This run took 73 seconds.
From 7f2dd3808baf5c67be7d32e1b045530979549fa0 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sat, 17 Jan 2026 03:27:57 +0000
Subject: [PATCH] build: Updating composer dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* mediawiki/mediawiki-codesniffer: 48.0.0 → 49.0.0
* mediawiki/minus-x: 1.1.3 → 2.0.0
Change-Id: I3d450770e5ef7cd9c2de679d8a18a8a94316d7c5
---
composer.json | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/composer.json b/composer.json
index f5c5c8c..d4d0565 100644
--- a/composer.json
+++ b/composer.json
@@ -8,9 +8,9 @@
"composer/installers": "~1.0|~2.0"
},
"require-dev": {
- "mediawiki/mediawiki-codesniffer": "48.0.0",
+ "mediawiki/mediawiki-codesniffer": "49.0.0",
"mediawiki/mediawiki-phan-config": "0.18.0",
- "mediawiki/minus-x": "1.1.3",
+ "mediawiki/minus-x": "2.0.0",
"php-parallel-lint/php-console-highlighter": "1.0.0",
"php-parallel-lint/php-parallel-lint": "1.4.0"
},
--
2.47.3
$ date
--- stdout ---
Sat Jan 17 03:26:48 UTC 2026
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-ProofreadPage.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
d87d27d5c4424fb6ea46141d592adb833cf1fe1c refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "low",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": false
},
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112148,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<8.0.3"
}
],
"effects": [
"mocha"
],
"range": "<8.0.3",
"nodes": [
"node_modules/diff"
],
"fixAvailable": false
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "low",
"isDirect": false,
"via": [
"diff"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "0.14.0 - 12.0.0-beta-3",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": false
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111755,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/qs"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 3,
"high": 1,
"critical": 2,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 948,
"optional": 39,
"peer": 1,
"peerOptional": 0,
"total": 948
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 39 installs, 0 updates, 0 removals
- Locking composer/installers (v2.3.0)
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (3.0.5)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
- Locking doctrine/deprecations (1.1.5)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mediawiki/mediawiki-codesniffer (v48.0.0)
- Locking mediawiki/mediawiki-phan-config (0.18.0)
- Locking mediawiki/minus-x (1.1.3)
- Locking mediawiki/phan-taint-check-plugin (8.0.0)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking phan/phan (5.5.2)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.4.0)
- Locking phpcsstandards/phpcsutils (1.1.1)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.6.6)
- Locking phpdocumentor/type-resolver (1.12.0)
- Locking phpstan/phpdoc-parser (2.3.1)
- Locking psr/container (2.0.2)
- Locking psr/log (3.0.2)
- Locking sabre/event (5.1.7)
- Locking squizlabs/php_codesniffer (3.13.2)
- Locking symfony/console (v7.4.3)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/polyfill-php80 (v1.33.0)
- Locking symfony/service-contracts (v3.6.1)
- Locking symfony/string (v8.0.1)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (2.1.2)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 39 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Installing composer/installers (v2.3.0): Extracting archive
- Installing squizlabs/php_codesniffer (3.13.2): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing phpcsstandards/phpcsutils (1.1.1): Extracting archive
- Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v48.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v8.0.1): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.1): Extracting archive
- Installing symfony/console (v7.4.3): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing webmozart/assert (2.1.2): Extracting archive
- Installing phpstan/phpdoc-parser (2.3.1): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.5): Extracting archive
- Installing phpdocumentor/type-resolver (1.12.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.6.6): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (3.0.2): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (5.5.2): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (8.0.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.18.0): Extracting archive
- Installing mediawiki/minus-x (1.1.3): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
0/36 [>---------------------------] 0%
28/36 [=====================>------] 77%
35/36 [===========================>] 97%
36/36 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
18 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
Upgrading c:mediawiki/mediawiki-codesniffer from 48.0.0 -> 49.0.0
Upgrading c:mediawiki/minus-x from 1.1.3 -> 2.0.0
$ /usr/bin/composer update
--- stderr ---
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 4 updates, 0 removals
- Upgrading mediawiki/mediawiki-codesniffer (v48.0.0 => v49.0.0)
- Upgrading mediawiki/minus-x (1.1.3 => 2.0.0)
- Upgrading phpcsstandards/phpcsutils (1.1.1 => 1.2.2)
- Upgrading squizlabs/php_codesniffer (3.13.2 => 3.13.5)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 4 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Upgrading squizlabs/php_codesniffer (3.13.2 => 3.13.5): Extracting archive
- Upgrading phpcsstandards/phpcsutils (1.1.1 => 1.2.2): Extracting archive
- Upgrading mediawiki/mediawiki-codesniffer (v48.0.0 => v49.0.0): Extracting archive
- Upgrading mediawiki/minus-x (1.1.3 => 2.0.0): Extracting archive
0/4 [>---------------------------] 0%
3/4 [=====================>------] 75%
4/4 [============================] 100%
Generating autoload files
18 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
$ vendor/bin/phpcs --report=json
--- stdout ---
{"totals":{"errors":0,"warnings":0,"fixable":0},"files":{"\/src\/repo\/includes\/Parser\/LegacyPagequalityTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/SchemaHooks.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/LegacyPagelistTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/EditInSequence.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Link.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/fixProofreadIndexPagesContentModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/CustomNumberFormatters\/ArabicJommlFormat.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/SimpleFilePagination.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/OOUI\/PageQualityInputWidget.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/ParsoidPagelistTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/FileProvider.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/CodeMirrorHooks.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/LegacyParserTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/ParsoidTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/fixProofreadPagePagesContentModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexEditAction.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/ScribuntoHooks.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/OOUI\/PagelistInputWidget.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/DiffFormatterUtils.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Api\/ApiQueryImageForPage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/PagePagination.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/PageNumberNotFoundException.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Api\/ApiQueryProofreadInfo.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/ParserError.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/ParsoidPagequalityTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Special\/SpecialPagesWithoutScans.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/FileNotFoundException.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexSubmitAction.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/Pagination.