This run took 52 seconds.
From 4d4c0d3de323202b4ee71f52da52a59c0ad94568 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Feb 2026 20:32:22 +0000
Subject: [PATCH] build: Updating composer dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* mediawiki/mediawiki-codesniffer: 49.0.0 → 50.0.0
* mediawiki/mediawiki-phan-config: 0.18.0 → 0.19.0
Change-Id: I7317c8727eac2ebe942a2d8dc342b6ea8231ff5b
---
composer.json | 4 ++--
package-lock.json | 40 ++++++++++++++++++++--------------------
2 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/composer.json b/composer.json
index 15ef067..940f873 100644
--- a/composer.json
+++ b/composer.json
@@ -8,8 +8,8 @@
"web-auth/webauthn-lib": "^5.2.3"
},
"require-dev": {
- "mediawiki/mediawiki-codesniffer": "49.0.0",
- "mediawiki/mediawiki-phan-config": "0.18.0",
+ "mediawiki/mediawiki-codesniffer": "50.0.0",
+ "mediawiki/mediawiki-phan-config": "0.19.0",
"mediawiki/minus-x": "2.0.1",
"php-parallel-lint/php-console-highlighter": "1.0.0",
"php-parallel-lint/php-parallel-lint": "1.4.0"
diff --git a/package-lock.json b/package-lock.json
index db42539..5711ae8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -278,9 +278,9 @@
}
},
"node_modules/@eslint/eslintrc/node_modules/minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"dependencies": {
"brace-expansion": "^1.1.7"
@@ -701,12 +701,12 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
- "version": "9.0.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
- "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+ "version": "9.0.9",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+ "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
"dev": true,
"dependencies": {
- "brace-expansion": "^2.0.1"
+ "brace-expansion": "^2.0.2"
},
"engines": {
"node": ">=16 || 14 >=14.17"
@@ -2176,9 +2176,9 @@
}
},
"node_modules/eslint/node_modules/minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"dependencies": {
"brace-expansion": "^1.1.7"
@@ -5480,9 +5480,9 @@
}
},
"minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"requires": {
"brace-expansion": "^1.1.7"
@@ -5759,12 +5759,12 @@
}
},
"minimatch": {
- "version": "9.0.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
- "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+ "version": "9.0.9",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+ "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
"dev": true,
"requires": {
- "brace-expansion": "^2.0.1"
+ "brace-expansion": "^2.0.2"
}
}
}
@@ -6462,9 +6462,9 @@
}
},
"minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"requires": {
"brace-expansion": "^1.1.7"
--
2.47.3
$ date
--- stdout ---
Fri Feb 27 20:31:46 UTC 2026
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-OATHAuth.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
71f0e1db9b2740a8f2efd92cdb0f8809ba2f92f2 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113465,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <9.0.6"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113544,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
},
{
"source": 1113552,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3 || 9.0.0 - 9.0.6",
"nodes": [
"node_modules/@eslint/eslintrc/node_modules/minimatch",
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/eslint/node_modules/minimatch",
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 3,
"critical": 0,
"total": 3
},
"dependencies": {
"prod": 1,
"dev": 431,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 431
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 56 installs, 0 updates, 0 removals
- Locking bacon/bacon-qr-code (v3.0.3)
- Locking brick/math (0.14.8)
- Locking christian-riesen/base32 (1.6.0)
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (3.0.5)
- Locking dasprid/enum (1.0.7)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
- Locking endroid/qr-code (6.0.9)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking jakobo/hotp-php (v2.0.0)
- Locking mediawiki/mediawiki-codesniffer (v49.0.0)
- Locking mediawiki/mediawiki-phan-config (0.18.0)
- Locking mediawiki/minus-x (2.0.1)
- Locking mediawiki/phan-taint-check-plugin (8.0.0)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking okvpn/clock-lts (1.0.0)
- Locking paragonie/constant_time_encoding (v3.1.3)
- Locking phan/phan (5.5.2)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.4.0)
- Locking phpcsstandards/phpcsutils (1.2.2)
- Locking psr/clock (1.0.0)
- Locking psr/container (2.0.2)
- Locking psr/event-dispatcher (1.0.0)
- Locking psr/http-message (2.0)
- Locking psr/log (3.0.2)
- Locking sabre/event (5.1.7)
- Locking spomky-labs/cbor-php (3.2.2)
- Locking spomky-labs/pki-framework (1.4.1)
- Locking squizlabs/php_codesniffer (3.13.5)
- Locking symfony/clock (v7.4.0)
- Locking symfony/console (v7.4.6)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/polyfill-php80 (v1.33.0)
- Locking symfony/polyfill-php83 (v1.33.0)
- Locking symfony/polyfill-php84 (v1.33.0)
- Locking symfony/polyfill-uuid (v1.33.0)
- Locking symfony/property-access (v7.4.4)
- Locking symfony/property-info (v7.4.6)
- Locking symfony/serializer (v7.4.6)
- Locking symfony/service-contracts (v3.6.1)
- Locking symfony/string (v8.0.6)
- Locking symfony/type-info (v8.0.6)
- Locking symfony/uid (v7.4.4)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking web-auth/cose-lib (4.5.0)
- Locking web-auth/webauthn-lib (5.2.3)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 56 installs, 0 updates, 0 removals
- Downloading christian-riesen/base32 (1.6.0)
- Downloading dasprid/enum (1.0.7)
- Downloading bacon/bacon-qr-code (v3.0.3)
- Downloading endroid/qr-code (6.0.9)
- Downloading jakobo/hotp-php (v2.0.0)
- Downloading symfony/polyfill-uuid (v1.33.0)
- Downloading symfony/type-info (v8.0.6)
- Downloading spomky-labs/pki-framework (1.4.1)
- Downloading web-auth/cose-lib (4.5.0)
