mediawiki/extensions/WikibaseMediaInfo: REL1_45 (log #2358268)

$ date
--- stdout ---
Mon Feb 23 16:41:46 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-WikibaseMediaInfo.git /src/repo --depth=1 -b REL1_45
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_45
--- stdout ---
4eea29fc16d2e465bd12412f152b861888df9a5d refs/heads/REL1_45

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@eslint/eslintrc": {
      "name": "@eslint/eslintrc",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "eslint",
        "eslint-plugin-unicorn"
      ],
      "range": "0.0.1 || >=0.1.1",
      "nodes": [
        "node_modules/@eslint/eslintrc",
        "node_modules/eslint-plugin-unicorn/node_modules/@eslint/eslintrc"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@humanwhocodes/config-array": {
      "name": "@humanwhocodes/config-array",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "eslint"
      ],
      "range": "*",
      "nodes": [
        "node_modules/@humanwhocodes/config-array"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/eslint-plugin": {
      "name": "@typescript-eslint/eslint-plugin",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia",
        "eslint-plugin-jest"
      ],
      "range": "<=8.55.1-alpha.3",
      "nodes": [
        "node_modules/@typescript-eslint/eslint-plugin",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/parser": {
      "name": "@typescript-eslint/parser",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin"
      ],
      "range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@typescript-eslint/parser",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/type-utils": {
      "name": "@typescript-eslint/type-utils",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin"
      ],
      "range": "5.9.2-alpha.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@typescript-eslint/type-utils",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/typescript-estree": {
      "name": "@typescript-eslint/typescript-estree",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils"
      ],
      "range": "6.16.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@stylistic/eslint-plugin/node_modules/@typescript-eslint/typescript-estree",
        "node_modules/@typescript-eslint/typescript-estree",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/typescript-estree"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/utils": {
      "name": "@typescript-eslint/utils",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/type-utils",
        "eslint-plugin-jest"
      ],
      "range": "<=8.56.1-alpha.2",
      "nodes": [
        "node_modules/@stylistic/eslint-plugin/node_modules/@typescript-eslint/utils",
        "node_modules/@typescript-eslint/utils",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "ajv": {
      "name": "ajv",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113398,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<6.14.0"
        },
        {
          "source": 1113399,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0-alpha.0 <8.18.0"
        }
      ],
      "effects": [],
      "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
      "nodes": [
        "node_modules/ajv",
        "node_modules/table/node_modules/ajv"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1112703,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.5.1"
        }
      ],
      "effects": [],
      "range": "<3.5.1",
      "nodes": [
        "node_modules/diff"
      ],
      "fixAvailable": true
    },
    "doiuse": {
      "name": "doiuse",
      "severity": "high",
      "isDirect": false,
      "via": [
        "multimatch"
      ],
      "effects": [
        "stylelint-no-unsupported-browser-features"
      ],
      "range": ">=2.2.0",
      "nodes": [
        "node_modules/doiuse"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "eslint": {
      "name": "eslint",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@eslint/eslintrc",
        "@humanwhocodes/config-array",
        "file-entry-cache",
        "minimatch"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils",
        "eslint-config-wikimedia",
        "eslint-plugin-jest",
        "eslint-plugin-jsdoc",
        "eslint-plugin-vue",
        "grunt-eslint"
      ],
      "range": "0.7.1 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
      "nodes": [
        "node_modules/eslint"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-config-wikimedia": {
      "name": "eslint-config-wikimedia",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/parser",
        "eslint",
        "eslint-plugin-jest",
        "eslint-plugin-jsdoc",
        "eslint-plugin-unicorn",
        "eslint-plugin-vue"
      ],
      "effects": [],
      "range": ">=0.9.0",
      "nodes": [
        "node_modules/eslint-config-wikimedia"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-jest": {
      "name": "eslint-plugin-jest",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "25.0.1 - 29.12.2",
      "nodes": [
        "node_modules/eslint-plugin-jest"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-jsdoc": {
      "name": "eslint-plugin-jsdoc",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "8.4.4 - 62.6.1",
      "nodes": [
        "node_modules/eslint-plugin-jsdoc"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-mediawiki": {
      "name": "eslint-plugin-mediawiki",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint-plugin-vue"
      ],
      "effects": [],
      "range": "0.2.3 - 0.7.0",
      "nodes": [
        "node_modules/eslint-plugin-mediawiki"
      ],
      "fixAvailable": true
    },
    "eslint-plugin-n": {
      "name": "eslint-plugin-n",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [],
      "range": "<=17.21.1",
      "nodes": [
        "node_modules/eslint-plugin-n"
      ],
      "fixAvailable": true
    },
    "eslint-plugin-unicorn": {
      "name": "eslint-plugin-unicorn",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@eslint/eslintrc"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "50.0.0 - 54.0.0",
      "nodes": [
        "node_modules/eslint-plugin-unicorn"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-vue": {
      "name": "eslint-plugin-vue",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia",
        "eslint-plugin-mediawiki"
      ],
      "range": "5.0.0-beta.0 - 10.7.0",
      "nodes": [
        "node_modules/eslint-plugin-vue"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "file-entry-cache": {
      "name": "file-entry-cache",
      "severity": "high",
      "isDirect": false,
      "via": [
        "flat-cache"
      ],
      "effects": [
        "eslint"
      ],
      "range": "4.0.0 - 7.0.2",
      "nodes": [
        "node_modules/file-entry-cache"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "flat-cache": {
      "name": "flat-cache",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "file-entry-cache"
      ],
      "range": "1.3.4 - 4.0.0",
      "nodes": [
        "node_modules/flat-cache"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "glob": {
      "name": "glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "nyc",
        "rimraf",
        "tap-mocha-reporter",
        "test-exclude"
      ],
      "range": "3.0.0 - 10.5.0",
      "nodes": [
        "node_modules/glob"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "grunt": {
      "name": "grunt",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob",
        "minimatch"
      ],
      "effects": [
        "grunt-eslint"
      ],
      "range": ">=0.4.0-a",
      "nodes": [
        "node_modules/grunt"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "grunt-eslint": {
      "name": "grunt-eslint",
      "severity": "high",
      "isDirect": true,
      "via": [
        "eslint",
        "grunt"
      ],
      "effects": [],
      "range": "<=17.3.2 || >=18.1.0",
      "nodes": [
        "node_modules/grunt-eslint"
      ],
      "fixAvailable": {
        "name": "grunt-eslint",
        "version": "20.2.0",
        "isSemVerMajor": true
      }
    },
    "istanbul-lib-processinfo": {
      "name": "istanbul-lib-processinfo",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "nyc"
      ],
      "range": "<=2.0.3",
      "nodes": [
        "node_modules/istanbul-lib-processinfo"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "jpeg-js": {
      "name": "jpeg-js",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1088964,
          "name": "jpeg-js",
          "dependency": "jpeg-js",
          "title": "Infinite loop in jpeg-js",
          "url": "https://github.com/advisories/GHSA-xvf7-4v9q-58w6",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.4.4"
        },
        {
          "source": 1093580,
          "name": "jpeg-js",
          "dependency": "jpeg-js",
          "title": "Uncontrolled resource consumption in jpeg-js",
          "url": "https://github.com/advisories/GHSA-w7q9-p3jq-fmhm",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 5.5,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<0.4.0"
        }
      ],
      "effects": [],
      "range": "<=0.4.3",
      "nodes": [
        "node_modules/jpeg-js"
      ],
      "fixAvailable": {
        "name": "jpeg-js",
        "version": "0.4.4",
        "isSemVerMajor": true
      }
    },
    "jquery": {
      "name": "jquery",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1102100,
          "name": "jquery",
          "dependency": "jquery",
          "title": "Potential XSS vulnerability in jQuery",
          "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=1.2.0 <3.5.0"
        },
        {
          "source": 1109145,
          "name": "jquery",
          "dependency": "jquery",
          "title": "Potential XSS vulnerability in jQuery",
          "url": "https://github.com/advisories/GHSA-jpcq-cgw6-v4j6",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H"
          },
          "range": ">=1.0.3 <3.5.0"
        }
      ],
      "effects": [
        "oojs-ui"
      ],
      "range": "<=3.4.1",
      "nodes": [
        "node_modules/oojs-ui/node_modules/jquery"
      ],
      "fixAvailable": {
        "name": "oojs-ui",
        "version": "0.53.1",
        "isSemVerMajor": true
      }
    },
    "jsdom": {
      "name": "jsdom",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-native",
        "tough-cookie"
      ],
      "effects": [],
      "range": "0.1.20 || 0.2.0 - 16.5.3",
      "nodes": [
        "node_modules/jsdom"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113371,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<10.2.1"
        }
      ],
      "effects": [
        "@eslint/eslintrc",
        "@humanwhocodes/config-array",
        "@typescript-eslint/typescript-estree",
        "eslint",
        "eslint-plugin-n",
        "glob",
        "grunt",
        "multimatch",
        "test-exclude"
      ],
      "range": "<10.2.1",
      "nodes": [
        "node_modules/@eslint/eslintrc/node_modules/minimatch",
        "node_modules/@stylistic/eslint-plugin/node_modules/minimatch",
        "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
        "node_modules/eslint-config-wikimedia/node_modules/minimatch",
        "node_modules/eslint-plugin-n/node_modules/minimatch",
        "node_modules/eslint-plugin-unicorn/node_modules/minimatch",
        "node_modules/eslint/node_modules/minimatch",
        "node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "mockery": {
      "name": "mockery",
      "severity": "critical",
      "isDirect": true,
      "via": [
        {
          "source": 1092753,
          "name": "mockery",
          "dependency": "mockery",
          "title": "mockery is vulnerable to prototype pollution",
          "url": "https://github.com/advisories/GHSA-gmwp-3pwc-3j3g",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=2.1.0"
        }
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/mockery"
      ],
      "fixAvailable": false
    },
    "multimatch": {
      "name": "multimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "doiuse"
      ],
      "range": "<=7.0.0",
      "nodes": [
        "node_modules/multimatch"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "nyc": {
      "name": "nyc",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob",
        "istanbul-lib-processinfo",
        "rimraf",
        "spawn-wrap",
        "test-exclude"
      ],
