This run took 188 seconds.
From 8734a5c90be7c783a714d147fbd36fc88f8211cf Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Mar 2026 13:08:55 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
Change-Id: I61031f3412697025b16659e3e797dfe8f777de9b
---
package-lock.json | 51 +++++++++++++++++++++++++----------------------
1 file changed, 27 insertions(+), 24 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 8444317..4ce06d6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -854,9 +854,9 @@
}
},
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -1128,9 +1128,9 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -1594,9 +1594,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"devOptional": true,
"dependencies": {
"balanced-match": "^1.0.0",
@@ -3681,9 +3681,9 @@
}
},
"node_modules/glob/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -4861,9 +4861,9 @@
"dev": true
},
"node_modules/mocha/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -5580,9 +5580,9 @@
"dev": true
},
"node_modules/picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true,
"engines": {
"node": ">=8.6"
@@ -7102,9 +7102,9 @@
}
},
"node_modules/ts-declaration-location/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -7554,15 +7554,18 @@
"integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
},
"node_modules/yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true,
"bin": {
"yaml": "bin.mjs"
},
"engines": {
"node": ">= 14.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/eemeli"
}
},
"node_modules/yaml-eslint-parser": {
--
2.47.3
$ date
--- stdout ---
Fri Mar 27 13:06:44 UTC 2026
--- end ---
$ git clone file:///srv/git/mediawiki-services-wikifeeds.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
bbaf80ff8d18a2f74ec1439b17366dfc321f1934 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@eslint/eslintrc": {
"name": "@eslint/eslintrc",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "0.0.1 || >=0.1.1",
"nodes": [
"node_modules/@eslint/eslintrc"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@humanwhocodes/config-array": {
"name": "@humanwhocodes/config-array",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "*",
"nodes": [
"node_modules/@humanwhocodes/config-array"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@typescript-eslint/eslint-plugin": {
"name": "@typescript-eslint/eslint-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "<=8.55.1-alpha.3",
"nodes": [
"node_modules/@typescript-eslint/eslint-plugin"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/parser": {
"name": "@typescript-eslint/parser",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [],
"range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/parser"
],
"fixAvailable": true
},
"@typescript-eslint/type-utils": {
"name": "@typescript-eslint/type-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"@typescript-eslint/utils",
"eslint"
],
"effects": [
"@typescript-eslint/eslint-plugin"
],
"range": "5.9.2-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/type-utils"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils"
],
"range": "6.16.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/type-utils"
],
"range": "<=8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115432,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<5.0.5"
}
],
"effects": [
"minimatch"
],
"range": "<5.0.5",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion",
"node_modules/glob/node_modules/brace-expansion",
"node_modules/mocha/node_modules/brace-expansion"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"pre-commit"
],
"range": "<6.0.6",
"nodes": [
"node_modules/pre-commit/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"eslint": {
"name": "eslint",
"severity": "moderate",
"isDirect": true,
"via": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"file-entry-cache",
"minimatch"
],
"effects": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint-config-wikimedia",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"range": "0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
"nodes": [
"node_modules/eslint"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"eslint",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"effects": [],
"range": ">=0.9.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-jsdoc": {
"name": "eslint-plugin-jsdoc",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "8.4.4 - 62.6.1",
"nodes": [
"node_modules/eslint-plugin-jsdoc"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "moderate",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [],
"range": "<=17.21.1",
"nodes": [
"node_modules/eslint-plugin-n"
],
"fixAvailable": {
"name": "eslint-plugin-n",
"version": "17.24.0",
"isSemVerMajor": true
}
},
"eslint-plugin-vue": {
"name": "eslint-plugin-vue",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "5.0.0-beta.0 - 10.7.0",
"nodes": [
"node_modules/eslint-plugin-vue"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"file-entry-cache": {
"name": "file-entry-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"flat-cache"
],
"effects": [
"eslint"
],
"range": "4.0.0 - 7.0.2",
"nodes": [
"node_modules/file-entry-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"flat-cache": {
"name": "flat-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"file-entry-cache"
],
"range": "1.3.4 - 4.0.0",
"nodes": [
"node_modules/flat-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/request/node_modules/form-data"
],
"fixAvailable": false
},
"glob": {
"name": "glob",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"mocha",
"nyc",
"rimraf",
"test-exclude"
],
"range": "4.3.0 - 10.5.0",
"nodes": [
"node_modules/glob",
"node_modules/mv/node_modules/glob",
"node_modules/nyc/node_modules/glob",
"node_modules/rimraf/node_modules/glob",
"node_modules/test-exclude/node_modules/glob"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"istanbul-lib-processinfo": {
"name": "istanbul-lib-processinfo",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "<=2.0.3",
"nodes": [
"node_modules/istanbul-lib-processinfo"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [
"service-runner"
],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "moderate",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"@typescript-eslint/typescript-estree",
"eslint",
"eslint-plugin-n",
"glob",
"mocha",
"test-exclude"
],
"range": "2.0.0 - 10.0.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/glob/node_modules/minimatch",
"node_modules/minimatch",
"node_modules/mocha/node_modules/minimatch"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "high",
"isDirect": true,
"via": [
"glob",
"minimatch",
"serialize-javascript"
],
"effects": [],
"range": ">=3.0.0-0",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1109573,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"mv": {
"name": "mv",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [],
"range": ">=2.1.0",
"nodes": [
"node_modules/mv"
],
"fixAvailable": true
},
"nyc": {
"name": "nyc",
"severity": "moderate",
"isDirect": true,
"via": [
"glob",
"istanbul-lib-processinfo",
"rimraf",
"spawn-wrap",
"test-exclude"
],
"effects": [],
"range": "<=17.1.0",
"nodes": [
"node_modules/nyc"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/picomatch",
"node_modules/ts-declaration-location/node_modules/picomatch"
],
"fixAvailable": true
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113719,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/request/node_modules/qs"
],
"fixAvailable": false
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"preq",
"requestretry"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
},
"request"
],
"effects": [
"preq"
],
"range": "<=7.1.0",
"nodes": [
"node_modules/requestretry"
],
"fixAvailable": false
},
"rimraf": {
"name": "rimraf",
"severity": "moderate",
"isDirect": false,
"via": [
"glob"
],
"effects": [
"flat-cache",
"istanbul-lib-processinfo",
"mv",
"nyc",
"spawn-wrap"
],
"range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
"nodes": [
"node_modules/mv/node_modules/rimraf",
"node_modules/rimraf"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113686,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
"severity": "high",
"cwe": [
"CWE-96"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=7.0.2"
}
],
"effects": [
"mocha"
],
"range": "<=7.0.2",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"service-runner": {
"name": "service-runner",
"severity": "high",
"isDirect": true,
"via": [
"limitation",
"tar"
],
"effects": [],
"range": ">=3.0.0",
"nodes": [
"node_modules/service-runner"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"spawn-wrap": {
"name": "spawn-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "0.0.1 - 2.0.0",
"nodes": [
"node_modules/spawn-wrap"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
},
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
}
],
"effects": [
"service-runner"
],
"range": "<=7.5.10",
"nodes": [
"node_modules/tar"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"test-exclude": {
"name": "test-exclude",
"severity": "moderate",
"isDirect": false,
"via": [
"glob",
"minimatch"
],
"effects": [
"nyc"
],
"range": "4.2.2 || 5.0.0 - 7.0.2",
"nodes": [
"node_modules/test-exclude"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 29,
"high": 9,
"critical": 2,
"total": 40
},
"dependencies": {
"prod": 223,
"dev": 435,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 669
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@eslint/eslintrc": {
"name": "@eslint/eslintrc",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "0.0.1 || >=0.1.1",
"nodes": [
"node_modules/@eslint/eslintrc"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@humanwhocodes/config-array": {
"name": "@humanwhocodes/config-array",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "*",
"nodes": [
"node_modules/@humanwhocodes/config-array"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@typescript-eslint/eslint-plugin": {
"name": "@typescript-eslint/eslint-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint"
],
"effects": [],
"range": "<=8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/eslint-plugin"
],
"fixAvailable": true
},
"@typescript-eslint/parser": {
"name": "@typescript-eslint/parser",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/parser"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/type-utils": {
"name": "@typescript-eslint/type-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"@typescript-eslint/utils",
"eslint"
],
"effects": [
"@typescript-eslint/eslint-plugin"
],
"range": "5.62.1-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/type-utils"
],
"fixAvailable": true
},
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils"
],
"range": "6.16.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [],
"range": "<=8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115432,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<5.0.5"
}
],
"effects": [
"minimatch"
],
"range": "<5.0.5",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion",
"node_modules/glob/node_modules/brace-expansion",
"node_modules/mocha/node_modules/brace-expansion"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"pre-commit"
],
"range": "<6.0.6",
"nodes": [
"node_modules/pre-commit/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"eslint": {
"name": "eslint",
"severity": "moderate",
"isDirect": true,
"via": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"file-entry-cache",
"minimatch"
],
"effects": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint-config-wikimedia",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"range": "0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
"nodes": [
"node_modules/eslint"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"eslint",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"effects": [],
"range": ">=0.9.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-jsdoc": {
"name": "eslint-plugin-jsdoc",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "8.4.4 - 62.6.1",
"nodes": [
"node_modules/eslint-plugin-jsdoc"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "moderate",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [],
"range": "<=17.21.1",
"nodes": [
"node_modules/eslint-plugin-n"
],
"fixAvailable": {
"name": "eslint-plugin-n",
"version": "17.24.0",
"isSemVerMajor": true
}
},
"eslint-plugin-vue": {
"name": "eslint-plugin-vue",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "5.0.0-beta.0 - 10.7.0",
"nodes": [
"node_modules/eslint-plugin-vue"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"file-entry-cache": {
"name": "file-entry-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"flat-cache"
],
"effects": [
"eslint"
],
"range": "4.0.0 - 7.0.2",
"nodes": [
"node_modules/file-entry-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"flat-cache": {
"name": "flat-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"file-entry-cache"
],
"range": "1.3.4 - 4.0.0",
"nodes": [