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/QualityStatsBuilder.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/DatabaseIndexContentLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/PagelistTagRendererTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/MultiFormatSerializerUtils.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexRedirectContent.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/FilePagination.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Api\/ApiQueryPagesInIndex.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/DeleteIndexQualityStats.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/WikitextLinksExtractor.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/PageList.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/CustomNumberFormatters\/BengaliCurrencyFormat.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Api\/ApiQueryDefaultContentForPage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Api\/ApiQueryProofread.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexTemplateStyles.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/ParsoidPagesTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageEditAction.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/ParserHelper.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexSlotDiffRenderer.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageRevisionTagger.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/UpdateIndexQualityStats.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageSubmitAction.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/ProofreadPageInit.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexQualityStatsLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/IndexForPageLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/PaginationFactory.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/CustomIndexField.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/PageNumber.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Pagination\/PageNotInPaginationException.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexContentLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/PagesQualityStats.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/ProofreadPage.namespaces.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/ProofreadPage.i18n.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/TranslusionPagesModifier.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/ProofreadPageTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/ProofreadPageLuaLibrary.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/DiffFormatterUtilsTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/PaginationFactoryTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/WikitextLinksExtractorTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexContent.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/DatabaseIndexForPageLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageContentBuilder.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/ProofreadPageInitTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageContent.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Context.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/FileProviderMock.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/LegacyPagesTagParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageLevel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Scribunto\/IndexAndPageLibraryTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Scribunto\/ProofreadPageLibraryTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/DatabasePageQualityLevelLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/MultiFormatSerializerUtilsTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Api\/ApiQueryProofreadPagesInIndexTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/CustomIndexFieldsParser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/DatabaseIndexForPageLookupTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexSlotDiffRendererTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/EditIndexPage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageViewAction.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/QualityStatsBuilderTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/.phan\/config.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/ParserHelperTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/DatabasePageQualityLevelLookupTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Special\/SpecialProofreadPages.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/IndexForPageLookupMock.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/EditPagePage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageQualityLevelLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexQualityStatsLookupMock.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/selenium\/settings\/ProofreadPage.LocalSettings.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/PagesQualityStatsTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageQualityLevelLookupMock.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/ContextTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexTemplateStylesTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageSlotDiffRenderer.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/FileProviderTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/PageListTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/PageNumberTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/FilePaginationTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/PagePaginationTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Parser\/PagesTagRendererTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/ProofreadPage.alias.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexContentTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexRedirectContentTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/CustomIndexFieldsParserTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexContentLookupMock.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Index\/IndexContentHandler.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageContentTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageDisplayHandlerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Pagination\/SimpleFilePaginationTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageDisplayHandler.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/ProofreadPage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageContentBuilderTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Tags.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageRevisionTaggerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageContentHandlerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/ProofreadPageTestCase.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageLevelTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Page\/PageSlotDiffRendererTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/includes\/Page\/PageContentHandler.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/Index\/IndexContentHandlerTest.php":{"errors":0,"warnings":0,"messages":[]}}}
--- end ---
$ /usr/bin/composer install
--- stderr ---
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Nothing to install, update or remove
Generating autoload files
18 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
--- end ---
$ /usr/bin/composer test
--- stderr ---
> parallel-lint . --exclude node_modules --exclude vendor
> phpcs -sp --cache
> minus-x check .
--- stdout ---
PHP 8.4.11 | 10 parallel jobs
............................................................ 60/127 ( 47%)
............................................................ 120/127 ( 94%)
....... 127/127 (100%)
Checked 127 files in 0.5 seconds
No syntax error found
............................................................ 60 / 64 (94%)
.... 64 / 64 (100%)
Time: 486ms; Memory: 12MB
MinusX
======
Processing /src/repo...
