mediawiki/extensions/ContentTranslation: REL1_44 (log #2362343)

$ date
--- stdout ---
Thu Feb 26 06:14:35 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-ContentTranslation.git /src/repo --depth=1 -b REL1_44
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_44
--- stdout ---
d2af17984fe1ace0f1f75ad4d8ab0fdea4a38b75 refs/heads/REL1_44

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "inquirer",
        "webdriverio",
        "yarn-install"
      ],
      "effects": [
        "@wdio/junit-reporter",
        "@wdio/local-runner",
        "@wdio/spec-reporter"
      ],
      "range": "<=9.0.0-alpha.426",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/junit-reporter": {
      "name": "@wdio/junit-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/junit-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/junit-reporter",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "effects": [],
      "range": "<=9.1.5",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "gaze",
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "<=9.1.5",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/spec-reporter": {
      "name": "@wdio/spec-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/spec-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/spec-reporter",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "ajv": {
      "name": "ajv",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113428,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<6.14.0"
        },
        {
          "source": 1113429,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0-alpha.0 <8.18.0"
        }
      ],
      "effects": [],
      "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
      "nodes": [
        "node_modules/ajv",
        "node_modules/table/node_modules/ajv"
      ],
      "fixAvailable": true
    },
    "basic-ftp": {
      "name": "basic-ftp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113518,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
          "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c",
          "severity": "critical",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<5.2.0"
        }
      ],
      "effects": [],
      "range": "<5.2.0",
      "nodes": [
        "node_modules/basic-ftp"
      ],
      "fixAvailable": true
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104663,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        }
      ],
      "effects": [
        "pre-commit",
        "yarn-install"
      ],
      "range": "<6.0.6",
      "nodes": [
        "node_modules/pre-commit/node_modules/cross-spawn",
        "node_modules/yarn-install/node_modules/cross-spawn"
      ],
      "fixAvailable": {
        "name": "pre-commit",
        "version": "1.0.10",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": "7.7.6 - 8.10.2",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1112705,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=5.0.0 <5.2.2"
        }
      ],
      "effects": [],
      "range": "5.0.0 - 5.2.1",
      "nodes": [
        "node_modules/diff"
      ],
      "fixAvailable": true
    },
    "edgedriver": {
      "name": "edgedriver",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-xml-parser"
      ],
      "effects": [],
      "range": "5.6.1 - 6.1.1",
      "nodes": [
        "node_modules/edgedriver"
      ],
      "fixAvailable": true
    },
    "external-editor": {
      "name": "external-editor",
      "severity": "low",
      "isDirect": false,
      "via": [
        "tmp"
      ],
      "effects": [
        "inquirer"
      ],
      "range": ">=1.1.1",
      "nodes": [
        "node_modules/external-editor"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "fast-xml-parser": {
      "name": "fast-xml-parser",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113331,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)",
          "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj",
          "severity": "high",
          "cwe": [
            "CWE-776"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.1.3 <5.3.6"
        },
        {
          "source": 1113407,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names",
          "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2",
          "severity": "critical",
          "cwe": [
            "CWE-185"
          ],
          "cvss": {
            "score": 9.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
          },
          "range": ">=4.1.3 <5.3.5"
        }
      ],
      "effects": [
        "edgedriver"
      ],
      "range": "4.1.3 - 5.3.5",
      "nodes": [
        "node_modules/fast-xml-parser"
      ],
      "fixAvailable": true
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "gaze": {
      "name": "gaze",
      "severity": "high",
      "isDirect": false,
      "via": [
        "globule"
      ],
      "effects": [
        "@wdio/runner"
      ],
      "range": ">=0.4.0",
      "nodes": [
        "node_modules/gaze"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "glob": {
      "name": "glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109842,
          "name": "glob",
          "dependency": "glob",
          "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
          "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
          "severity": "high",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=10.2.0 <10.5.0"
        }
      ],
      "effects": [],
      "range": "10.2.0 - 10.4.5",
      "nodes": [
        "node_modules/archiver-utils/node_modules/glob",
        "node_modules/webdriverio/node_modules/glob"
      ],
      "fixAvailable": true
    },
    "globule": {
      "name": "globule",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "gaze"
      ],
      "range": "*",
      "nodes": [
        "node_modules/globule"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "inquirer": {
      "name": "inquirer",
      "severity": "low",
      "isDirect": false,
      "via": [
        "external-editor"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
      "nodes": [
        "node_modules/inquirer"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112715,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml has prototype pollution in merge (<<)",
          "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.0.0 <4.1.1"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.1.0",
      "nodes": [
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "lodash": {
      "name": "lodash",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112455,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
          "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": ">=4.0.0 <=4.17.22"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.17.21",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113461,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=5.0.0 <5.1.7"
        },
        {
          "source": 1113462,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=6.0.0 <6.2.1"
        },
        {
          "source": 1113465,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=9.0.0 <9.0.6"
        }
      ],
      "effects": [
        "globule"
      ],
      "range": "<=3.1.2 || 5.0.0 - 5.1.6 || 6.0.0 - 6.2.0 || 9.0.0 - 9.0.5",
      "nodes": [
        "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
        "node_modules/@wdio/cli/node_modules/minimatch",
        "node_modules/@wdio/config/node_modules/minimatch",
        "node_modules/@wdio/runner/node_modules/minimatch",
        "node_modules/archiver-utils/node_modules/minimatch",
        "node_modules/eslint-plugin-n/node_modules/minimatch",
        "node_modules/filelist/node_modules/minimatch",
        "node_modules/globule/node_modules/minimatch",
        "node_modules/minimatch",
        "node_modules/mocha/node_modules/minimatch",
        "node_modules/readdir-glob/node_modules/minimatch",
        "node_modules/webdriverio/node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "pre-commit": {
      "name": "pre-commit",
      "severity": "high",
      "isDirect": true,
      "via": [
        "cross-spawn"
      ],
      "effects": [],
      "range": ">=1.1.0",
      "nodes": [
        "node_modules/pre-commit"
      ],
      "fixAvailable": {
        "name": "pre-commit",
        "version": "1.0.10",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "tar-fs",
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "10.0.0 - 22.11.1",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/puppeteer-core",
        "node_modules/@wdio/runner/node_modules/puppeteer-core",
        "node_modules/devtools/node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113132,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "high",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109532,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1109534,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=3.0.0 <3.1.1"
        },
        {
          "source": 1109543,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1109552,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
          "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=2.0.0 <2.1.2"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/tar-fs",
        "node_modules/@wdio/runner/node_modules/tar-fs",
        "node_modules/devtools/node_modules/tar-fs",
        "node_modules/tar-fs"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        }
      ],
      "effects": [
        "external-editor"
      ],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "undici": {
