This run took 59 seconds.
From 758651059c18df6ad185198f1e0da2045c8ee5ce Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Mar 2026 18:44:09 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
* https://github.com/advisories/GHSA-f886-m6hf-6m8v
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
Change-Id: Ib3addc4e66c53e5b805f04baa66f806fd688a921
---
package-lock.json | 75 ++++++++++++++++++++++++-----------------------
1 file changed, 39 insertions(+), 36 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index ca46f3e..8125ec5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -452,9 +452,9 @@
}
},
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -709,9 +709,9 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -1015,9 +1015,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0",
@@ -4357,9 +4357,9 @@
"dev": true
},
"node_modules/picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true,
"engines": {
"node": ">=8.6"
@@ -5688,9 +5688,9 @@
}
},
"node_modules/ts-declaration-location/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -5972,15 +5972,18 @@
}
},
"node_modules/yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true,
"bin": {
"yaml": "bin.mjs"
},
"engines": {
"node": ">= 14.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/eemeli"
}
},
"node_modules/yaml-eslint-parser": {
@@ -6322,9 +6325,9 @@
}
},
"picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true
}
}
@@ -6484,9 +6487,9 @@
},
"dependencies": {
"brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0"
@@ -6710,9 +6713,9 @@
"dev": true
},
"brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0",
@@ -9152,9 +9155,9 @@
"dev": true
},
"picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true
},
"pluralize": {
@@ -10063,9 +10066,9 @@
},
"dependencies": {
"picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true
}
}
@@ -10257,9 +10260,9 @@
"dev": true
},
"yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true
},
"yaml-eslint-parser": {
--
2.47.3
$ date
--- stdout ---
Fri Mar 27 18:43:25 UTC 2026
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-Flow.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
55dac2918e57f8caff5dfbdfcdd16de123036be9 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115496,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.1.13"
},
{
"source": 1115497,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.3"
}
],
"effects": [],
"range": "<1.1.13 || >=2.0.0 <2.0.3",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"gaze": {
"name": "gaze",
"severity": "high",
"isDirect": false,
"via": [
"globule"
],
"effects": [
"grunt-contrib-watch"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/gaze"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"globule": {
"name": "globule",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"gaze"
],
"range": "*",
"nodes": [
"node_modules/globule"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-contrib-watch": {
"name": "grunt-contrib-watch",
"severity": "high",
"isDirect": true,
"via": [
"gaze"
],
"effects": [],
"range": ">=0.5.0",
"nodes": [
"node_modules/grunt-contrib-watch"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"globule",
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/globule/node_modules/minimatch",
"node_modules/grunt/node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/picomatch",
"node_modules/ts-declaration-location/node_modules/picomatch"
],
"fixAvailable": true
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 2,
"high": 7,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 494,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 494
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 40 installs, 0 updates, 0 removals
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (3.0.5)
- Locking danog/advanced-json-rpc (v3.2.3)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
- Locking doctrine/deprecations (1.1.6)
- Locking mediawiki/mediawiki-codesniffer (v50.0.0)
- Locking mediawiki/mediawiki-phan-config (0.20.0)
- Locking mediawiki/minus-x (2.0.1)
- Locking mediawiki/phan-taint-check-plugin (9.1.0)
- Locking netresearch/jsonmapper (v5.0.1)
- Locking phan/phan (6.0.2)
- Locking phan/tolerant-php-parser (v0.2.0)
- Locking phan/var_representation_polyfill (0.1.4)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.4.0)
- Locking phpcsstandards/phpcsutils (1.2.2)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (6.0.3)
- Locking phpdocumentor/type-resolver (2.0.0)
- Locking phpstan/phpdoc-parser (2.3.2)
- Locking pimple/pimple (v3.6.2)
- Locking psr/container (2.0.2)
- Locking psr/log (3.0.2)
- Locking sabre/event (6.0.1)
- Locking squizlabs/php_codesniffer (3.13.5)
- Locking symfony/console (v8.0.7)
- Locking symfony/css-selector (v2.8.52)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/dom-crawler (v2.8.52)
- Locking symfony/polyfill-ctype (v1.33.0)
- Locking symfony/polyfill-intl-grapheme (v1.33.0)
- Locking symfony/polyfill-intl-normalizer (v1.33.0)
- Locking symfony/polyfill-mbstring (v1.33.0)
- Locking symfony/service-contracts (v3.6.1)