"node_modules/flat-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/request/node_modules/form-data"
],
"fixAvailable": false
},
"glob": {
"name": "glob",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"mocha",
"nyc",
"rimraf",
"test-exclude"
],
"range": "4.3.0 - 10.5.0",
"nodes": [
"node_modules/glob",
"node_modules/mv/node_modules/glob",
"node_modules/nyc/node_modules/glob",
"node_modules/rimraf/node_modules/glob",
"node_modules/test-exclude/node_modules/glob"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"istanbul-lib-processinfo": {
"name": "istanbul-lib-processinfo",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "<=2.0.3",
"nodes": [
"node_modules/istanbul-lib-processinfo"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [
"service-runner"
],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "moderate",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"@typescript-eslint/typescript-estree",
"eslint",
"eslint-plugin-n",
"glob",
"mocha",
"test-exclude"
],
"range": "2.0.0 - 10.0.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/glob/node_modules/minimatch",
"node_modules/minimatch",
"node_modules/mocha/node_modules/minimatch"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "high",
"isDirect": true,
"via": [
"glob",
"minimatch",
"serialize-javascript"
],
"effects": [],
"range": ">=3.0.0-0",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1109573,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"mv": {
"name": "mv",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [],
"range": ">=2.1.0",
"nodes": [
"node_modules/mv"
],
"fixAvailable": true
},
"nyc": {
"name": "nyc",
"severity": "moderate",
"isDirect": true,
"via": [
"glob",
"istanbul-lib-processinfo",
"rimraf",
"spawn-wrap",
"test-exclude"
],
"effects": [],
"range": "<=17.1.0",
"nodes": [
"node_modules/nyc"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/picomatch",
"node_modules/ts-declaration-location/node_modules/picomatch"
],
"fixAvailable": true
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113719,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/request/node_modules/qs"
],
"fixAvailable": false
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"preq",
"requestretry"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
},
"request"
],
"effects": [
"preq"
],
"range": "<=7.1.0",
"nodes": [
"node_modules/requestretry"
],
"fixAvailable": false
},
"rimraf": {
"name": "rimraf",
"severity": "moderate",
"isDirect": false,
"via": [
"glob"
],
"effects": [
"flat-cache",
"istanbul-lib-processinfo",
"mv",
"nyc",
"spawn-wrap"
],
"range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
"nodes": [
"node_modules/mv/node_modules/rimraf",
"node_modules/rimraf"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113686,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
"severity": "high",
"cwe": [
"CWE-96"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=7.0.2"
}
],
"effects": [
"mocha"
],
"range": "<=7.0.2",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"service-runner": {
"name": "service-runner",
"severity": "high",
"isDirect": true,
"via": [
"limitation",
"tar"
],
"effects": [],
"range": ">=3.0.0",
"nodes": [
"node_modules/service-runner"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"spawn-wrap": {
"name": "spawn-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "0.0.1 - 2.0.0",
"nodes": [
"node_modules/spawn-wrap"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
},
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
}
],
"effects": [
"service-runner"
],
"range": "<=7.5.10",
"nodes": [
"node_modules/tar"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"test-exclude": {
"name": "test-exclude",
"severity": "moderate",
"isDirect": false,
"via": [
"glob",
"minimatch"
],
"effects": [
"nyc"
],
"range": "4.2.2 || 5.0.0 - 7.0.2",
"nodes": [
"node_modules/test-exclude"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 29,
"high": 9,
"critical": 2,
"total": 40
},
"dependencies": {
"prod": 223,
"dev": 435,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 669
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-es-x@8.7.0
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^8.7.0" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^8.7.0" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-n@17.23.1
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8.23.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN eslint-plugin-n@"^17.23.1" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8.23.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN eslint-plugin-n@"^17.23.1" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-compat-utils@0.6.5
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=6.0.0" from eslint-compat-utils@0.6.5
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x/node_modules/eslint-compat-utils
npm WARN eslint-compat-utils@"^0.6.3" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=6.0.0" from eslint-compat-utils@0.6.5
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x/node_modules/eslint-compat-utils
npm WARN eslint-compat-utils@"^0.6.3" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-es-x@7.8.0
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8" from eslint-plugin-es-x@7.8.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^7.8.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8" from eslint-plugin-es-x@7.8.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^7.8.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
--- stdout ---
{
"added": 669,
"removed": 0,
"changed": 0,
"audited": 670,
"funding": 115,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@eslint/eslintrc": {
"name": "@eslint/eslintrc",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "0.0.1 || >=0.1.1",
"nodes": [
"node_modules/@eslint/eslintrc"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@humanwhocodes/config-array": {
"name": "@humanwhocodes/config-array",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"eslint"
],
"range": "*",
"nodes": [
"node_modules/@humanwhocodes/config-array"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"@typescript-eslint/eslint-plugin": {
"name": "@typescript-eslint/eslint-plugin",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint"
],
"effects": [],
"range": "<=8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/eslint-plugin"
],
"fixAvailable": true
},
"@typescript-eslint/parser": {
"name": "@typescript-eslint/parser",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "1.1.1-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/parser"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/type-utils": {
"name": "@typescript-eslint/type-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"@typescript-eslint/utils",
"eslint"
],
"effects": [
"@typescript-eslint/eslint-plugin"
],
"range": "5.62.1-alpha.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/type-utils"
],
"fixAvailable": true
},
"@typescript-eslint/typescript-estree": {
"name": "@typescript-eslint/typescript-estree",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils"
],
"range": "6.16.0 - 8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"@typescript-eslint/utils": {
"name": "@typescript-eslint/utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@typescript-eslint/typescript-estree",
"eslint"
],
"effects": [],
"range": "<=8.56.1-alpha.2",
"nodes": [
"node_modules/@typescript-eslint/utils"
],
"fixAvailable": true
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115432,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<5.0.5"
}
],
"effects": [
"minimatch"
],
"range": "<5.0.5",
"nodes": [
"",
"",
"",
""
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"pre-commit"
],
"range": "<6.0.6",
"nodes": [
"node_modules/pre-commit/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"eslint": {
"name": "eslint",
"severity": "moderate",
"isDirect": true,
"via": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"file-entry-cache",
"minimatch"
],
"effects": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"@typescript-eslint/type-utils",
"@typescript-eslint/utils",
"eslint-config-wikimedia",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"range": "0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2",
"nodes": [
"node_modules/eslint"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"eslint-config-wikimedia": {
"name": "eslint-config-wikimedia",
"severity": "moderate",
"isDirect": true,
"via": [
"@typescript-eslint/eslint-plugin",
"@typescript-eslint/parser",
"eslint",
"eslint-plugin-jsdoc",
"eslint-plugin-vue"
],
"effects": [],
"range": ">=0.9.0",
"nodes": [
"node_modules/eslint-config-wikimedia"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-jsdoc": {
"name": "eslint-plugin-jsdoc",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "8.4.4 - 62.6.1",
"nodes": [
"node_modules/eslint-plugin-jsdoc"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"eslint-plugin-n": {
"name": "eslint-plugin-n",
"severity": "moderate",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [],
"range": "<=17.21.1",
"nodes": [
"node_modules/eslint-plugin-n"
],
"fixAvailable": {
"name": "eslint-plugin-n",
"version": "17.24.0",
"isSemVerMajor": true
}
},
"eslint-plugin-vue": {
"name": "eslint-plugin-vue",
"severity": "moderate",
"isDirect": false,
"via": [
"eslint"
],
"effects": [
"eslint-config-wikimedia"
],
"range": "5.0.0-beta.0 - 10.7.0",
"nodes": [
"node_modules/eslint-plugin-vue"
],
"fixAvailable": {
"name": "eslint-config-wikimedia",
"version": "0.8.1",
"isSemVerMajor": true
}
},
"file-entry-cache": {
"name": "file-entry-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"flat-cache"
],
"effects": [
"eslint"
],
"range": "4.0.0 - 7.0.2",
"nodes": [
"node_modules/file-entry-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"flat-cache": {
"name": "flat-cache",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"file-entry-cache"
],
"range": "1.3.4 - 4.0.0",
"nodes": [
"node_modules/flat-cache"
],
"fixAvailable": {
"name": "eslint",
"version": "10.1.0",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109540,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/request/node_modules/form-data"
],
"fixAvailable": false
},
"glob": {
"name": "glob",
"severity": "moderate",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"mocha",
"nyc",
"rimraf",
"test-exclude"
],
"range": "4.3.0 - 10.5.0",
"nodes": [
"node_modules/glob",
"node_modules/mv/node_modules/glob",
"node_modules/nyc/node_modules/glob",
"node_modules/rimraf/node_modules/glob",
"node_modules/test-exclude/node_modules/glob"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"istanbul-lib-processinfo": {
"name": "istanbul-lib-processinfo",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "<=2.0.3",
"nodes": [
"node_modules/istanbul-lib-processinfo"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [
"service-runner"
],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "moderate",
"isDirect": false,
"via": [
"brace-expansion"
],
"effects": [
"@eslint/eslintrc",
"@humanwhocodes/config-array",
"@typescript-eslint/typescript-estree",
"eslint",
"eslint-plugin-n",
"glob",
"mocha",
"test-exclude"
],
"range": "2.0.0 - 10.0.2",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch",
"node_modules/glob/node_modules/minimatch",
"node_modules/minimatch",
"node_modules/mocha/node_modules/minimatch"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"mocha": {
"name": "mocha",
"severity": "high",
"isDirect": true,
"via": [
"glob",
"minimatch",
"serialize-javascript"
],
"effects": [],
"range": ">=3.0.0-0",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1109573,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"mv": {
"name": "mv",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [],
"range": ">=2.1.0",
"nodes": [
"node_modules/mv"
],
"fixAvailable": true
},
"nyc": {
"name": "nyc",
"severity": "moderate",
"isDirect": true,
"via": [
"glob",
"istanbul-lib-processinfo",
"rimraf",
"spawn-wrap",
"test-exclude"
],
"effects": [],
"range": "<=17.1.0",
"nodes": [
"node_modules/nyc"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"",
"",
""
],
"fixAvailable": true
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113719,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<6.14.1"
}
],
"effects": [
"request"
],
"range": "<6.14.1",
"nodes": [
"node_modules/request/node_modules/qs"
],
"fixAvailable": false
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"qs",
"tough-cookie"
],
"effects": [
"preq",
"requestretry"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
},
"request"
],
"effects": [
"preq"
],
"range": "<=7.1.0",
"nodes": [
"node_modules/requestretry"
],
"fixAvailable": false
},
"rimraf": {
"name": "rimraf",
"severity": "moderate",
"isDirect": false,
"via": [
"glob"
],
"effects": [
"flat-cache",
"istanbul-lib-processinfo",
"mv",
"nyc",
"spawn-wrap"
],
"range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10",
"nodes": [
"node_modules/mv/node_modules/rimraf",