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
...................................................
All good!
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "low",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": false
},
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112148,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<8.0.3"
}
],
"effects": [
"mocha"
],
"range": "<8.0.3",
"nodes": [
"node_modules/diff"
],
"fixAvailable": false
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "low",
"isDirect": false,
"via": [
"diff"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "0.14.0 - 12.0.0-beta-3",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": false
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111755,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/qs"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 3,
"high": 1,
"critical": 2,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 948,
"optional": 39,
"peer": 1,
"peerOptional": 0,
"total": 948
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 948,
"removed": 0,
"changed": 0,
"audited": 949,
"funding": 195,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@wdio/mocha-framework": {
"name": "@wdio/mocha-framework",
"severity": "low",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@wdio/mocha-framework"
],
"fixAvailable": false
},
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112148,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<8.0.3"
}
],
"effects": [
"mocha"
],
"range": "<8.0.3",
"nodes": [
"node_modules/diff"
],
"fixAvailable": false
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "low",
"isDirect": false,
"via": [
"diff"
],
"effects": [
"@wdio/mocha-framework"
],
"range": "0.14.0 - 12.0.0-beta-3",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": false
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111755,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/qs"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": {
"name": "wdio-mediawiki",
"version": "6.1.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 3,
"high": 1,
"critical": 2,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 948,
"optional": 39,
"peer": 1,
"peerOptional": 0,
"total": 948
}
}
}
}
--- end ---
{"added": 948, "removed": 0, "changed": 0, "audited": 949, "funding": 195, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@wdio/mocha-framework": {"name": "@wdio/mocha-framework", "severity": "low", "isDirect": true, "via": ["mocha"], "effects": [], "range": "*", "nodes": ["node_modules/@wdio/mocha-framework"], "fixAvailable": false}, "diff": {"name": "diff", "severity": "low", "isDirect": false, "via": [{"source": 1112148, "name": "diff", "dependency": "diff", "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "severity": "low", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<8.0.3"}], "effects": ["mocha"], "range": "<8.0.3", "nodes": ["node_modules/diff"], "fixAvailable": false}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}, "mocha": {"name": "mocha", "severity": "low", "isDirect": false, "via": ["diff"], "effects": ["@wdio/mocha-framework"], "range": "0.14.0 - 12.0.0-beta-3", "nodes": ["node_modules/mocha"], "fixAvailable": false}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["wdio-mediawiki"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "high", "isDirect": false, "via": [{"source": 1111755, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "high", "cwe": ["CWE-20"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.14.1"}], "effects": ["request"], "range": "<6.14.1", "nodes": ["node_modules/qs"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "qs", "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": ["mwbot"], "effects": [], "range": "<=5.1.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.1.0", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 3, "moderate": 3, "high": 1, "critical": 2, "total": 9}, "dependencies": {"prod": 1, "dev": 948, "optional": 39, "peer": 1, "peerOptional": 0, "total": 948}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
--- stdout ---
added 923 packages, and audited 924 packages in 13s
195 packages are looking for funding
run `npm fund` for details
# npm audit report
diff <8.0.3
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
No fix available
node_modules/diff
mocha 0.14.0 - 12.0.0-beta-3
Depends on vulnerable versions of diff
node_modules/mocha
@wdio/mocha-framework *
Depends on vulnerable versions of mocha
node_modules/@wdio/mocha-framework
form-data <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.1.0, which is a breaking change
node_modules/form-data
request *
Depends on vulnerable versions of form-data
Depends on vulnerable versions of qs
Depends on vulnerable versions of tough-cookie
node_modules/request
mwbot >=0.1.6
Depends on vulnerable versions of request
node_modules/mwbot
wdio-mediawiki <=5.1.0
Depends on vulnerable versions of mwbot
node_modules/wdio-mediawiki
qs <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.1.0, which is a breaking change
node_modules/qs
tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.1.0, which is a breaking change
node_modules/tough-cookie
9 vulnerabilities (3 low, 3 moderate, 1 high, 2 critical)
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated lodash.isequal@4.5.0: This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
--- stdout ---
