect-webdriverio",
"webdriverio"
],
"effects": [
"@wdio/cli",
"@wdio/runner"
],
"range": "<=9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/globals"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/local-runner": {
"name": "@wdio/local-runner",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/runner"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/local-runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/runner": {
"name": "@wdio/runner",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"expect-webdriverio",
"webdriver",
"webdriverio"
],
"effects": [
"@wdio/local-runner"
],
"range": "7.16.5 - 9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/utils": {
"name": "@wdio/utils",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers"
],
"effects": [
"@wdio/cli",
"@wdio/config",
"@wdio/mocha-framework",
"@wdio/runner",
"devtools",
"webdriver",
"webdriverio"
],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/utils",
"node_modules/@wdio/globals/node_modules/@wdio/utils",
"node_modules/@wdio/mocha-framework/node_modules/@wdio/utils",
"node_modules/@wdio/runner/node_modules/@wdio/utils",
"node_modules/devtools/node_modules/@wdio/utils",
"node_modules/expect-webdriverio/node_modules/@wdio/utils"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"devtools": {
"name": "devtools",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"puppeteer-core"
],
"effects": [],
"range": ">=7.16.5",
"nodes": [
"node_modules/devtools"
],
"fixAvailable": true
},
"expect-webdriverio": {
"name": "expect-webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/globals",
"webdriverio"
],
"effects": [
"@wdio/globals",
"@wdio/runner"
],
"range": "4.0.0-alpha.0 - 4.0.0-alpha.6 || 4.0.1 - 5.0.0-alpha.2",
"nodes": [
"node_modules/expect-webdriverio"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"@wdio/cli"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/inquirer"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki",
"wdio-wikibase"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"puppeteer-core": {
"name": "puppeteer-core",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers",
"ws"
],
"effects": [
"devtools",
"webdriverio"
],
"range": "11.0.0 - 22.13.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/puppeteer-core",
"node_modules/@wdio/globals/node_modules/puppeteer-core",
"node_modules/@wdio/runner/node_modules/puppeteer-core",
"node_modules/devtools/node_modules/puppeteer-core",
"node_modules/expect-webdriverio/node_modules/puppeteer-core"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1109534,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.1.1"
},
{
"source": 1109542,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.9"
},
{
"source": 1109551,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=3.0.0 <3.0.7"
}
],
"effects": [
"@puppeteer/browsers"
],
"range": "3.0.0 - 3.1.0",
"nodes": [
"node_modules/@puppeteer/browsers/node_modules/tar-fs"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1109537,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/tmp"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"wdio-wikibase": {
"name": "wdio-wikibase",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot",
"wdio-mediawiki"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/wdio-wikibase"
],
"fixAvailable": false
},
"webdriver": {
"name": "webdriver",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriver",
"node_modules/@wdio/globals/node_modules/webdriver",
"node_modules/@wdio/runner/node_modules/webdriver",
"node_modules/expect-webdriverio/node_modules/webdriver"
],
"fixAvailable": true
},
"webdriverio": {
"name": "webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"devtools",
"puppeteer-core",
"webdriver"
],
"effects": [
"@wdio/cli",
"@wdio/globals",
"@wdio/runner",
"expect-webdriverio"
],
"range": "7.16.5 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriverio",
"node_modules/@wdio/globals/node_modules/webdriverio",
"node_modules/@wdio/runner/node_modules/webdriverio",
"node_modules/expect-webdriverio/node_modules/webdriverio"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098392,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=8.0.0 <8.17.1"
}
],
"effects": [
"puppeteer-core"
],
"range": "8.0.0 - 8.17.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/ws",
"node_modules/@wdio/globals/node_modules/ws",
"node_modules/@wdio/runner/node_modules/ws",
"node_modules/devtools/node_modules/ws",
"node_modules/expect-webdriverio/node_modules/ws"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 4,
"high": 15,
"critical": 2,
"total": 24
},
"dependencies": {
"prod": 1,
"dev": 1641,
"optional": 122,
"peer": 112,
"peerOptional": 0,
"total": 1641
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
"added": 1641,
"removed": 0,
"changed": 0,
"audited": 1642,
"funding": 287,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@puppeteer/browsers": {
"name": "@puppeteer/browsers",
"severity": "high",
"isDirect": false,
"via": [
"tar-fs"
],
"effects": [
"@wdio/utils",
"puppeteer-core"
],
"range": "1.4.2 - 2.2.3",
"nodes": [
"node_modules/@puppeteer/browsers"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/cli": {
"name": "@wdio/cli",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"inquirer",
"webdriverio"
],
"effects": [],
"range": "<=7.0.8 || 7.12.6 - 9.0.0-alpha.426 || 9.16.0",
"nodes": [
"node_modules/@wdio/cli"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/config": {
"name": "@wdio/config",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/config",
"node_modules/@wdio/globals/node_modules/@wdio/config",
"node_modules/@wdio/runner/node_modules/@wdio/config",
"node_modules/devtools/node_modules/@wdio/config",
"node_modules/expect-webdriverio/node_modules/@wdio/config"
],
"fixAvailable": true
},