"node_modules/rimraf"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"serialize-javascript": {
"name": "serialize-javascript",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113686,
"name": "serialize-javascript",
"dependency": "serialize-javascript",
"title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
"severity": "high",
"cwe": [
"CWE-96"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=7.0.2"
}
],
"effects": [
"mocha"
],
"range": "<=7.0.2",
"nodes": [
"node_modules/serialize-javascript"
],
"fixAvailable": {
"name": "mocha",
"version": "7.2.0",
"isSemVerMajor": true
}
},
"service-runner": {
"name": "service-runner",
"severity": "high",
"isDirect": true,
"via": [
"limitation",
"tar"
],
"effects": [],
"range": ">=3.0.0",
"nodes": [
"node_modules/service-runner"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"spawn-wrap": {
"name": "spawn-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
"rimraf"
],
"effects": [
"nyc"
],
"range": "0.0.1 - 2.0.0",
"nodes": [
"node_modules/spawn-wrap"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
},
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
}
],
"effects": [
"service-runner"
],
"range": "<=7.5.10",
"nodes": [
"node_modules/tar"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"test-exclude": {
"name": "test-exclude",
"severity": "moderate",
"isDirect": false,
"via": [
"glob",
"minimatch"
],
"effects": [
"nyc"
],
"range": "4.2.2 || 5.0.0 - 7.0.2",
"nodes": [
"node_modules/test-exclude"
],
"fixAvailable": {
"name": "nyc",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": {
"name": "service-runner",
"version": "2.9.0",
"isSemVerMajor": true
}
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 29,
"high": 9,
"critical": 2,
"total": 40
},
"dependencies": {
"prod": 223,
"dev": 435,
"optional": 13,
"peer": 1,
"peerOptional": 0,
"total": 669
}
}
}
}
--- end ---
{"added": 669, "removed": 0, "changed": 0, "audited": 670, "funding": 115, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@eslint/eslintrc": {"name": "@eslint/eslintrc", "severity": "moderate", "isDirect": false, "via": ["minimatch"], "effects": ["eslint"], "range": "0.0.1 || >=0.1.1", "nodes": ["node_modules/@eslint/eslintrc"], "fixAvailable": {"name": "eslint", "version": "10.1.0", "isSemVerMajor": true}}, "@humanwhocodes/config-array": {"name": "@humanwhocodes/config-array", "severity": "moderate", "isDirect": false, "via": ["minimatch"], "effects": ["eslint"], "range": "*", "nodes": ["node_modules/@humanwhocodes/config-array"], "fixAvailable": {"name": "eslint", "version": "10.1.0", "isSemVerMajor": true}}, "@typescript-eslint/eslint-plugin": {"name": "@typescript-eslint/eslint-plugin", "severity": "moderate", "isDirect": false, "via": ["@typescript-eslint/type-utils", "@typescript-eslint/utils", "eslint"], "effects": [], "range": "<=8.56.1-alpha.2", "nodes": ["node_modules/@typescript-eslint/eslint-plugin"], "fixAvailable": true}, "@typescript-eslint/parser": {"name": "@typescript-eslint/parser", "severity": "moderate", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "eslint"], "effects": ["eslint-config-wikimedia"], "range": "1.1.1-alpha.0 - 8.56.1-alpha.2", "nodes": ["node_modules/@typescript-eslint/parser"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/type-utils": {"name": "@typescript-eslint/type-utils", "severity": "moderate", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "@typescript-eslint/utils", "eslint"], "effects": ["@typescript-eslint/eslint-plugin"], "range": "5.62.1-alpha.0 - 8.56.1-alpha.2", "nodes": ["node_modules/@typescript-eslint/type-utils"], "fixAvailable": true}, "@typescript-eslint/typescript-estree": {"name": "@typescript-eslint/typescript-estree", "severity": "moderate", "isDirect": false, "via": ["minimatch"], "effects": ["@typescript-eslint/parser", "@typescript-eslint/type-utils", "@typescript-eslint/utils"], "range": "6.16.0 - 8.56.1-alpha.2", "nodes": ["node_modules/@typescript-eslint/typescript-estree"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "@typescript-eslint/utils": {"name": "@typescript-eslint/utils", "severity": "moderate", "isDirect": false, "via": ["@typescript-eslint/typescript-estree", "eslint"], "effects": [], "range": "<=8.56.1-alpha.2", "nodes": ["node_modules/@typescript-eslint/utils"], "fixAvailable": true}, "brace-expansion": {"name": "brace-expansion", "severity": "moderate", "isDirect": false, "via": [{"source": 1115432, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<5.0.5"}], "effects": ["minimatch"], "range": "<5.0.5", "nodes": ["", "", "", ""], "fixAvailable": {"name": "mocha", "version": "7.2.0", "isSemVerMajor": true}}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1104663, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}], "effects": ["pre-commit"], "range": "<6.0.6", "nodes": ["node_modules/pre-commit/node_modules/cross-spawn"], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "eslint": {"name": "eslint", "severity": "moderate", "isDirect": true, "via": ["@eslint/eslintrc", "@humanwhocodes/config-array", "file-entry-cache", "minimatch"], "effects": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/parser", "@typescript-eslint/type-utils", "@typescript-eslint/utils", "eslint-config-wikimedia", "eslint-plugin-jsdoc", "eslint-plugin-vue"], "range": "0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2", "nodes": ["node_modules/eslint"], "fixAvailable": {"name": "eslint", "version": "10.1.0", "isSemVerMajor": true}}, "eslint-config-wikimedia": {"name": "eslint-config-wikimedia", "severity": "moderate", "isDirect": true, "via": ["@typescript-eslint/eslint-plugin", "@typescript-eslint/parser", "eslint", "eslint-plugin-jsdoc", "eslint-plugin-vue"], "effects": [], "range": ">=0.9.0", "nodes": ["node_modules/eslint-config-wikimedia"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-jsdoc": {"name": "eslint-plugin-jsdoc", "severity": "moderate", "isDirect": false, "via": ["eslint"], "effects": ["eslint-config-wikimedia"], "range": "8.4.4 - 62.6.1", "nodes": ["node_modules/eslint-plugin-jsdoc"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "eslint-plugin-n": {"name": "eslint-plugin-n", "severity": "moderate", "isDirect": true, "via": ["minimatch"], "effects": [], "range": "<=17.21.1", "nodes": ["node_modules/eslint-plugin-n"], "fixAvailable": {"name": "eslint-plugin-n", "version": "17.24.0", "isSemVerMajor": true}}, "eslint-plugin-vue": {"name": "eslint-plugin-vue", "severity": "moderate", "isDirect": false, "via": ["eslint"], "effects": ["eslint-config-wikimedia"], "range": "5.0.0-beta.0 - 10.7.0", "nodes": ["node_modules/eslint-plugin-vue"], "fixAvailable": {"name": "eslint-config-wikimedia", "version": "0.8.1", "isSemVerMajor": true}}, "file-entry-cache": {"name": "file-entry-cache", "severity": "moderate", "isDirect": false, "via": ["flat-cache"], "effects": ["eslint"], "range": "4.0.0 - 7.0.2", "nodes": ["node_modules/file-entry-cache"], "fixAvailable": {"name": "eslint", "version": "10.1.0", "isSemVerMajor": true}}, "flat-cache": {"name": "flat-cache", "severity": "moderate", "isDirect": false, "via": ["rimraf"], "effects": ["file-entry-cache"], "range": "1.3.4 - 4.0.0", "nodes": ["node_modules/flat-cache"], "fixAvailable": {"name": "eslint", "version": "10.1.0", "isSemVerMajor": true}}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/request/node_modules/form-data"], "fixAvailable": false}, "glob": {"name": "glob", "severity": "moderate", "isDirect": false, "via": ["minimatch"], "effects": ["mocha", "nyc", "rimraf", "test-exclude"], "range": "4.3.0 - 10.5.0", "nodes": ["node_modules/glob", "node_modules/mv/node_modules/glob", "node_modules/nyc/node_modules/glob", "node_modules/rimraf/node_modules/glob", "node_modules/test-exclude/node_modules/glob"], "fixAvailable": {"name": "mocha", "version": "7.2.0", "isSemVerMajor": true}}, "istanbul-lib-processinfo": {"name": "istanbul-lib-processinfo", "severity": "moderate", "isDirect": false, "via": ["rimraf"], "effects": ["nyc"], "range": "<=2.0.3", "nodes": ["node_modules/istanbul-lib-processinfo"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "limitation": {"name": "limitation", "severity": "moderate", "isDirect": false, "via": ["wikimedia-kad-fork"], "effects": ["service-runner"], "range": ">=0.2.3", "nodes": ["node_modules/limitation"], "fixAvailable": {"name": "service-runner", "version": "2.9.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "moderate", "isDirect": false, "via": ["brace-expansion"], "effects": ["@eslint/eslintrc", "@humanwhocodes/config-array", "@typescript-eslint/typescript-estree", "eslint", "eslint-plugin-n", "glob", "mocha", "test-exclude"], "range": "2.0.0 - 10.0.2", "nodes": ["node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch", "node_modules/glob/node_modules/minimatch", "node_modules/minimatch", "node_modules/mocha/node_modules/minimatch"], "fixAvailable": {"name": "mocha", "version": "7.2.0", "isSemVerMajor": true}}, "mocha": {"name": "mocha", "severity": "high", "isDirect": true, "via": ["glob", "minimatch", "serialize-javascript"], "effects": [], "range": ">=3.0.0-0", "nodes": ["node_modules/mocha"], "fixAvailable": {"name": "mocha", "version": "7.2.0", "isSemVerMajor": true}}, "ms": {"name": "ms", "severity": "moderate", "isDirect": false, "via": [{"source": 1109573, "name": "ms", "dependency": "ms", "title": "Vercel ms Inefficient Regular Expression Complexity vulnerability", "url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<2.0.0"}], "effects": ["wikimedia-kad-fork"], "range": "<2.0.0", "nodes": ["node_modules/wikimedia-kad-fork/node_modules/ms"], "fixAvailable": {"name": "service-runner", "version": "2.9.0", "isSemVerMajor": true}}, "mv": {"name": "mv", "severity": "moderate", "isDirect": false, "via": ["rimraf"], "effects": [], "range": ">=2.1.0", "nodes": ["node_modules/mv"], "fixAvailable": true}, "nyc": {"name": "nyc", "severity": "moderate", "isDirect": true, "via": ["glob", "istanbul-lib-processinfo", "rimraf", "spawn-wrap", "test-exclude"], "effects": [], "range": "<=17.1.0", "nodes": ["node_modules/nyc"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "picomatch": {"name": "picomatch", "severity": "high", "isDirect": false, "via": [{"source": 1115490, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<2.3.2"}, {"source": 1115492, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": ">=4.0.0 <4.0.4"}, {"source": 1115493, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<2.3.2"}, {"source": 1115495, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <4.0.4"}], "effects": [], "range": "<=2.3.1 || 4.0.0 - 4.0.3", "nodes": ["", "", ""], "fixAvailable": true}, "pre-commit": {"name": "pre-commit", "severity": "high", "isDirect": true, "via": ["cross-spawn"], "effects": [], "range": ">=1.1.0", "nodes": ["node_modules/pre-commit"], "fixAvailable": {"name": "pre-commit", "version": "1.0.10", "isSemVerMajor": true}}, "preq": {"name": "preq", "severity": "high", "isDirect": true, "via": ["request", "requestretry"], "effects": [], "range": "*", "nodes": ["node_modules/preq"], "fixAvailable": false}, "qs": {"name": "qs", "severity": "moderate", "isDirect": false, "via": [{"source": 1113719, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "moderate", "cwe": ["CWE-20"], "cvss": {"score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<6.14.1"}], "effects": ["request"], "range": "<6.14.1", "nodes": ["node_modules/request/node_modules/qs"], "fixAvailable": false}, "request": {"name": "request", "severity": "critical", "isDirect": false, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "qs", "tough-cookie"], "effects": ["preq", "requestretry"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": false}, "requestretry": {"name": "requestretry", "severity": "high", "isDirect": false, "via": [{"source": 1090420, "name": "requestretry", "dependency": "requestretry", "title": "Cookie exposure in requestretry", "url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45", "severity": "high", "cwe": ["CWE-200"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": "<7.0.0"}, "request"], "effects": ["preq"], "range": "<=7.1.0", "nodes": ["node_modules/requestretry"], "fixAvailable": false}, "rimraf": {"name": "rimraf", "severity": "moderate", "isDirect": false, "via": ["glob"], "effects": ["flat-cache", "istanbul-lib-processinfo", "mv", "nyc", "spawn-wrap"], "range": "2.3.0 - 3.0.2 || 4.2.0 - 5.0.10", "nodes": ["node_modules/mv/node_modules/rimraf", "node_modules/rimraf"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "serialize-javascript": {"name": "serialize-javascript", "severity": "high", "isDirect": false, "via": [{"source": 