      "effects": [],
      "range": "<=17.1.0",
      "nodes": [
        "node_modules/nyc"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "oojs-ui": {
      "name": "oojs-ui",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "jquery"
      ],
      "effects": [],
      "range": "0.11.0 - 0.38.1",
      "nodes": [
        "node_modules/oojs-ui"
      ],
      "fixAvailable": {
        "name": "oojs-ui",
        "version": "0.53.1",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113132,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "high",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie"
      ],
      "effects": [
        "jsdom",
        "request-promise-core",
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-core": {
      "name": "request-promise-core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request-promise-core"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-native": {
      "name": "request-promise-native",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request",
        "request-promise-core",
        "tough-cookie"
      ],
      "effects": [
        "jsdom"
      ],
      "range": ">=1.0.0",
      "nodes": [
        "node_modules/request-promise-native"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "rimraf": {
      "name": "rimraf",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob"
      ],
      "effects": [
        "flat-cache",
        "istanbul-lib-processinfo",
        "nyc",
        "spawn-wrap",
        "tmp"
      ],
      "range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
      "nodes": [
        "node_modules/rimraf",
        "node_modules/tmp/node_modules/rimraf"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "spawn-wrap": {
      "name": "spawn-wrap",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "nyc"
      ],
      "range": "0.0.1 - 2.0.0",
      "nodes": [
        "node_modules/spawn-wrap"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "stylelint-config-wikimedia": {
      "name": "stylelint-config-wikimedia",
      "severity": "high",
      "isDirect": true,
      "via": [
        "stylelint-no-unsupported-browser-features"
      ],
      "effects": [],
      "range": ">=0.10.2",
      "nodes": [
        "node_modules/stylelint-config-wikimedia"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "stylelint-no-unsupported-browser-features": {
      "name": "stylelint-no-unsupported-browser-features",
      "severity": "high",
      "isDirect": false,
      "via": [
        "doiuse"
      ],
      "effects": [
        "stylelint-config-wikimedia"
      ],
      "range": "*",
      "nodes": [
        "node_modules/stylelint-no-unsupported-browser-features"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "tap-mocha-reporter": {
      "name": "tap-mocha-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob"
      ],
      "effects": [],
      "range": ">=0.0.4",
      "nodes": [
        "node_modules/tap-mocha-reporter"
      ],
      "fixAvailable": {
        "name": "tap-mocha-reporter",
        "version": "0.0.3",
        "isSemVerMajor": true
      }
    },
    "test-exclude": {
      "name": "test-exclude",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob",
        "minimatch"
      ],
      "effects": [
        "nyc"
      ],
      "range": "4.2.2 || 5.0.0 - 7.0.2",
      "nodes": [
        "node_modules/test-exclude"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        },
        "rimraf"
      ],
      "effects": [],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "tmp",
        "version": "0.2.5",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "jsdom",
        "request",
        "request-promise-native"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 7,
      "high": 34,
      "critical": 3,
      "total": 45
    },
    "dependencies": {
      "prod": 1,
      "dev": 680,
      "optional": 5,
      "peer": 5,
      "peerOptional": 0,
      "total": 680
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 39 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.3.2)
  - Locking composer/semver (3.4.4)
  - Locking composer/spdx-licenses (1.5.9)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
  - Locking doctrine/deprecations (1.1.6)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking mediawiki/mediawiki-codesniffer (v48.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.17.0)
  - Locking mediawiki/minus-x (1.1.3)
  - Locking mediawiki/phan-taint-check-plugin (7.0.0)
  - Locking microsoft/tolerant-php-parser (v0.1.2)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking phan/phan (5.5.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.4.0)
  - Locking phpcsstandards/phpcsutils (1.1.1)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.6.6)
  - Locking phpdocumentor/type-resolver (1.12.0)
  - Locking phpstan/phpdoc-parser (2.3.2)
  - Locking psr/container (2.0.2)
  - Locking psr/log (3.0.2)
  - Locking sabre/event (5.1.7)
  - Locking serialization/serialization (4.1.0)
  - Locking squizlabs/php_codesniffer (3.13.2)
  - Locking symfony/console (v7.4.4)
  - Locking symfony/deprecation-contracts (v3.6.0)
  - Locking symfony/polyfill-ctype (v1.33.0)
  - Locking symfony/polyfill-intl-grapheme (v1.33.0)
  - Locking symfony/polyfill-intl-normalizer (v1.33.0)
  - Locking symfony/polyfill-mbstring (v1.33.0)
  - Locking symfony/polyfill-php80 (v1.33.0)
  - Locking symfony/service-contracts (v3.6.1)
  - Locking symfony/string (v8.0.4)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (2.1.5)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 39 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing squizlabs/php_codesniffer (3.13.2): Extracting archive
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
  - Installing composer/pcre (3.3.2): Extracting archive
  - Installing phpcsstandards/phpcsutils (1.1.1): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.9): Extracting archive
  - Installing composer/semver (3.4.4): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v48.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
  - Installing symfony/string (v8.0.4): Extracting archive
  - Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.6.1): Extracting archive
  - Installing symfony/console (v7.4.4): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
  - Installing webmozart/assert (2.1.5): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.6): Extracting archive
  - Installing phpdocumentor/type-resolver (1.12.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.6.6): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (3.0.2): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.5.1): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (7.0.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.17.0): Extracting archive
  - Installing mediawiki/minus-x (1.1.3): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  - Installing serialization/serialization (4.1.0): Extracting archive
  0/37 [>---------------------------]   0%
 28/37 [=====================>------]  75%
 37/37 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
17 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@eslint/eslintrc": {
      "name": "@eslint/eslintrc",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "eslint",
        "eslint-plugin-unicorn"
      ],
      "range": "0.0.1 || >=0.1.1",
      "nodes": [
        "node_modules/@eslint/eslintrc",
        "node_modules/eslint-plugin-unicorn/node_modules/@eslint/eslintrc"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@humanwhocodes/config-array": {
      "name": "@humanwhocodes/config-array",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "eslint"
      ],
      "range": "*",
      "nodes": [
        "node_modules/@humanwhocodes/config-array"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/eslint-plugin": {
      "name": "@typescript-eslint/eslint-plugin",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia",
        "eslint-plugin-jest"
      ],
      "range": "<=8.55.1-alpha.3",
      "nodes": [
        "node_modules/@typescript-eslint/eslint-plugin",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/parser": {
      "name": "@typescript-eslint/parser",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin"
      ],
      "range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@typescript-eslint/parser",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/type-utils": {
      "name": "@typescript-eslint/type-utils",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin"
      ],
      "range": "5.9.2-alpha.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@typescript-eslint/type-utils",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/typescript-estree": {
      "name": "@typescript-eslint/typescript-estree",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils"
      ],
      "range": "6.16.0 - 8.56.1-alpha.2",
      "nodes": [
        "node_modules/@stylistic/eslint-plugin/node_modules/@typescript-eslint/typescript-estree",
        "node_modules/@typescript-eslint/typescript-estree",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/typescript-estree"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "@typescript-eslint/utils": {
      "name": "@typescript-eslint/utils",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/typescript-estree",
        "eslint"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/type-utils",
        "eslint-plugin-jest"
      ],
      "range": "<=8.56.1-alpha.2",
      "nodes": [
        "node_modules/@stylistic/eslint-plugin/node_modules/@typescript-eslint/utils",
        "node_modules/@typescript-eslint/utils",
        "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "ajv": {
      "name": "ajv",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113398,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<6.14.0"
        },
        {
          "source": 1113399,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0-alpha.0 <8.18.0"
        }
      ],
      "effects": [],
      "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
      "nodes": [
        "node_modules/ajv",
        "node_modules/table/node_modules/ajv"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1112703,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.5.1"
        }
      ],
      "effects": [],
      "range": "<3.5.1",
      "nodes": [
        "node_modules/diff"
      ],
      "fixAvailable": true
    },
    "doiuse": {
      "name": "doiuse",
      "severity": "high",
      "isDirect": false,
      "via": [
        "multimatch"
      ],
      "effects": [
        "stylelint-no-unsupported-browser-features"
      ],
      "range": ">=2.2.0",
      "nodes": [
        "node_modules/doiuse"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "eslint": {
      "name": "eslint",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@eslint/eslintrc",
        "@humanwhocodes/config-array",
        "file-entry-cache",
        "minimatch"
      ],
      "effects": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/parser",
        "@typescript-eslint/type-utils",
        "@typescript-eslint/utils",
        "eslint-config-wikimedia",
        "eslint-plugin-jest",
        "eslint-plugin-jsdoc",
        "eslint-plugin-vue",
        "grunt-eslint"
      ],
      "range": "0.7.1 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
      "nodes": [
        "node_modules/eslint"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-config-wikimedia": {
      "name": "eslint-config-wikimedia",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/parser",
        "eslint",
        "eslint-plugin-jest",
        "eslint-plugin-jsdoc",
        "eslint-plugin-unicorn",
        "eslint-plugin-vue"
      ],
      "effects": [],
      "range": ">=0.9.0",
      "nodes": [
        "node_modules/eslint-config-wikimedia"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-jest": {
      "name": "eslint-plugin-jest",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@typescript-eslint/eslint-plugin",
        "@typescript-eslint/utils",
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "25.0.1 - 29.12.2",
      "nodes": [
        "node_modules/eslint-plugin-jest"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-jsdoc": {
      "name": "eslint-plugin-jsdoc",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "8.4.4 - 62.6.1",
      "nodes": [