added 923 packages, and audited 924 packages in 20s
195 packages are looking for funding
run `npm fund` for details
9 vulnerabilities (3 low, 3 moderate, 1 high, 2 critical)
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
--- stdout ---
> test
> grunt test
Running "eslint:all" (eslint) task
/src/repo/modules/index.pagelist/PagelistInputWidget.DialogModel.js
57:2 warning Prefer .then to .done no-jquery/no-done-fail
/src/repo/modules/index.pagelist/PagelistInputWidget.Model.js
196:2 warning Prefer .then to .done no-jquery/no-done-fail
/src/repo/modules/index.pagelist/PagelistInputWidget.TopPanel.js
23:17 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
27:18 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
31:15 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
/src/repo/modules/index.pagelist/init.js
6:1 warning @internal should not have a name jsdoc/valid-types
/src/repo/modules/page.editinsequence/EditorController.js
93:26 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
/src/repo/modules/page.editinsequence/PageModel.js
138:1 warning The type 'pageModelUpdated' is undefined jsdoc/no-undefined-types
280:1 warning The type 'pageModelUpdated' is undefined jsdoc/no-undefined-types
/src/repo/modules/page.editinsequence/PagelistModel.js
33:2 warning Prefer .then to .done no-jquery/no-done-fail
98:1 warning The type 'pageListReady' is undefined jsdoc/no-undefined-types
99:1 warning The type 'pageUpdated' is undefined jsdoc/no-undefined-types
100:1 warning The type 'lastReached' is undefined jsdoc/no-undefined-types
101:1 warning The type 'firstReached' is undefined jsdoc/no-undefined-types
145:1 warning The type 'pageUpdated' is undefined jsdoc/no-undefined-types
146:1 warning The type 'lastReached' is undefined jsdoc/no-undefined-types
181:1 warning The type 'pageUpdated' is undefined jsdoc/no-undefined-types
182:1 warning The type 'firstReached' is undefined jsdoc/no-undefined-types
/src/repo/modules/page/OpenseadragonController.js
22:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
/src/repo/modules/page/ext.proofreadpage.page.edit.js
148:14 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
156:14 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
164:14 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
172:14 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
180:14 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
362:1 warning @internal should not have a name jsdoc/valid-types
/src/repo/modules/ve/node/ve.ui.MWPagesInspector.js
72:2 warning Prefer .then to .done no-jquery/no-done-fail
✖ 26 problems (0 errors, 26 warnings)
Running "stylelint:all" (stylelint) task
>> modules/ext.proofreadpage.base.less
>> 6:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 7:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 8:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 9:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 10:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 13:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 14:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 15:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 16:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 17:1 ⚠ Unexpected browser feature "css-paged-media" is not supported by Safari 12,13,14,15,11.1,12.1,13.1,14.1,15.1,15.2-15.3,15.4,15.5,15.6,16.0,16.1,16.2,16.3,16.4,16.5,16.6,17.0,17.1,17.2,17.3,17.4,17.5,17.6,18.0,18.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5,13.0-13.1,13.2,13.3,13.4-13.7,14.0-14.4,14.5-14.8,15.0-15.1,15.2-15.3,15.4,15.5,15.6-15.8,16.0,16.1,16.2,16.3,16.4,16.5,16.6-16.7,17.0,17.1,17.2,17.3,17.4,17.5,17.6-17.7,18.0,18.1, Android Browser 142 plugin/no-unsupported-browser-features
>> 78:1 ⚠ Unexpected browser feature "prefers-color-scheme" is not supported by Safari 12,11.1, Safari on iOS 11.3-11.4,12.0-12.1,12.2-12.5 plugin/no-unsupported-browser-features
>>
>> ⚠ 11 problems (0 errors, 11 warnings)
⚠ 11 warnings
>> Linted 12 files without errors
Running "banana:ProofreadPage" (banana) task
>> 2 message directories checked.
Done.
--- end ---
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating composer dependencies
* mediawiki/mediawiki-codesniffer: 48.0.0 → 49.0.0
* mediawiki/minus-x: 1.1.3 → 2.0.0
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmp1mg73p2n
--- stdout ---
[master 7f2dd38] build: Updating composer dependencies
1 file changed, 2 insertions(+), 2 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 7f2dd3808baf5c67be7d32e1b045530979549fa0 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sat, 17 Jan 2026 03:27:57 +0000
Subject: [PATCH] build: Updating composer dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* mediawiki/mediawiki-codesniffer: 48.0.0 → 49.0.0
* mediawiki/minus-x: 1.1.3 → 2.0.0
Change-Id: I3d450770e5ef7cd9c2de679d8a18a8a94316d7c5
---
composer.json | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/composer.json b/composer.json
index f5c5c8c..d4d0565 100644
--- a/composer.json
+++ b/composer.json
@@ -8,9 +8,9 @@
"composer/installers": "~1.0|~2.0"
},
"require-dev": {
- "mediawiki/mediawiki-codesniffer": "48.0.0",
+ "mediawiki/mediawiki-codesniffer": "49.0.0",
"mediawiki/mediawiki-phan-config": "0.18.0",
- "mediawiki/minus-x": "1.1.3",
+ "mediawiki/minus-x": "2.0.0",
"php-parallel-lint/php-console-highlighter": "1.0.0",
"php-parallel-lint/php-parallel-lint": "1.4.0"
},
--
2.47.3
--- end ---