1113686, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "severity": "high", "cwe": ["CWE-96"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<=7.0.2"}], "effects": ["mocha"], "range": "<=7.0.2", "nodes": ["node_modules/serialize-javascript"], "fixAvailable": {"name": "mocha", "version": "7.2.0", "isSemVerMajor": true}}, "service-runner": {"name": "service-runner", "severity": "high", "isDirect": true, "via": ["limitation", "tar"], "effects": [], "range": ">=3.0.0", "nodes": ["node_modules/service-runner"], "fixAvailable": {"name": "service-runner", "version": "2.9.0", "isSemVerMajor": true}}, "spawn-wrap": {"name": "spawn-wrap", "severity": "moderate", "isDirect": false, "via": ["rimraf"], "effects": ["nyc"], "range": "0.0.1 - 2.0.0", "nodes": ["node_modules/spawn-wrap"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "tar": {"name": "tar", "severity": "high", "isDirect": false, "via": [{"source": 1097493, "name": "tar", "dependency": "tar", "title": "Denial of service while parsing a tar file due to lack of folders count validation", "url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<6.2.1"}, {"source": 1112659, "name": "tar", "dependency": "tar", "title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal", "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v", "severity": "high", "cwe": ["CWE-22", "CWE-59"], "cvss": {"score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"}, "range": "<7.5.7"}, {"source": 1113300, "name": "tar", "dependency": "tar", "title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization", "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": "<=7.5.2"}, {"source": 1113375, "name": "tar", "dependency": "tar", "title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction", "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}, "range": "<7.5.8"}, {"source": 1114200, "name": "tar", "dependency": "tar", "title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96", "severity": "high", "cwe": ["CWE-22", "CWE-59"], "cvss": {"score": 0, "vectorString": null}, "range": "<=7.5.9"}, {"source": 1114302, "name": "tar", "dependency": "tar", "title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": "<=7.5.10"}, {"source": 1114680, "name": "tar", "dependency": "tar", "title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS", "url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w", "severity": "high", "cwe": ["CWE-176", "CWE-367"], "cvss": {"score": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"}, "range": "<=7.5.3"}], "effects": ["service-runner"], "range": "<=7.5.10", "nodes": ["node_modules/tar"], "fixAvailable": {"name": "service-runner", "version": "2.9.0", "isSemVerMajor": true}}, "test-exclude": {"name": "test-exclude", "severity": "moderate", "isDirect": false, "via": ["glob", "minimatch"], "effects": ["nyc"], "range": "4.2.2 || 5.0.0 - 7.0.2", "nodes": ["node_modules/test-exclude"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": false}, "wikimedia-kad-fork": {"name": "wikimedia-kad-fork", "severity": "moderate", "isDirect": false, "via": ["ms"], "effects": ["limitation"], "range": "*", "nodes": ["node_modules/wikimedia-kad-fork"], "fixAvailable": {"name": "service-runner", "version": "2.9.0", "isSemVerMajor": true}}, "yaml": {"name": "yaml", "severity": "moderate", "isDirect": false, "via": [{"source": 1115369, "name": "yaml", "dependency": "yaml", "title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections", "url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp", "severity": "moderate", "cwe": ["CWE-674"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <2.8.3"}], "effects": [], "range": "2.0.0 - 2.8.2", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 29, "high": 9, "critical": 2, "total": 40}, "dependencies": {"prod": 223, "dev": 435, "optional": 13, "peer": 1, "peerOptional": 0, "total": 669}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-es-x@8.7.0
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^8.7.0" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^8.7.0" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-n@17.23.1
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8.23.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN eslint-plugin-n@"^17.23.1" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8.23.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN eslint-plugin-n@"^17.23.1" from eslint-config-wikimedia@0.32.3
npm WARN node_modules/eslint-config-wikimedia
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-compat-utils@0.6.5
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=6.0.0" from eslint-compat-utils@0.6.5
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x/node_modules/eslint-compat-utils
npm WARN eslint-compat-utils@"^0.6.3" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=6.0.0" from eslint-compat-utils@0.6.5
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x/node_modules/eslint-compat-utils
npm WARN eslint-compat-utils@"^0.6.3" from eslint-plugin-es-x@8.7.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-es-x
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-es-x@7.8.0
npm WARN Found: eslint@8.57.0
npm WARN node_modules/eslint
npm WARN dev eslint@"8.57.0" from the root project
npm WARN 27 more (@eslint-community/eslint-utils, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=8" from eslint-plugin-es-x@7.8.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^7.8.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN
npm WARN Conflicting peer dependency: eslint@10.1.0
npm WARN node_modules/eslint
npm WARN peer eslint@">=8" from eslint-plugin-es-x@7.8.0
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n/node_modules/eslint-plugin-es-x
npm WARN eslint-plugin-es-x@"^7.8.0" from eslint-plugin-n@17.23.1
npm WARN node_modules/eslint-config-wikimedia/node_modules/eslint-plugin-n
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated lodash.get@4.4.2: This package is deprecated. Use the optional chaining (?.) operator instead.
npm WARN deprecated kad-fs@0.0.4: This package is no longer maintained.
npm WARN deprecated rimraf@2.4.5: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated lodash.clone@4.5.0: This package is deprecated. Use structuredClone instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated kad-memstore@0.0.1: This package is no longer maintained.
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@6.0.4: Glob versions prior to v9 are no longer supported
npm WARN deprecated preq@0.5.14: Deprecated as this is a wrapper around the deprecated request library. Preq can be replaced with fetch, which is available from Node 18 as an experimental feature.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 664 packages, and audited 665 packages in 15s
115 packages are looking for funding
run `npm fund` for details
# npm audit report
brace-expansion <5.0.5
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix --force`
Will install eslint@10.1.0, which is a breaking change
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion
node_modules/mocha/node_modules/brace-expansion
minimatch 2.0.0 - 10.0.2
Depends on vulnerable versions of brace-expansion
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/glob/node_modules/minimatch
node_modules/minimatch
node_modules/mocha/node_modules/minimatch
@eslint/eslintrc 0.0.1 || >=0.1.1
Depends on vulnerable versions of minimatch
node_modules/@eslint/eslintrc
eslint 0.12.0 - 2.0.0-rc.1 || 4.1.0 - 10.0.0-rc.2
Depends on vulnerable versions of @eslint/eslintrc
Depends on vulnerable versions of @humanwhocodes/config-array
Depends on vulnerable versions of file-entry-cache
Depends on vulnerable versions of minimatch
node_modules/eslint
@typescript-eslint/eslint-plugin <=8.56.1-alpha.2
Depends on vulnerable versions of @typescript-eslint/type-utils
Depends on vulnerable versions of @typescript-eslint/utils
Depends on vulnerable versions of eslint
node_modules/@typescript-eslint/eslint-plugin
@typescript-eslint/parser 1.1.1-alpha.0 - 8.56.1-alpha.2
Depends on vulnerable versions of @typescript-eslint/typescript-estree
Depends on vulnerable versions of eslint
node_modules/@typescript-eslint/parser
eslint-config-wikimedia >=0.9.0
Depends on vulnerable versions of @typescript-eslint/eslint-plugin
Depends on vulnerable versions of @typescript-eslint/parser
Depends on vulnerable versions of eslint
Depends on vulnerable versions of eslint-plugin-jsdoc
Depends on vulnerable versions of eslint-plugin-vue
node_modules/eslint-config-wikimedia
@typescript-eslint/type-utils 5.62.1-alpha.0 - 8.56.1-alpha.2
Depends on vulnerable versions of @typescript-eslint/typescript-estree
Depends on vulnerable versions of @typescript-eslint/utils
Depends on vulnerable versions of eslint
node_modules/@typescript-eslint/type-utils
@typescript-eslint/utils <=8.56.1-alpha.2
Depends on vulnerable versions of @typescript-eslint/typescript-estree
Depends on vulnerable versions of eslint
node_modules/@typescript-eslint/utils
eslint-plugin-jsdoc 8.4.4 - 62.6.1
Depends on vulnerable versions of eslint
node_modules/eslint-plugin-jsdoc
eslint-plugin-vue 5.0.0-beta.0 - 10.7.0
Depends on vulnerable versions of eslint
node_modules/eslint-plugin-vue
@humanwhocodes/config-array *
Depends on vulnerable versions of minimatch
node_modules/@humanwhocodes/config-array
@typescript-eslint/typescript-estree 6.16.0 - 8.56.1-alpha.2
Depends on vulnerable versions of minimatch
node_modules/@typescript-eslint/typescript-estree
eslint-plugin-n <=17.21.1
Depends on vulnerable versions of minimatch
node_modules/eslint-plugin-n
glob 4.3.0 - 10.5.0
Depends on vulnerable versions of minimatch
node_modules/glob
node_modules/mv/node_modules/glob
node_modules/nyc/node_modules/glob
node_modules/rimraf/node_modules/glob
node_modules/test-exclude/node_modules/glob
mocha >=3.0.0-0
Depends on vulnerable versions of glob
Depends on vulnerable versions of minimatch
Depends on vulnerable versions of serialize-javascript
node_modules/mocha
nyc <=17.1.0
Depends on vulnerable versions of glob
Depends on vulnerable versions of istanbul-lib-processinfo
Depends on vulnerable versions of rimraf
Depends on vulnerable versions of spawn-wrap
Depends on vulnerable versions of test-exclude
node_modules/nyc
rimraf 2.3.0 - 3.0.2 || 4.2.0 - 5.0.10
Depends on vulnerable versions of glob
node_modules/mv/node_modules/rimraf
node_modules/rimraf
flat-cache 1.3.4 - 4.0.0
Depends on vulnerable versions of rimraf
node_modules/flat-cache
file-entry-cache 4.0.0 - 7.0.2
Depends on vulnerable versions of flat-cache
node_modules/file-entry-cache
istanbul-lib-processinfo <=2.0.3
Depends on vulnerable versions of rimraf
node_modules/istanbul-lib-processinfo
mv >=2.1.0
Depends on vulnerable versions of rimraf
node_modules/mv
spawn-wrap 0.0.1 - 2.0.0
Depends on vulnerable versions of rimraf
node_modules/spawn-wrap
test-exclude 4.2.2 || 5.0.0 - 7.0.2
Depends on vulnerable versions of glob
Depends on vulnerable versions of minimatch
node_modules/test-exclude
cross-spawn <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix --force`
Will install pre-commit@1.0.10, which is a breaking change
node_modules/pre-commit/node_modules/cross-spawn
pre-commit >=1.1.0
Depends on vulnerable versions of cross-spawn
node_modules/pre-commit
form-data <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
No fix available
node_modules/request/node_modules/form-data
request *
Depends on vulnerable versions of form-data
Depends on vulnerable versions of qs
Depends on vulnerable versions of tough-cookie
node_modules/request
preq *
Depends on vulnerable versions of request
Depends on vulnerable versions of requestretry
node_modules/preq
requestretry <=7.1.0
Depends on vulnerable versions of request
node_modules/requestretry
ms <2.0.0
Severity: moderate
Vercel ms Inefficient Regular Expression Complexity vulnerability - https://github.com/advisories/GHSA-w9mr-4mfr-499f
fix available via `npm audit fix --force`
Will install service-runner@2.9.0, which is a breaking change
node_modules/wikimedia-kad-fork/node_modules/ms
wikimedia-kad-fork *
Depends on vulnerable versions of ms
node_modules/wikimedia-kad-fork
limitation >=0.2.3
Depends on vulnerable versions of wikimedia-kad-fork
node_modules/limitation
service-runner >=3.0.0
Depends on vulnerable versions of limitation
Depends on vulnerable versions of tar
node_modules/service-runner
qs <6.14.1
Severity: moderate
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
No fix available
node_modules/request/node_modules/qs
serialize-javascript <=7.0.2
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
fix available via `npm audit fix --force`
Will install mocha@7.2.0, which is a breaking change
node_modules/serialize-javascript
tar <=7.5.10
Severity: high
Denial of service while parsing a tar file due to lack of folders count validation - https://github.com/advisories/GHSA-f5x3-32g6-xq36
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
fix available via `npm audit fix --force`
Will install service-runner@2.9.0, which is a breaking change
node_modules/tar
tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
No fix available
node_modules/tough-cookie
38 vulnerabilities (28 moderate, 8 high, 2 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated lodash.get@4.4.2: This package is deprecated. Use the optional chaining (?.) operator instead.