"@wdio/globals": {
"name": "@wdio/globals",
"severity": "high",
"isDirect": false,
"via": [
"expect-webdriverio",
"webdriverio"
],
"effects": [
"@wdio/cli",
"@wdio/runner"
],
"range": "<=9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/globals"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/local-runner": {
"name": "@wdio/local-runner",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/runner"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/local-runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "high",
"isDirect": true,
"via": [
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/runner": {
"name": "@wdio/runner",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/globals",
"@wdio/utils",
"expect-webdriverio",
"webdriver",
"webdriverio"
],
"effects": [
"@wdio/local-runner"
],
"range": "7.16.5 - 9.0.4 || 9.16.0",
"nodes": [
"node_modules/@wdio/runner"
],
"fixAvailable": {
"name": "@wdio/local-runner",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"@wdio/utils": {
"name": "@wdio/utils",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers"
],
"effects": [
"@wdio/cli",
"@wdio/config",
"@wdio/mocha-framework",
"@wdio/runner",
"devtools",
"webdriver",
"webdriverio"
],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/@wdio/utils",
"node_modules/@wdio/globals/node_modules/@wdio/utils",
"node_modules/@wdio/mocha-framework/node_modules/@wdio/utils",
"node_modules/@wdio/runner/node_modules/@wdio/utils",
"node_modules/devtools/node_modules/@wdio/utils",
"node_modules/expect-webdriverio/node_modules/@wdio/utils"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"devtools": {
"name": "devtools",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"puppeteer-core"
],
"effects": [],
"range": ">=7.16.5",
"nodes": [
"node_modules/devtools"
],
"fixAvailable": true
},
"expect-webdriverio": {
"name": "expect-webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/globals",
"webdriverio"
],
"effects": [
"@wdio/globals",
"@wdio/runner"
],
"range": "4.0.0-alpha.0 - 4.0.0-alpha.6 || 4.0.1 - 5.0.0-alpha.2",
"nodes": [
"node_modules/expect-webdriverio"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/external-editor"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"@wdio/cli"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/inquirer"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki",
"wdio-wikibase"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"puppeteer-core": {
"name": "puppeteer-core",
"severity": "high",
"isDirect": false,
"via": [
"@puppeteer/browsers",
"ws"
],
"effects": [
"devtools",
"webdriverio"
],
"range": "11.0.0 - 22.13.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/puppeteer-core",
"node_modules/@wdio/globals/node_modules/puppeteer-core",
"node_modules/@wdio/runner/node_modules/puppeteer-core",
"node_modules/devtools/node_modules/puppeteer-core",
"node_modules/expect-webdriverio/node_modules/puppeteer-core"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1109534,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.1.1"
},
{
"source": 1109542,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.9"
},
{
"source": 1109551,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=3.0.0 <3.0.7"
}
],
"effects": [
"@puppeteer/browsers"
],
"range": "3.0.0 - 3.1.0",
"nodes": [
"node_modules/@puppeteer/browsers/node_modules/tar-fs"
],
"fixAvailable": {
"name": "@wdio/mocha-framework",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1109537,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/tmp"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.0.0",
"isSemVerMajor": true
}
},
"wdio-wikibase": {
"name": "wdio-wikibase",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot",
"wdio-mediawiki"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/wdio-wikibase"
],
"fixAvailable": false
},
"webdriver": {
"name": "webdriver",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils"
],
"effects": [],
"range": "8.15.0 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriver",
"node_modules/@wdio/globals/node_modules/webdriver",
"node_modules/@wdio/runner/node_modules/webdriver",
"node_modules/expect-webdriverio/node_modules/webdriver"
],
"fixAvailable": true
},
"webdriverio": {
"name": "webdriverio",
"severity": "high",
"isDirect": false,
"via": [
"@wdio/config",
"@wdio/utils",
"devtools",
"puppeteer-core",
"webdriver"
],
"effects": [
"@wdio/cli",
"@wdio/globals",
"@wdio/runner",
"expect-webdriverio"
],
"range": "7.16.5 - 8.46.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/webdriverio",
"node_modules/@wdio/globals/node_modules/webdriverio",
"node_modules/@wdio/runner/node_modules/webdriverio",
"node_modules/expect-webdriverio/node_modules/webdriverio"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
},
"ws": {
"name": "ws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098392,
"name": "ws",
"dependency": "ws",
"title": "ws affected by a DoS when handling a request with many HTTP headers",
"url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
"severity": "high",
"cwe": [
"CWE-476"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=8.0.0 <8.17.1"
}
],
"effects": [
"puppeteer-core"
],
"range": "8.0.0 - 8.17.0",
"nodes": [
"node_modules/@wdio/cli/node_modules/ws",
"node_modules/@wdio/globals/node_modules/ws",
"node_modules/@wdio/runner/node_modules/ws",
"node_modules/devtools/node_modules/ws",
"node_modules/expect-webdriverio/node_modules/ws"
],
"fixAvailable": {
"name": "@wdio/cli",
"version": "9.20.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 4,
"high": 15,
"critical": 2,
"total": 24
},
"dependencies": {
"prod": 1,
"dev": 1641,
"optional": 122,
"peer": 112,
"peerOptional": 0,
"total": 1641
}
}
}
}
--- end ---
