log #2343713

$ date
--- stdout ---
Sat Jan 24 08:49:10 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-libs-node-cssjanus.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
edc0fa0f04ddf2179e94a56a74c1a46202039e67 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "lodash": {
      "name": "lodash",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112455,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
          "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": ">=4.0.0 <=4.17.22"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.17.21",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 1,
      "high": 0,
      "critical": 0,
      "total": 1
    },
    "dependencies": {
      "prod": 1,
      "dev": 373,
      "optional": 0,
      "peer": 1,
      "peerOptional": 0,
      "total": 373
    }
  }
}

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "lodash": {
      "name": "lodash",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112455,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
          "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": ">=4.0.0 <=4.17.22"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.17.21",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 1,
      "high": 0,
      "critical": 0,
      "total": 1
    },
    "dependencies": {
      "prod": 1,
      "dev": 373,
      "optional": 0,
      "peer": 1,
      "peerOptional": 0,
      "total": 373
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
  "added": 373,
  "removed": 0,
  "changed": 0,
  "audited": 374,
  "funding": 79,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "lodash": {
        "name": "lodash",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1112455,
            "name": "lodash",
            "dependency": "lodash",
            "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
            "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
            },
            "range": ">=4.0.0 <=4.17.22"
          }
        ],
        "effects": [],
        "range": "4.0.0 - 4.17.21",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 1,
        "high": 0,
        "critical": 0,
        "total": 1
      },
      "dependencies": {
        "prod": 1,
        "dev": 373,
        "optional": 0,
        "peer": 1,
        "peerOptional": 0,
        "total": 373
      }
    }
  }
}

--- end ---
{"added": 373, "removed": 0, "changed": 0, "audited": 374, "funding": 79, "audit": {"auditReportVersion": 2, "vulnerabilities": {"lodash": {"name": "lodash", "severity": "moderate", "isDirect": false, "via": [{"source": 1112455, "name": "lodash", "dependency": "lodash", "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "range": ">=4.0.0 <=4.17.22"}], "effects": [], "range": "4.0.0 - 4.17.21", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 1, "high": 0, "critical": 0, "total": 1}, "dependencies": {"prod": 1, "dev": 373, "optional": 0, "peer": 1, "peerOptional": 0, "total": 373}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---

added 373 packages, and audited 374 packages in 4s

79 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stdout ---

added 373 packages, and audited 374 packages in 4s

79 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

--- end ---
$ /usr/bin/npm test
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old.  To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
--- stdout ---

> cssjanus@2.3.0 test
> eslint . && qunit test/unit.js


/src/repo/src/cssjanus.js
  79:24  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp

/src/repo/test/bench.js
   84:10  warning  Found readFileSync from package "fs" with non literal argument at index 0   security/detect-non-literal-fs-filename
   99:2   warning  Found writeFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  136:2   warning  Don't use process.exit(); throw an error instead                            n/no-process-exit

✖ 4 problems (0 errors, 4 warnings)

TAP version 13
ok 1 preserve comments
ok 2 flip position
ok 3 flip negative values
ok 4 flip four value notation
ok 5 flip direction
ok 6 flip float
ok 7 flip padding
ok 8 flip padding-{edge}
ok 9 flip margin-{edge}
ok 10 flip cursor
ok 11 flip text-align
ok 12 flip text-shadow
ok 13 flip box-shadow
ok 14 flip border-{edge}
ok 15 flip border-{edge}-color
ok 16 flip border-{edge}-style
ok 17 flip border-color
ok 18 flip border-width
ok 19 flip border-style
ok 20 flip border-radius
ok 21 flip border-radius (one-way)
ok 22 flip border-top-{edge}-radius
ok 23 flip border-bottom-{edge}-radius
ok 24 flip transform translate x-axis
ok 25 flip background-position keywords
ok 26 flip background-position percentages
ok 27 do not flip background-position non-percentages
ok 28 flip background percentages
ok 29 flip background-position-x percentages
ok 30 do not flip background-position-y
ok 31 do not flip URLs when url transforms are off
ok 32 flip URLs when url transforms are on
ok 33 do not flip URLs (back-compat boolean argument)
ok 34 flip URLs (back-compat boolean argument)
ok 35 leave class names alone
ok 36 leave unknown properties alone
ok 37 flip multiple rules
ok 38 flip duplicate properties
ok 39 do not flip rules or properties with @noflip comments
ok 40 do not flip gradient notation
ok 41 long content
ok 42 do not touch CSS Logical
ok 43 do not touch dir attribute selector and dir pseudo-class selector
1..43
# pass 43
# skip 0
# todo 0
# fail 0

--- end ---
{"1112455": {"source": 1112455, "name": "lodash", "dependency": "lodash", "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "range": ">=4.0.0 <=4.17.22"}}
Upgrading n:lodash from 4.17.21 -> 4.17.23
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json

--- end ---
build: Updating lodash to 4.17.23

* https://github.com/advisories/GHSA-xxjr-mmjv-4gpg

$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmpet__ohc6
--- stdout ---
[master 4203390] build: Updating lodash to 4.17.23
 1 file changed, 6 insertions(+), 6 deletions(-)

--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 42033901410c3ca10316959648fea1ddd744ea21 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sat, 24 Jan 2026 08:49:27 +0000
Subject: [PATCH] build: Updating lodash to 4.17.23

* https://github.com/advisories/GHSA-xxjr-mmjv-4gpg

Change-Id: Icb2be7e50d33ef6bd892f0d085fc2b6f851cf2a1
---
 package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c5cc0d8..5e80136 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2970,9 +2970,9 @@
 			}
 		},
 		"node_modules/lodash": {
-			"version": "4.17.21",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-			"integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
 			"dev": true
 		},
 		"node_modules/lodash.flattendeep": {
@@ -6644,9 +6644,9 @@
 			}
 		},
 		"lodash": {
-			"version": "4.17.21",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-			"integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
 			"dev": true
 		},
 		"lodash.flattendeep": {
-- 
2.47.3


--- end ---
mediawiki/libs/node-cssjanus: main (log #2343713)