npm WARN deprecated kad-fs@0.0.4: This package is no longer maintained.
npm WARN deprecated rimraf@2.4.5: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated lodash.clone@4.5.0: This package is deprecated. Use structuredClone instead.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated kad-memstore@0.0.1: This package is no longer maintained.
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@6.0.4: Glob versions prior to v9 are no longer supported
npm WARN deprecated preq@0.5.14: Deprecated as this is a wrapper around the deprecated request library. Preq can be replaced with fetch, which is available from Node 18 as an experimental feature.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 664 packages, and audited 665 packages in 11s
115 packages are looking for funding
run `npm fund` for details
38 vulnerabilities (28 moderate, 8 high, 2 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
strict mode: missing type "object" for keyword "required" at "#/definitions/problem#" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "#/definitions/problem#" (strictTypes)
--- stdout ---
> @wikimedia/wikifeeds@1.0.0 test
> npm run lint && PREQ_CONNECT_TIMEOUT=15 mocha --recursive
> @wikimedia/wikifeeds@1.0.0 lint
> eslint .
/src/repo/.eslintrc.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/app.js
20:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
64:37 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
136:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
138:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
150:31 warning Found non-literal argument in require security/detect-non-literal-require
197:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
198:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
236:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
/src/repo/etc/dyk-sites.js
19:5 warning Missing JSDoc @return declaration jsdoc/require-returns
/src/repo/etc/news-sites.js
4:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
5:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
6:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
50:1 warning Syntax error in type: {Object.<string, NewsSite>} jsdoc/valid-types
/src/repo/lib/announcements.js
30:1 warning Expected this semicolon to be at the end of the previous line semi-style
34:1 warning This line has a length of 123. Maximum allowed is 100 max-len
51:1 warning This line has a length of 134. Maximum allowed is 100 max-len
84:1 warning This line has a length of 119. Maximum allowed is 100 max-len
86:1 warning This line has a length of 118. Maximum allowed is 100 max-len
135:1 warning This line has a length of 123. Maximum allowed is 100 max-len
/src/repo/lib/api-util.js
296:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
/src/repo/lib/did-you-know.js
20:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
21:1 warning Missing JSDoc @param "lang" type jsdoc/require-param-type
41:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
42:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
82:12 warning 'si' is already declared in the upper scope on line 8 column 7 no-shadow
97:20 warning 'result' is already declared in the upper scope on line 88 column 19 no-shadow
/src/repo/lib/featured.js
136:12 warning 'si' is already declared in the upper scope on line 12 column 7 no-shadow
/src/repo/lib/imageinfo.js
30:1 warning The type 'Bool' is undefined jsdoc/no-undefined-types
85:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
132:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
203:43 warning Array.prototype.map() expects a return value from arrow function array-callback-return
280:1 warning Syntax error in type: [type] jsdoc/valid-types
282:1 warning Syntax error in type: [type] jsdoc/valid-types
/src/repo/lib/most-read.js
81:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
82:1 warning @public should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
83:1 warning @public should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
100:1 warning This line has a length of 122. Maximum allowed is 100 max-len
115:28 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
116:1 warning This line has a length of 112. Maximum allowed is 100 max-len
145:19 warning 'pageviews' is already declared in the upper scope on line 10 column 7 no-shadow
161:25 warning Array.prototype.map() expects a return value from arrow function array-callback-return
202:1 warning This line has a length of 148. Maximum allowed is 100 max-len
212:1 warning This line has a length of 113. Maximum allowed is 100 max-len
/src/repo/lib/news.js
15:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
73:12 warning 'si' is already declared in the upper scope on line 8 column 7 no-shadow
96:20 warning 'result' is already declared in the upper scope on line 80 column 19 no-shadow
/src/repo/lib/on-this-day.js
34:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
122:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
123:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
128:12 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
141:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
151:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
172:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
184:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
207:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
253:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
270:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
309:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
320:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
321:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
342:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
360:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
380:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
412:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
426:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
440:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
454:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
468:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
483:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
484:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
543:1 warning Missing JSDoc @param "sendResponse" type jsdoc/require-param-type
/src/repo/lib/on-this-day.languages.js
28:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
30:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
32:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
60:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
62:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
64:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
100:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
102:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
104:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
128:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
130:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
132:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
156:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
158:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
160:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
189:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
191:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
193:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
217:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
219:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
221:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
245:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
247:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
249:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
273:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
275:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
277:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
301:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
303:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
305:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
335:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
337:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
339:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
362:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
364:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
366:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
390:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
392:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
418:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
420:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
422:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
/src/repo/lib/pageviews.js
36:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
37:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
38:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
39:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
53:1 warning The type 'Platform' is undefined jsdoc/no-undefined-types
54:1 warning The type 'Agent' is undefined jsdoc/no-undefined-types
56:1 warning The type 'Granularity' is undefined jsdoc/no-undefined-types
71:1 warning The type 'Platform' is undefined jsdoc/no-undefined-types
/src/repo/lib/random.js
38:9 warning 'score' is already declared in the upper scope on line 31 column 10 no-shadow
55:1 warning Missing JSDoc @param "scoredResults" type jsdoc/require-param-type
/src/repo/lib/siteinfo.js
3:1 warning Use the global form of 'use strict' strict
10:29 warning Unsafe Regular Expression security/detect-unsafe-regex
/src/repo/lib/util.js
104:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
142:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
222:1 warning The type 'Router' is undefined jsdoc/no-undefined-types
280:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
293:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
306:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
378:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
450:34 warning Default parameters should be last default-param-last
/src/repo/package-lock.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/package.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/scripts/check-featured-feed.js
49:35 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
82:44 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
107:34 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
150:30 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
217:5 warning Don't use process.exit(); throw an error instead n/no-process-exit
/src/repo/spec.yaml
228:1 warning This line has a length of 154. Maximum allowed is 100 max-len
232:1 warning This line has a length of 141. Maximum allowed is 100 max-len
866:1 warning This line has a length of 117. Maximum allowed is 100 max-len
871:1 warning This line has a length of 116. Maximum allowed is 100 max-len
876:1 warning This line has a length of 116. Maximum allowed is 100 max-len
881:1 warning This line has a length of 116. Maximum allowed is 100 max-len
886:1 warning This line has a length of 116. Maximum allowed is 100 max-len
938:1 warning This line has a length of 108. Maximum allowed is 100 max-len
955:1 warning This line has a length of 126. Maximum allowed is 100 max-len
956:1 warning This line has a length of 107. Maximum allowed is 100 max-len
962:1 warning This line has a length of 132. Maximum allowed is 100 max-len
969:1 warning This line has a length of 127. Maximum allowed is 100 max-len
971:1 warning This line has a length of 108. Maximum allowed is 100 max-len
972:1 warning This line has a length of 113. Maximum allowed is 100 max-len
973:1 warning This line has a length of 121. Maximum allowed is 100 max-len
977:1 warning This line has a length of 121. Maximum allowed is 100 max-len
981:1 warning This line has a length of 113. Maximum allowed is 100 max-len
985:1 warning This line has a length of 111. Maximum allowed is 100 max-len
991:1 warning This line has a length of 124. Maximum allowed is 100 max-len
995:1 warning This line has a length of 281. Maximum allowed is 100 max-len
1082:1 warning This line has a length of 144. Maximum allowed is 100 max-len
✖ 161 problems (0 errors, 161 warnings)
aggregated featured
starting test server
✔ should return 200 for a valid request (1826ms)
✔ should return 404 for an invalid year
✔ should return 404 for an invalid month
✔ should return 404 for an invalid day
✔ should return only historic keys for past date (665ms)
✔ should return current keys for today (1539ms)
✔ should return future keys for tomorrow (2091ms)
aggregate onthisday
✔ should return 200 for a valid request (4655ms)
✔ should return 404 for an invalid month (267ms)
✔ should return 404 for an invalid day (158ms)
✔ should return objects with the expected keys (4151ms)
express app
✔ should get robots.txt
✔ should set CORS headers
✔ should set CSP headers
✔ should get static content gzipped
✔ should get static content uncompressed
Swagger spec
✔ get the spec
✔ spec validation
validate responses against schema
- random response should conform to schema
✔ featured article response should conform to schema (187ms)
✔ featured image response should conform to schema (287ms)
✔ most-read response should conform to schema (1412ms)
✔ news response should conform to schema (95ms)
✔ announcements should conform to schema
✔ onthisday response should conform to schema (4561ms)
✔ featured article response should conform to schema (invalid lang, agg=true)