{"added": 1641, "removed": 0, "changed": 0, "audited": 1642, "funding": 287, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@puppeteer/browsers": {"name": "@puppeteer/browsers", "severity": "high", "isDirect": false, "via": ["tar-fs"], "effects": ["@wdio/utils", "puppeteer-core"], "range": "1.4.2 - 2.2.3", "nodes": ["node_modules/@puppeteer/browsers"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/cli": {"name": "@wdio/cli", "severity": "high", "isDirect": true, "via": ["@wdio/config", "@wdio/globals", "@wdio/utils", "inquirer", "webdriverio"], "effects": [], "range": "<=7.0.8 || 7.12.6 - 9.0.0-alpha.426 || 9.16.0", "nodes": ["node_modules/@wdio/cli"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/config": {"name": "@wdio/config", "severity": "high", "isDirect": false, "via": ["@wdio/utils"], "effects": [], "range": "8.15.0 - 8.46.0", "nodes": ["node_modules/@wdio/cli/node_modules/@wdio/config", "node_modules/@wdio/globals/node_modules/@wdio/config", "node_modules/@wdio/runner/node_modules/@wdio/config", "node_modules/devtools/node_modules/@wdio/config", "node_modules/expect-webdriverio/node_modules/@wdio/config"], "fixAvailable": true}, "@wdio/globals": {"name": "@wdio/globals", "severity": "high", "isDirect": false, "via": ["expect-webdriverio", "webdriverio"], "effects": ["@wdio/cli", "@wdio/runner"], "range": "<=9.0.4 || 9.16.0", "nodes": ["node_modules/@wdio/globals"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/local-runner": {"name": "@wdio/local-runner", "severity": "high", "isDirect": true, "via": ["@wdio/runner"], "effects": [], "range": "8.15.0 - 8.46.0", "nodes": ["node_modules/@wdio/local-runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/mocha-framework": {"name": "@wdio/mocha-framework", "severity": "high", "isDirect": true, "via": ["@wdio/utils"], "effects": [], "range": "8.15.0 - 8.46.0", "nodes": ["node_modules/@wdio/mocha-framework"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/runner": {"name": "@wdio/runner", "severity": "high", "isDirect": false, "via": ["@wdio/config", "@wdio/globals", "@wdio/utils", "expect-webdriverio", "webdriver", "webdriverio"], "effects": ["@wdio/local-runner"], "range": "7.16.5 - 9.0.4 || 9.16.0", "nodes": ["node_modules/@wdio/runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.20.1", "isSemVerMajor": true}}, "@wdio/utils": {"name": "@wdio/utils", "severity": "high", "isDirect": false, "via": ["@puppeteer/browsers"], "effects": ["@wdio/cli", "@wdio/config", "@wdio/mocha-framework", "@wdio/runner", "devtools", "webdriver", "webdriverio"], "range": "8.15.0 - 8.46.0", "nodes": ["node_modules/@wdio/cli/node_modules/@wdio/utils", "node_modules/@wdio/globals/node_modules/@wdio/utils", "node_modules/@wdio/mocha-framework/node_modules/@wdio/utils", "node_modules/@wdio/runner/node_modules/@wdio/utils", "node_modules/devtools/node_modules/@wdio/utils", "node_modules/expect-webdriverio/node_modules/@wdio/utils"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "9.20.1", "isSemVerMajor": true}}, "devtools": {"name": "devtools", "severity": "high", "isDirect": false, "via": ["@wdio/config", "@wdio/utils", "puppeteer-core"], "effects": [], "range": ">=7.16.5", "nodes": ["node_modules/devtools"], "fixAvailable": true}, "expect-webdriverio": {"name": "expect-webdriverio", "severity": "high", "isDirect": false, "via": ["@wdio/globals", "webdriverio"], "effects": ["@wdio/globals", "@wdio/runner"], "range": "4.0.0-alpha.0 - 4.0.0-alpha.6 || 4.0.1 - 5.0.0-alpha.2", "nodes": ["node_modules/expect-webdriverio"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "external-editor": {"name": "external-editor", "severity": "low", "isDirect": false, "via": ["tmp"], "effects": ["inquirer"], "range": ">=1.1.1", "nodes": ["node_modules/external-editor"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.0.0", "isSemVerMajor": true}}, "inquirer": {"name": "inquirer", "severity": "low", "isDirect": false, "via": ["external-editor"], "effects": ["@wdio/cli"], "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7", "nodes": ["node_modules/inquirer"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["wdio-mediawiki", "wdio-wikibase"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.0.0", "isSemVerMajor": true}}, "puppeteer-core": {"name": "puppeteer-core", "severity": "high", "isDirect": false, "via": ["@puppeteer/browsers", "ws"], "effects": ["devtools", "webdriverio"], "range": "11.0.0 - 22.13.0", "nodes": ["node_modules/@wdio/cli/node_modules/puppeteer-core", "node_modules/@wdio/globals/node_modules/puppeteer-core", "node_modules/@wdio/runner/node_modules/puppeteer-core", "node_modules/devtools/node_modules/puppeteer-core", "node_modules/expect-webdriverio/node_modules/puppeteer-core"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.0.0", "isSemVerMajor": true}}, "tar-fs": {"name": "tar-fs", "severity": "high", "isDirect": false, "via": [{"source": 1109534, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=3.0.0 <3.1.1"}, {"source": 1109542, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": ">=3.0.0 <3.0.9"}, {"source": 1109551, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": ">=3.0.0 <3.0.7"}], "effects": ["@puppeteer/browsers"], "range": "3.0.0 - 3.1.0", "nodes": ["node_modules/@puppeteer/browsers/node_modules/tar-fs"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "9.20.1", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "low", "isDirect": false, "via": [{"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}], "effects": ["external-editor"], "range": "<=0.2.3", "nodes": ["node_modules/tmp"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.0.0", "isSemVerMajor": true}}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": ["mwbot"], "effects": [], "range": "<=5.1.