This run took 35 seconds.
From 072a436ca657b5f6ba76f51a0ad5f89a78e08278 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Wed, 21 Jan 2026 00:11:03 +0000
Subject: [PATCH] build: Updating diff to 5.2.2
* https://github.com/advisories/GHSA-73rr-hh4g-fpgx
Change-Id: I56bc832bd10935db1c0aa118ede4d2446e70cb4d
---
package-lock.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index a00d814..76acdf0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1545,9 +1545,9 @@
}
},
"node_modules/diff": {
- "version": "5.2.0",
- "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
- "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
+ "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
"dev": true,
"engines": {
"node": ">=0.3.1"
@@ -7022,9 +7022,9 @@
"dev": true
},
"diff": {
- "version": "5.2.0",
- "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
- "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
+ "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
"dev": true
},
"diff-sequences": {
--
2.47.3
$ date
--- stdout ---
Wed Jan 21 00:10:41 UTC 2026
--- end ---
$ git clone file:///srv/git/jsdoc-wmf-theme.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
c3449b00eadef78ba78cb9772a9055ddc5df0963 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112327,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.0.0 <5.2.2"
}
],
"effects": [],
"range": "5.0.0 - 5.2.1",
"nodes": [
"node_modules/diff"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 0,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 37,
"dev": 461,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 497
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112327,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.0.0 <5.2.2"
}
],
"effects": [],
"range": "5.0.0 - 5.2.1",
"nodes": [
"node_modules/diff"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 0,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 37,
"dev": 461,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 497
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 497,
"removed": 0,
"changed": 0,
"audited": 498,
"funding": 113,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112327,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.0.0 <5.2.2"
}
],
"effects": [],
"range": "5.0.0 - 5.2.1",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 0,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 37,
"dev": 461,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 497
}
}
}
}
--- end ---
{"added": 497, "removed": 0, "changed": 0, "audited": 498, "funding": 113, "audit": {"auditReportVersion": 2, "vulnerabilities": {"diff": {"name": "diff", "severity": "low", "isDirect": false, "via": [{"source": 1112327, "name": "diff", "dependency": "diff", "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "severity": "low", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=5.0.0 <5.2.2"}], "effects": [], "range": "5.0.0 - 5.2.1", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 1, "moderate": 0, "high": 0, "critical": 0, "total": 1}, "dependencies": {"prod": 37, "dev": 461, "optional": 0, "peer": 1, "peerOptional": 0, "total": 497}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
--- stdout ---
added 497 packages, and audited 498 packages in 5s
113 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
--- stdout ---
added 497 packages, and audited 498 packages in 5s
113 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
$ /usr/bin/npm test
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
--- stdout ---
> jsdoc-wmf-theme@1.1.0 test
> grunt lint && mocha tests/
Running "eslint:all" (eslint) task
Running "stylelint:src" (stylelint) task
>> Linted 9 files without errors
Done.
Externals plugin
✔ should extend wmfConf with defaultMaps when wmfConf already has some entries
✔ should initialize wmfConf with defaultMaps when wmfConf is empty
✔ should initialize templates and wmfConf when they do not exist
3 passing (17ms)
--- end ---
{"1112327": {"source": 1112327, "name": "diff", "dependency": "diff", "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "severity": "low", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=5.0.0 <5.2.2"}}
Upgrading n:diff from 5.2.0 -> 5.2.2
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating diff to 5.2.2
* https://github.com/advisories/GHSA-73rr-hh4g-fpgx
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmps5ge11s8
--- stdout ---
[master 072a436] build: Updating diff to 5.2.2
1 file changed, 6 insertions(+), 6 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 072a436ca657b5f6ba76f51a0ad5f89a78e08278 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Wed, 21 Jan 2026 00:11:03 +0000
Subject: [PATCH] build: Updating diff to 5.2.2
* https://github.com/advisories/GHSA-73rr-hh4g-fpgx
Change-Id: I56bc832bd10935db1c0aa118ede4d2446e70cb4d
---
package-lock.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index a00d814..76acdf0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1545,9 +1545,9 @@
}
},
"node_modules/diff": {
- "version": "5.2.0",
- "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
- "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
+ "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
"dev": true,
"engines": {
"node": ">=0.3.1"
@@ -7022,9 +7022,9 @@
"dev": true
},
"diff": {
- "version": "5.2.0",
- "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
- "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.2.tgz",
+ "integrity": "sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==",
"dev": true
},
"diff-sequences": {
--
2.47.3
--- end ---