      "name": "undici",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112496,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
          "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.23.0"
        }
      ],
      "effects": [],
      "range": "<6.23.0",
      "nodes": [
        "node_modules/undici"
      ],
      "fixAvailable": true
    },
    "validator": {
      "name": "validator",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109241,
          "name": "validator",
          "dependency": "validator",
          "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
          "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<13.15.20"
        },
        {
          "source": 1112713,
          "name": "validator",
          "dependency": "validator",
          "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements",
          "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g",
          "severity": "high",
          "cwe": [
            "CWE-172",
            "CWE-792"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<13.15.22"
        }
      ],
      "effects": [],
      "range": "<=13.15.20",
      "nodes": [
        "node_modules/validator"
      ],
      "fixAvailable": true
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [],
      "range": "<=5.1.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.7.6 - 8.10.2",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/webdriverio",
        "node_modules/@wdio/runner/node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/ws",
        "node_modules/@wdio/runner/node_modules/ws",
        "node_modules/devtools/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "yarn-install": {
      "name": "yarn-install",
      "severity": "high",
      "isDirect": false,
      "via": [
        "cross-spawn"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "*",
      "nodes": [
        "node_modules/yarn-install"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 4,
      "moderate": 7,
      "high": 20,
      "critical": 4,
      "total": 35
    },
    "dependencies": {
      "prod": 1,
      "dev": 1028,
      "optional": 17,
      "peer": 180,
      "peerOptional": 0,
      "total": 1028
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 40 installs, 0 updates, 0 removals
  - Locking composer/installers (v2.3.0)
  - Locking composer/pcre (3.3.2)
  - Locking composer/semver (3.4.3)
  - Locking composer/spdx-licenses (1.5.9)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
  - Locking doctrine/deprecations (1.1.6)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking firebase/php-jwt (v7.0.3)
  - Locking mediawiki/mediawiki-codesniffer (v46.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.15.0)
  - Locking mediawiki/minus-x (1.1.3)
  - Locking mediawiki/phan-taint-check-plugin (6.1.0)
  - Locking microsoft/tolerant-php-parser (v0.1.2)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking phan/phan (5.4.5)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.2.1)
  - Locking phpcsstandards/phpcsutils (1.0.12)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.6.6)
  - Locking phpdocumentor/type-resolver (1.12.0)
  - Locking phpstan/phpdoc-parser (2.3.2)
  - Locking psr/container (2.0.2)
  - Locking psr/log (3.0.2)
  - Locking sabre/event (5.1.7)
  - Locking squizlabs/php_codesniffer (3.11.3)
  - Locking symfony/console (v7.4.4)
  - Locking symfony/deprecation-contracts (v3.6.0)
  - Locking symfony/polyfill-ctype (v1.33.0)
  - Locking symfony/polyfill-intl-grapheme (v1.33.0)
  - Locking symfony/polyfill-intl-normalizer (v1.33.0)
  - Locking symfony/polyfill-mbstring (v1.33.0)
  - Locking symfony/polyfill-php80 (v1.33.0)
  - Locking symfony/service-contracts (v3.6.1)
  - Locking symfony/string (v8.0.4)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (2.1.5)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 40 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing composer/installers (v2.3.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.11.3): Extracting archive
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
  - Installing composer/pcre (3.3.2): Extracting archive
  - Installing firebase/php-jwt (v7.0.3): Extracting archive
  - Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
  - Installing phpcsstandards/phpcsutils (1.0.12): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.9): Extracting archive
  - Installing composer/semver (3.4.3): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v46.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
  - Installing symfony/string (v8.0.4): Extracting archive
  - Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.6.1): Extracting archive
  - Installing symfony/console (v7.4.4): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
  - Installing webmozart/assert (2.1.5): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.6): Extracting archive
  - Installing phpdocumentor/type-resolver (1.12.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.6.6): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (3.0.2): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.4.5): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (6.1.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.15.0): Extracting archive
  - Installing mediawiki/minus-x (1.1.3): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  0/37 [>---------------------------]   0%
 25/37 [==================>---------]  67%
 36/37 [===========================>]  97%
 37/37 [============================] 100%
2 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
18 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "inquirer",
        "webdriverio",
        "yarn-install"
      ],
      "effects": [
        "@wdio/junit-reporter",
        "@wdio/local-runner",
        "@wdio/spec-reporter"
      ],
      "range": "<=9.0.0-alpha.426",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/junit-reporter": {
      "name": "@wdio/junit-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/junit-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/junit-reporter",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "effects": [],
      "range": "<=9.1.5",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "gaze",
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "<=9.1.5",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "@wdio/spec-reporter": {
      "name": "@wdio/spec-reporter",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/cli"
      ],
      "effects": [],
      "range": "6.0.4 - 8.0.0-alpha.631",
      "nodes": [
        "node_modules/@wdio/spec-reporter"
      ],
      "fixAvailable": {
        "name": "@wdio/spec-reporter",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "ajv": {
      "name": "ajv",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113428,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<6.14.0"
        },
        {
          "source": 1113429,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0-alpha.0 <8.18.0"
        }
      ],
      "effects": [],
      "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
      "nodes": [
        "node_modules/ajv",
        "node_modules/table/node_modules/ajv"
      ],
      "fixAvailable": true
    },
    "basic-ftp": {
      "name": "basic-ftp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113518,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
          "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c",
          "severity": "critical",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<5.2.0"
        }
      ],
      "effects": [],
      "range": "<5.2.0",
      "nodes": [
        "node_modules/basic-ftp"
      ],
      "fixAvailable": true
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104663,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        }
      ],
      "effects": [
        "pre-commit",
        "yarn-install"
      ],
      "range": "<6.0.6",
      "nodes": [
        "node_modules/pre-commit/node_modules/cross-spawn",
        "node_modules/yarn-install/node_modules/cross-spawn"
      ],
      "fixAvailable": {
        "name": "pre-commit",
        "version": "1.0.10",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": "7.7.6 - 8.10.2",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1112705,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=5.0.0 <5.2.2"
        }
      ],
      "effects": [],
      "range": "5.0.0 - 5.2.1",
      "nodes": [
        "node_modules/diff"
      ],
      "fixAvailable": true
    },
    "edgedriver": {
      "name": "edgedriver",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-xml-parser"
      ],
      "effects": [],
      "range": "5.6.1 - 6.1.1",
      "nodes": [
        "node_modules/edgedriver"
      ],
      "fixAvailable": true
    },
    "external-editor": {
      "name": "external-editor",
      "severity": "low",
      "isDirect": false,
      "via": [
        "tmp"
      ],
      "effects": [
        "inquirer"
      ],
      "range": ">=1.1.1",
      "nodes": [
        "node_modules/external-editor"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "fast-xml-parser": {
      "name": "fast-xml-parser",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113331,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)",
          "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj",
          "severity": "high",
          "cwe": [
            "CWE-776"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.1.3 <5.3.6"
        },
        {