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.0.0", "isSemVerMajor": true}}, "wdio-wikibase": {"name": "wdio-wikibase", "severity": "moderate", "isDirect": true, "via": ["mwbot", "wdio-mediawiki"], "effects": [], "range": "*", "nodes": ["node_modules/wdio-wikibase"], "fixAvailable": false}, "webdriver": {"name": "webdriver", "severity": "high", "isDirect": false, "via": ["@wdio/config", "@wdio/utils"], "effects": [], "range": "8.15.0 - 8.46.0", "nodes": ["node_modules/@wdio/cli/node_modules/webdriver", "node_modules/@wdio/globals/node_modules/webdriver", "node_modules/@wdio/runner/node_modules/webdriver", "node_modules/expect-webdriverio/node_modules/webdriver"], "fixAvailable": true}, "webdriverio": {"name": "webdriverio", "severity": "high", "isDirect": false, "via": ["@wdio/config", "@wdio/utils", "devtools", "puppeteer-core", "webdriver"], "effects": ["@wdio/cli", "@wdio/globals", "@wdio/runner", "expect-webdriverio"], "range": "7.16.5 - 8.46.0", "nodes": ["node_modules/@wdio/cli/node_modules/webdriverio", "node_modules/@wdio/globals/node_modules/webdriverio", "node_modules/@wdio/runner/node_modules/webdriverio", "node_modules/expect-webdriverio/node_modules/webdriverio"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}, "ws": {"name": "ws", "severity": "high", "isDirect": false, "via": [{"source": 1098392, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": ["CWE-476"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=8.0.0 <8.17.1"}], "effects": ["puppeteer-core"], "range": "8.0.0 - 8.17.0", "nodes": ["node_modules/@wdio/cli/node_modules/ws", "node_modules/@wdio/globals/node_modules/ws", "node_modules/@wdio/runner/node_modules/ws", "node_modules/devtools/node_modules/ws", "node_modules/expect-webdriverio/node_modules/ws"], "fixAvailable": {"name": "@wdio/cli", "version": "9.20.1", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 3, "moderate": 4, "high": 15, "critical": 2, "total": 24}, "dependencies": {"prod": 1, "dev": 1641, "optional": 122, "peer": 112, "peerOptional": 0, "total": 1641}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated supertest@5.0.0: Please upgrade to supertest v7.1.3+, see release notes at https://github.com/forwardemail/supertest/releases/tag/v7.1.3 - maintenance is supported by Forward Email @ https://forwardemail.net
npm WARN deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated fstream@1.0.12: This package is no longer supported.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated superagent@6.1.0: Please upgrade to superagent v10.2.2+, see release notes at https://github.com/forwardemail/superagent/releases/tag/v10.2.2 - maintenance is supported by Forward Email @ https://forwardemail.net
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 1640 packages, and audited 1641 packages in 36s
287 packages are looking for funding
run `npm fund` for details
# npm audit report
form-data <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
No fix available
node_modules/form-data
request *
Depends on vulnerable versions of form-data
Depends on vulnerable versions of tough-cookie
node_modules/request
mwbot >=0.1.6
Depends on vulnerable versions of request
node_modules/mwbot
wdio-mediawiki <=5.1.0
Depends on vulnerable versions of mwbot
node_modules/wdio-mediawiki
wdio-wikibase *
Depends on vulnerable versions of mwbot
Depends on vulnerable versions of wdio-mediawiki
node_modules/wdio-wikibase
tar-fs 3.0.0 - 3.1.0
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.1, which is a breaking change
node_modules/@puppeteer/browsers/node_modules/tar-fs
@puppeteer/browsers 1.4.2 - 2.2.3
Depends on vulnerable versions of tar-fs
node_modules/@puppeteer/browsers
@wdio/utils 8.15.0 - 8.46.0
Depends on vulnerable versions of @puppeteer/browsers
node_modules/@wdio/cli/node_modules/@wdio/utils
node_modules/@wdio/globals/node_modules/@wdio/utils
node_modules/@wdio/mocha-framework/node_modules/@wdio/utils
node_modules/@wdio/runner/node_modules/@wdio/utils
node_modules/devtools/node_modules/@wdio/utils
node_modules/expect-webdriverio/node_modules/@wdio/utils
@wdio/cli <=7.0.8 || 7.12.6 - 9.0.0-alpha.426 || 9.16.0
Depends on vulnerable versions of @wdio/config
Depends on vulnerable versions of @wdio/globals
Depends on vulnerable versions of @wdio/utils
Depends on vulnerable versions of inquirer
Depends on vulnerable versions of webdriverio
node_modules/@wdio/cli
@wdio/config 8.15.0 - 8.46.0
Depends on vulnerable versions of @wdio/utils
node_modules/@wdio/cli/node_modules/@wdio/config
node_modules/@wdio/globals/node_modules/@wdio/config
node_modules/@wdio/runner/node_modules/@wdio/config
node_modules/devtools/node_modules/@wdio/config
node_modules/expect-webdriverio/node_modules/@wdio/config
@wdio/mocha-framework 8.15.0 - 8.46.0
Depends on vulnerable versions of @wdio/utils
node_modules/@wdio/mocha-framework
@wdio/runner 7.16.5 - 9.0.4 || 9.16.0
Depends on vulnerable versions of @wdio/config
Depends on vulnerable versions of @wdio/globals
Depends on vulnerable versions of @wdio/utils
Depends on vulnerable versions of expect-webdriverio
Depends on vulnerable versions of webdriver
Depends on vulnerable versions of webdriverio
node_modules/@wdio/runner
@wdio/local-runner 8.15.0 - 8.46.0
Depends on vulnerable versions of @wdio/runner
node_modules/@wdio/local-runner
devtools >=7.16.5
Depends on vulnerable versions of @wdio/config
Depends on vulnerable versions of @wdio/utils
Depends on vulnerable versions of puppeteer-core
node_modules/devtools
webdriver 8.15.0 - 8.46.0
Depends on vulnerable versions of @wdio/config
Depends on vulnerable versions of @wdio/utils
node_modules/@wdio/cli/node_modules/webdriver
node_modules/@wdio/globals/node_modules/webdriver
node_modules/@wdio/runner/node_modules/webdriver
node_modules/expect-webdriverio/node_modules/webdriver
webdriverio 7.16.5 - 8.46.0
Depends on vulnerable versions of @wdio/config