✔ featured image response should conform to schema (invalid date, agg=true)
✔ most-read response should conform to schema (invalid date, agg=true)
✔ news response (invalid language, agg=true) should be empty
✔ featured article request should fail for invalid language when !agg=true
✔ featured image request should fail for invalid date when !agg=true
✔ most-read request should fail for invalid date when !agg=true
✔ news request should fail for invalid language when !agg=true
validate spec examples
✔ spec from root
✔ retrieve service info
✔ Retrieve feed content availability from \'wikipedia.org\'
✔ Retrieve announcements
✔ retrieve selected events on January 15 (333ms)
✔ retrieve title of the featured article for April 29, 2016 (220ms)
✔ retrieve featured article info for unsupported site (with aggregated=true)
✔ retrieve featured image data for April 29, 2016 (1248ms)
✔ retrieve the most read articles for January 1, 2016 (533ms)
✔ retrieve the most-read articles for January 1, 2016 (with aggregated=true) (339ms)
✔ retrieve most-read articles for date with no data (with aggregated=true)
✔ get 'In the News' content (158ms)
✔ get "In the News" content for unsupported language (with aggregated=true)
✔ retrieve a random article title (51ms)
did-you-know
✔ ar: results list should have expected properties (270ms)
✔ de: results list should have expected properties (137ms)
✔ en: results list should have expected properties
✔ hi: results list should have expected properties (191ms)
✔ pt: results list should have expected properties (188ms)
✔ ru: results list should have expected properties (171ms)
✔ uk: results list should have expected properties (184ms)
featured
✔ incomplete date should return 404
✔ extra uri path parameter after date should return 404
✔ Missing TFA should return 204 (196ms)
✔ Missing TFA with aggregated=true should return 204 (122ms)
✔ featured article of an old date should return 404
featured-image-lang
✔ bg description (2174ms)
✔ bn description (275ms)
✔ bs description (242ms)
✔ cs description (364ms)
✔ de description (174ms)
✔ el description (286ms)
✔ en description (182ms)
✔ fa description (266ms)
✔ he description (309ms)
✔ hu description (335ms)
✔ it description (302ms)
✔ ja description (310ms)
✔ la description (294ms)
✔ no description (264ms)
✔ sco description (300ms)
✔ sd description (341ms)
✔ sv description (300ms)
✔ tr description (253ms)
✔ ur description (300ms)
✔ vi description (251ms)
✔ zh description (331ms)
featured-image
✔ incomplete date should return 404
✔ extra uri path parameter after date should return 404
service information
✔ should get the service name
✔ should get the service version
✔ should redirect to the service home page
✔ should get the service info
most-read articles
✔ Should provide pageviews from day prior when aggregated flag is set (2006ms)
✔ Should drop duplicate pageviews (3053ms)
✔ Should filter out missing summaries (1895ms)
✔ Should return 204 for fywiki requests
✔ main page filtering RegExp should handle all main page title chars
✔ Should filter out blocked titles from some languages, but not others
✔ Should filter out certain blocked titles from all wikis
most-read articles
✔ Should return 200 even if title has invalid utf8 encoding (1037ms)
✔ Should filter-out invalid utf8 encoding
news headline selectors
✔ test news headlines should be general not categorical
✔ test news headline topics should be nonnull
✔ bs news headlines should be general not categorical
✔ bs news headline topics should be nonnull
✔ da news headlines should be general not categorical
✔ da news headline topics should be nonnull
✔ de news headlines should be general not categorical
✔ de news headline topics should be nonnull
✔ el news headlines should be general not categorical
✔ el news headline topics should be nonnull
✔ en news headlines should be general not categorical
✔ en news headline topics should be nonnull
✔ es news headlines should be general not categorical
✔ es news headline topics should be nonnull
✔ fi news headlines should be general not categorical
✔ fi news headline topics should be nonnull
✔ fr news headlines should be general not categorical
✔ fr news headline topics should be nonnull
✔ he news headlines should be general not categorical
✔ he news headline topics should be nonnull
✔ ko news headlines should be general not categorical
✔ ko news headline topics should be nonnull
✔ no news headlines should be general not categorical
✔ no news headline topics should be nonnull
✔ pl news headlines should be general not categorical
✔ pl news headline topics should be nonnull
✔ pt news headlines should be general not categorical
✔ pt news headline topics should be nonnull
✔ ru news headlines should be general not categorical
✔ ru news headline topics should be nonnull
✔ sco news headlines should be general not categorical
✔ sco news headline topics should be nonnull
✔ sv news headlines should be general not categorical
✔ sv news headline topics should be nonnull
✔ uk news headlines should be general not categorical
✔ uk news headline topics should be nonnull
✔ vi news headlines should be general not categorical
✔ vi news headline topics should be nonnull
✔ news headline topic should be the first bold link
✔ news headline topic should be the first link when no link is bolded
news
✔ test: results list should have expected properties (524ms)
✔ bs: results list should have expected properties (366ms)
✔ da: results list should have expected properties (1321ms)
✔ de: results list should have expected properties (592ms)
✔ el: results list should have expected properties (586ms)
✔ en: results list should have expected properties (131ms)
✔ es: results list should have expected properties (156ms)
✔ fi: results list should have expected properties (1140ms)
✔ fr: results list should have expected properties (497ms)
✔ he: results list should have expected properties (482ms)
✔ ko: results list should have expected properties (888ms)
✔ no: results list should have expected properties (206ms)
✔ pl: results list should have expected properties (287ms)
✔ pt: results list should have expected properties (3461ms)
✔ ru: results list should have expected properties (380ms)
✔ sco: results list should have expected properties (130ms)
✔ sv: results list should have expected properties (223ms)
✔ uk: results list should have expected properties (201ms)
✔ vi: results list should have expected properties (386ms)
onthisday
✔ all: unsupported language throws 404
✔ selected: unsupported language throws 404
✔ selected: fetches some results (457ms)
✔ births: unsupported language throws 404
✔ births: fetches some results (1845ms)
✔ deaths: unsupported language throws 404
✔ deaths: fetches some results (2909ms)
✔ events: unsupported language throws 404
✔ events: fetches some results (934ms)
✔ holidays: unsupported language throws 404
✔ holidays: fetches some results (1069ms)
✔ "all" fetches some results for births, deaths, events, holidays and selected (3011ms)
✔ verify contents in events (3262ms)
random/title
✔ pickBestResult should select best-scored title from sample
✔ redirects to the right format with random title - html (82ms)
✔ redirects to the right format with random title - invalid format
✔ returns 404 for yue.wikipedia.org
stopping test server
lib:announcements
✔ should return no announcement for inactive wiki
✔ should return one or more announcements for active wiki
lib:announcements:etc
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
.hasEnded
✔ invalid endTime
✔ endTime has passed
✔ endTime has not passed yet
announcements-unit-config
✔ all dates should be valid
MW core page HTML
✔ fetches the core page html output only with title in params
✔ fetches the core page html output with revision in params
featured-unit
✔ isSupported should return the correct boolean
✔ findPageTitle should find the first bold link: a inside b
✔ findPageTitle should find the first bold link: b inside a
✔ findPageTitle should return undefined if nothing found
featured-image-unit
✔ structureExtMetadataValue returns description for preferred lang if present
✔ structureExtMetadataValue falls back to en description if preferred lang not present
✔ structureExtMetadataValue returns lang undefined for type of value equals to string
✔ structureExtMetadataValue returns undefined for undefined input
news-unit
✔ news story constructed correctly (duplicate titles handled correctly)
✔ floating spans are removed
onthisday-unit
✔ eventsForYearListElements returns a WMFEvent for only year list elements
✔ Sort year list events in correct BC[E] aware manner
page title generation: titleForDayPageFromMonthDayNumberStrings
✔ 1 digit mm and 1 digit dd
✔ 0 padded mm and 1 digit dd
✔ 0 padded mm and 0 padded dd
day page URI generation: dayTitleForRequest
✔ returns expected title for 0 padded month and 2 digit day
✔ returns expected title for 2 digit month and 0 padded day
✔ returns expected title for 1 digit month and 1 digit day
selected page URI generation: selectedTitleForRequest
✔ returns expected title for 0 padded month and 2 digit day
✔ returns expected title for 2 digit month and 0 padded day
✔ returns expected title for 1 digit month and 1 digit day
anchor to WMFPage transforms: wmfPageFromAnchorElement
✔ WMFPage model object is correctly created from a topic anchor
✔ WMFPage model object is correctly created from a non-topic anchor
wmfEventFromListElement: WMFEvent model object is correctly created
✔ from a selected list element
✔ from a birth list element
✔ from an event list element
✔ from a death list element
✔ from a birth list element
✔ from a selected div element on zhwiki
✔ wmfEventFromListElement should return null for elements not describing events
wmfHolidayFromListElement: WMFHoliday model object is correctly created
✔ WMFHoliday model object is correctly created from a holiday list element
yearListElementRegEx
✔ rejects malformed BC strings
✔ accepts well formed BC strings
✔ accepts well formed BCE strings
✔ accepts well formed CE strings
✔ accepts well formed year strings (no BCE/AD/CE)
✔ accepts well formed AD strings
✔ extracts expected BC/BCE strings
✔ extracts expected BC/BCE strings in Chinese
✔ AD strings should not be negated
✔ rejects non year list strings
✔ rejects strings missing text
listElementsByHeadingID extracts expected number of births from
✔ DE fixture (49ms)
✔ EN fixture (50ms)
✔ AR fixture (48ms)
✔ BS fixture
nested list element handling
✔ listElementsByHeadingID extracts expected number of holidays from EN fixture
✔ expected textContent for a list item NOT nested within another list item
✔ expected textContent for a list item nested within another list item
✔ expected textContent for list items nested within a year-dash list item
✔ expected textContent for list items nested within a year list item (no dash)
addPrefixFromAncestorListElementsToListElement
✔ expected extraction from ancestor year element
✔ expected extraction from multiline ancestor year element
✔ expected extraction from ancestor year element with dash
✔ expected extraction from ancestor year element with dash space
✔ expected extraction from multiline ancestor year element with dash
✔ expected extraction from multiline non-year ancestor
✔ expected extraction from double-nested list element
✔ expected extraction from triple-nested list element
✔ expected extraction from nested Russian list element with "год"
✔ Prefixed text content from ancestor element is escaped
isAnchorForYear
✔ correctly identifies anchor linking to year article
✔ correctly rejects anchor linking article starting with a year
✔ correctly rejects anchor linking article starting with a number
✔ correctly rejects anchor linking article not starting with a year
✔ correctly identifies anchor linking to year article with an era string
✔ correctly identifies anchor linking to year article with era string w/o space
non-article urls should be excluded
✔ exclude external url from WMFHoliday pages
✔ exclude external url from WMFEvent pages
✔ exclude redlinks from WMFEvent pages
style tags should be dropped
✔ exclude style tags
random
✔ pickBestResult should select best-scored title from sample
util
✔ promiseAwaitAll, ignoreRejected
✔ promiseAwaitAll, propagate rejected
removeDuplicateTitles
✔ deduplicates and applies update function
296 passing (1m)
1 pending
--- end ---
{}
{}
{}
{}
{"1115490": {"source": 1115490, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<2.3.2"}, "1115492": {"source": 1115492, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": ">=4.0.0 <4.0.4"}, "1115493": {"source": 1115493, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<2.3.2"}, "1115495": {"source": 1115495, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <4.0.4"}}
Upgrading n:picomatch from 2.3.1, 4.0.3 -> 2.3.2, 4.0.4
{"1115369": {"source": 1115369, "name": "yaml", "dependency": "yaml", "title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections", "url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp", "severity": "moderate", "cwe": ["CWE-674"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <2.8.3"}}
Upgrading n:yaml from 2.8.1 -> 2.8.3
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating npm dependencies
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmpf5goyslm
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
/src/repo/.eslintrc.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/app.js
20:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
64:37 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
136:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
138:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
150:31 warning Found non-literal argument in require security/detect-non-literal-require
197:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
198:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
236:1 warning The type 'bluebird' is undefined jsdoc/no-undefined-types
/src/repo/etc/dyk-sites.js
19:5 warning Missing JSDoc @return declaration jsdoc/require-returns
/src/repo/etc/news-sites.js
4:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
5:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
6:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
50:1 warning Syntax error in type: {Object.<string, NewsSite>} jsdoc/valid-types
/src/repo/lib/announcements.js
30:1 warning Expected this semicolon to be at the end of the previous line semi-style
34:1 warning This line has a length of 123. Maximum allowed is 100 max-len
51:1 warning This line has a length of 134. Maximum allowed is 100 max-len
84:1 warning This line has a length of 119. Maximum allowed is 100 max-len
86:1 warning This line has a length of 118. Maximum allowed is 100 max-len
135:1 warning This line has a length of 123. Maximum allowed is 100 max-len
/src/repo/lib/api-util.js
296:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
/src/repo/lib/did-you-know.js
20:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
21:1 warning Missing JSDoc @param "lang" type jsdoc/require-param-type
41:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
42:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
82:12 warning 'si' is already declared in the upper scope on line 8 column 7 no-shadow
97:20 warning 'result' is already declared in the upper scope on line 88 column 19 no-shadow
/src/repo/lib/featured.js
136:12 warning 'si' is already declared in the upper scope on line 12 column 7 no-shadow
/src/repo/lib/imageinfo.js
30:1 warning The type 'Bool' is undefined jsdoc/no-undefined-types
85:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
132:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
203:43 warning Array.prototype.map() expects a return value from arrow function array-callback-return
280:1 warning Syntax error in type: [type] jsdoc/valid-types
282:1 warning Syntax error in type: [type] jsdoc/valid-types
/src/repo/lib/most-read.js
81:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
82:1 warning @public should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
83:1 warning @public should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
100:1 warning This line has a length of 122. Maximum allowed is 100 max-len
115:28 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
116:1 warning This line has a length of 112. Maximum allowed is 100 max-len
145:19 warning 'pageviews' is already declared in the upper scope on line 10 column 7 no-shadow
161:25 warning Array.prototype.map() expects a return value from arrow function array-callback-return
202:1 warning This line has a length of 148. Maximum allowed is 100 max-len
212:1 warning This line has a length of 113. Maximum allowed is 100 max-len
/src/repo/lib/news.js
15:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
73:12 warning 'si' is already declared in the upper scope on line 8 column 7 no-shadow
96:20 warning 'result' is already declared in the upper scope on line 80 column 19 no-shadow
/src/repo/lib/on-this-day.js
34:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
122:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
123:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
128:12 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
141:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
151:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
172:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
184:1 warning The type 'AnchorElement' is undefined jsdoc/no-undefined-types
207:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
253:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
270:1 warning The type 'Integer' is undefined jsdoc/no-undefined-types
309:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
320:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
321:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
342:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
360:1 warning The type 'ListElement' is undefined jsdoc/no-undefined-types
380:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
412:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
426:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
440:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
454:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
468:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
483:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
484:1 warning The type 'Document' is undefined jsdoc/no-undefined-types
543:1 warning Missing JSDoc @param "sendResponse" type jsdoc/require-param-type
/src/repo/lib/on-this-day.languages.js
28:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
30:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
32:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
60:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
62:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
64:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
100:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
102:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
104:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
128:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
130:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
132:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
156:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
158:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
160:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
189:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
191:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
193:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
217:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
219:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
221:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
245:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
247:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
249:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
273:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
275:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
277:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
301:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
303:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
305:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
335:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
337:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
339:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
362:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
364:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
366:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
390:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
392:11 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
418:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
420:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
422:13 warning Found non-literal argument to RegExp Constructor security/detect-non-literal-regexp
/src/repo/lib/pageviews.js
36:1 warning At most one access-control tag may be present on a JSDoc block jsdoc/check-access
37:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
38:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
39:1 warning @private should not have a bracketed type in "jsdoc" mode jsdoc/valid-types
53:1 warning The type 'Platform' is undefined jsdoc/no-undefined-types
54:1 warning The type 'Agent' is undefined jsdoc/no-undefined-types
56:1 warning The type 'Granularity' is undefined jsdoc/no-undefined-types
71:1 warning The type 'Platform' is undefined jsdoc/no-undefined-types
/src/repo/lib/random.js
38:9 warning 'score' is already declared in the upper scope on line 31 column 10 no-shadow
55:1 warning Missing JSDoc @param "scoredResults" type jsdoc/require-param-type
/src/repo/lib/siteinfo.js
3:1 warning Use the global form of 'use strict' strict
10:29 warning Unsafe Regular Expression security/detect-unsafe-regex
/src/repo/lib/util.js
104:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
142:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
222:1 warning The type 'Router' is undefined jsdoc/no-undefined-types
280:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
293:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
306:1 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
378:1 warning The type 'Application' is undefined jsdoc/no-undefined-types
450:34 warning Default parameters should be last default-param-last
/src/repo/package-lock.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/package.json
1:1 warning Use the global form of 'use strict' strict
/src/repo/scripts/check-featured-feed.js
49:35 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
82:44 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
107:34 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
150:30 warning 'feature' is already declared in the upper scope on line 212 column 7 no-shadow
217:5 warning Don't use process.exit(); throw an error instead n/no-process-exit
/src/repo/spec.yaml
228:1 warning This line has a length of 154. Maximum allowed is 100 max-len
232:1 warning This line has a length of 141. Maximum allowed is 100 max-len
866:1 warning This line has a length of 117. Maximum allowed is 100 max-len
871:1 warning This line has a length of 116. Maximum allowed is 100 max-len
876:1 warning This line has a length of 116. Maximum allowed is 100 max-len
881:1 warning This line has a length of 116. Maximum allowed is 100 max-len
886:1 warning This line has a length of 116. Maximum allowed is 100 max-len
938:1 warning This line has a length of 108. Maximum allowed is 100 max-len
955:1 warning This line has a length of 126. Maximum allowed is 100 max-len
956:1 warning This line has a length of 107. Maximum allowed is 100 max-len
962:1 warning This line has a length of 132. Maximum allowed is 100 max-len
969:1 warning This line has a length of 127. Maximum allowed is 100 max-len
971:1 warning This line has a length of 108. Maximum allowed is 100 max-len
972:1 warning This line has a length of 113. Maximum allowed is 100 max-len
973:1 warning This line has a length of 121. Maximum allowed is 100 max-len
977:1 warning This line has a length of 121. Maximum allowed is 100 max-len
981:1 warning This line has a length of 113. Maximum allowed is 100 max-len
985:1 warning This line has a length of 111. Maximum allowed is 100 max-len
991:1 warning This line has a length of 124. Maximum allowed is 100 max-len
995:1 warning This line has a length of 281. Maximum allowed is 100 max-len
1082:1 warning This line has a length of 144. Maximum allowed is 100 max-len
✖ 161 problems (0 errors, 161 warnings)
aggregated featured
starting test server
✔ should return 200 for a valid request (987ms)
✔ should return 404 for an invalid year
✔ should return 404 for an invalid month
✔ should return 404 for an invalid day
✔ should return only historic keys for past date (634ms)
✔ should return current keys for today (665ms)
✔ should return future keys for tomorrow (376ms)
aggregate onthisday
✔ should return 200 for a valid request (5334ms)
✔ should return 404 for an invalid month (115ms)
✔ should return 404 for an invalid day (120ms)
✔ should return objects with the expected keys (3682ms)
express app
✔ should get robots.txt
✔ should set CORS headers
✔ should set CSP headers
✔ should get static content gzipped
✔ should get static content uncompressed
Swagger spec
✔ get the spec
✔ spec validation
validate responses against schema
- random response should conform to schema
✔ featured article response should conform to schema (258ms)
✔ featured image response should conform to schema (185ms)
✔ most-read response should conform to schema (338ms)
✔ news response should conform to schema (146ms)
✔ announcements should conform to schema
✔ onthisday response should conform to schema (3877ms)
✔ featured article response should conform to schema (invalid lang, agg=true)
✔ featured image response should conform to schema (invalid date, agg=true)
✔ most-read response should conform to schema (invalid date, agg=true)
✔ news response (invalid language, agg=true) should be empty
strict mode: missing type "object" for keyword "required" at "#/definitions/problem#" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "#/definitions/problem#" (strictTypes)
✔ featured article request should fail for invalid language when !agg=true
✔ featured image request should fail for invalid date when !agg=true
✔ most-read request should fail for invalid date when !agg=true
✔ news request should fail for invalid language when !agg=true
validate spec examples
✔ spec from root
✔ retrieve service info
✔ Retrieve feed content availability from \'wikipedia.org\'
✔ Retrieve announcements
✔ retrieve selected events on January 15 (300ms)
✔ retrieve title of the featured article for April 29, 2016 (156ms)
✔ retrieve featured article info for unsupported site (with aggregated=true)
✔ retrieve featured image data for April 29, 2016 (198ms)
✔ retrieve the most read articles for January 1, 2016 (313ms)
✔ retrieve the most-read articles for January 1, 2016 (with aggregated=true) (241ms)