        "node_modules/eslint-plugin-jsdoc"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-mediawiki": {
      "name": "eslint-plugin-mediawiki",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint-plugin-vue"
      ],
      "effects": [],
      "range": "0.2.3 - 0.7.0",
      "nodes": [
        "node_modules/eslint-plugin-mediawiki"
      ],
      "fixAvailable": true
    },
    "eslint-plugin-n": {
      "name": "eslint-plugin-n",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [],
      "range": "<=17.21.1",
      "nodes": [
        "node_modules/eslint-plugin-n"
      ],
      "fixAvailable": true
    },
    "eslint-plugin-unicorn": {
      "name": "eslint-plugin-unicorn",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@eslint/eslintrc"
      ],
      "effects": [
        "eslint-config-wikimedia"
      ],
      "range": "50.0.0 - 54.0.0",
      "nodes": [
        "node_modules/eslint-plugin-unicorn"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "eslint-plugin-vue": {
      "name": "eslint-plugin-vue",
      "severity": "high",
      "isDirect": false,
      "via": [
        "eslint"
      ],
      "effects": [
        "eslint-config-wikimedia",
        "eslint-plugin-mediawiki"
      ],
      "range": "5.0.0-beta.0 - 10.7.0",
      "nodes": [
        "node_modules/eslint-plugin-vue"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "file-entry-cache": {
      "name": "file-entry-cache",
      "severity": "high",
      "isDirect": false,
      "via": [
        "flat-cache"
      ],
      "effects": [
        "eslint"
      ],
      "range": "4.0.0 - 7.0.2",
      "nodes": [
        "node_modules/file-entry-cache"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "flat-cache": {
      "name": "flat-cache",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "file-entry-cache"
      ],
      "range": "1.3.4 - 4.0.0",
      "nodes": [
        "node_modules/flat-cache"
      ],
      "fixAvailable": {
        "name": "eslint-config-wikimedia",
        "version": "0.8.1",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "glob": {
      "name": "glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "nyc",
        "rimraf",
        "tap-mocha-reporter",
        "test-exclude"
      ],
      "range": "3.0.0 - 10.5.0",
      "nodes": [
        "node_modules/glob"
      ],
      "fixAvailable": {
        "name": "tap-mocha-reporter",
        "version": "0.0.3",
        "isSemVerMajor": true
      }
    },
    "grunt": {
      "name": "grunt",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob",
        "minimatch"
      ],
      "effects": [
        "grunt-eslint"
      ],
      "range": ">=0.4.0-a",
      "nodes": [
        "node_modules/grunt"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "grunt-eslint": {
      "name": "grunt-eslint",
      "severity": "high",
      "isDirect": true,
      "via": [
        "eslint",
        "grunt"
      ],
      "effects": [],
      "range": "<=17.3.2 || >=18.1.0",
      "nodes": [
        "node_modules/grunt-eslint"
      ],
      "fixAvailable": {
        "name": "grunt-eslint",
        "version": "20.2.0",
        "isSemVerMajor": true
      }
    },
    "istanbul-lib-processinfo": {
      "name": "istanbul-lib-processinfo",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "nyc"
      ],
      "range": "<=2.0.3",
      "nodes": [
        "node_modules/istanbul-lib-processinfo"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "jpeg-js": {
      "name": "jpeg-js",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1088964,
          "name": "jpeg-js",
          "dependency": "jpeg-js",
          "title": "Infinite loop in jpeg-js",
          "url": "https://github.com/advisories/GHSA-xvf7-4v9q-58w6",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.4.4"
        },
        {
          "source": 1093580,
          "name": "jpeg-js",
          "dependency": "jpeg-js",
          "title": "Uncontrolled resource consumption in jpeg-js",
          "url": "https://github.com/advisories/GHSA-w7q9-p3jq-fmhm",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 5.5,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<0.4.0"
        }
      ],
      "effects": [],
      "range": "<=0.4.3",
      "nodes": [
        "node_modules/jpeg-js"
      ],
      "fixAvailable": {
        "name": "jpeg-js",
        "version": "0.4.4",
        "isSemVerMajor": true
      }
    },
    "jquery": {
      "name": "jquery",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1102100,
          "name": "jquery",
          "dependency": "jquery",
          "title": "Potential XSS vulnerability in jQuery",
          "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=1.2.0 <3.5.0"
        },
        {
          "source": 1109145,
          "name": "jquery",
          "dependency": "jquery",
          "title": "Potential XSS vulnerability in jQuery",
          "url": "https://github.com/advisories/GHSA-jpcq-cgw6-v4j6",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H"
          },
          "range": ">=1.0.3 <3.5.0"
        }
      ],
      "effects": [
        "oojs-ui"
      ],
      "range": "<=3.4.1",
      "nodes": [
        "node_modules/oojs-ui/node_modules/jquery"
      ],
      "fixAvailable": {
        "name": "oojs-ui",
        "version": "0.53.1",
        "isSemVerMajor": true
      }
    },
    "jsdom": {
      "name": "jsdom",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-native",
        "tough-cookie"
      ],
      "effects": [],
      "range": "0.1.20 || 0.2.0 - 16.5.3",
      "nodes": [
        "node_modules/jsdom"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113371,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<10.2.1"
        }
      ],
      "effects": [
        "@eslint/eslintrc",
        "@humanwhocodes/config-array",
        "@typescript-eslint/typescript-estree",
        "eslint",
        "eslint-plugin-n",
        "glob",
        "grunt",
        "multimatch",
        "test-exclude"
      ],
      "range": "<10.2.1",
      "nodes": [
        "node_modules/@eslint/eslintrc/node_modules/minimatch",
        "node_modules/@stylistic/eslint-plugin/node_modules/minimatch",
        "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
        "node_modules/eslint-config-wikimedia/node_modules/minimatch",
        "node_modules/eslint-plugin-n/node_modules/minimatch",
        "node_modules/eslint-plugin-unicorn/node_modules/minimatch",
        "node_modules/eslint/node_modules/minimatch",
        "node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "mockery": {
      "name": "mockery",
      "severity": "critical",
      "isDirect": true,
      "via": [
        {
          "source": 1092753,
          "name": "mockery",
          "dependency": "mockery",
          "title": "mockery is vulnerable to prototype pollution",
          "url": "https://github.com/advisories/GHSA-gmwp-3pwc-3j3g",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=2.1.0"
        }
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/mockery"
      ],
      "fixAvailable": false
    },
    "multimatch": {
      "name": "multimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "doiuse"
      ],
      "range": "<=7.0.0",
      "nodes": [
        "node_modules/multimatch"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "nyc": {
      "name": "nyc",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob",
        "istanbul-lib-processinfo",
        "rimraf",
        "spawn-wrap",
        "test-exclude"
      ],
      "effects": [],
      "range": "<=17.1.0",
      "nodes": [
        "node_modules/nyc"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "oojs-ui": {
      "name": "oojs-ui",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "jquery"
      ],
      "effects": [],
      "range": "0.11.0 - 0.38.1",
      "nodes": [
        "node_modules/oojs-ui"
      ],
      "fixAvailable": {
        "name": "oojs-ui",
        "version": "0.53.1",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113132,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "high",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie"
      ],
      "effects": [
        "jsdom",
        "request-promise-core",
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-core": {
      "name": "request-promise-core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request-promise-core"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-native": {
      "name": "request-promise-native",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request",
        "request-promise-core",
        "tough-cookie"
      ],
      "effects": [
        "jsdom"
      ],
      "range": ">=1.0.0",
      "nodes": [
        "node_modules/request-promise-native"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    },
    "rimraf": {
      "name": "rimraf",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob"
      ],
      "effects": [
        "flat-cache",
        "istanbul-lib-processinfo",
        "nyc",
        "spawn-wrap",
        "tmp"
      ],
      "range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
      "nodes": [
        "node_modules/rimraf",
        "node_modules/tmp/node_modules/rimraf"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "spawn-wrap": {
      "name": "spawn-wrap",
      "severity": "high",
      "isDirect": false,
      "via": [
        "rimraf"
      ],
      "effects": [
        "nyc"
      ],
      "range": "0.0.1 - 2.0.0",
      "nodes": [
        "node_modules/spawn-wrap"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "stylelint-config-wikimedia": {
      "name": "stylelint-config-wikimedia",
      "severity": "high",
      "isDirect": true,
      "via": [
        "stylelint-no-unsupported-browser-features"
      ],
      "effects": [],
      "range": ">=0.10.2",
      "nodes": [
        "node_modules/stylelint-config-wikimedia"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "stylelint-no-unsupported-browser-features": {
      "name": "stylelint-no-unsupported-browser-features",
      "severity": "high",
      "isDirect": false,
      "via": [
        "doiuse"
      ],
      "effects": [
        "stylelint-config-wikimedia"
      ],
      "range": "*",
      "nodes": [
        "node_modules/stylelint-no-unsupported-browser-features"
      ],
      "fixAvailable": {
        "name": "stylelint-config-wikimedia",
        "version": "0.10.1",
        "isSemVerMajor": true
      }
    },
    "tap-mocha-reporter": {
      "name": "tap-mocha-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "glob"
      ],
      "effects": [],
      "range": ">=0.0.4",
      "nodes": [
        "node_modules/tap-mocha-reporter"
      ],
      "fixAvailable": {
        "name": "tap-mocha-reporter",
        "version": "0.0.3",
        "isSemVerMajor": true
      }
    },
    "test-exclude": {
      "name": "test-exclude",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob",
        "minimatch"
      ],
      "effects": [
        "nyc"
      ],
      "range": "4.2.2 || 5.0.0 - 7.0.2",
      "nodes": [
        "node_modules/test-exclude"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        },
        "rimraf"
      ],
      "effects": [],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "tmp",
        "version": "0.2.5",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "jsdom",
        "request",
        "request-promise-native"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "28.1.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 7,
      "high": 34,
      "critical": 3,
      "total": 45
    },
    "dependencies": {
      "prod": 1,
      "dev": 680,
      "optional": 5,
      "peer": 5,
      "peerOptional": 0,
      "total": 680
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/eslint-plugin@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN   @typescript-eslint/eslint-plugin@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN   node_modules/eslint-config-wikimedia
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN     @typescript-eslint/eslint-plugin@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/parser@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/parser@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser
npm WARN   @typescript-eslint/parser@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN   node_modules/eslint-config-wikimedia
npm WARN   1 more (@typescript-eslint/eslint-plugin)
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/parser@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser
npm WARN     @typescript-eslint/parser@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN     1 more (@typescript-eslint/eslint-plugin)
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/type-utils@8.35.1
npm WARN Found: peer eslint@"^8.57.0 || ^9.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from the root project
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/type-utils@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/type-utils@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils
npm WARN   @typescript-eslint/type-utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/type-utils@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils
npm WARN     @typescript-eslint/type-utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN     node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/utils@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/utils@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils
npm WARN   @typescript-eslint/utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN   1 more (@typescript-eslint/type-utils)
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/utils@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils
npm WARN     @typescript-eslint/utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN     node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN     1 more (@typescript-eslint/type-utils)
--- stdout ---
{
  "added": 678,
  "removed": 0,
  "changed": 0,
  "audited": 679,
  "funding": 121,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@eslint/eslintrc": {
        "name": "@eslint/eslintrc",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "eslint",
          "eslint-plugin-unicorn"
        ],
        "range": "0.0.1 || >=0.1.1",
        "nodes": [
          "",
          "node_modules/@eslint/eslintrc"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@humanwhocodes/config-array": {
        "name": "@humanwhocodes/config-array",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "eslint"
        ],
        "range": "*",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@typescript-eslint/eslint-plugin": {
        "name": "@typescript-eslint/eslint-plugin",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@typescript-eslint/parser",
          "@typescript-eslint/type-utils",
          "@typescript-eslint/utils",
          "eslint"
        ],
        "effects": [
          "eslint-config-wikimedia",
          "eslint-plugin-jest"
        ],
        "range": "<=8.55.1-alpha.3",
        "nodes": [
          "",
          "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@typescript-eslint/parser": {
        "name": "@typescript-eslint/parser",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@typescript-eslint/typescript-estree",
          "eslint"
        ],
        "effects": [
          "@typescript-eslint/eslint-plugin"
        ],
        "range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
        "nodes": [
          "",
          "node_modules/@typescript-eslint/parser",
          "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@typescript-eslint/type-utils": {
        "name": "@typescript-eslint/type-utils",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@typescript-eslint/typescript-estree",
          "@typescript-eslint/utils",
          "eslint"
        ],
        "effects": [
          "@typescript-eslint/eslint-plugin"
        ],
        "range": "5.9.2-alpha.0 - 8.56.1-alpha.2",
        "nodes": [
          "",
          "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@typescript-eslint/typescript-estree": {
        "name": "@typescript-eslint/typescript-estree",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "@typescript-eslint/parser",
          "@typescript-eslint/type-utils",
          "@typescript-eslint/utils"
        ],
        "range": "6.16.0 - 8.56.1-alpha.2",
        "nodes": [
          "",
          "",
          "node_modules/@typescript-eslint/typescript-estree",
          "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/typescript-estree"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "@typescript-eslint/utils": {
        "name": "@typescript-eslint/utils",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@typescript-eslint/typescript-estree",
          "eslint"
        ],
        "effects": [
          "@typescript-eslint/eslint-plugin",
          "@typescript-eslint/type-utils",
          "eslint-plugin-jest"
        ],
        "range": "<=8.56.1-alpha.2",
        "nodes": [
          "",
          "",
          "node_modules/@typescript-eslint/utils",
          "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "ajv": {
        "name": "ajv",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1113398,
            "name": "ajv",
            "dependency": "ajv",
            "title": "ajv has ReDoS when using `$data` option",
            "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
            "severity": "moderate",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<6.14.0"
          },
          {
            "source": 1113399,
            "name": "ajv",
            "dependency": "ajv",
            "title": "ajv has ReDoS when using `$data` option",
            "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
            "severity": "moderate",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=7.0.0-alpha.0 <8.18.0"
          }
        ],
        "effects": [],
        "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
        "nodes": [
          "",
          ""
        ],
        "fixAvailable": true
      },
      "diff": {
        "name": "diff",
        "severity": "low",
        "isDirect": false,
        "via": [
          {
            "source": 1112703,
            "name": "diff",
            "dependency": "diff",
            "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
            "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
            "severity": "low",
            "cwe": [
              "CWE-400",
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<3.5.1"
          }
        ],
        "effects": [],
        "range": "<3.5.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "doiuse": {
        "name": "doiuse",
        "severity": "high",
        "isDirect": false,
        "via": [
          "multimatch"
        ],
        "effects": [
          "stylelint-no-unsupported-browser-features"
        ],
        "range": ">=2.2.0",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "stylelint-config-wikimedia",
          "version": "0.10.1",
          "isSemVerMajor": true
        }
      },
      "eslint": {
        "name": "eslint",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@eslint/eslintrc",
          "@humanwhocodes/config-array",
          "file-entry-cache",
          "minimatch"
        ],
        "effects": [
          "@typescript-eslint/eslint-plugin",
          "@typescript-eslint/parser",
          "@typescript-eslint/type-utils",
          "@typescript-eslint/utils",
          "eslint-config-wikimedia",
          "eslint-plugin-jest",
          "eslint-plugin-jsdoc",
          "eslint-plugin-vue",
          "grunt-eslint"
        ],
        "range": "0.7.1 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
        "nodes": [
          "",
          "node_modules/eslint"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "eslint-config-wikimedia": {
        "name": "eslint-config-wikimedia",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@typescript-eslint/eslint-plugin",
          "@typescript-eslint/parser",
          "eslint",
          "eslint-plugin-jest",
          "eslint-plugin-jsdoc",
          "eslint-plugin-unicorn",
          "eslint-plugin-vue"
        ],
        "effects": [],
        "range": ">=0.9.0",
        "nodes": [
          "node_modules/eslint-config-wikimedia"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "eslint-plugin-jest": {
        "name": "eslint-plugin-jest",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@typescript-eslint/eslint-plugin",
          "@typescript-eslint/utils",
          "eslint"
        ],
        "effects": [
          "eslint-config-wikimedia"
        ],
        "range": "25.0.1 - 29.12.2",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "eslint-plugin-jsdoc": {
        "name": "eslint-plugin-jsdoc",
        "severity": "high",
        "isDirect": false,
        "via": [
          "eslint"
        ],
        "effects": [
          "eslint-config-wikimedia"
        ],
        "range": "8.4.4 - 62.6.1",
        "nodes": [
          "node_modules/eslint-plugin-jsdoc"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "eslint-plugin-mediawiki": {
        "name": "eslint-plugin-mediawiki",
        "severity": "high",
        "isDirect": false,
        "via": [
          "eslint-plugin-vue"
        ],
        "effects": [],
        "range": "0.2.3 - 0.7.0",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "eslint-plugin-n": {
        "name": "eslint-plugin-n",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [],
        "range": "<=17.21.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "eslint-plugin-unicorn": {
        "name": "eslint-plugin-unicorn",
        "severity": "high",
        "isDirect": false,
        "via": [
          "@eslint/eslintrc"
        ],
        "effects": [
          "eslint-config-wikimedia"
        ],
        "range": "50.0.0 - 54.0.0",
        "nodes": [
          "node_modules/eslint-plugin-unicorn"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "eslint-plugin-vue": {
        "name": "eslint-plugin-vue",
        "severity": "high",
        "isDirect": false,
        "via": [
          "eslint"
        ],
        "effects": [
          "eslint-config-wikimedia",
          "eslint-plugin-mediawiki"
        ],
        "range": "5.0.0-beta.0 - 10.7.0",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "file-entry-cache": {
        "name": "file-entry-cache",
        "severity": "high",
        "isDirect": false,
        "via": [
          "flat-cache"
        ],
        "effects": [
          "eslint"
        ],
        "range": "4.0.0 - 7.0.2",
        "nodes": [
          "node_modules/file-entry-cache"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "flat-cache": {
        "name": "flat-cache",
        "severity": "high",
        "isDirect": false,
        "via": [
          "rimraf"
        ],
        "effects": [
          "file-entry-cache"
        ],
        "range": "1.3.4 - 4.0.0",
        "nodes": [
          "node_modules/flat-cache"
        ],
        "fixAvailable": {
          "name": "eslint-config-wikimedia",
          "version": "0.8.1",
          "isSemVerMajor": true
        }
      },
      "form-data": {
        "name": "form-data",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1109540,
            "name": "form-data",
            "dependency": "form-data",
            "title": "form-data uses unsafe random function in form-data for choosing boundary",
            "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
            "severity": "critical",
            "cwe": [
              "CWE-330"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<2.5.4"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<2.5.4",
        "nodes": [
          "node_modules/form-data"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "glob": {
        "name": "glob",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "nyc",
          "rimraf",
          "tap-mocha-reporter",
          "test-exclude"
        ],
        "range": "3.0.0 - 10.5.0",
        "nodes": [
          "node_modules/glob"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "grunt": {
        "name": "grunt",
        "severity": "high",
        "isDirect": true,
        "via": [
          "glob",
          "minimatch"
        ],
        "effects": [
          "grunt-eslint"
        ],
        "range": ">=0.4.0-a",
        "nodes": [
          "node_modules/grunt"
        ],
        "fixAvailable": {
          "name": "grunt",
          "version": "0.3.17",
          "isSemVerMajor": true
        }
      },
      "grunt-eslint": {
        "name": "grunt-eslint",
        "severity": "high",
        "isDirect": true,
        "via": [
          "eslint",
          "grunt"
        ],
        "effects": [],
        "range": "<=17.3.2 || >=18.1.0",