Depends on vulnerable versions of @wdio/utils
Depends on vulnerable versions of devtools
Depends on vulnerable versions of puppeteer-core
Depends on vulnerable versions of webdriver
node_modules/@wdio/cli/node_modules/webdriverio
node_modules/@wdio/globals/node_modules/webdriverio
node_modules/@wdio/runner/node_modules/webdriverio
node_modules/expect-webdriverio/node_modules/webdriverio
@wdio/globals <=9.0.4 || 9.16.0
Depends on vulnerable versions of expect-webdriverio
Depends on vulnerable versions of webdriverio
node_modules/@wdio/globals
expect-webdriverio 4.0.0-alpha.0 - 4.0.0-alpha.6 || 4.0.1 - 5.0.0-alpha.2
Depends on vulnerable versions of @wdio/globals
Depends on vulnerable versions of webdriverio
node_modules/expect-webdriverio
puppeteer-core 11.0.0 - 22.13.0
Depends on vulnerable versions of @puppeteer/browsers
Depends on vulnerable versions of ws
node_modules/@wdio/cli/node_modules/puppeteer-core
node_modules/@wdio/globals/node_modules/puppeteer-core
node_modules/@wdio/runner/node_modules/puppeteer-core
node_modules/devtools/node_modules/puppeteer-core
node_modules/expect-webdriverio/node_modules/puppeteer-core
tmp <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.1, which is a breaking change
node_modules/tmp
external-editor >=1.1.1
Depends on vulnerable versions of tmp
node_modules/external-editor
inquirer 3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
Depends on vulnerable versions of external-editor
node_modules/inquirer
tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
No fix available
node_modules/tough-cookie
ws 8.0.0 - 8.17.0
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @wdio/cli@9.20.1, which is a breaking change
node_modules/@wdio/cli/node_modules/ws
node_modules/@wdio/globals/node_modules/ws
node_modules/@wdio/runner/node_modules/ws
node_modules/devtools/node_modules/ws
node_modules/expect-webdriverio/node_modules/ws
24 vulnerabilities (3 low, 4 moderate, 15 high, 2 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@2.3.1',
npm WARN EBADENGINE required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated supertest@5.0.0: Please upgrade to supertest v7.1.3+, see release notes at https://github.com/forwardemail/supertest/releases/tag/v7.1.3 - maintenance is supported by Forward Email @ https://forwardemail.net
npm WARN deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated fstream@1.0.12: This package is no longer supported.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated superagent@6.1.0: Please upgrade to superagent v10.2.2+, see release notes at https://github.com/forwardemail/superagent/releases/tag/v10.2.2 - maintenance is supported by Forward Email @ https://forwardemail.net
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: cache-loader@4.1.0
npm WARN Found: webpack@5.66.0
npm WARN node_modules/webpack
npm WARN peer webpack@"^4.0.0 || ^5.0.0" from @soda/friendly-errors-webpack-plugin@1.8.1
npm WARN node_modules/@soda/friendly-errors-webpack-plugin
npm WARN @soda/friendly-errors-webpack-plugin@"^1.8.0" from @vue/cli-service@5.0.0-rc.2
npm WARN node_modules/@vue/cli-service
npm WARN 25 more (@vue/cli-plugin-babel, @vue/cli-plugin-eslint, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer webpack@"^4.0.0" from cache-loader@4.1.0
npm WARN node_modules/cache-loader
npm WARN cache-loader@"^4.1.0" from @vue/cli-plugin-typescript@5.0.0-rc.2
npm WARN node_modules/@vue/cli-plugin-typescript
npm WARN 1 more (@vue/cli-service)
npm WARN
npm WARN Conflicting peer dependency: webpack@4.47.0
npm WARN node_modules/webpack
npm WARN peer webpack@"^4.0.0" from cache-loader@4.1.0
npm WARN node_modules/cache-loader
npm WARN cache-loader@"^4.1.0" from @vue/cli-plugin-typescript@5.0.0-rc.2
npm WARN node_modules/@vue/cli-plugin-typescript
npm WARN 1 more (@vue/cli-service)
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @vue/server-renderer@3.5.16
npm WARN Found: vue@3.5.13
npm WARN node_modules/vue
npm WARN vue@"3.5.13" from the root project
npm WARN 6 more (@vue/babel-preset-app, @vue/cli-plugin-typescript, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer vue@"3.5.16" from @vue/server-renderer@3.5.16
npm WARN node_modules/@vue/test-utils/node_modules/@vue/server-renderer
npm WARN optional @vue/server-renderer@"^3.0.1" from @vue/test-utils@2.3.0
npm WARN node_modules/@vue/test-utils
npm WARN
npm WARN Conflicting peer dependency: vue@3.5.16
npm WARN node_modules/vue
npm WARN peer vue@"3.5.16" from @vue/server-renderer@3.5.16
npm WARN node_modules/@vue/test-utils/node_modules/@vue/server-renderer
npm WARN optional @vue/server-renderer@"^3.0.1" from @vue/test-utils@2.3.0
npm WARN node_modules/@vue/test-utils
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated stylelint-processor-html@1.0.0: Please use stylelint-processor-arbitrary-tags https://github.com/mapbox/stylelint-processor-arbitrary-tags
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated @stylelint/postcss-markdown@0.36.2: Use the original unforked package instead: postcss-markdown
npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.3: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated superagent@6.1.0: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated html-webpack-plugin@3.2.0: 3.x is no longer supported
npm WARN deprecated babel-eslint@10.1.0: babel-eslint is now @babel/eslint-parser. This package will no longer receive updates.
npm WARN deprecated @hapi/address@2.1.4: Moved to 'npm install @sideway/address'
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.3.3: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated fstream@1.0.12: This package is no longer supported.
npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi'
npm WARN deprecated svgo@1.3.2: This SVGO version is no longer supported. Upgrade to v2.x.x.