✔ retrieve most-read articles for date with no data (with aggregated=true)
✔ get 'In the News' content (61ms)
✔ get "In the News" content for unsupported language (with aggregated=true)
✔ retrieve a random article title (100ms)
did-you-know
✔ ar: results list should have expected properties (174ms)
✔ de: results list should have expected properties (128ms)
✔ en: results list should have expected properties (80ms)
✔ hi: results list should have expected properties (179ms)
✔ pt: results list should have expected properties (91ms)
✔ ru: results list should have expected properties (186ms)
✔ uk: results list should have expected properties (119ms)
featured
✔ incomplete date should return 404
✔ extra uri path parameter after date should return 404
✔ Missing TFA should return 204 (236ms)
✔ Missing TFA with aggregated=true should return 204 (652ms)
✔ featured article of an old date should return 404
featured-image-lang
✔ bg description (346ms)
✔ bn description (257ms)
✔ bs description (335ms)
✔ cs description (316ms)
✔ de description (181ms)
✔ el description (309ms)
✔ en description (213ms)
✔ fa description (234ms)
✔ he description (310ms)
✔ hu description (275ms)
✔ it description (301ms)
✔ ja description (296ms)
✔ la description (272ms)
✔ no description (335ms)
✔ sco description (250ms)
✔ sd description (297ms)
✔ sv description (345ms)
✔ tr description (317ms)
✔ ur description (337ms)
✔ vi description (385ms)
✔ zh description (299ms)
featured-image
✔ incomplete date should return 404
✔ extra uri path parameter after date should return 404
service information
✔ should get the service name
✔ should get the service version
✔ should redirect to the service home page
✔ should get the service info
most-read articles
✔ Should provide pageviews from day prior when aggregated flag is set (480ms)
✔ Should drop duplicate pageviews (283ms)
✔ Should filter out missing summaries (427ms)
✔ Should return 204 for fywiki requests
✔ main page filtering RegExp should handle all main page title chars
✔ Should filter out blocked titles from some languages, but not others
✔ Should filter out certain blocked titles from all wikis
most-read articles
✔ Should return 200 even if title has invalid utf8 encoding (314ms)
✔ Should filter-out invalid utf8 encoding
news headline selectors
✔ test news headlines should be general not categorical
✔ test news headline topics should be nonnull
✔ bs news headlines should be general not categorical
✔ bs news headline topics should be nonnull
✔ da news headlines should be general not categorical
✔ da news headline topics should be nonnull
✔ de news headlines should be general not categorical
✔ de news headline topics should be nonnull
✔ el news headlines should be general not categorical
✔ el news headline topics should be nonnull
✔ en news headlines should be general not categorical
✔ en news headline topics should be nonnull
✔ es news headlines should be general not categorical
✔ es news headline topics should be nonnull
✔ fi news headlines should be general not categorical
✔ fi news headline topics should be nonnull
✔ fr news headlines should be general not categorical
✔ fr news headline topics should be nonnull
✔ he news headlines should be general not categorical
✔ he news headline topics should be nonnull
✔ ko news headlines should be general not categorical
✔ ko news headline topics should be nonnull
✔ no news headlines should be general not categorical
✔ no news headline topics should be nonnull
✔ pl news headlines should be general not categorical
✔ pl news headline topics should be nonnull
✔ pt news headlines should be general not categorical
✔ pt news headline topics should be nonnull
✔ ru news headlines should be general not categorical
✔ ru news headline topics should be nonnull
✔ sco news headlines should be general not categorical
✔ sco news headline topics should be nonnull
✔ sv news headlines should be general not categorical
✔ sv news headline topics should be nonnull
✔ uk news headlines should be general not categorical
✔ uk news headline topics should be nonnull
✔ vi news headlines should be general not categorical
✔ vi news headline topics should be nonnull
✔ news headline topic should be the first bold link
✔ news headline topic should be the first link when no link is bolded
news
✔ test: results list should have expected properties (183ms)
✔ bs: results list should have expected properties (169ms)
✔ da: results list should have expected properties (133ms)
✔ de: results list should have expected properties (68ms)
✔ el: results list should have expected properties (134ms)
✔ en: results list should have expected properties (125ms)
✔ es: results list should have expected properties (119ms)
✔ fi: results list should have expected properties (290ms)
✔ fr: results list should have expected properties (322ms)
✔ he: results list should have expected properties (179ms)
✔ ko: results list should have expected properties (283ms)
✔ no: results list should have expected properties (106ms)
✔ pl: results list should have expected properties (180ms)
✔ pt: results list should have expected properties (2879ms)
✔ ru: results list should have expected properties (202ms)
✔ sco: results list should have expected properties (148ms)
✔ sv: results list should have expected properties (107ms)
✔ uk: results list should have expected properties (184ms)
✔ vi: results list should have expected properties (214ms)
onthisday
✔ all: unsupported language throws 404
✔ selected: unsupported language throws 404
✔ selected: fetches some results (333ms)
✔ births: unsupported language throws 404
✔ births: fetches some results (2572ms)
✔ deaths: unsupported language throws 404
✔ deaths: fetches some results (847ms)
✔ events: unsupported language throws 404
✔ events: fetches some results (1015ms)
✔ holidays: unsupported language throws 404
✔ holidays: fetches some results (348ms)
✔ "all" fetches some results for births, deaths, events, holidays and selected (3424ms)
✔ verify contents in events (3015ms)
random/title
✔ pickBestResult should select best-scored title from sample
✔ redirects to the right format with random title - html (94ms)
✔ redirects to the right format with random title - invalid format
✔ returns 404 for yue.wikipedia.org
stopping test server
lib:announcements
✔ should return no announcement for inactive wiki
✔ should return one or more announcements for active wiki
lib:announcements:etc
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ should return no image_url
✔ should return correct type
✔ countries is an array of strings
✔ should not deliver HTML in certain legacy iOS announcements fields
✔ iOS legacy fundraising announcement should have the proper platform ID
✔ iOS fundraising announcement should have the proper platform ID
✔ should deliver HTML in certain V2 announcements fields
✔ caption_HTML on iOS should be inside a paragraph
✔ caption_HTML on Android should not be inside a paragraph
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
✔ buildId should not return lower case characters
.hasEnded
✔ invalid endTime
✔ endTime has passed
✔ endTime has not passed yet
announcements-unit-config
✔ all dates should be valid
MW core page HTML
✔ fetches the core page html output only with title in params
✔ fetches the core page html output with revision in params
featured-unit
✔ isSupported should return the correct boolean
✔ findPageTitle should find the first bold link: a inside b
✔ findPageTitle should find the first bold link: b inside a
✔ findPageTitle should return undefined if nothing found
featured-image-unit
✔ structureExtMetadataValue returns description for preferred lang if present
✔ structureExtMetadataValue falls back to en description if preferred lang not present
✔ structureExtMetadataValue returns lang undefined for type of value equals to string
✔ structureExtMetadataValue returns undefined for undefined input
news-unit
✔ news story constructed correctly (duplicate titles handled correctly)
✔ floating spans are removed
onthisday-unit
✔ eventsForYearListElements returns a WMFEvent for only year list elements
✔ Sort year list events in correct BC[E] aware manner
page title generation: titleForDayPageFromMonthDayNumberStrings
✔ 1 digit mm and 1 digit dd
✔ 0 padded mm and 1 digit dd
✔ 0 padded mm and 0 padded dd
day page URI generation: dayTitleForRequest
✔ returns expected title for 0 padded month and 2 digit day
✔ returns expected title for 2 digit month and 0 padded day
✔ returns expected title for 1 digit month and 1 digit day
selected page URI generation: selectedTitleForRequest
✔ returns expected title for 0 padded month and 2 digit day
✔ returns expected title for 2 digit month and 0 padded day
✔ returns expected title for 1 digit month and 1 digit day
anchor to WMFPage transforms: wmfPageFromAnchorElement
✔ WMFPage model object is correctly created from a topic anchor
✔ WMFPage model object is correctly created from a non-topic anchor
wmfEventFromListElement: WMFEvent model object is correctly created
✔ from a selected list element
✔ from a birth list element
✔ from an event list element
✔ from a death list element
✔ from a birth list element
✔ from a selected div element on zhwiki
✔ wmfEventFromListElement should return null for elements not describing events
wmfHolidayFromListElement: WMFHoliday model object is correctly created
✔ WMFHoliday model object is correctly created from a holiday list element
yearListElementRegEx
✔ rejects malformed BC strings
✔ accepts well formed BC strings
✔ accepts well formed BCE strings
✔ accepts well formed CE strings
✔ accepts well formed year strings (no BCE/AD/CE)
✔ accepts well formed AD strings
✔ extracts expected BC/BCE strings
✔ extracts expected BC/BCE strings in Chinese
✔ AD strings should not be negated
✔ rejects non year list strings
✔ rejects strings missing text
listElementsByHeadingID extracts expected number of births from
✔ DE fixture (69ms)
✔ EN fixture (61ms)
✔ AR fixture (51ms)
✔ BS fixture
nested list element handling
✔ listElementsByHeadingID extracts expected number of holidays from EN fixture
✔ expected textContent for a list item NOT nested within another list item
✔ expected textContent for a list item nested within another list item
✔ expected textContent for list items nested within a year-dash list item
✔ expected textContent for list items nested within a year list item (no dash)
addPrefixFromAncestorListElementsToListElement
✔ expected extraction from ancestor year element
✔ expected extraction from multiline ancestor year element
✔ expected extraction from ancestor year element with dash
✔ expected extraction from ancestor year element with dash space
✔ expected extraction from multiline ancestor year element with dash
✔ expected extraction from multiline non-year ancestor
✔ expected extraction from double-nested list element
✔ expected extraction from triple-nested list element
✔ expected extraction from nested Russian list element with "год"
✔ Prefixed text content from ancestor element is escaped
isAnchorForYear
✔ correctly identifies anchor linking to year article
✔ correctly rejects anchor linking article starting with a year
✔ correctly rejects anchor linking article starting with a number
✔ correctly rejects anchor linking article not starting with a year
✔ correctly identifies anchor linking to year article with an era string
✔ correctly identifies anchor linking to year article with era string w/o space
non-article urls should be excluded
✔ exclude external url from WMFHoliday pages
✔ exclude external url from WMFEvent pages
✔ exclude redlinks from WMFEvent pages
style tags should be dropped
✔ exclude style tags
random
✔ pickBestResult should select best-scored title from sample
util
✔ promiseAwaitAll, ignoreRejected
✔ promiseAwaitAll, propagate rejected
removeDuplicateTitles
✔ deduplicates and applies update function
296 passing (47s)
1 pending
--- stdout ---
[master 8734a5c] build: Updating npm dependencies
1 file changed, 27 insertions(+), 24 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 8734a5c90be7c783a714d147fbd36fc88f8211cf Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Mar 2026 13:08:55 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
Change-Id: I61031f3412697025b16659e3e797dfe8f777de9b
---
package-lock.json | 51 +++++++++++++++++++++++++----------------------
1 file changed, 27 insertions(+), 24 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 8444317..4ce06d6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -854,9 +854,9 @@
}
},
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -1128,9 +1128,9 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -1594,9 +1594,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"devOptional": true,
"dependencies": {
"balanced-match": "^1.0.0",
@@ -3681,9 +3681,9 @@
}
},
"node_modules/glob/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -4861,9 +4861,9 @@
"dev": true
},
"node_modules/mocha/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -5580,9 +5580,9 @@
"dev": true
},
"node_modules/picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true,
"engines": {
"node": ">=8.6"
@@ -7102,9 +7102,9 @@
}
},
"node_modules/ts-declaration-location/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -7554,15 +7554,18 @@
"integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
},
"node_modules/yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true,
"bin": {
"yaml": "bin.mjs"
},
"engines": {
"node": ">= 14.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/eemeli"
}
},
"node_modules/yaml-eslint-parser": {
--
2.47.3
--- end ---