          "source": 1113407,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names",
          "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2",
          "severity": "critical",
          "cwe": [
            "CWE-185"
          ],
          "cvss": {
            "score": 9.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
          },
          "range": ">=4.1.3 <5.3.5"
        }
      ],
      "effects": [
        "edgedriver"
      ],
      "range": "4.1.3 - 5.3.5",
      "nodes": [
        "node_modules/fast-xml-parser"
      ],
      "fixAvailable": true
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "gaze": {
      "name": "gaze",
      "severity": "high",
      "isDirect": false,
      "via": [
        "globule"
      ],
      "effects": [
        "@wdio/runner"
      ],
      "range": ">=0.4.0",
      "nodes": [
        "node_modules/gaze"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "glob": {
      "name": "glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109842,
          "name": "glob",
          "dependency": "glob",
          "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
          "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
          "severity": "high",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=10.2.0 <10.5.0"
        }
      ],
      "effects": [],
      "range": "10.2.0 - 10.4.5",
      "nodes": [
        "node_modules/archiver-utils/node_modules/glob",
        "node_modules/webdriverio/node_modules/glob"
      ],
      "fixAvailable": true
    },
    "globule": {
      "name": "globule",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "gaze"
      ],
      "range": "*",
      "nodes": [
        "node_modules/globule"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "inquirer": {
      "name": "inquirer",
      "severity": "low",
      "isDirect": false,
      "via": [
        "external-editor"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
      "nodes": [
        "node_modules/inquirer"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112715,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml has prototype pollution in merge (<<)",
          "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.0.0 <4.1.1"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.1.0",
      "nodes": [
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "lodash": {
      "name": "lodash",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112455,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
          "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": ">=4.0.0 <=4.17.22"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.17.21",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113461,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=5.0.0 <5.1.7"
        },
        {
          "source": 1113462,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=6.0.0 <6.2.1"
        },
        {
          "source": 1113465,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=9.0.0 <9.0.6"
        }
      ],
      "effects": [
        "globule"
      ],
      "range": "<=3.1.2 || 5.0.0 - 5.1.6 || 6.0.0 - 6.2.0 || 9.0.0 - 9.0.5",
      "nodes": [
        "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
        "node_modules/@wdio/cli/node_modules/minimatch",
        "node_modules/@wdio/config/node_modules/minimatch",
        "node_modules/@wdio/runner/node_modules/minimatch",
        "node_modules/archiver-utils/node_modules/minimatch",
        "node_modules/eslint-plugin-n/node_modules/minimatch",
        "node_modules/filelist/node_modules/minimatch",
        "node_modules/globule/node_modules/minimatch",
        "node_modules/minimatch",
        "node_modules/mocha/node_modules/minimatch",
        "node_modules/readdir-glob/node_modules/minimatch",
        "node_modules/webdriverio/node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "pre-commit": {
      "name": "pre-commit",
      "severity": "high",
      "isDirect": true,
      "via": [
        "cross-spawn"
      ],
      "effects": [],
      "range": ">=1.1.0",
      "nodes": [
        "node_modules/pre-commit"
      ],
      "fixAvailable": {
        "name": "pre-commit",
        "version": "1.0.10",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "tar-fs",
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "10.0.0 - 22.11.1",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/puppeteer-core",
        "node_modules/@wdio/runner/node_modules/puppeteer-core",
        "node_modules/devtools/node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113132,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "high",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109532,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1109534,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=3.0.0 <3.1.1"
        },
        {
          "source": 1109543,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1109552,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
          "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=2.0.0 <2.1.2"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/tar-fs",
        "node_modules/@wdio/runner/node_modules/tar-fs",
        "node_modules/devtools/node_modules/tar-fs",
        "node_modules/tar-fs"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        }
      ],
      "effects": [
        "external-editor"
      ],
      "range": "<=0.2.3",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "undici": {
      "name": "undici",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1112496,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
          "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.23.0"
        }
      ],
      "effects": [],
      "range": "<6.23.0",
      "nodes": [
        "node_modules/undici"
      ],
      "fixAvailable": true
    },
    "validator": {
      "name": "validator",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109241,
          "name": "validator",
          "dependency": "validator",
          "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
          "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<13.15.20"
        },
        {
          "source": 1112713,
          "name": "validator",
          "dependency": "validator",
          "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements",
          "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g",
          "severity": "high",
          "cwe": [
            "CWE-172",
            "CWE-792"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<13.15.22"
        }
      ],
      "effects": [],
      "range": "<=13.15.20",
      "nodes": [
        "node_modules/validator"
      ],
      "fixAvailable": true
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [],
      "range": "<=5.1.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.3.2",
        "isSemVerMajor": true
      }
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.7.6 - 8.10.2",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/webdriverio",
        "node_modules/@wdio/runner/node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/@wdio/cli/node_modules/ws",
        "node_modules/@wdio/runner/node_modules/ws",
        "node_modules/devtools/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    },
    "yarn-install": {
      "name": "yarn-install",
      "severity": "high",
      "isDirect": false,
      "via": [
        "cross-spawn"
      ],
      "effects": [
        "@wdio/cli"
      ],
      "range": "*",
      "nodes": [
        "node_modules/yarn-install"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.24.0",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 4,
      "moderate": 7,
      "high": 20,
      "critical": 4,
      "total": 35
    },
    "dependencies": {
      "prod": 1,
      "dev": 1028,
      "optional": 17,
      "peer": 180,
      "peerOptional": 0,
      "total": 1028
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
  "added": 1033,
  "removed": 0,
  "changed": 0,
  "audited": 1034,
  "funding": 217,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@wdio/cli": {
        "name": "@wdio/cli",
        "severity": "high",
        "isDirect": true,
        "via": [
          "inquirer",
          "webdriverio",
          "yarn-install"
        ],
        "effects": [
          "@wdio/junit-reporter",
          "@wdio/local-runner",
          "@wdio/spec-reporter"
        ],
        "range": "<=9.0.0-alpha.426",
        "nodes": [
          "node_modules/@wdio/cli"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/junit-reporter": {
        "name": "@wdio/junit-reporter",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli"
        ],
        "effects": [],
        "range": "6.0.4 - 8.0.0-alpha.631",
        "nodes": [
          "node_modules/@wdio/junit-reporter"
        ],
        "fixAvailable": {
          "name": "@wdio/junit-reporter",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/local-runner": {
        "name": "@wdio/local-runner",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli",
          "@wdio/runner"
        ],
        "effects": [],
        "range": "<=9.1.5",
        "nodes": [
          "node_modules/@wdio/local-runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/runner": {
        "name": "@wdio/runner",
        "severity": "high",
        "isDirect": false,
        "via": [
          "gaze",
          "webdriverio"
        ],
        "effects": [
          "@wdio/local-runner"
        ],
        "range": "<=9.1.5",