- Downloading symfony/uid (v7.4.4)
- Downloading symfony/serializer (v7.4.6)
- Downloading symfony/property-info (v7.4.6)
- Downloading symfony/property-access (v7.4.4)
- Downloading symfony/clock (v7.4.0)
- Downloading spomky-labs/cbor-php (3.2.2)
- Downloading web-auth/webauthn-lib (5.2.3)
0/16 [>---------------------------] 0%
10/16 [=================>----------] 62%
14/16 [========================>---] 87%
16/16 [============================] 100%
- Installing squizlabs/php_codesniffer (3.13.5): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
- Installing brick/math (0.14.8): Extracting archive
- Installing christian-riesen/base32 (1.6.0): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing dasprid/enum (1.0.7): Extracting archive
- Installing bacon/bacon-qr-code (v3.0.3): Extracting archive
- Installing endroid/qr-code (6.0.9): Extracting archive
- Installing jakobo/hotp-php (v2.0.0): Extracting archive
- Installing phpcsstandards/phpcsutils (1.2.2): Extracting archive
- Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v49.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v8.0.6): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.1): Extracting archive
- Installing symfony/console (v7.4.6): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (3.0.2): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (5.5.2): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (8.0.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.18.0): Extracting archive
- Installing mediawiki/minus-x (2.0.1): Extracting archive
- Installing psr/clock (1.0.0): Extracting archive
- Installing okvpn/clock-lts (1.0.0): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
- Installing psr/http-message (2.0): Extracting archive
- Installing symfony/polyfill-php83 (v1.33.0): Extracting archive
- Installing symfony/polyfill-php84 (v1.33.0): Extracting archive
- Installing symfony/polyfill-uuid (v1.33.0): Extracting archive
- Installing symfony/type-info (v8.0.6): Extracting archive
- Installing spomky-labs/pki-framework (1.4.1): Extracting archive
- Installing web-auth/cose-lib (4.5.0): Extracting archive
- Installing symfony/uid (v7.4.4): Extracting archive
- Installing symfony/serializer (v7.4.6): Extracting archive
- Installing symfony/property-info (v7.4.6): Extracting archive
- Installing symfony/property-access (v7.4.4): Extracting archive
- Installing symfony/clock (v7.4.0): Extracting archive
- Installing spomky-labs/cbor-php (3.2.2): Extracting archive
- Installing psr/event-dispatcher (1.0.0): Extracting archive
- Installing paragonie/constant_time_encoding (v3.1.3): Extracting archive
- Installing web-auth/webauthn-lib (5.2.3): Extracting archive
0/54 [>---------------------------] 0%
27/54 [==============>-------------] 50%
46/54 [=======================>----] 85%
54/54 [============================] 100%
7 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
32 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
Upgrading c:mediawiki/mediawiki-codesniffer from 49.0.0 -> 50.0.0
Upgrading c:mediawiki/mediawiki-phan-config from 0.18.0 -> 0.19.0
$ /usr/bin/composer update
--- stderr ---
Loading composer repositories with package information
Updating dependencies
Lock file operations: 2 installs, 5 updates, 3 removals
- Removing microsoft/tolerant-php-parser (v0.1.2)
- Removing symfony/polyfill-php80 (v1.33.0)
- Removing tysonandre/var_representation_polyfill (0.1.3)
- Upgrading mediawiki/mediawiki-codesniffer (v49.0.0 => v50.0.0)
- Upgrading mediawiki/mediawiki-phan-config (0.18.0 => 0.19.0)
- Upgrading mediawiki/phan-taint-check-plugin (8.0.0 => 9.0.0)
- Upgrading phan/phan (5.5.2 => 6.0.1)
- Locking phan/tolerant-php-parser (v0.2.0)
- Locking phan/var_representation_polyfill (0.1.4)
- Upgrading symfony/console (v7.4.6 => v8.0.6)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 2 installs, 5 updates, 3 removals
0 [>---------------------------] 0 [->--------------------------]
- Removing tysonandre/var_representation_polyfill (0.1.3)
- Removing symfony/polyfill-php80 (v1.33.0)
- Removing microsoft/tolerant-php-parser (v0.1.2)
- Upgrading mediawiki/mediawiki-codesniffer (v49.0.0 => v50.0.0): Extracting archive
- Upgrading symfony/console (v7.4.6 => v8.0.6): Extracting archive
- Installing phan/var_representation_polyfill (0.1.4): Extracting archive
- Installing phan/tolerant-php-parser (v0.2.0): Extracting archive
- Upgrading phan/phan (5.5.2 => 6.0.1): Extracting archive
- Upgrading mediawiki/phan-taint-check-plugin (8.0.0 => 9.0.0): Extracting archive
- Upgrading mediawiki/mediawiki-phan-config (0.18.0 => 0.19.0): Extracting archive
0/7 [>---------------------------] 0%
6/7 [========================>---] 85%
7/7 [============================] 100%
Generating autoload files
31 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
--- stdout ---
--- end ---
$ vendor/bin/phpcs --report=json
--- stdout ---
{"totals":{"errors":0,"warnings":0,"fixable":0},"files":{"\/src\/repo\/src\/Enforce2FA\/UserRequirementsConditionCheckerWith2FAAssumption.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Hook\/RegistrationCallback.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLField\/RegisteredKeyLayout.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Hook\/TestHandler.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Module\/IModule.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLField\/NoJsInfoField.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Key\/AuthKey.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/TOTPAuthenticationRequest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/RecoveryCodesAuthenticationRequest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLField\/AddKeyLayout.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Hook\/UpdateTables.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/WebAuthnAddKeyForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Module\/WebAuthn.