- Locking symfony/string (v8.0.6)
- Locking webmozart/assert (2.1.6)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 40 installs, 0 updates, 0 removals
- Downloading pimple/pimple (v3.6.2)
- Downloading symfony/css-selector (v2.8.52)
- Downloading symfony/dom-crawler (v2.8.52)
0/3 [>---------------------------] 0%
1/3 [=========>------------------] 33%
3/3 [============================] 100%
- Installing squizlabs/php_codesniffer (3.13.5): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing phpcsstandards/phpcsutils (1.2.2): Extracting archive
- Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
- Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v50.0.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
- Installing symfony/string (v8.0.6): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.1): Extracting archive
- Installing symfony/console (v8.0.7): Extracting archive
- Installing sabre/event (6.0.1): Extracting archive
- Installing phan/var_representation_polyfill (0.1.4): Extracting archive
- Installing phan/tolerant-php-parser (v0.2.0): Extracting archive
- Installing netresearch/jsonmapper (v5.0.1): Extracting archive
- Installing webmozart/assert (2.1.6): Extracting archive
- Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.6): Extracting archive
- Installing phpdocumentor/type-resolver (2.0.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (6.0.3): Extracting archive
- Installing danog/advanced-json-rpc (v3.2.3): Extracting archive
- Installing psr/log (3.0.2): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (6.0.2): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (9.1.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.20.0): Extracting archive
- Installing mediawiki/minus-x (2.0.1): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
- Installing pimple/pimple (v3.6.2): Extracting archive
- Installing symfony/css-selector (v2.8.52): Extracting archive
- Installing symfony/dom-crawler (v2.8.52): Extracting archive
0/38 [>---------------------------] 0%
28/38 [====================>-------] 73%
37/38 [===========================>] 97%
38/38 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
16 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115496,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.1.13"
},
{
"source": 1115497,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.3"
}
],
"effects": [],
"range": "<1.1.13 || >=2.0.0 <2.0.3",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"gaze": {
"name": "gaze",
"severity": "high",
"isDirect": false,
"via": [
"globule"
],
"effects": [
"grunt-contrib-watch"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/gaze"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"globule": {
"name": "globule",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"gaze"
],
"range": "*",
"nodes": [
"node_modules/globule"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-contrib-watch": {
"name": "grunt-contrib-watch",
"severity": "high",
"isDirect": true,
"via": [
"gaze"
],
"effects": [],
"range": ">=0.5.0",
"nodes": [
"node_modules/grunt-contrib-watch"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"globule",
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/globule/node_modules/minimatch",
"node_modules/grunt/node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/picomatch",
"node_modules/ts-declaration-location/node_modules/picomatch"
],
"fixAvailable": true
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 2,
"high": 7,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 494,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 494
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 494,
"removed": 0,
"changed": 0,
"audited": 495,
"funding": 119,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115496,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.1.13"
},
{
"source": 1115497,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.3"
}
],
"effects": [],
"range": "<1.1.13 || >=2.0.0 <2.0.3",
"nodes": [
"",
""
],
"fixAvailable": true
},
"gaze": {
"name": "gaze",
"severity": "high",
"isDirect": false,
"via": [
"globule"
],
"effects": [
"grunt-contrib-watch"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/gaze"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"globule": {
"name": "globule",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"gaze"
],
"range": "*",
"nodes": [
"node_modules/globule"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"minimatch"
],
"effects": [
"grunt-eslint"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"grunt-contrib-watch": {
"name": "grunt-contrib-watch",
"severity": "high",
"isDirect": true,
"via": [
"gaze"
],
"effects": [],
"range": ">=0.5.0",
"nodes": [
"node_modules/grunt-contrib-watch"
],
"fixAvailable": {
"name": "grunt-contrib-watch",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"globule",
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/globule/node_modules/minimatch",
"node_modules/grunt/node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt",