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
> wikibase@0.1.0 postinstall
> npm-run-all -p install:*
> wikibase@0.1.0 install:tainted-ref
> npm --prefix view/lib/wikibase-tainted-ref ci
> wikibase@0.1.0 install:bridge
> npm --prefix client/data-bridge ci
> wikibase@0.1.0 install:rest-api
> npm --prefix repo/rest-api ci
added 928 packages, and audited 929 packages in 3m
224 packages are looking for funding
run `npm fund` for details
25 vulnerabilities (3 low, 12 moderate, 8 high, 2 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
> tainted-ref@0.1.0 prepare
> node build/wikimedia-ui-base.js
added 2722 packages, and audited 2723 packages in 3m
160 packages are looking for funding
run `npm fund` for details
159 vulnerabilities (7 low, 78 moderate, 55 high, 19 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
> data-bridge@0.1.0 prepare
> node build/wikimedia-ui-base.js
added 2826 packages, and audited 2827 packages in 4m
306 packages are looking for funding
run `npm fund` for details
107 vulnerabilities (14 low, 39 moderate, 50 high, 4 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
added 1640 packages, and audited 1641 packages in 5m
287 packages are looking for funding
run `npm fund` for details
24 vulnerabilities (3 low, 4 moderate, 15 high, 2 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stderr ---
specs/openapi-joined.json: join processed in 3129ms
╔═══════════════════════════════════════════════════════╗
║ ║
║ A new version of Redocly CLI (2.12.0) is available. ║
║ Update now: `npm i -g @redocly/cli@latest`. ║
║ Changelog: https://redocly.com/docs/cli/changelog/ ║
║ ║
╚═══════════════════════════════════════════════════════╝
validating specs/openapi-joined.json...
PASS repo/tests/jest/store/editStatementsStore.spec.js (6.552 s)
specs/openapi-joined.json: validated in 2795ms
Woohoo! Your API description is valid. 🎉
2 problems are explicitly ignored.
PASS repo/tests/jest/wikibase.wbui2025.editableSnakValue.spec.js (14.032 s)
PASS repo/tests/jest/ScopedTypeaheadSearch.spec.js (14.059 s)
PASS repo/tests/jest/wikibase.vector.searchClient.spec.js
PASS repo/tests/jest/wikibase.wbui2025.editStatement.spec.js (9.675 s)
PASS repo/tests/jest/wikibase.wbui2025.propertyLookup.spec.js
PASS repo/tests/jest/store/parsedValueStore.spec.js
PASS repo/tests/jest/wikibase.wbui2025.statementGroupView.spec.js (5.961 s)
PASS repo/tests/jest/wikibase.wbui2025.statementView.spec.js
PASS repo/tests/jest/wikibase.wbui2025.references.spec.js
PASS repo/tests/jest/wikibase.wbui2025.addQualifier.spec.js
PASS repo/tests/jest/wikibase.wbui2025.mainSnak.spec.js
PASS repo/tests/jest/wikibase.wbui2025.statementSections.spec.js
PASS repo/tests/jest/store/savedStatementsStore.spec.js
PASS repo/tests/jest/wikibase.wbui2025.qualifiers.spec.js
PASS repo/tests/jest/wikibase.wbui2025.statusMessage.spec.js
PASS repo/tests/jest/wikibase.wbui2025.propertySelector.spec.js
PASS repo/tests/jest/wikibase.wbui2025.modalOverlay.spec.js
PASS repo/tests/jest/wikibase.wbui2025.propertyName.spec.js
PASS repo/tests/jest/wikibase.wbui2025.addStatementButton.spec.js
PASS repo/tests/jest/store/serverRenderedHtml.spec.js
PASS repo/tests/jest/store/messageStore.spec.js
PASS repo/tests/jest/wikibase.wbui2025.editStatementGroup.spec.js (8.382 s)
Test Suites: 23 passed, 23 total
Tests: 138 passed, 138 total
Snapshots: 0 total
Time: 38.745 s
Ran all test suites.
PASS tests/unit/StatementTracker.spec.ts (13.942 s)
PASS tests/unit/MWHookHandler.spec.ts (14.044 s)
PASS tests/unit/store/actions.spec.ts
PASS tests/unit/store/mutations.spec.ts
PASS tests/unit/TaintedIcon.spec.ts
PASS tests/unit/TaintedPopper.spec.ts (16.789 s)
PASS tests/unit/store/getters.spec.ts
PASS tests/unit/Popper.spec.ts
PASS tests/unit/ReferenceListChangeCounter.spec.ts
PASS tests/unit/TaintedChecker.spec.ts
PASS tests/unit/store/index.spec.ts
PASS tests/unit/App.spec.ts
Test Suites: 12 passed, 12 total
Tests: 68 passed, 68 total
Snapshots: 0 total
Time: 23.872 s
Ran all test suites.
PASS tests/unit/store/getters.spec.ts (9.688 s)
PASS tests/unit/store/actions.spec.ts (10.26 s)
PASS tests/unit/services/createServices.spec.ts
PASS tests/unit/data-access/ApiWritingRepository.spec.ts
PASS tests/unit/presentation/components/ErrorPermission.spec.ts (13.586 s)
PASS tests/unit/data-access/ApiPageEditPermissionErrorsRepository.spec.ts
PASS tests/unit/presentation/components/AppHeader.spec.ts (5.05 s)
PASS tests/unit/data-access/CombiningPermissionsRepository.spec.ts
PASS tests/unit/presentation/components/Loading.spec.ts
PASS tests/unit/store/statements/getters.spec.ts
PASS tests/unit/presentation/App.spec.ts (7.214 s)
PASS tests/unit/mediawiki/init.spec.ts
[Vue warn]: Invalid prop: custom validator check failed for prop "type".