        "nodes": [
          "node_modules/@wdio/runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "@wdio/spec-reporter": {
        "name": "@wdio/spec-reporter",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/cli"
        ],
        "effects": [],
        "range": "6.0.4 - 8.0.0-alpha.631",
        "nodes": [
          "node_modules/@wdio/spec-reporter"
        ],
        "fixAvailable": {
          "name": "@wdio/spec-reporter",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "ajv": {
        "name": "ajv",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1113428,
            "name": "ajv",
            "dependency": "ajv",
            "title": "ajv has ReDoS when using `$data` option",
            "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
            "severity": "moderate",
            "cwe": [
              "CWE-400",
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<6.14.0"
          },
          {
            "source": 1113429,
            "name": "ajv",
            "dependency": "ajv",
            "title": "ajv has ReDoS when using `$data` option",
            "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
            "severity": "moderate",
            "cwe": [
              "CWE-400",
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=7.0.0-alpha.0 <8.18.0"
          }
        ],
        "effects": [],
        "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
        "nodes": [
          "",
          ""
        ],
        "fixAvailable": true
      },
      "basic-ftp": {
        "name": "basic-ftp",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1113518,
            "name": "basic-ftp",
            "dependency": "basic-ftp",
            "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
            "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c",
            "severity": "critical",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 9.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
            },
            "range": "<5.2.0"
          }
        ],
        "effects": [],
        "range": "<5.2.0",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "cross-spawn": {
        "name": "cross-spawn",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1104663,
            "name": "cross-spawn",
            "dependency": "cross-spawn",
            "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
            "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<6.0.6"
          }
        ],
        "effects": [
          "pre-commit",
          "yarn-install"
        ],
        "range": "<6.0.6",
        "nodes": [
          "node_modules/pre-commit/node_modules/cross-spawn",
          "node_modules/yarn-install/node_modules/cross-spawn"
        ],
        "fixAvailable": {
          "name": "pre-commit",
          "version": "1.0.10",
          "isSemVerMajor": true
        }
      },
      "devtools": {
        "name": "devtools",
        "severity": "high",
        "isDirect": false,
        "via": [
          "puppeteer-core"
        ],
        "effects": [],
        "range": "7.7.6 - 8.10.2",
        "nodes": [
          "node_modules/devtools"
        ],
        "fixAvailable": true
      },
      "diff": {
        "name": "diff",
        "severity": "low",
        "isDirect": false,
        "via": [
          {
            "source": 1112705,
            "name": "diff",
            "dependency": "diff",
            "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
            "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
            "severity": "low",
            "cwe": [
              "CWE-400",
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=5.0.0 <5.2.2"
          }
        ],
        "effects": [],
        "range": "5.0.0 - 5.2.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "edgedriver": {
        "name": "edgedriver",
        "severity": "high",
        "isDirect": false,
        "via": [
          "fast-xml-parser"
        ],
        "effects": [],
        "range": "5.6.1 - 6.1.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "external-editor": {
        "name": "external-editor",
        "severity": "low",
        "isDirect": false,
        "via": [
          "tmp"
        ],
        "effects": [
          "inquirer"
        ],
        "range": ">=1.1.1",
        "nodes": [
          "node_modules/external-editor"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "fast-xml-parser": {
        "name": "fast-xml-parser",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1113331,
            "name": "fast-xml-parser",
            "dependency": "fast-xml-parser",
            "title": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)",
            "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj",
            "severity": "high",
            "cwe": [
              "CWE-776"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=4.1.3 <5.3.6"
          },
          {
            "source": 1113407,
            "name": "fast-xml-parser",
            "dependency": "fast-xml-parser",
            "title": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names",
            "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2",
            "severity": "critical",
            "cwe": [
              "CWE-185"
            ],
            "cvss": {
              "score": 9.3,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
            },
            "range": ">=4.1.3 <5.3.5"
          }
        ],
        "effects": [
          "edgedriver"
        ],
        "range": "4.1.3 - 5.3.5",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "form-data": {
        "name": "form-data",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1109540,
            "name": "form-data",
            "dependency": "form-data",
            "title": "form-data uses unsafe random function in form-data for choosing boundary",
            "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
            "severity": "critical",
            "cwe": [
              "CWE-330"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<2.5.4"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<2.5.4",
        "nodes": [
          "node_modules/form-data"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "gaze": {
        "name": "gaze",
        "severity": "high",
        "isDirect": false,
        "via": [
          "globule"
        ],
        "effects": [
          "@wdio/runner"
        ],
        "range": ">=0.4.0",
        "nodes": [
          "node_modules/gaze"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "glob": {
        "name": "glob",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1109842,
            "name": "glob",
            "dependency": "glob",
            "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
            "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
            "severity": "high",
            "cwe": [
              "CWE-78"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=10.2.0 <10.5.0"
          }
        ],
        "effects": [],
        "range": "10.2.0 - 10.4.5",
        "nodes": [
          "",
          ""
        ],
        "fixAvailable": true
      },
      "globule": {
        "name": "globule",
        "severity": "high",
        "isDirect": false,
        "via": [
          "minimatch"
        ],
        "effects": [
          "gaze"
        ],
        "range": "*",
        "nodes": [
          "node_modules/globule"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "inquirer": {
        "name": "inquirer",
        "severity": "low",
        "isDirect": false,
        "via": [
          "external-editor"
        ],
        "effects": [
          "@wdio/cli"
        ],
        "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
        "nodes": [
          "node_modules/inquirer"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "js-yaml": {
        "name": "js-yaml",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1112715,
            "name": "js-yaml",
            "dependency": "js-yaml",
            "title": "js-yaml has prototype pollution in merge (<<)",
            "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 5.3,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
            },
            "range": ">=4.0.0 <4.1.1"
          }
        ],
        "effects": [],
        "range": "4.0.0 - 4.1.0",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "lodash": {
        "name": "lodash",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1112455,
            "name": "lodash",
            "dependency": "lodash",
            "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
            "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
            },
            "range": ">=4.0.0 <=4.17.22"
          }
        ],
        "effects": [],
        "range": "4.0.0 - 4.17.21",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "minimatch": {
        "name": "minimatch",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113459,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<3.1.3"
          },
          {
            "source": 1113461,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=5.0.0 <5.1.7"
          },
          {
            "source": 1113462,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=6.0.0 <6.2.1"
          },
          {
            "source": 1113465,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=9.0.0 <9.0.6"
          }
        ],
        "effects": [
          "globule"