"version": "0.3.17",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115490,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115492,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115493,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115495,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"",
"",
""
],
"fixAvailable": true
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115369,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 2,
"high": 7,
"critical": 0,
"total": 9
},
"dependencies": {
"prod": 1,
"dev": 494,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 494
}
}
}
}
--- end ---
{"added": 494, "removed": 0, "changed": 0, "audited": 495, "funding": 119, "audit": {"auditReportVersion": 2, "vulnerabilities": {"brace-expansion": {"name": "brace-expansion", "severity": "moderate", "isDirect": false, "via": [{"source": 1115496, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<1.1.13"}, {"source": 1115497, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.3"}], "effects": [], "range": "<1.1.13 || >=2.0.0 <2.0.3", "nodes": ["", ""], "fixAvailable": true}, "gaze": {"name": "gaze", "severity": "high", "isDirect": false, "via": ["globule"], "effects": ["grunt-contrib-watch"], "range": ">=0.4.0", "nodes": ["node_modules/gaze"], "fixAvailable": {"name": "grunt-contrib-watch", "version": "0.4.4", "isSemVerMajor": true}}, "globule": {"name": "globule", "severity": "high", "isDirect": false, "via": ["minimatch"], "effects": ["gaze"], "range": "*", "nodes": ["node_modules/globule"], "fixAvailable": {"name": "grunt-contrib-watch", "version": "0.4.4", "isSemVerMajor": true}}, "grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": ["minimatch"], "effects": ["grunt-eslint"], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "grunt-contrib-watch": {"name": "grunt-contrib-watch", "severity": "high", "isDirect": true, "via": ["gaze"], "effects": [], "range": ">=0.5.0", "nodes": ["node_modules/grunt-contrib-watch"], "fixAvailable": {"name": "grunt-contrib-watch", "version": "0.4.4", "isSemVerMajor": true}}, "grunt-eslint": {"name": "grunt-eslint", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": "<=1.0.0 || >=18.1.0", "nodes": ["node_modules/grunt-eslint"], "fixAvailable": {"name": "grunt-eslint", "version": "18.0.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.3"}, {"source": 1113538, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": ["CWE-407"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.3"}, {"source": 1113546, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.4"}], "effects": ["globule", "grunt"], "range": "<=3.1.3", "nodes": ["node_modules/globule/node_modules/minimatch", "node_modules/grunt/node_modules/minimatch"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "picomatch": {"name": "picomatch", "severity": "high", "isDirect": false, "via": [{"source": 1115490, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<2.3.2"}, {"source": 1115492, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": ">=4.0.0 <4.0.4"}, {"source": 1115493, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<2.3.2"}, {"source": 1115495, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <4.0.4"}], "effects": [], "range": "<=2.3.1 || 4.0.0 - 4.0.3", "nodes": ["", "", ""], "fixAvailable": true}, "yaml": {"name": "yaml", "severity": "moderate", "isDirect": false, "via": [{"source": 1115369, "name": "yaml", "dependency": "yaml", "title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections", "url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp", "severity": "moderate", "cwe": ["CWE-674"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <2.8.3"}], "effects": [], "range": "2.0.0 - 2.8.2", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 2, "high": 7, "critical": 0, "total": 9}, "dependencies": {"prod": 1, "dev": 494, "optional": 0, "peer": 1, "peerOptional": 0, "total": 494}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 494 packages, and audited 495 packages in 5s
119 packages are looking for funding
run `npm fund` for details
# npm audit report
minimatch <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix --force`
Will install grunt@0.3.17, which is a breaking change
node_modules/globule/node_modules/minimatch
node_modules/grunt/node_modules/minimatch
globule *
Depends on vulnerable versions of minimatch
node_modules/globule
gaze >=0.4.0
Depends on vulnerable versions of globule
node_modules/gaze
grunt-contrib-watch >=0.5.0
Depends on vulnerable versions of gaze
node_modules/grunt-contrib-watch
grunt >=0.4.0-a
Depends on vulnerable versions of minimatch
node_modules/grunt
grunt-eslint <=1.0.0 || >=18.1.0
Depends on vulnerable versions of grunt
node_modules/grunt-eslint
6 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 494 packages, and audited 495 packages in 7s
119 packages are looking for funding
run `npm fund` for details
6 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stdout ---
> flow@0.0.0 test
> grunt test
Running "tyops:src" (tyops) task
>> No typos found; 963 files checked for 13 typos.