        "nodes": [
          "node_modules/grunt-eslint"
        ],
        "fixAvailable": {
          "name": "grunt-eslint",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "istanbul-lib-processinfo": {
        "name": "istanbul-lib-processinfo",
        "severity": "high",
        "isDirect": false,
        "via": [
          "rimraf"
        ],
        "effects": [
          "nyc"
        ],
        "range": "<=2.0.3",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "jpeg-js": {
        "name": "jpeg-js",
        "severity": "high",
        "isDirect": true,
        "via": [
          {
            "source": 1088964,
            "name": "jpeg-js",
            "dependency": "jpeg-js",
            "title": "Infinite loop in jpeg-js",
            "url": "https://github.com/advisories/GHSA-xvf7-4v9q-58w6",
            "severity": "high",
            "cwe": [
              "CWE-835"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<0.4.4"
          },
          {
            "source": 1093580,
            "name": "jpeg-js",
            "dependency": "jpeg-js",
            "title": "Uncontrolled resource consumption in jpeg-js",
            "url": "https://github.com/advisories/GHSA-w7q9-p3jq-fmhm",
            "severity": "moderate",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 5.5,
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
            },
            "range": "<0.4.0"
          }
        ],
        "effects": [],
        "range": "<=0.4.3",
        "nodes": [
          "node_modules/jpeg-js"
        ],
        "fixAvailable": {
          "name": "jpeg-js",
          "version": "0.4.4",
          "isSemVerMajor": true
        }
      },
      "jquery": {
        "name": "jquery",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1102100,
            "name": "jquery",
            "dependency": "jquery",
            "title": "Potential XSS vulnerability in jQuery",
            "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2",
            "severity": "moderate",
            "cwe": [
              "CWE-79"
            ],
            "cvss": {
              "score": 6.9,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
            },
            "range": ">=1.2.0 <3.5.0"
          },
          {
            "source": 1109145,
            "name": "jquery",
            "dependency": "jquery",
            "title": "Potential XSS vulnerability in jQuery",
            "url": "https://github.com/advisories/GHSA-jpcq-cgw6-v4j6",
            "severity": "moderate",
            "cwe": [
              "CWE-79"
            ],
            "cvss": {
              "score": 6.9,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H"
            },
            "range": ">=1.0.3 <3.5.0"
          }
        ],
        "effects": [
          "oojs-ui"
        ],
        "range": "<=3.4.1",
        "nodes": [
          "node_modules/oojs-ui/node_modules/jquery"
        ],
        "fixAvailable": {
          "name": "oojs-ui",
          "version": "0.53.1",
          "isSemVerMajor": true
        }
      },
      "jsdom": {
        "name": "jsdom",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "request",
          "request-promise-native",
          "tough-cookie"
        ],
        "effects": [],
        "range": "0.1.20 || 0.2.0 - 16.5.3",
        "nodes": [
          "node_modules/jsdom"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "minimatch": {
        "name": "minimatch",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113371,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<10.2.1"
          }
        ],
        "effects": [
          "@eslint/eslintrc",
          "@humanwhocodes/config-array",
          "@typescript-eslint/typescript-estree",
          "eslint",
          "eslint-plugin-n",
          "glob",
          "grunt",
          "multimatch",
          "test-exclude"
        ],
        "range": "<10.2.1",
        "nodes": [
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "node_modules/minimatch"
        ],
        "fixAvailable": {
          "name": "grunt",
          "version": "0.3.17",
          "isSemVerMajor": true
        }
      },
      "mockery": {
        "name": "mockery",
        "severity": "critical",
        "isDirect": true,
        "via": [
          {
            "source": 1092753,
            "name": "mockery",
            "dependency": "mockery",
            "title": "mockery is vulnerable to prototype pollution",
            "url": "https://github.com/advisories/GHSA-gmwp-3pwc-3j3g",
            "severity": "critical",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 9.8,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": "<=2.1.0"
          }
        ],
        "effects": [],
        "range": "*",
        "nodes": [
          "node_modules/mockery"
        ],
        "fixAvailable": false
      },
      "multimatch": {
        "name": "multimatch",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "doiuse"
        ],
        "range": "<=7.0.0",
        "nodes": [
          "node_modules/multimatch"
        ],
        "fixAvailable": {
          "name": "stylelint-config-wikimedia",
          "version": "0.10.1",
          "isSemVerMajor": true
        }
      },
      "nyc": {
        "name": "nyc",
        "severity": "high",
        "isDirect": true,
        "via": [
          "glob",
          "istanbul-lib-processinfo",
          "rimraf",
          "spawn-wrap",
          "test-exclude"
        ],
        "effects": [],
        "range": "<=17.1.0",
        "nodes": [
          "node_modules/nyc"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "oojs-ui": {
        "name": "oojs-ui",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "jquery"
        ],
        "effects": [],
        "range": "0.11.0 - 0.38.1",
        "nodes": [
          "node_modules/oojs-ui"
        ],
        "fixAvailable": {
          "name": "oojs-ui",
          "version": "0.53.1",
          "isSemVerMajor": true
        }
      },
      "qs": {
        "name": "qs",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113132,
            "name": "qs",
            "dependency": "qs",
            "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
            "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
            "severity": "high",
            "cwe": [
              "CWE-20"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<6.14.1"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<6.14.1",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "request": {
        "name": "request",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1096727,
            "name": "request",
            "dependency": "request",
            "title": "Server-Side Request Forgery in Request",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "severity": "moderate",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<=2.88.2"
          },
          "form-data",
          "qs",
          "tough-cookie"
        ],
        "effects": [
          "jsdom",
          "request-promise-core",
          "request-promise-native"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "request-promise-core": {
        "name": "request-promise-core",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "request"
        ],
        "effects": [
          "request-promise-native"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request-promise-core"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "request-promise-native": {
        "name": "request-promise-native",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "request",
          "request-promise-core",
          "tough-cookie"
        ],
        "effects": [
          "jsdom"
        ],
        "range": ">=1.0.0",
        "nodes": [
          "node_modules/request-promise-native"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      },
      "rimraf": {
        "name": "rimraf",
        "severity": "high",
        "isDirect": false,
        "via": [
          "glob"
        ],
        "effects": [
          "flat-cache",
          "istanbul-lib-processinfo",
          "nyc",
          "spawn-wrap",
          "tmp"
        ],
        "range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
        "nodes": [
          "node_modules/rimraf",
          "node_modules/tmp/node_modules/rimraf"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "spawn-wrap": {
        "name": "spawn-wrap",
        "severity": "high",
        "isDirect": false,
        "via": [
          "rimraf"
        ],
        "effects": [
          "nyc"
        ],
        "range": "0.0.1 - 2.0.0",
        "nodes": [
          "node_modules/spawn-wrap"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "stylelint-config-wikimedia": {
        "name": "stylelint-config-wikimedia",
        "severity": "high",
        "isDirect": true,
        "via": [
          "stylelint-no-unsupported-browser-features"
        ],
        "effects": [],
        "range": ">=0.10.2",
        "nodes": [
          "node_modules/stylelint-config-wikimedia"
        ],
        "fixAvailable": {
          "name": "stylelint-config-wikimedia",
          "version": "0.10.1",
          "isSemVerMajor": true
        }
      },
      "stylelint-no-unsupported-browser-features": {
        "name": "stylelint-no-unsupported-browser-features",
        "severity": "high",
        "isDirect": false,
        "via": [
          "doiuse"
        ],
        "effects": [
          "stylelint-config-wikimedia"
        ],
        "range": "*",
        "nodes": [
          "node_modules/stylelint-no-unsupported-browser-features"
        ],
        "fixAvailable": {
          "name": "stylelint-config-wikimedia",
          "version": "0.10.1",
          "isSemVerMajor": true
        }
      },
      "tap-mocha-reporter": {
        "name": "tap-mocha-reporter",
        "severity": "high",
        "isDirect": true,
        "via": [
          "glob"
        ],
        "effects": [],
        "range": ">=0.0.4",
        "nodes": [
          "node_modules/tap-mocha-reporter"
        ],
        "fixAvailable": {
          "name": "tap-mocha-reporter",
          "version": "0.0.3",
          "isSemVerMajor": true
        }
      },
      "test-exclude": {
        "name": "test-exclude",
        "severity": "high",
        "isDirect": false,
        "via": [
          "glob",
          "minimatch"
        ],
        "effects": [
          "nyc"
        ],
        "range": "4.2.2 || 5.0.0 - 7.0.2",
        "nodes": [
          "node_modules/test-exclude"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "tmp": {
        "name": "tmp",
        "severity": "high",
        "isDirect": true,
        "via": [
          {
            "source": 1109537,
            "name": "tmp",
            "dependency": "tmp",
            "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
            "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
            "severity": "low",
            "cwe": [
              "CWE-59"
            ],
            "cvss": {
              "score": 2.5,
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
            },
            "range": "<=0.2.3"
          },
          "rimraf"
        ],
        "effects": [],
        "range": "<=0.2.3",
        "nodes": [
          "node_modules/tmp"
        ],
        "fixAvailable": {
          "name": "tmp",
          "version": "0.2.5",
          "isSemVerMajor": true
        }
      },
      "tough-cookie": {
        "name": "tough-cookie",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1097682,
            "name": "tough-cookie",
            "dependency": "tough-cookie",
            "title": "tough-cookie Prototype Pollution vulnerability",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "range": "<4.1.3"
          }
        ],
        "effects": [
          "jsdom",
          "request",
          "request-promise-native"
        ],
        "range": "<4.1.3",
        "nodes": [
          "node_modules/tough-cookie"
        ],
        "fixAvailable": {
          "name": "jsdom",
          "version": "28.1.0",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 1,
        "moderate": 7,
        "high": 34,
        "critical": 3,
        "total": 45
      },
      "dependencies": {
        "prod": 1,
        "dev": 678,
        "optional": 7,
        "peer": 7,
        "peerOptional": 0,
        "total": 678
      }
    }
  }
}