        ],
        "range": "<=3.1.2 || 5.0.0 - 5.1.6 || 6.0.0 - 6.2.0 || 9.0.0 - 9.0.5",
        "nodes": [
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "node_modules/globule/node_modules/minimatch"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "mwbot": {
        "name": "mwbot",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "request"
        ],
        "effects": [
          "wdio-mediawiki"
        ],
        "range": ">=0.1.6",
        "nodes": [
          "node_modules/mwbot"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "pre-commit": {
        "name": "pre-commit",
        "severity": "high",
        "isDirect": true,
        "via": [
          "cross-spawn"
        ],
        "effects": [],
        "range": ">=1.1.0",
        "nodes": [
          "node_modules/pre-commit"
        ],
        "fixAvailable": {
          "name": "pre-commit",
          "version": "1.0.10",
          "isSemVerMajor": true
        }
      },
      "puppeteer-core": {
        "name": "puppeteer-core",
        "severity": "high",
        "isDirect": false,
        "via": [
          "tar-fs",
          "ws"
        ],
        "effects": [
          "devtools",
          "webdriverio"
        ],
        "range": "10.0.0 - 22.11.1",
        "nodes": [
          "node_modules/@wdio/cli/node_modules/puppeteer-core",
          "node_modules/@wdio/runner/node_modules/puppeteer-core",
          "node_modules/devtools/node_modules/puppeteer-core"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "qs": {
        "name": "qs",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113132,
            "name": "qs",
            "dependency": "qs",
            "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
            "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
            "severity": "high",
            "cwe": [
              "CWE-20"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<6.14.1"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<6.14.1",
        "nodes": [
          ""
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "request": {
        "name": "request",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1096727,
            "name": "request",
            "dependency": "request",
            "title": "Server-Side Request Forgery in Request",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "severity": "moderate",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<=2.88.2"
          },
          "form-data",
          "qs",
          "tough-cookie"
        ],
        "effects": [
          "mwbot"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "tar-fs": {
        "name": "tar-fs",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1109532,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
            "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
            "severity": "high",
            "cwe": [
              "CWE-22",
              "CWE-61"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=2.0.0 <2.1.4"
          },
          {
            "source": 1109534,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
            "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
            "severity": "high",
            "cwe": [
              "CWE-22",
              "CWE-61"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=3.0.0 <3.1.1"
          },
          {
            "source": 1109543,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs can extract outside the specified dir with a specific tarball",
            "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": ">=2.0.0 <2.1.3"
          },
          {
            "source": 1109552,
            "name": "tar-fs",
            "dependency": "tar-fs",
            "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
            "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": ">=2.0.0 <2.1.2"
          }
        ],
        "effects": [
          "puppeteer-core"
        ],
        "range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0",
        "nodes": [
          "",
          "node_modules/@wdio/cli/node_modules/tar-fs",
          "node_modules/@wdio/runner/node_modules/tar-fs",
          "node_modules/devtools/node_modules/tar-fs"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "tmp": {
        "name": "tmp",
        "severity": "low",
        "isDirect": false,
        "via": [
          {
            "source": 1109537,
            "name": "tmp",
            "dependency": "tmp",
            "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
            "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
            "severity": "low",
            "cwe": [
              "CWE-59"
            ],
            "cvss": {
              "score": 2.5,
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
            },
            "range": "<=0.2.3"
          }
        ],
        "effects": [
          "external-editor"
        ],
        "range": "<=0.2.3",
        "nodes": [
          "node_modules/tmp"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "tough-cookie": {
        "name": "tough-cookie",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1097682,
            "name": "tough-cookie",
            "dependency": "tough-cookie",
            "title": "tough-cookie Prototype Pollution vulnerability",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "range": "<4.1.3"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<4.1.3",
        "nodes": [
          "node_modules/tough-cookie"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "undici": {
        "name": "undici",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1112496,
            "name": "undici",
            "dependency": "undici",
            "title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
            "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
            "severity": "moderate",
            "cwe": [
              "CWE-770"
            ],
            "cvss": {
              "score": 5.9,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<6.23.0"
          }
        ],
        "effects": [],
        "range": "<6.23.0",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "validator": {
        "name": "validator",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1109241,
            "name": "validator",
            "dependency": "validator",
            "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
            "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
            "severity": "moderate",
            "cwe": [
              "CWE-79"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<13.15.20"
          },
          {
            "source": 1112713,
            "name": "validator",
            "dependency": "validator",
            "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements",
            "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g",
            "severity": "high",
            "cwe": [
              "CWE-172",
              "CWE-792"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<13.15.22"
          }
        ],
        "effects": [],
        "range": "<=13.15.20",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "wdio-mediawiki": {
        "name": "wdio-mediawiki",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "mwbot"
        ],
        "effects": [],
        "range": "<=5.1.0",
        "nodes": [
          "node_modules/wdio-mediawiki"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.3.2",
          "isSemVerMajor": true
        }
      },
      "webdriverio": {
        "name": "webdriverio",
        "severity": "high",
        "isDirect": false,
        "via": [
          "devtools",
          "puppeteer-core"
        ],
        "effects": [
          "@wdio/cli",
          "@wdio/runner"
        ],
        "range": "7.7.6 - 8.10.2",
        "nodes": [
          "node_modules/@wdio/cli/node_modules/webdriverio",
          "node_modules/@wdio/runner/node_modules/webdriverio"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "ws": {
        "name": "ws",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1098392,
            "name": "ws",
            "dependency": "ws",
            "title": "ws affected by a DoS when handling a request with many HTTP headers",
            "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
            "severity": "high",
            "cwe": [
              "CWE-476"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=8.0.0 <8.17.1"
          }
        ],
        "effects": [
          "puppeteer-core"
        ],
        "range": "8.0.0 - 8.17.0",
        "nodes": [
          "node_modules/@wdio/cli/node_modules/ws",
          "node_modules/@wdio/runner/node_modules/ws",
          "node_modules/devtools/node_modules/ws"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      },
      "yarn-install": {
        "name": "yarn-install",
        "severity": "high",
        "isDirect": false,
        "via": [
          "cross-spawn"
        ],
        "effects": [
          "@wdio/cli"
        ],
        "range": "*",
        "nodes": [
          "node_modules/yarn-install"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.24.0",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 4,
        "moderate": 7,
        "high": 20,
        "critical": 4,
        "total": 35
      },
      "dependencies": {
        "prod": 1,
        "dev": 1033,
        "optional": 17,
        "peer": 183,
        "peerOptional": 0,
        "total": 1033
      }
    }
  }
}