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/TwoFactorModuleSelectAuthenticationRequest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Module\/TOTP.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/RecoveryCodesStatusForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/RecoveryCodesSecondaryAuthenticationProvider.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/TOTPSecondaryAuthenticationProvider.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/WebAuthnManageForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/KeySessionStorageTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Notifications\/DisablePresentationModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Module\/RecoveryCodes.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHAuthLogger.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/WebAuthnAuthenticationRequest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/WebAuthnSecondaryAuthenticationProvider.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Key\/TOTPKey.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/AAGUIDLookup.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Auth\/FakeModuleAuthenticationRequest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Api\/Module\/ApiWebAuthn.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/disableOATHAuthForUser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Auth\/RecoveryCodesAuthenticationRequestTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/WebAuthnSerializerFactory.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/unit\/AAGUIDLookupTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHAuthModuleRegistry.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Notifications\/Manager.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Notifications\/RecoveryCodesGeneratedForUserPresentationModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHUser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Notifications\/EnablePresentationModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/OATHAuth.alias.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/UpdateSecretsToEncryptedFormat.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Special\/DisableOATHForUser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/OATHAuthOOUIHTMLForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHAuthServices.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Auth\/TOTPAuthenticationRequestTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Notifications\/RecoveryCodeCountPresentationModel.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Enforce2FA\/UserRequirementsConditionCheckerWith2FAAssumptionTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/PopulateUserHandles.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Key\/WebAuthnKeyTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Key\/RecoveryCodeKeys.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Auth\/TwoFactorModuleSelectAuthenticationRequestTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/TOTPEnableForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Api\/Module\/ApiQueryOATH.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/OATHAuthModuleRegistryTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Api\/Module\/ApiOATHValidate.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Enforce2FA\/Mandatory2FAChecker.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/.phan\/config.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Special\/BypassReauthTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/unit\/Key\/EncryptionHelperTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/DisableForm.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Module\/RecoveryCodesTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/HTMLForm\/RecoveryCodesTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/MoveRecoveryCodesFromTOTP.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/maintenance\/UpdateForMultipleDevicesSupport.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Hook\/HookHandler.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/HTMLForm\/RecoveryCodesTraitTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/HTMLForm\/KeySessionStorageTraitTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/EncryptionTestTrait.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Module\/TOTPTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHUserRepository.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/WebAuthnAuthenticator.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Special\/VerifyOATHForUserTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/OATHAuth.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Hook\/HookHandlerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Special\/DisableOATHForUserTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Special\/Recover2FAForUser.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Api\/Module\/ApiOATHValidateTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/WebAuthnAuthenticatorTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/OATHUserRepositoryTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/OATHAuthLoggerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Enforce2FA\/Mandatory2FACheckerTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Key\/RecoveryCodeKeysTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Auth\/SecondaryAuthenticationProvider.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/ServiceWiring.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Key\/WebAuthnKey.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Key\/TOTPKeyTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Special\/Recover2FAForUserTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Auth\/SecondaryAuthenticationProviderTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Key\/EncryptionHelper.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/tests\/phpunit\/integration\/Special\/OATHManageTest.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Special\/OATHManage.php":{"errors":0,"warnings":0,"messages":[]},"\/src\/repo\/src\/Special\/VerifyOATHForUser.php":{"errors":0,"warnings":0,"messages":[]}}}