--- end ---
{"added": 678, "removed": 0, "changed": 0, "audited": 679, "funding": 121, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@eslint/eslintrc": {"name": "@eslint/eslintrc", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["eslint", "eslint-plugin-unicorn"], "range": "0.0.1 || >=0.1.1", "nodes": ["", "node_modules/@eslint/eslintrc"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@humanwhocodes/config-array": {"name": "@humanwhocodes/config-array", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["eslint"], "range": "*", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/eslint-plugin": {"name": "@typescript-eslint/eslint-plugin", "severity": "high", "isDirect": false, "via": ["@typescript-eslint/parser", "@typescript-eslint/type-utils", "@typescript-eslint/utils", "eslint"], "effects": ["eslint-config-wikimedia", "eslint-plugin-jest"], "range": "<=8.55.1-alpha.3", "nodes": ["", "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/parser": {"name": "@typescript-eslint/parser", "severity": "high", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "eslint"], "effects": ["@typescript-eslint/eslint-plugin"], "range": "1.1.1-alpha.0 - 8.56.1-alpha.2", "nodes": ["", "node_modules/@typescript-eslint/parser", "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/type-utils": {"name": "@typescript-eslint/type-utils", "severity": "high", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "@typescript-eslint/utils", "eslint"], "effects": ["@typescript-eslint/eslint-plugin"], "range": "5.9.2-alpha.0 - 8.56.1-alpha.2", "nodes": ["", "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/typescript-estree": {"name": "@typescript-eslint/typescript-estree", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["@typescript-eslint/parser", "@typescript-eslint/type-utils", "@typescript-eslint/utils"], "range": "6.16.0 - 8.56.1-alpha.2", "nodes": ["", "", "node_modules/@typescript-eslint/typescript-estree", "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/typescript-estree"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/utils": {"name": "@typescript-eslint/utils", "severity": "high", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "eslint"], "effects": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/type-utils", "eslint-plugin-jest"], "range": "<=8.56.1-alpha.2", "nodes": ["", "", "node_modules/@typescript-eslint/utils", "node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "ajv": {"name": "ajv", "severity": "moderate", "isDirect": false, "via": [{"source": 1113398, "name": "ajv", "dependency": "ajv", "title": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 0, "vectorString": null}, "range": "<6.14.0"}, {"source": 1113399, "name": "ajv", "dependency": "ajv", "title": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 0, "vectorString": null}, "range": ">=7.0.0-alpha.0 <8.18.0"}], "effects": [], "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0", "nodes": ["", ""], "fixAvailable": true}, "diff": {"name": "diff", "severity": "low", "isDirect": false, "via": [{"source": 1112703, "name": "diff", "dependency": "diff", "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "severity": "low", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.5.1"}], "effects": [], "range": "<3.5.1", "nodes": [""], "fixAvailable": true}, "doiuse": {"name": "doiuse", "severity": "high", "isDirect": false, "via": ["multimatch"], "effects": ["stylelint-no-unsupported-browser-features"], "range": ">=2.2.0", "nodes": [""], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.10.1", "isSemVerMajor": true}}, "eslint": {"name": "eslint", "severity": "high", "isDirect": false, "via": ["@eslint/eslintrc", "@humanwhocodes/config-array", "file-entry-cache", "minimatch"], "effects": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/parser", "@typescript-eslint/type-utils", "@typescript-eslint/utils", "eslint-config-wikimedia", "eslint-plugin-jest", "eslint-plugin-jsdoc", "eslint-plugin-vue", "grunt-eslint"], "range": "0.7.1 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2", "nodes": ["", "node_modules/eslint"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-config-wikimedia": {"name": "eslint-config-wikimedia", "severity": "high", "isDirect": true, "via": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/parser", "eslint", "eslint-plugin-jest", "eslint-plugin-jsdoc", "eslint-plugin-unicorn", "eslint-plugin-vue"], "effects": [], "range": ">=0.9.0", "nodes": ["node_modules/eslint-config-wikimedia"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-jest": {"name": "eslint-plugin-jest", "severity": "high", "isDirect": false, "via": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/utils", "eslint"], "effects": ["eslint-config-wikimedia"], "range": "25.0.1 - 29.12.2", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-jsdoc": {"name": "eslint-plugin-jsdoc", "severity": "high", "isDirect": false, "via": ["eslint"], "effects": ["eslint-config-wikimedia"], "range": "8.4.4 - 62.6.1", "nodes": ["node_modules/eslint-plugin-jsdoc"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-mediawiki": {"name": "eslint-plugin-mediawiki", "severity": "high", "isDirect": false, "via": ["eslint-plugin-vue"], "effects": [], "range": "0.2.3 - 0.7.0", "nodes": [""], "fixAvailable": true}, "eslint-plugin-n": {"name": "eslint-plugin-n", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": [], "range": "<=17.21.1", "nodes": [""], "fixAvailable": true}, "eslint-plugin-unicorn": {"name": "eslint-plugin-unicorn", "severity": "high", "isDirect": false, "via": ["@eslint/eslintrc"], "effects": ["eslint-config-wikimedia"], "range": "50.0.0 - 54.0.0", "nodes": ["node_modules/eslint-plugin-unicorn"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-vue": {"name": "eslint-plugin-vue", "severity": "high", "isDirect": false, "via": ["eslint"], "effects": ["eslint-config-wikimedia", "eslint-plugin-mediawiki"], "range": "5.0.0-beta.0 - 10.7.0", "nodes": [""], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "file-entry-cache": {"name": "file-entry-cache", "severity": "high", "isDirect": false, "via": ["flat-cache"], "effects": ["eslint"], "range": "4.0.0 - 7.0.2", "nodes": ["node_modules/file-entry-cache"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "flat-cache": {"name": "flat-cache", "severity": "high", "isDirect": false, "via": ["rimraf"], "effects": ["file-entry-cache"], "range": "1.3.4 - 4.0.0", "nodes": ["node_modules/flat-cache"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "glob": {"name": "glob", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["nyc", "rimraf", "tap-mocha-reporter", "test-exclude"], "range": "3.0.0 - 10.5.0", "nodes": ["node_modules/glob"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": ["glob", "minimatch"], "effects": ["grunt-eslint"], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "grunt-eslint": {"name": "grunt-eslint", "severity": "high", "isDirect": true, "via": ["eslint", "grunt"], "effects": [], "range": "<=17.3.2 || >=18.1.0", "nodes": ["node_modules/grunt-eslint"], "fixAvailable": {"name": "grunt-eslint", "version": "18.0.0", "isSemVerMajor": true}}, "istanbul-lib-processinfo": {"name": "istanbul-lib-processinfo", "severity": "high", "isDirect": false, "via": ["rimraf"], "effects": ["nyc"], "range": "<=2.0.3", "nodes": [""], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "jpeg-js": {"name": "jpeg-js", "severity": "high", "isDirect": true, "via": [{"source": 1088964, "name": "jpeg-js", "dependency": "jpeg-js", "title": "Infinite loop in jpeg-js", "url": "https://github.com/advisories/GHSA-xvf7-4v9q-58w6", "severity": "high", "cwe": ["CWE-835"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.4.4"}, {"source": 1093580, "name": "jpeg-js", "dependency": "jpeg-js", "title": "Uncontrolled resource consumption in jpeg-js", "url": "https://github.com/advisories/GHSA-w7q9-p3jq-fmhm", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<0.4.0"}], "effects": [], "range": "<=0.4.3", "nodes": ["node_modules/jpeg-js"], "fixAvailable": {"name": "jpeg-js", "version": "0.4.4", "isSemVerMajor": true}}, "jquery": {"name": "jquery", "severity": "moderate", "isDirect": false, "via": [{"source": 1102100, "name": "jquery", "dependency": "jquery", "title": "Potential XSS vulnerability in jQuery", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"}, "range": ">=1.2.0 <3.5.0"}, {"source": 1109145, "name": "jquery", "dependency": "jquery", "title": "Potential XSS vulnerability in