--- end ---
{"added": 1033, "removed": 0, "changed": 0, "audited": 1034, "funding": 217, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@wdio/cli": {"name": "@wdio/cli", "severity": "high", "isDirect": true, "via": ["inquirer", "webdriverio", "yarn-install"], "effects": ["@wdio/junit-reporter", "@wdio/local-runner", "@wdio/spec-reporter"], "range": "<=9.0.0-alpha.426", "nodes": ["node_modules/@wdio/cli"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "@wdio/junit-reporter": {"name": "@wdio/junit-reporter", "severity": "high", "isDirect": true, "via": ["@wdio/cli"], "effects": [], "range": "6.0.4 - 8.0.0-alpha.631", "nodes": ["node_modules/@wdio/junit-reporter"], "fixAvailable": {"name": "@wdio/junit-reporter", "version": "9.24.0", "isSemVerMajor": true}}, "@wdio/local-runner": {"name": "@wdio/local-runner", "severity": "high", "isDirect": true, "via": ["@wdio/cli", "@wdio/runner"], "effects": [], "range": "<=9.1.5", "nodes": ["node_modules/@wdio/local-runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.24.0", "isSemVerMajor": true}}, "@wdio/runner": {"name": "@wdio/runner", "severity": "high", "isDirect": false, "via": ["gaze", "webdriverio"], "effects": ["@wdio/local-runner"], "range": "<=9.1.5", "nodes": ["node_modules/@wdio/runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.24.0", "isSemVerMajor": true}}, "@wdio/spec-reporter": {"name": "@wdio/spec-reporter", "severity": "high", "isDirect": true, "via": ["@wdio/cli"], "effects": [], "range": "6.0.4 - 8.0.0-alpha.631", "nodes": ["node_modules/@wdio/spec-reporter"], "fixAvailable": {"name": "@wdio/spec-reporter", "version": "9.24.0", "isSemVerMajor": true}}, "ajv": {"name": "ajv", "severity": "moderate", "isDirect": false, "via": [{"source": 1113428, "name": "ajv", "dependency": "ajv", "title": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "severity": "moderate", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<6.14.0"}, {"source": 1113429, "name": "ajv", "dependency": "ajv", "title": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "severity": "moderate", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=7.0.0-alpha.0 <8.18.0"}], "effects": [], "range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0", "nodes": ["", ""], "fixAvailable": true}, "basic-ftp": {"name": "basic-ftp", "severity": "critical", "isDirect": false, "via": [{"source": 1113518, "name": "basic-ftp", "dependency": "basic-ftp", "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir()\u00a0method", "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c", "severity": "critical", "cwe": ["CWE-22"], "cvss": {"score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}, "range": "<5.2.0"}], "effects": [], "range": "<5.2.0", "nodes": [""], "fixAvailable": true}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}], "effects": ["pre-commit", "yarn-install"], "range": "<6.0.6", "nodes": ["node_modules/pre-commit/node_modules/cross-spawn", "node_modules/yarn-install/node_modules/cross-spawn"], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "devtools": {"name": "devtools", "severity": "high", "isDirect": false, "via": ["puppeteer-core"], "effects": [], "range": "7.7.6 - 8.10.2", "nodes": ["node_modules/devtools"], "fixAvailable": true}, "diff": {"name": "diff", "severity": "low", "isDirect": false, "via": [{"source": 1112705, "name": "diff", "dependency": "diff", "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "severity": "low", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=5.0.0 <5.2.2"}], "effects": [], "range": "5.0.0 - 5.2.1", "nodes": [""], "fixAvailable": true}, "edgedriver": {"name": "edgedriver", "severity": "high", "isDirect": false, "via": ["fast-xml-parser"], "effects": [], "range": "5.6.1 - 6.1.1", "nodes": [""], "fixAvailable": true}, "external-editor": {"name": "external-editor", "severity": "low", "isDirect": false, "via": ["tmp"], "effects": ["inquirer"], "range": ">=1.1.1", "nodes": ["node_modules/external-editor"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "fast-xml-parser": {"name": "fast-xml-parser", "severity": "critical", "isDirect": false, "via": [{"source": 1113331, "name": "fast-xml-parser", "dependency": "fast-xml-parser", "title": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)", "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj", "severity": "high", "cwe": ["CWE-776"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.1.3 <5.3.6"}, {"source": 1113407, "name": "fast-xml-parser", "dependency": "fast-xml-parser", "title": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names", "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2", "severity": "critical", "cwe": ["CWE-185"], "cvss": {"score": 9.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"}, "range": ">=4.1.3 <5.3.5"}], "effects": ["edgedriver"], "range": "4.1.3 - 5.3.5", "nodes": [""], "fixAvailable": true}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "gaze": {"name": "gaze", "severity": "high", "isDirect": false, "via": ["globule"], "effects": ["@wdio/runner"], "range": ">=0.4.0", "nodes": ["node_modules/gaze"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.24.0", "isSemVerMajor": true}}, "glob": {"name": "glob", "severity": "high", "isDirect": false, "via": [{"source": 1109842, "name": "glob", "dependency": "glob", "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true", "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2", "severity": "high", "cwe": ["CWE-78"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=10.2.0 <10.5.0"}], "effects": [], "range": "10.2.0 - 10.4.5", "nodes": ["", ""], "fixAvailable": true}, "globule": {"name": "globule", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["gaze"], "range": "*", "nodes": ["node_modules/globule"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.24.0", "isSemVerMajor": true}}, "inquirer": {"name": "inquirer", "severity": "low", "isDirect": false, "via": ["external-editor"], "effects": ["@wdio/cli"], "range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7", "nodes": ["node_modules/inquirer"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "js-yaml": {"name": "js-yaml", "severity": "moderate", "isDirect": false, "via": [{"source": 1112715, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml has prototype pollution in merge (<<)", "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": ">=4.0.0 <4.1.1"}], "effects": [], "range": "4.0.0 - 4.1.0", "nodes": [""], "fixAvailable": true}, "lodash": {"name": "lodash", "severity": "moderate", "isDirect": false, "via": [{"source": 1112455, "name": "lodash", "dependency": "lodash", "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "range": ">=4.0.0 <=4.17.22"}], "effects": [], "range": "4.0.0 - 4.17.21", "nodes": [""], "fixAvailable": true}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.3"}, {"source": 1113461, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=5.0.0 <5.1.7"}, {"source": 1113462, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=6.0.0 <6.2.1"}, {"source": 1113465, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=9.0.0 <9.0.6"}], "effects": ["globule"], "range": "<=3.1.2 || 5.0.0 - 5.1.6 || 6.0.0 - 6.2.0 || 9.0.0 - 9.0.5", "nodes": ["", "", "", "", "", "", "", "", "", "", "", "node_modules/globule/node_modules/minimatch"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.24.0", "isSemVerMajor": true}}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["wdio-mediawiki"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "pre-commit": {"name": "pre-commit", "severity": "high", "isDirect": true, "via": ["cross-spawn"], "effects": [], "range": ">=1.1.0", "nodes": ["node_modules/pre-commit"], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "puppeteer-core": {"name": "puppeteer-core", "severity": "high", "isDirect": false, "via": ["tar-fs", "ws"], "effects": ["devtools", "webdriverio"], "range": "10.0.0 - 22.11.1", "nodes": ["node_modules/@wdio/cli/node_modules/puppeteer-core", "node_modules/@wdio/runner/node_modules/puppeteer-core", "node_modules/devtools/node_modules/puppeteer-core"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "high", "isDirect": false, "via": [{"source": 1113132, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "high", "cwe": ["CWE-20"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.14.1"}], "effects": ["request"], "range": "<6.14.1", "nodes": [""], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "qs", "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "tar-fs": {"name": "tar-fs", "severity": "high", "isDirect": false, "via": [{"source": 1109532, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.4"}, {"source": 1109534, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball", "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v", "severity": "high", "cwe": ["CWE-22", "CWE-61"], "cvss": {"score": 0, "vectorString": null}, "range": ">=3.0.0 <3.1.1"}, {"source": 1109543, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs can extract outside the specified dir with a specific tarball", "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": ">=2.0.0 <2.1.3"}, {"source": 1109552, "name": "tar-fs", "dependency": "tar-fs", "title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File", "url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": ">=2.0.0 <2.1.2"}], "effects": ["puppeteer-core"], "range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0", "nodes": ["", "node_modules/@wdio/cli/node_modules/tar-fs", "node_modules/@wdio/runner/node_modules/tar-fs", "node_modules/devtools/node_modules/tar-fs"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "low", "isDirect": false, "via": [{"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}], "effects": ["external-editor"], "range": "<=0.2.3", "nodes": ["node_modules/tmp"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "undici": {"name": "undici", "severity": "moderate", "isDirect": false, "via": [{"source": 1112496, "name": "undici", "dependency": "undici", "title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion", "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9", "severity": "moderate", "cwe": ["CWE-770"], "cvss": {"score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.23.0"}], "effects": [], "range": "<6.23.0", "nodes": [""], "fixAvailable": true}, "validator": {"name": "validator", "severity": "high", "isDirect": false, "via": [{"source": 1109241, "name": "validator", "dependency": "validator", "title": "validator.js has a URL validation bypass vulnerability in its isURL function", "url": "https://github.com/advisories/GHSA-9965-vmph-33xx", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<13.15.20"}, {"source": 1112713, "name": "validator", "dependency": "validator", "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements", "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g", "severity": "high", "cwe": ["CWE-172", "CWE-792"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<13.15.22"}], "effects": [], "range": "<=13.15.20", "nodes": [""], "fixAvailable": true}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": ["mwbot"], "effects": [], "range": "<=5.1.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.3.2", "isSemVerMajor": true}}, "webdriverio": {"name": "webdriverio", "severity": "high", "isDirect": false, "via": ["devtools", "puppeteer-core"], "effects": ["@wdio/cli", "@wdio/runner"], "range": "7.7.6 - 8.10.2", "nodes": ["node_modules/@wdio/cli/node_modules/webdriverio", "node_modules/@wdio/runner/node_modules/webdriverio"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "ws": {"name": "ws", "severity": "high", "isDirect": false, "via": [{"source": 1098392, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": ["CWE-476"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=8.0.0 <8.17.1"}], "effects": ["puppeteer-core"], "range": "8.0.0 - 8.17.0", "nodes": ["node_modules/@wdio/cli/node_modules/ws", "node_modules/@wdio/runner/node_modules/ws", "node_modules/devtools/node_modules/ws"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}, "yarn-install": {"name": "yarn-install", "severity": "high", "isDirect": false, "via": ["cross-spawn"], "effects": ["@wdio/cli"], "range": "*", "nodes": ["node_modules/yarn-install"], "fixAvailable": {"name": "@wdio/cli", "version": "9.24.0", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 4, "moderate": 7, "high": 20, "critical": 4, "total": 35}, "dependencies": {"prod": 1, "dev": 1033, "optional": 17, "peer": 183, "peerOptional": 0, "total": 1033}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
--- stdout ---