Running "eslint:all" (eslint) task
/src/repo/modules/editor/editors/visualeditor/mw.flow.ve.Target.js
104:4 warning 'sessionState' is never reassigned. Use 'const' instead prefer-const
116:3 warning 'doc' is never reassigned. Use 'const' instead prefer-const
148:3 warning 'newMode' is never reassigned. Use 'const' instead prefer-const
149:3 warning 'oldFormat' is never reassigned. Use 'const' instead prefer-const
150:3 warning 'newFormat' is never reassigned. Use 'const' instead prefer-const
151:3 warning 'doc' is never reassigned. Use 'const' instead prefer-const
153:3 warning 'content' is never reassigned. Use 'const' instead prefer-const
157:3 warning Prefer .then to .fail no-jquery/no-done-fail
167:4 warning 'surfaceModel' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/editor/editors/visualeditor/mw.flow.ve.UserCache.js
52:23 warning 'newData' is never reassigned. Use 'const' instead prefer-const
86:15 warning 'cacheData' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/editor/editors/visualeditor/ui/inspectors/mw.flow.ve.ui.MentionInspector.js
66:3 warning 'key' is never reassigned. Use 'const' instead prefer-const
67:3 warning 'value' is never reassigned. Use 'const' instead prefer-const
68:3 warning 'inspector' is never reassigned. Use 'const' instead prefer-const
71:3 warning Prefer .then to .done no-jquery/no-done-fail
101:3 warning 'key' is never reassigned. Use 'const' instead prefer-const
107:3 warning 'templateModel' is never reassigned. Use 'const' instead prefer-const
142:4 warning Prefer .then to .done no-jquery/no-done-fail
167:3 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
172:3 warning 'overlay' is never reassigned. Use 'const' instead prefer-const
177:3 warning 'iconWidget' is never reassigned. Use 'const' instead prefer-const
200:4 warning 'surfaceModel' is never reassigned. Use 'const' instead prefer-const
206:4 warning Prefer .then to .done no-jquery/no-done-fail
260:3 warning 'errorText' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/editor/editors/visualeditor/ui/widgets/mw.flow.ve.ui.MentionTargetInputWidget.js
20:4 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
27:41 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
85:4 warning 'widget' is never reassigned. Use 'const' instead prefer-const
86:4 warning 'value' is never reassigned. Use 'const' instead prefer-const
94:3 warning 'xhr' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/board/base/flow-board-api-events.js
10:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
62:10 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
107:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
108:4 warning 'dfd' is never reassigned. Use 'const' instead prefer-const
115:3 warning '$rendered' is never reassigned. Use 'const' instead prefer-const
163:4 warning '$target' is never reassigned. Use 'const' instead prefer-const
164:4 warning '$tooltipTarget' is never reassigned. Use 'const' instead prefer-const
165:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
167:4 warning 'url' is never reassigned. Use 'const' instead prefer-const
168:4 warning 'links' is never reassigned. Use 'const' instead prefer-const
193:3 warning '$newLink' is never reassigned. Use 'const' instead prefer-const
230:4 warning '$target' is never reassigned. Use 'const' instead prefer-const
235:4 warning '$replacement' is never reassigned. Use 'const' instead prefer-const
257:4 warning '$replacement' is never reassigned. Use 'const' instead prefer-const
262:4 warning '$target' is never reassigned. Use 'const' instead prefer-const
275:2 warning Found more than one @return declaration jsdoc/require-returns
275:2 warning Found more than one @return declaration jsdoc/require-returns-check
289:5 warning '$this' is never reassigned. Use 'const' instead prefer-const
296:4 warning '$form' is never reassigned. Use 'const' instead prefer-const
297:4 warning 'revisionId' is never reassigned. Use 'const' instead prefer-const