jQuery", "url": "https://github.com/advisories/GHSA-jpcq-cgw6-v4j6", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H"}, "range": ">=1.0.3 <3.5.0"}], "effects": ["oojs-ui"], "range": "<=3.4.1", "nodes": ["node_modules/oojs-ui/node_modules/jquery"], "fixAvailable": {"name": "oojs-ui", "version": "0.53.1", "isSemVerMajor": true}}, "jsdom": {"name": "jsdom", "severity": "moderate", "isDirect": true, "via": ["request", "request-promise-native", "tough-cookie"], "effects": [], "range": "0.1.20 || 0.2.0 - 16.5.3", "nodes": ["node_modules/jsdom"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113371, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<10.2.1"}], "effects": ["@eslint/eslintrc", "@humanwhocodes/config-array", "@typescript-eslint/typescript-estree", "eslint", "eslint-plugin-n", "glob", "grunt", "multimatch", "test-exclude"], "range": "<10.2.1", "nodes": ["", "", "", "", "", "", "", "node_modules/minimatch"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "mockery": {"name": "mockery", "severity": "critical", "isDirect": true, "via": [{"source": 1092753, "name": "mockery", "dependency": "mockery", "title": "mockery is vulnerable to prototype pollution", "url": "https://github.com/advisories/GHSA-gmwp-3pwc-3j3g", "severity": "critical", "cwe": ["CWE-1321"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<=2.1.0"}], "effects": [], "range": "*", "nodes": ["node_modules/mockery"], "fixAvailable": false}, "multimatch": {"name": "multimatch", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["doiuse"], "range": "<=7.0.0", "nodes": ["node_modules/multimatch"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.10.1", "isSemVerMajor": true}}, "nyc": {"name": "nyc", "severity": "high", "isDirect": true, "via": ["glob", "istanbul-lib-processinfo", "rimraf", "spawn-wrap", "test-exclude"], "effects": [], "range": "<=17.1.0", "nodes": ["node_modules/nyc"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "oojs-ui": {"name": "oojs-ui", "severity": "moderate", "isDirect": true, "via": ["jquery"], "effects": [], "range": "0.11.0 - 0.38.1", "nodes": ["node_modules/oojs-ui"], "fixAvailable": {"name": "oojs-ui", "version": "0.53.1", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "high", "isDirect": false, "via": [{"source": 1113132, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "high", "cwe": ["CWE-20"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.14.1"}], "effects": ["request"], "range": "<6.14.1", "nodes": [""], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "qs", "tough-cookie"], "effects": ["jsdom", "request-promise-core", "request-promise-native"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "request-promise-core": {"name": "request-promise-core", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["request-promise-native"], "range": "*", "nodes": ["node_modules/request-promise-core"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "request-promise-native": {"name": "request-promise-native", "severity": "moderate", "isDirect": false, "via": ["request", "request-promise-core", "tough-cookie"], "effects": ["jsdom"], "range": ">=1.0.0", "nodes": ["node_modules/request-promise-native"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}, "rimraf": {"name": "rimraf", "severity": "high", "isDirect": false, "via": ["glob"], "effects": ["flat-cache", "istanbul-lib-processinfo", "nyc", "spawn-wrap", "tmp"], "range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10", "nodes": ["node_modules/rimraf", "node_modules/tmp/node_modules/rimraf"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "spawn-wrap": {"name": "spawn-wrap", "severity": "high", "isDirect": false, "via": ["rimraf"], "effects": ["nyc"], "range": "0.0.1 - 2.0.0", "nodes": ["node_modules/spawn-wrap"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "stylelint-config-wikimedia": {"name": "stylelint-config-wikimedia", "severity": "high", "isDirect": true, "via": ["stylelint-no-unsupported-browser-features"], "effects": [], "range": ">=0.10.2", "nodes": ["node_modules/stylelint-config-wikimedia"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.10.1", "isSemVerMajor": true}}, "stylelint-no-unsupported-browser-features": {"name": "stylelint-no-unsupported-browser-features", "severity": "high", "isDirect": false, "via": ["doiuse"], "effects": ["stylelint-config-wikimedia"], "range": "*", "nodes": ["node_modules/stylelint-no-unsupported-browser-features"], "fixAvailable": {"name": "stylelint-config-wikimedia", "version": "0.10.1", "isSemVerMajor": true}}, "tap-mocha-reporter": {"name": "tap-mocha-reporter", "severity": "high", "isDirect": true, "via": ["glob"], "effects": [], "range": ">=0.0.4", "nodes": ["node_modules/tap-mocha-reporter"], "fixAvailable": {"name": "tap-mocha-reporter", "version": "0.0.3", "isSemVerMajor": true}}, "test-exclude": {"name": "test-exclude", "severity": "high", "isDirect": false, "via": ["glob", "minimatch"], "effects": ["nyc"], "range": "4.2.2 || 5.0.0 - 7.0.2", "nodes": ["node_modules/test-exclude"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "high", "isDirect": true, "via": [{"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}, "rimraf"], "effects": [], "range": "<=0.2.3", "nodes": ["node_modules/tmp"], "fixAvailable": {"name": "tmp", "version": "0.2.5", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["jsdom", "request", "request-promise-native"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "jsdom", "version": "28.1.0", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 1, "moderate": 7, "high": 34, "critical": 3, "total": 45}, "dependencies": {"prod": 1, "dev": 678, "optional": 7, "peer": 7, "peerOptional": 0, "total": 678}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/eslint-plugin@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN   @typescript-eslint/eslint-plugin@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN   node_modules/eslint-config-wikimedia
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN     @typescript-eslint/eslint-plugin@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/parser@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/parser@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser
npm WARN   @typescript-eslint/parser@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN   node_modules/eslint-config-wikimedia
npm WARN   1 more (@typescript-eslint/eslint-plugin)
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/parser@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser
npm WARN     @typescript-eslint/parser@"8.35.1" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN     1 more (@typescript-eslint/eslint-plugin)
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/type-utils@8.35.1
npm WARN Found: peer eslint@"^8.57.0 || ^9.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from the root project
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/type-utils@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/type-utils@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils
npm WARN   @typescript-eslint/type-utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/type-utils@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils
npm WARN     @typescript-eslint/type-utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN     node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @typescript-eslint/utils@8.35.1
npm WARN Found: eslint@8.57.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=8.40.0" from @stylistic/eslint-plugin@3.1.0
npm WARN   node_modules/@stylistic/eslint-plugin
npm WARN     @stylistic/eslint-plugin@"^3.1.0" from eslint-config-wikimedia@0.31.0
npm WARN     node_modules/eslint-config-wikimedia
npm WARN   26 more (eslint-compat-utils, eslint-config-wikimedia, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/utils@8.35.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils
npm WARN   @typescript-eslint/utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN   1 more (@typescript-eslint/type-utils)
npm WARN 
npm WARN Conflicting peer dependency: eslint@9.39.3
npm WARN node_modules/eslint
npm WARN   peer eslint@"^8.57.0 || ^9.0.0" from @typescript-eslint/utils@8.35.1
npm WARN   node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils
npm WARN     @typescript-eslint/utils@"8.35.1" from @typescript-eslint/eslint-plugin@8.35.1
npm WARN     node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
npm WARN     1 more (@typescript-eslint/type-utils)
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 678 packages, and audited 679 packages in 15s