added 1032 packages, and audited 1033 packages in 23s

217 packages are looking for funding
  run `npm fund` for details

# npm audit report

cross-spawn  <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix --force`
Will install pre-commit@1.0.10, which is a breaking change
node_modules/pre-commit/node_modules/cross-spawn
node_modules/yarn-install/node_modules/cross-spawn
  pre-commit  >=1.1.0
  Depends on vulnerable versions of cross-spawn
  node_modules/pre-commit
  yarn-install  *
  Depends on vulnerable versions of cross-spawn
  node_modules/yarn-install
    @wdio/cli  <=9.0.0-alpha.426
    Depends on vulnerable versions of inquirer
    Depends on vulnerable versions of webdriverio
    Depends on vulnerable versions of yarn-install
    node_modules/@wdio/cli
      @wdio/junit-reporter  6.0.4 - 8.0.0-alpha.631
      Depends on vulnerable versions of @wdio/cli
      node_modules/@wdio/junit-reporter
      @wdio/local-runner  <=9.1.5
      Depends on vulnerable versions of @wdio/cli
      Depends on vulnerable versions of @wdio/runner
      node_modules/@wdio/local-runner
      @wdio/spec-reporter  6.0.4 - 8.0.0-alpha.631
      Depends on vulnerable versions of @wdio/cli
      node_modules/@wdio/spec-reporter

form-data  <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.3.2, which is a breaking change
node_modules/form-data
  request  *
  Depends on vulnerable versions of form-data
  Depends on vulnerable versions of qs
  Depends on vulnerable versions of tough-cookie
  node_modules/request
    mwbot  >=0.1.6
    Depends on vulnerable versions of request
    node_modules/mwbot
      wdio-mediawiki  <=5.1.0
      Depends on vulnerable versions of mwbot
      node_modules/wdio-mediawiki

minimatch  <3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
fix available via `npm audit fix --force`
Will install @wdio/local-runner@9.24.0, which is a breaking change
node_modules/globule/node_modules/minimatch
  globule  *
  Depends on vulnerable versions of minimatch
  node_modules/globule
    gaze  >=0.4.0
    Depends on vulnerable versions of globule
    node_modules/gaze
      @wdio/runner  <=9.1.5
      Depends on vulnerable versions of gaze
      Depends on vulnerable versions of webdriverio
      node_modules/@wdio/runner

qs  <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.3.2, which is a breaking change
node_modules/qs