298:4 warning '$target' is never reassigned. Use 'const' instead prefer-const
299:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
302:11 warning Prefer .then to .done no-jquery/no-done-fail
302:11 warning Prefer .then to .done no-jquery/no-done-fail
324:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
327:10 warning Prefer .then to .done no-jquery/no-done-fail
327:10 warning Prefer .then to .fail no-jquery/no-done-fail
/src/repo/modules/engine/components/board/base/flow-board-interactive-events.js
9:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
/src/repo/modules/engine/components/board/base/flow-board-load-events.js
9:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
/src/repo/modules/engine/components/board/base/flow-boardandhistory-base.js
66:4 warning '$this' is never reassigned. Use 'const' instead prefer-const
67:4 warning 'flowComponent' is never reassigned. Use 'const' instead prefer-const
70:4 warning 'role' is never reassigned. Use 'const' instead prefer-const
71:4 warning 'template' is never reassigned. Use 'const' instead prefer-const
72:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
79:4 warning '$deferred' is never reassigned. Use 'const' instead prefer-const
100:3 warning '$form' is never reassigned. Use 'const' instead prefer-const
118:7 warning 'target' is never reassigned. Use 'const' instead prefer-const
119:4 warning '$form' is never reassigned. Use 'const' instead prefer-const
120:4 warning 'flowComponent' is never reassigned. Use 'const' instead prefer-const
121:4 warning '$fields' is never reassigned. Use 'const' instead prefer-const
123:4 warning '$deferred' is never reassigned. Use 'const' instead prefer-const
124:4 warning 'callbacks' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/board/features/flow-board-loadmore.js
51:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
53:4 warning '_scrollWithoutInfinite' is never reassigned. Use 'const' instead prefer-const
100:3 warning 'apiParameters' is never reassigned. Use 'const' instead prefer-const
119:3 warning Prefer .then to .done no-jquery/no-done-fail
119:3 warning Prefer .then to .fail no-jquery/no-done-fail
221:4 warning '$this' is never reassigned. Use 'const' instead prefer-const
222:4 warning '$target' is never reassigned. Use 'const' instead prefer-const
223:4 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
230:3 warning 'scrollTarget' is never reassigned. Use 'const' instead prefer-const
231:3 warning '$scrollContainer' is never reassigned. Use 'const' instead prefer-const
232:3 warning 'topicsData' is never reassigned. Use 'const' instead prefer-const
294:7 warning 'scrollTargetSelector' is never reassigned. Use 'const' instead prefer-const
296:4 warning 'scrollContainerSelector' is never reassigned. Use 'const' instead prefer-const
297:4 warning '$scrollContainer' is never reassigned. Use 'const' instead prefer-const
298:4 warning 'board' is never reassigned. Use 'const' instead prefer-const
357:43 warning '$topic' is already declared in the upper scope on line 348 column 62 no-shadow
369:2 warning Found more than one @return declaration jsdoc/require-returns
369:2 warning Found more than one @return declaration jsdoc/require-returns-check
440:3 warning 'calculationContainerHeight' is never reassigned. Use 'const' instead prefer-const
441:3 warning 'calculationContainerScroll' is never reassigned. Use 'const' instead prefer-const
482:4 warning 'toInsert' is never reassigned. Use 'const' instead prefer-const
547:8 warning 'rootsBackup' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/board/features/flow-board-navigation.js
11:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
/src/repo/modules/engine/components/board/features/flow-board-side-rail.js
9:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
/src/repo/modules/engine/components/board/features/flow-board-visualeditor.js
9:1 warning The type 'FlowBoardComponent' is undefined jsdoc/no-undefined-types
24:7 warning '$topic' is never reassigned. Use 'const' instead prefer-const