at <EventEmittingButton type="potato" size="L" message="click me" ... >
at <VTUROOT>
PASS tests/unit/presentation/components/EventEmittingButton.spec.ts
PASS tests/unit/store/mutations.spec.ts
PASS tests/unit/presentation/components/ErrorWrapper.spec.ts
PASS tests/unit/store/entity/actions.spec.ts
PASS tests/unit/data-access/TrimmingWritingRepository.spec.ts
PASS tests/unit/mediawiki/BridgeDomElementsSelector.spec.ts
PASS tests/unit/data-access/ApiCore.spec.ts
PASS tests/unit/data-access/SpecialPageReadingEntityRepository.spec.ts
PASS tests/unit/data-access/ApiRenderReferencesRepository.spec.ts
PASS tests/unit/data-access/BatchingApi.spec.ts
PASS tests/unit/store/statements/MainSnakPath.spec.ts
PASS tests/unit/presentation/components/ErrorSavingAssertUser.spec.ts
PASS tests/unit/mediawiki/Dispatcher.spec.ts
PASS tests/unit/data-access/ApiEntityLabelRepository.spec.ts
PASS tests/unit/presentation/components/ErrorSaving.spec.ts
PASS tests/unit/data-access/ApiRepoConfigRepository.spec.ts
PASS tests/unit/change-op/statement-mutation/strategies/UpdateMutationStrategy.spec.ts
PASS tests/unit/presentation/components/ErrorUnsupportedSnakType.spec.ts
PASS tests/unit/presentation/components/StringDataValue.spec.ts
PASS tests/unit/presentation/components/EditDecision.spec.ts
PASS tests/unit/data-access/ApiTempUserConfigRepository.spec.ts
PASS tests/unit/presentation/components/ErrorUnknown.spec.ts
PASS tests/unit/presentation/components/ErrorUnsupportedDatatype.spec.ts
PASS tests/unit/change-op/statement-mutation/strategies/ReplaceMutationStrategy.spec.ts
PASS tests/unit/data-access/RepoRouter.spec.ts
PASS tests/unit/presentation/components/WarningAnonymousEdit.spec.ts
PASS tests/unit/main.spec.ts
PASS tests/unit/mediawiki/prepareContainer.spec.ts
PASS tests/unit/mediawiki/MwInitTracker.spec.ts
PASS tests/unit/presentation/components/ErrorPermissionInfo.spec.ts
PASS tests/unit/presentation/components/ReportIssue.spec.ts
PASS tests/unit/presentation/components/DataBridge.spec.ts
PASS tests/unit/presentation/components/License.spec.ts
PASS tests/unit/presentation/components/ReferenceSection.spec.ts
PASS tests/unit/data-access/ApiWbgetentities.spec.ts
PASS tests/unit/data-access/ApiPropertyDataTypeRepository.spec.ts
PASS tests/unit/presentation/components/ErrorDeprecatedStatement.spec.ts
PASS tests/unit/presentation/components/ResizingTextField.spec.ts
PASS tests/unit/presentation/components/ErrorAmbiguousStatement.spec.ts
PASS tests/unit/presentation/components/RadioInput.spec.ts
PASS tests/unit/store/newMockableEntityRevision.spec.ts
PASS tests/unit/presentation/extendVueEnvironment.spec.ts
PASS tests/unit/presentation/components/BailoutActions.spec.ts
PASS tests/unit/presentation/components/ProcessDialogHeader.spec.ts
PASS tests/unit/data-access/DataBridgeTrackerService.spec.ts
PASS tests/unit/data-access/MwLanguageInfoRepository.spec.ts
PASS tests/unit/data-access/ApiReadingEntityRepository.spec.ts
PASS tests/unit/tracking/mutationsTrackerPlugin.spec.ts
PASS tests/unit/store/entity/mutations.spec.ts
PASS tests/unit/data-access/ApiQuery.spec.ts
PASS tests/unit/presentation/plugins/InLanguagePlugin/InLanguagePlugin.spec.ts
PASS tests/unit/store/statements/mutations.spec.ts
PASS tests/unit/presentation/components/ThankYou.spec.ts
PASS tests/unit/data-access/MwMessagesRepository.spec.ts
[Vue warn]: Invalid prop: custom validator check failed for prop "type".
at <IconMessageBox type="potato" ref="VTU_COMPONENT" >
at <VTUROOT>
PASS tests/unit/presentation/IconMessageBox.spec.ts
PASS tests/unit/mediawiki/subscribeToEvents.spec.ts
PASS tests/unit/presentation/components/TermLabel.spec.ts
PASS tests/unit/presentation/components/PropertyLabel.spec.ts
PASS tests/unit/store/statements/actions.spec.ts
PASS tests/unit/data-access/ApiPurge.spec.ts
PASS tests/unit/presentation/plugins/MessagesPlugin/Messages.spec.ts
PASS tests/unit/services/ServiceContainer.spec.ts
PASS tests/unit/tracking/PrefixingEventTracker.spec.ts
PASS tests/unit/presentation/components/PageList.spec.ts
PASS tests/unit/presentation/components/UserLink.spec.ts
PASS tests/unit/change-op/statement-mutation/statementMutationFactory.spec.ts
PASS tests/unit/store/index.spec.ts
PASS tests/unit/mediawiki/facades/EventTracker.spec.ts
PASS tests/unit/utils/errorTypeFormatter.spec.ts
PASS tests/unit/presentation/components/ErrorSavingEditConflict.spec.ts
PASS tests/unit/presentation/plugins/RepoRouter/RepoRouterPlugin.spec.ts
PASS tests/unit/data-access/ClientRouter.spec.ts
PASS tests/unit/presentation/components/RadioGroup.spec.ts
PASS tests/unit/presentation/components/IndeterminateProgressBar.spec.ts
PASS tests/unit/timer.spec.ts
PASS tests/unit/store/clone.spec.ts
Test Suites: 88 passed, 88 total
Tests: 627 passed, 627 total
Snapshots: 13 passed, 13 total
Time: 39.681 s
Ran all test suites.
PASS tests/integration/store/actions.spec.ts (9.61 s)
PASS tests/integration/mediawiki/init.spec.ts (9.796 s)
Test Suites: 2 passed, 2 total
Tests: 16 passed, 16 total
Snapshots: 0 total
Time: 11.602 s
Ran all test suites.