121 packages are looking for funding
  run `npm fund` for details

# npm audit report

form-data  <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix --force`
Will install jsdom@28.1.0, which is a breaking change
node_modules/form-data
  request  *
  Depends on vulnerable versions of form-data
  Depends on vulnerable versions of qs
  Depends on vulnerable versions of tough-cookie
  node_modules/request
    jsdom  0.1.20 || 0.2.0 - 16.5.3
    Depends on vulnerable versions of request
    Depends on vulnerable versions of request-promise-native
    Depends on vulnerable versions of tough-cookie
    node_modules/jsdom
    request-promise-core  *
    Depends on vulnerable versions of request
    node_modules/request-promise-core
      request-promise-native  >=1.0.0
      Depends on vulnerable versions of request
      Depends on vulnerable versions of request-promise-core
      Depends on vulnerable versions of tough-cookie
      node_modules/request-promise-native

jpeg-js  <=0.4.3
Severity: high
Infinite loop in jpeg-js - https://github.com/advisories/GHSA-xvf7-4v9q-58w6
Uncontrolled resource consumption in jpeg-js - https://github.com/advisories/GHSA-w7q9-p3jq-fmhm
fix available via `npm audit fix --force`
Will install jpeg-js@0.4.4, which is a breaking change
node_modules/jpeg-js

jquery  <=3.4.1
Severity: moderate
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-gxr4-xjj5-5px2
Potential XSS vulnerability in jQuery - https://github.com/advisories/GHSA-jpcq-cgw6-v4j6
fix available via `npm audit fix --force`
Will install oojs-ui@0.53.1, which is a breaking change
node_modules/oojs-ui/node_modules/jquery
  oojs-ui  0.11.0 - 0.38.1
  Depends on vulnerable versions of jquery
  node_modules/oojs-ui

minimatch  <10.2.1
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
fix available via `npm audit fix --force`
Will install grunt@0.3.17, which is a breaking change
node_modules/@eslint/eslintrc/node_modules/minimatch
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/eslint-config-wikimedia/node_modules/minimatch
node_modules/eslint-plugin-unicorn/node_modules/minimatch
node_modules/eslint/node_modules/minimatch
node_modules/minimatch
  @eslint/eslintrc  0.0.1 || >=0.1.1
  Depends on vulnerable versions of minimatch
  node_modules/@eslint/eslintrc
  node_modules/eslint-plugin-unicorn/node_modules/@eslint/eslintrc
    eslint  0.7.1 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2
    Depends on vulnerable versions of @eslint/eslintrc
    Depends on vulnerable versions of @humanwhocodes/config-array
    Depends on vulnerable versions of file-entry-cache
    Depends on vulnerable versions of minimatch
    node_modules/eslint
      @typescript-eslint/eslint-plugin  <=8.56.1-alpha.2
      Depends on vulnerable versions of @typescript-eslint/parser
      Depends on vulnerable versions of @typescript-eslint/type-utils
      Depends on vulnerable versions of @typescript-eslint/type-utils
      Depends on vulnerable versions of @typescript-eslint/utils
      Depends on vulnerable versions of @typescript-eslint/utils
      Depends on vulnerable versions of eslint
      node_modules/@typescript-eslint/eslint-plugin
      node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin
        eslint-config-wikimedia  >=0.9.0
        Depends on vulnerable versions of @stylistic/eslint-plugin
        Depends on vulnerable versions of @typescript-eslint/eslint-plugin
        Depends on vulnerable versions of @typescript-eslint/parser
        Depends on vulnerable versions of eslint
        Depends on vulnerable versions of eslint-plugin-jest
        Depends on vulnerable versions of eslint-plugin-jsdoc
        Depends on vulnerable versions of eslint-plugin-unicorn
        Depends on vulnerable versions of eslint-plugin-vue
        node_modules/eslint-config-wikimedia
      @typescript-eslint/parser  1.1.1-alpha.0 - 8.56.1-alpha.2
      Depends on vulnerable versions of @typescript-eslint/typescript-estree
      Depends on vulnerable versions of eslint
      node_modules/@typescript-eslint/parser
      node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/parser
      @typescript-eslint/type-utils  >=5.9.2-alpha.0
      Depends on vulnerable versions of @typescript-eslint/typescript-estree
      Depends on vulnerable versions of @typescript-eslint/utils
      Depends on vulnerable versions of @typescript-eslint/utils
      Depends on vulnerable versions of eslint
      node_modules/@typescript-eslint/type-utils
      node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/type-utils
      @typescript-eslint/utils  <=8.56.1-alpha.2
      Depends on vulnerable versions of @typescript-eslint/typescript-estree
      Depends on vulnerable versions of eslint
      node_modules/@typescript-eslint/utils
      node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils
        @stylistic/eslint-plugin  2.7.0-beta.0 - 5.0.0-beta.6 || >=6.0.0-beta.1
        Depends on vulnerable versions of @typescript-eslint/utils
        node_modules/@stylistic/eslint-plugin
      eslint-plugin-jest  25.0.1 - 29.12.2
      Depends on vulnerable versions of eslint
      node_modules/eslint-plugin-jest
      eslint-plugin-jsdoc  8.4.4 - 62.6.1
      Depends on vulnerable versions of eslint
      node_modules/eslint-plugin-jsdoc
      eslint-plugin-vue  5.0.0-beta.0 - 10.7.0
      Depends on vulnerable versions of eslint
      node_modules/eslint-plugin-vue
      grunt-eslint  <=17.3.2 || >=18.1.0
      Depends on vulnerable versions of eslint
      Depends on vulnerable versions of grunt
      node_modules/grunt-eslint
    eslint-plugin-unicorn  50.0.0 - 54.0.0
    Depends on vulnerable versions of @eslint/eslintrc
    node_modules/eslint-plugin-unicorn
  @humanwhocodes/config-array  *
  Depends on vulnerable versions of minimatch
  node_modules/@humanwhocodes/config-array
  @typescript-eslint/typescript-estree  6.16.0 - 8.56.1-alpha.2
  Depends on vulnerable versions of minimatch
  node_modules/@typescript-eslint/typescript-estree
  node_modules/eslint-config-wikimedia/node_modules/@typescript-eslint/typescript-estree
  glob  3.0.0 - 10.5.0
  Depends on vulnerable versions of minimatch
  node_modules/glob
    nyc  <=17.1.0
    Depends on vulnerable versions of glob
    Depends on vulnerable versions of istanbul-lib-processinfo
    Depends on vulnerable versions of rimraf
    Depends on vulnerable versions of spawn-wrap
    Depends on vulnerable versions of test-exclude
    node_modules/nyc
    rimraf  2.3.0 - 3.0.2 || 4.2.0 - 5.0.10
    Depends on vulnerable versions of glob
    node_modules/rimraf
    node_modules/tmp/node_modules/rimraf
      flat-cache  1.3.4 - 4.0.0
      Depends on vulnerable versions of rimraf
      node_modules/flat-cache
        file-entry-cache  4.0.0 - 7.0.2
        Depends on vulnerable versions of flat-cache
        node_modules/file-entry-cache
      istanbul-lib-processinfo  <=2.0.3
      Depends on vulnerable versions of rimraf
      node_modules/istanbul-lib-processinfo
      spawn-wrap  0.0.1 - 2.0.0
      Depends on vulnerable versions of rimraf
      node_modules/spawn-wrap
      tmp  <=0.2.3
      Depends on vulnerable versions of rimraf
      node_modules/tmp
    tap-mocha-reporter  >=0.0.4
    Depends on vulnerable versions of glob
    node_modules/tap-mocha-reporter
    test-exclude  4.2.2 || 5.0.0 - 7.0.2
    Depends on vulnerable versions of glob
    Depends on vulnerable versions of minimatch
    node_modules/test-exclude
  grunt  >=0.4.0-a
  Depends on vulnerable versions of glob
  Depends on vulnerable versions of minimatch
  node_modules/grunt
  multimatch  <=7.0.0
  Depends on vulnerable versions of minimatch
  node_modules/multimatch
    doiuse  >=2.2.0
    Depends on vulnerable versions of multimatch
    node_modules/doiuse
      stylelint-no-unsupported-browser-features  *
      Depends on vulnerable versions of doiuse
      node_modules/stylelint-no-unsupported-browser-features
        stylelint-config-wikimedia  >=0.10.2
        Depends on vulnerable versions of stylelint-no-unsupported-browser-features
        node_modules/stylelint-config-wikimedia

mockery  *
Severity: critical
mockery is vulnerable to prototype pollution - https://github.com/advisories/GHSA-gmwp-3pwc-3j3g
No fix available
node_modules/mockery

qs  <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix --force`
Will install jsdom@28.1.0, which is a breaking change
node_modules/qs



tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install jsdom@28.1.0, which is a breaking change
node_modules/tough-cookie

42 vulnerabilities (6 moderate, 33 high, 3 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

> wikibase-media-info@0.1.0 install
> rm -rf node_modules/mediawiki && git clone -q --depth=1 https://gerrit.wikimedia.org/r/mediawiki/core node_modules/mediawiki


added 678 packages, and audited 679 packages in 22s

121 packages are looking for funding
  run `npm fund` for details

42 vulnerabilities (6 moderate, 33 high, 3 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stdout ---

> wikibase-media-info@0.1.0 test
> grunt test && npm run test:unit

Running "eslint:all" (eslint) task
Warning: Cannot read properties of undefined (reading 'type')
Occurred while linting /src/repo/resources/base/ComponentWidget.js:289
Rule: "mediawiki/no-unlabeled-buttonwidget" Use --force to continue.

Aborted due to warnings.

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1268, in main
    libup.run()
    ~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1208, in run
    self.npm_audit_fix(new_npm_audit)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 239, in npm_audit_fix
    self.npm_test()
    ~~~~~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 289, in npm_test
    self.check_call(["npm", "test"])
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/shell2.py", line 66, in check_call
    res.check_returncode()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/subprocess.py", line 508, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
                             self.stderr)
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 3.