28:3 warning 'duplicatedArray' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/board/flow-board.js
13:1 warning The type 'FlowBoardAndHistoryComponentBase' is undefined jsdoc/no-undefined-types
14:1 warning The type 'FlowComponentEventsMixin' is undefined jsdoc/no-undefined-types
15:1 warning The type 'FlowComponentEnginesMixin' is undefined jsdoc/no-undefined-types
16:1 warning The type 'FlowBoardComponentApiEventsMixin' is undefined jsdoc/no-undefined-types
17:1 warning The type 'FlowBoardComponentInteractiveEventsMixin' is undefined jsdoc/no-undefined-types
18:1 warning The type 'FlowBoardComponentLoadEventsMixin' is undefined jsdoc/no-undefined-types
19:1 warning The type 'FlowBoardComponentLoadMoreFeatureMixin' is undefined jsdoc/no-undefined-types
20:1 warning The type 'FlowBoardComponentVisualEditorFeatureMixin' is undefined jsdoc/no-undefined-types
25:7 warning 'anchorUid' is never reassigned. Use 'const' instead prefer-const
84:3 warning '$header' is never reassigned. Use 'const' instead prefer-const
86:3 warning '$boardNavigation' is never reassigned. Use 'const' instead prefer-const
88:3 warning '$board' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/board/flow-boardhistory.js
6:1 warning The type 'FlowBoardAndHistoryComponentBase' is undefined jsdoc/no-undefined-types
42:3 warning 'flowBoardHistory' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/common/flow-component-events.js
123:4 warning 'returns' is never reassigned. Use 'const' instead prefer-const
273:4 warning 'deferreds' is never reassigned. Use 'const' instead prefer-const
275:4 warning 'self' is never reassigned. Use 'const' instead prefer-const
276:4 warning '$this' is never reassigned. Use 'const' instead prefer-const
277:4 warning 'flowComponent' is never reassigned. Use 'const' instead prefer-const
278:4 warning 'dataParams' is never reassigned. Use 'const' instead prefer-const
279:4 warning 'handlerName' is never reassigned. Use 'const' instead prefer-const
280:4 warning 'info' is never reassigned. Use 'const' instead prefer-const
285:4 warning 'args' is never reassigned. Use 'const' instead prefer-const
286:4 warning 'queryMap' is never reassigned. Use 'const' instead prefer-const
316:31 warning 'args' is already declared in the upper scope on line 285 column 4 no-shadow
336:31 warning 'args' is already declared in the upper scope on line 285 column 4 no-shadow
337:10 warning 'queryMap' is already declared in the upper scope on line 286 column 4 no-shadow
342:12 warning 'args' is already declared in the upper scope on line 336 column 31 no-shadow
351:7 warning 'args' is already declared in the upper scope on line 336 column 31 no-shadow
351:7 warning 'args' is never reassigned. Use 'const' instead prefer-const
352:7 warning '$form' is never reassigned. Use 'const' instead prefer-const
380:6 warning 'errorMsg' is never reassigned. Use 'const' instead prefer-const
412:3 warning Prefer .then to .fail no-jquery/no-done-fail
418:10 warning Prefer .then to .done no-jquery/no-done-fail
452:3 warning 'component' is never reassigned. Use 'const' instead prefer-const
472:3 warning '$content' is never reassigned. Use 'const' instead prefer-const
544:3 warning 'args' is never reassigned. Use 'const' instead prefer-const
545:3 warning '$context' is never reassigned. Use 'const' instead prefer-const
547:3 warning 'interactiveHandlerName' is never reassigned. Use 'const' instead prefer-const
548:3 warning 'apiHandlerName' is never reassigned. Use 'const' instead prefer-const
746:7 warning 'flowComponent' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/common/flow-component-menus.js
10:1 warning The type 'FlowComponent' is undefined jsdoc/no-undefined-types
/src/repo/modules/engine/components/flow-component.js
13:1 warning The type 'FlowComponentEventsMixin' is undefined jsdoc/no-undefined-types
14:1 warning The type 'FlowComponentEnginesMixin' is undefined jsdoc/no-undefined-types