PASS tests/e2e/StringDataValue.spec.ts (11.68 s)
PASS tests/e2e/app.spec.ts (12.009 s)
Test Suites: 2 passed, 2 total
Tests: 29 passed, 29 total
Snapshots: 0 total
Time: 13.888 s
Ran all test suites.
- Building for production...
(node:1714) [DEP_WEBPACK_COMPILATION_OPTIMIZE_CHUNK_ASSETS] DeprecationWarning: optimizeChunkAssets is deprecated (use Compilation.hooks.processAssets instead and use one of Compilation.PROCESS_ASSETS_STAGE_* as stage option)
(Use `node --trace-deprecation ...` to show where the warning was created)
(node:1714) [DEP_WEBPACK_COMPILATION_CACHE] DeprecationWarning: Compilation.cache was removed in favor of Compilation.getCache()
--- stdout ---
> wikibase@0.1.0 test
> npm-run-all -p test-fast:*
> wikibase@0.1.0 test-fast:tainted-ref
> npm --prefix view/lib/wikibase-tainted-ref test
> wikibase@0.1.0 test-fast:grunt
> grunt test
> wikibase@0.1.0 test-fast:bridge
> npm --prefix client/data-bridge test
> wikibase@0.1.0 test-fast:rest-api
> npm --prefix repo/rest-api test
> wikibase@0.1.0 test-fast:jest-repo
> jest -c repo/tests/jest/jest.config.js
> tainted-ref@0.1.0 test
> npm-run-all test:*
> data-bridge@0.1.0 test
> npm-run-all test:*
> wikibase-rest-api-definition@0.1.0 test
> npm run lint
> wikibase-rest-api-definition@0.1.0 lint
> npm-run-all --parallel --continue-on-error lint:*
> tainted-ref@0.1.0 test:unit
> vue-cli-service test:unit -c ./jest.config.js
> data-bridge@0.1.0 test:lint
> vue-cli-service lint --max-warnings 0 --no-fix . && stylelint --syntax scss 'src/**/*.(vue|scss)'
Running "eslint:all" (eslint) task
> wikibase-rest-api-definition@0.1.0 lint:eslint
> npm-run-all --parallel --continue-on-error eslint:*
> wikibase-rest-api-definition@0.1.0 lint:openapi
> npm run spec:join && redocly lint specs/openapi-joined.json
> wikibase-rest-api-definition@0.1.0 eslint:rest
> eslint . --max-warnings 0
> wikibase-rest-api-definition@0.1.0 spec:join
> bash -c 'redocly join --without-x-tag-groups specs/openapi.base.json <(node ../domains/crud/specs/index.fragment.js) <(node ../domains/search/specs/index.fragment.js) -o specs/openapi-joined.json'
> wikibase-rest-api-definition@0.1.0 eslint:search
> eslint ../domains/search --max-warnings 0
> wikibase-rest-api-definition@0.1.0 eslint:crud
> eslint ../domains/crud --max-warnings 0
> tainted-ref@0.1.0 test:lint
> vue-cli-service lint --max-warnings 0 --no-fix . && stylelint --syntax scss 'src/**/*.(vue|scss)'
DONE No lint errors found!
> data-bridge@0.1.0 test:unit
> jest -c ./jest.config.unit.js
DONE No lint errors found!
Running "banana:all" (banana) task
>> 5 message directories checked.
Running "stylelint:all" (stylelint) task
> data-bridge@0.1.0 test:integration
> jest -c ./jest.config.integration.js
> data-bridge@0.1.0 test:e2e
> jest -c ./jest.config.e2e.js
> data-bridge@0.1.0 test:distnodiff
> npm run build -- --dest /tmp/dist && diff -q ./dist/data-bridge.app.js /tmp/dist/data-bridge.app.js && diff -q ./dist/css/data-bridge.app.css /tmp/dist/css/data-bridge.app.css && diff -q ./dist/data-bridge.init.js /tmp/dist/data-bridge.init.js && diff -q ./dist/data-bridge.chunk-vendors.js /tmp/dist/data-bridge.chunk-vendors.js
>> Linted 51 files without errors
Done.
> data-bridge@0.1.0 build
> NODE_ENV=production vue-cli-service build --no-clean --skip-plugins eslint --report --report-json --no-module --dest /tmp/dist
WARNING Compiled with 2 warnings12:22:01 AM
warning
entrypoint size limit: The following entrypoint(s) combined asset size exceeds the recommended limit (244 KiB). This can impact web performance.
Entrypoints:
app (247 KiB)
data-bridge.chunk-vendors.js
css/data-bridge.app.css
data-bridge.app.js
warning
webpack performance recommendations:
You can limit the size of your bundles by using import() or require.ensure to lazy load some parts of your application.
For more info visit https://webpack.js.org/guides/code-splitting/
File Size Gzipped
../../../../tmp/dist/data-bridge.app.j 194.51 KiB 53.46 KiB
s
../../../../tmp/dist/data-bridge.chunk 27.44 KiB 10.19 KiB
-vendors.js
../../../../tmp/dist/data-bridge.init. 9.59 KiB 4.13 KiB
js
../../../../tmp/dist/css/data-bridge.a 25.54 KiB 4.26 KiB
pp.css
Images and other types of assets omitted.
DONE Build complete. The ../../../../tmp/dist directory is ready to be deployed.
INFO Check out deployment instructions at https://cli.vuejs.org/guide/deployment.html
--- end ---
{}
{}
{}
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
[DNM] there are no updates
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmp7zeh05_2
--- stdout ---
On branch REL1_45
Your branch is up to date with 'origin/REL1_45'.
nothing to commit, working tree clean
--- end ---