tar-fs  2.0.0 - 2.1.3
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix --force`
Will install @wdio/cli@9.24.0, which is a breaking change
node_modules/@wdio/cli/node_modules/tar-fs
node_modules/@wdio/runner/node_modules/tar-fs
node_modules/devtools/node_modules/tar-fs
  puppeteer-core  10.0.0 - 22.11.1
  Depends on vulnerable versions of tar-fs
  Depends on vulnerable versions of ws
  node_modules/@wdio/cli/node_modules/puppeteer-core
  node_modules/@wdio/runner/node_modules/puppeteer-core
  node_modules/devtools/node_modules/puppeteer-core
    devtools  7.7.6 - 8.10.2
    Depends on vulnerable versions of puppeteer-core
    node_modules/devtools
    webdriverio  7.7.6 - 8.10.2
    Depends on vulnerable versions of devtools
    Depends on vulnerable versions of puppeteer-core
    node_modules/@wdio/cli/node_modules/webdriverio
    node_modules/@wdio/runner/node_modules/webdriverio

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix --force`
Will install @wdio/cli@9.24.0, which is a breaking change
node_modules/tmp
  external-editor  >=1.1.1
  Depends on vulnerable versions of tmp
  node_modules/external-editor
    inquirer  3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
    Depends on vulnerable versions of external-editor
    node_modules/inquirer

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install wdio-mediawiki@6.3.2, which is a breaking change
node_modules/tough-cookie

ws  8.0.0 - 8.17.0
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @wdio/cli@9.24.0, which is a breaking change
node_modules/@wdio/cli/node_modules/ws
node_modules/@wdio/runner/node_modules/ws
node_modules/devtools/node_modules/ws

25 vulnerabilities (3 low, 3 moderate, 17 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
--- stdout ---

added 1032 packages, and audited 1033 packages in 28s

217 packages are looking for funding
  run `npm fund` for details

25 vulnerabilities (3 low, 3 moderate, 17 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stderr ---
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated iltorb@2.4.5: The zlib module provides APIs for brotli compression/decompression starting with Node.js v10.16.0, please use it over iltorb
npm ERR! code 1
npm ERR! path /src/repo/app/node_modules/iltorb
npm ERR! command failed
npm ERR! command sh -c node ./scripts/install.js || node-gyp rebuild
npm ERR! make: Entering directory '/src/repo/app/node_modules/iltorb/build'
npm ERR!   CC(target) Release/obj.target/iltorb/brotli/c/common/dictionary.o
npm ERR! make: Leaving directory '/src/repo/app/node_modules/iltorb/build'
npm ERR! info install installing standalone, skipping download.
npm ERR! gyp info it worked if it ends with ok
npm ERR! gyp info using node-gyp@11.1.0
npm ERR! gyp info using node@20.19.2 | linux | x64
npm ERR! gyp info find Python using Python version 3.13.5 found at "/usr/bin/python3"
npm ERR! gyp info spawn /usr/bin/python3
npm ERR! gyp info spawn args [
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/gyp/gyp_main.py',
npm ERR! gyp info spawn args 'binding.gyp',
npm ERR! gyp info spawn args '-f',
npm ERR! gyp info spawn args 'make',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/src/repo/app/node_modules/iltorb/build/config.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/share/nodejs/node-gyp/addon.gypi',
npm ERR! gyp info spawn args '-I',
npm ERR! gyp info spawn args '/usr/include/nodejs/common.gypi',
npm ERR! gyp info spawn args '-Dlibrary=shared_library',
npm ERR! gyp info spawn args '-Dvisibility=default',
npm ERR! gyp info spawn args '-Dnode_root_dir=/usr/include/nodejs',
npm ERR! gyp info spawn args '-Dnode_gyp_dir=/usr/share/nodejs/node-gyp',
npm ERR! gyp info spawn args '-Dnode_lib_file=/usr/include/nodejs/<(target_arch)/node.lib',
npm ERR! gyp info spawn args '-Dmodule_root_dir=/src/repo/app/node_modules/iltorb',
npm ERR! gyp info spawn args '-Dnode_engine=v8',
npm ERR! gyp info spawn args '--depth=.',
npm ERR! gyp info spawn args '--no-parallel',
npm ERR! gyp info spawn args '--generator-output',
npm ERR! gyp info spawn args 'build',
npm ERR! gyp info spawn args '-Goutput_dir=.'
npm ERR! gyp info spawn args ]
npm ERR! gyp info spawn make
npm ERR! gyp info spawn args [ 'BUILDTYPE=Release', '-C', 'build' ]
npm ERR! make: cc: No such file or directory
npm ERR! make: *** [iltorb.target.mk:145: Release/obj.target/iltorb/brotli/c/common/dictionary.o] Error 127
npm ERR! gyp ERR! build error 
npm ERR! gyp ERR! stack Error: `make` failed with exit code: 2
npm ERR! gyp ERR! stack at ChildProcess.<anonymous> (/usr/share/nodejs/node-gyp/lib/build.js:216:23)
npm ERR! gyp ERR! System Linux 6.1.0-30-cloud-amd64
npm ERR! gyp ERR! command "/usr/bin/node" "/usr/share/nodejs/node-gyp/bin/node-gyp.js" "rebuild"
npm ERR! gyp ERR! cwd /src/repo/app/node_modules/iltorb
npm ERR! gyp ERR! node -v v20.19.2
npm ERR! gyp ERR! node-gyp -v v11.1.0
npm ERR! gyp ERR! not ok

npm ERR! A complete log of this run can be found in:
npm ERR!     /cache/_logs/2026-02-26T06_16_10_728Z-debug-0.log
--- stdout ---

> test
> npm run test:cx2 && npm run test:cx3


> test:cx2
> npm -s run lint

Checked 1 message directory.

/src/repo/modules/dashboard/ext.cx.dashboard.js
  434:17  warning  Object.fromEntries() is not supported in Safari 11.1, iOS Safari 11.3-11.4  compat/compat

/src/repo/modules/mw.cx.init.js
  35:17  warning  Object.fromEntries() is not supported in Safari 11.1, iOS Safari 11.3-11.4  compat/compat

✖ 2 problems (0 errors, 2 warnings)


> test:cx3
> cd app && npm run test


> cx3@1.0.0+20250505 test
> npm install && npm -s run test:bundle && npm run lint && npm run test:unit


--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1268, in main
    libup.run()
    ~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1208, in run
    self.npm_audit_fix(new_npm_audit)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 239, in npm_audit_fix
    self.npm_test()
    ~~~~~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 289, in npm_test
    self.check_call(["npm", "test"])
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/shell2.py", line 66, in check_call
    res.check_returncode()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/subprocess.py", line 508, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
                             self.stderr)
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 1.