15:1 warning The type 'FlowComponentMenusFeatureMixin' is undefined jsdoc/no-undefined-types
96:4 warning '_expandScientificNotation' is never reassigned. Use 'const' instead prefer-const
96:43 warning 'timestamp' is already declared in the upper scope on line 95 column 7 no-shadow
140:4 warning 'context' is never reassigned. Use 'const' instead prefer-const
161:3 warning 'id' is never reassigned. Use 'const' instead prefer-const
231:3 warning 'args' is never reassigned. Use 'const' instead prefer-const
232:3 warning 'handlers' is never reassigned. Use 'const' instead prefer-const
233:3 warning 'special' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/components/flow-registry.js
33:3 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
40:8 warning 'constructors' is never reassigned. Use 'const' instead prefer-const
42:5 warning 'i' is already declared in the upper scope on line 31 column 10 no-shadow
83:3 warning 'componentName' is never reassigned. Use 'const' instead prefer-const
85:3 warning 'componentBase' is never reassigned. Use 'const' instead prefer-const
138:7 warning 'registeredClass' is never reassigned. Use 'const' instead prefer-const
146:3 warning 'method' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/misc/flow-api.js
43:5 warning '$deferred' is never reassigned. Use 'const' instead prefer-const
44:5 warning 'ajaxTimeoutSec' is never reassigned. Use 'const' instead prefer-const
45:5 warning 'apiConstructorParams' is never reassigned. Use 'const' instead prefer-const
51:4 warning 'mwApi' is never reassigned. Use 'const' instead prefer-const
126:4 warning 'map' is never reassigned. Use 'const' instead prefer-const
209:25 warning 'queryValue' is never reassigned. Use 'const' instead prefer-const
314:3 warning 'str' is never reassigned. Use 'const' instead prefer-const
315:3 warning 'prevApiCall' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/misc/flow-handlebars.js
74:7 warning 'fragment' is never reassigned. Use 'const' instead prefer-const
115:8 warning '$this' is never reassigned. Use 'const' instead prefer-const
116:5 warning 'data' is never reassigned. Use 'const' instead prefer-const
117:5 warning 'target' is already declared in the upper scope on line 113 column 70 no-shadow
117:5 warning 'target' is never reassigned. Use 'const' instead prefer-const
132:4 warning 'content' is never reassigned. Use 'const' instead prefer-const
244:2 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
260:3 warning 'formatter' is never reassigned. Use 'const' instead prefer-const
263:3 warning 'guid' is never reassigned. Use 'const' instead prefer-const
291:4 warning 'currentTime' is never reassigned. Use 'const' instead prefer-const
314:3 warning '$ago' is never reassigned. Use 'const' instead prefer-const
316:3 warning 'secondsAgo' is never reassigned. Use 'const' instead prefer-const
594:4 warning 'partialMatch' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/misc/jquery.conditionalScroll.js
18:8 warning '$this' is never reassigned. Use 'const' instead prefer-const
19:5 warning 'viewportY' is never reassigned. Use 'const' instead prefer-const
20:5 warning 'viewportHeight' is never reassigned. Use 'const' instead prefer-const
21:5 warning 'elOffset' is never reassigned. Use 'const' instead prefer-const
22:5 warning 'elHeight' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/misc/jquery.findWithParent.js
47:7 warning 'selectors' is never reassigned. Use 'const' instead prefer-const
49:4 warning 'self' is never reassigned. Use 'const' instead prefer-const
51:24 warning 'selector' is already declared in the upper scope on line 46 column 35 no-shadow
/src/repo/modules/engine/misc/mw-ui.enhance.js
18:4 warning '$fields' is never reassigned. Use 'const' instead prefer-const
65:7 warning '$tooltipTemplate' is never reassigned. Use 'const' instead prefer-const
91:8 warning '$target' is never reassigned. Use 'const' instead prefer-const
96:5 warning 'windowWidth' is never reassigned. Use 'const' instead prefer-const