--- end ---
$ /usr/bin/composer install
--- stderr ---
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Nothing to install, update or remove
Generating autoload files
31 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
--- end ---
$ /usr/bin/composer test
--- stderr ---
> composer lint
> parallel-lint . --exclude vendor --exclude node_modules
> composer phpcs
> phpcs -p -s --cache
> minus-x check .
--- stdout ---
PHP 8.4.18 | 10 parallel jobs
............................................................ 60/91 ( 65%)
............................... 91/91 (100%)
Checked 91 files in 0.4 seconds
No syntax error found
.............................................. 46 / 46 (100%)
Time: 387ms; Memory: 10MB
MinusX
======
Processing /src/repo...
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
.............................................................
...........................................
All good!
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113465,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <9.0.6"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113544,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
},
{
"source": 1113552,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3 || 9.0.0 - 9.0.6",
"nodes": [
"node_modules/@eslint/eslintrc/node_modules/minimatch",
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/eslint/node_modules/minimatch",
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 3,
"critical": 0,
"total": 3
},
"dependencies": {
"prod": 1,
"dev": 431,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 431
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 431,
"removed": 0,
"changed": 0,
"audited": 432,
"funding": 104,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113465,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <9.0.6"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113544,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
},
{
"source": 1113552,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3 || 9.0.0 - 9.0.6",
"nodes": [
"",
"",
"",
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 3,
"critical": 0,
"total": 3
},
"dependencies": {
"prod": 1,
"dev": 431,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 431
}
}
}
}
--- end ---
{"added": 431, "removed": 0, "changed": 0, "audited": 432, "funding": 104, "audit": {"auditReportVersion": 2, "vulnerabilities": {"grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": ["minimatch"], "effects": ["grunt-eslint"], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "grunt-eslint": {"name": "grunt-eslint", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": "<=1.0.0 || >=18.1.0", "nodes": ["node_modules/grunt-eslint"], "fixAvailable": {"name": "grunt-eslint", "version": "18.0.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.3"}, {"source": 1113465, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": ">=9.0.0 <9.0.6"}, {"source": 1113538, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": ["CWE-407"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.3"}, {"source": 1113544, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": ["CWE-407"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=9.0.0 <9.0.7"}, {"source": 1113546, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.4"}, {"source": 1113552, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=9.0.0 <9.0.7"}], "effects": ["grunt"], "range": "<=3.1.3 || 9.0.0 - 9.0.6", "nodes": ["", "", "", "node_modules/minimatch"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 3, "critical": 0, "total": 3}, "dependencies": {"prod": 1, "dev": 431, "optional": 0, "peer": 1, "peerOptional": 0, "total": 431}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 431 packages, and audited 432 packages in 5s
104 packages are looking for funding
run `npm fund` for details
# npm audit report
minimatch <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix --force`
Will install grunt@0.3.17, which is a breaking change
node_modules/minimatch
grunt >=0.4.0-a
Depends on vulnerable versions of minimatch
node_modules/grunt
grunt-eslint <=1.0.0 || >=18.1.0
Depends on vulnerable versions of grunt
node_modules/grunt-eslint
3 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 431 packages, and audited 432 packages in 5s
104 packages are looking for funding
run `npm fund` for details
3 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stdout ---
> test
> grunt test
Running "eslint:all" (eslint) task
/src/repo/modules/oathmanage/GroupsWith2FANotice.vue
5:1 warning This line has a length of 156. Maximum allowed is 100 max-len
16:1 warning This line has a length of 145. Maximum allowed is 100 max-len
38:1 warning This line has a length of 116. Maximum allowed is 100 max-len
/src/repo/modules/oathmanage/OATHManage.vue
110:1 warning This line has a length of 112. Maximum allowed is 100 max-len
/src/repo/modules/webauthn/ui/LoginForm.js
3:3 warning Unused eslint-disable directive (no problems were reported from 'no-jquery/no-global-selector')
/src/repo/modules/webauthn/util/Authenticator.js
58:9 warning navigator.credentials() is not supported in Safari 11.1, iOS Safari 11.3-11.4 compat/compat
/src/repo/modules/webauthn/util/Registrator.js
81:9 warning navigator.credentials() is not supported in Safari 11.1, iOS Safari 11.3-11.4 compat/compat
✖ 7 problems (0 errors, 7 warnings)
0 errors and 1 warning potentially fixable with the `--fix` option.
Running "stylelint:all" (stylelint) task
>> Linted 10 files without errors
Running "banana:OATHAuth" (banana) task
>> 2 message directories checked.
Running "banana:WebAuthn" (banana) task
>> 2 message directories checked.
Done.
--- end ---
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating composer dependencies
* mediawiki/mediawiki-codesniffer: 49.0.0 → 50.0.0
* mediawiki/mediawiki-phan-config: 0.18.0 → 0.19.0
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmp5lz429qk
--- stdout ---
[master 4d4c0d3] build: Updating composer dependencies
2 files changed, 22 insertions(+), 22 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 4d4c0d3de323202b4ee71f52da52a59c0ad94568 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Feb 2026 20:32:22 +0000
Subject: [PATCH] build: Updating composer dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* mediawiki/mediawiki-codesniffer: 49.0.0 → 50.0.0
* mediawiki/mediawiki-phan-config: 0.18.0 → 0.19.0
Change-Id: I7317c8727eac2ebe942a2d8dc342b6ea8231ff5b
---
composer.json | 4 ++--
package-lock.json | 40 ++++++++++++++++++++--------------------
2 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/composer.json b/composer.json
index 15ef067..940f873 100644
--- a/composer.json
+++ b/composer.json
@@ -8,8 +8,8 @@
"web-auth/webauthn-lib": "^5.2.3"
},
"require-dev": {
- "mediawiki/mediawiki-codesniffer": "49.0.0",
- "mediawiki/mediawiki-phan-config": "0.18.0",
+ "mediawiki/mediawiki-codesniffer": "50.0.0",
+ "mediawiki/mediawiki-phan-config": "0.19.0",
"mediawiki/minus-x": "2.0.1",
"php-parallel-lint/php-console-highlighter": "1.0.0",
"php-parallel-lint/php-parallel-lint": "1.4.0"
diff --git a/package-lock.json b/package-lock.json
index db42539..5711ae8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -278,9 +278,9 @@
}
},
"node_modules/@eslint/eslintrc/node_modules/minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"dependencies": {
"brace-expansion": "^1.1.7"
@@ -701,12 +701,12 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
- "version": "9.0.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
- "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+ "version": "9.0.9",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+ "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
"dev": true,
"dependencies": {
- "brace-expansion": "^2.0.1"
+ "brace-expansion": "^2.0.2"
},
"engines": {
"node": ">=16 || 14 >=14.17"
@@ -2176,9 +2176,9 @@
}
},
"node_modules/eslint/node_modules/minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"dependencies": {
"brace-expansion": "^1.1.7"
@@ -5480,9 +5480,9 @@
}
},
"minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"requires": {
"brace-expansion": "^1.1.7"
@@ -5759,12 +5759,12 @@
}
},
"minimatch": {
- "version": "9.0.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
- "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+ "version": "9.0.9",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+ "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
"dev": true,
"requires": {
- "brace-expansion": "^2.0.1"
+ "brace-expansion": "^2.0.2"
}
}
}
@@ -6462,9 +6462,9 @@
}
},
"minimatch": {
- "version": "3.1.2",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
- "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+ "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"dev": true,
"requires": {
"brace-expansion": "^1.1.7"
--
2.47.3
--- end ---