97:5 warning 'windowHeight' is never reassigned. Use 'const' instead prefer-const
98:5 warning 'scrollX' is never reassigned. Use 'const' instead prefer-const
99:5 warning 'scrollY' is never reassigned. Use 'const' instead prefer-const
104:20 warning 'tooltipLocation' is never reassigned. Use 'const' instead prefer-const
108:5 warning 'optionsUnreferenced' is never reassigned. Use 'const' instead prefer-const
209:4 warning 'tooltipWidth' is never reassigned. Use 'const' instead prefer-const
210:4 warning 'tooltipHeight' is never reassigned. Use 'const' instead prefer-const
213:4 warning 'targetPosition' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/engine/misc/mw-ui.modal.js
138:7 warning '$node' is never reassigned. Use 'const' instead prefer-const
139:4 warning '$contentNode' is never reassigned. Use 'const' instead prefer-const
193:7 warning '$heading' is never reassigned. Use 'const' instead prefer-const
243:7 warning 'self' is never reassigned. Use 'const' instead prefer-const
318:2 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
329:2 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
424:4 warning 'modal' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow-initialize.js
13:4 warning '$component' is never reassigned. Use 'const' instead prefer-const
15:4 warning '$board' is never reassigned. Use 'const' instead prefer-const
16:4 warning 'pageTitle' is never reassigned. Use 'const' instead prefer-const
17:4 warning 'initializer' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/dm/api/mw.flow.dm.APIHandler.js
19:31 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
29:24 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
57:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
57:13 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
59:3 warning 'xhr' is never reassigned. Use 'const' instead prefer-const
75:13 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
95:32 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
99:2 warning Found more than one @return declaration jsdoc/require-returns
99:2 warning Found more than one @return declaration jsdoc/require-returns-check
116:32 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
193:7 warning 'api' is never reassigned. Use 'const' instead prefer-const
206:37 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
220:7 warning 'api' is never reassigned. Use 'const' instead prefer-const
232:37 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
262:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
271:3 warning 'xhr' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/dm/mixins/mw.flow.dm.List.js
137:2 warning Missing JSDoc @return declaration jsdoc/require-returns
195:2 warning Missing JSDoc @return declaration jsdoc/require-returns
204:4 warning 'removed' is never reassigned. Use 'const' instead prefer-const
235:2 warning Missing JSDoc @return declaration jsdoc/require-returns
239:1 warning The type 'clear' is undefined jsdoc/no-undefined-types
/src/repo/modules/flow/dm/mw.flow.dm.Board.js
78:10 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
97:4 warning 'categoryDMs' is never reassigned. Use 'const' instead prefer-const
217:1 warning The type 'sortOrderChange' is undefined jsdoc/no-undefined-types
/src/repo/modules/flow/dm/mw.flow.dm.Item.js
71:33 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
/src/repo/modules/flow/dm/mw.flow.dm.ModeratedRevisionedContent.js
40:10 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
/src/repo/modules/flow/dm/mw.flow.dm.Post.js
66:4 warning 'result' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/dm/mw.flow.dm.RevisionedContent.js
83:10 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
374:1 warning The type 'watched' is undefined jsdoc/no-undefined-types
/src/repo/modules/flow/dm/mw.flow.dm.System.js
138:7 warning 'system' is never reassigned. Use 'const' instead prefer-const
139:4 warning 'apiParams' is never reassigned. Use 'const' instead prefer-const
203:4 warning 'topicTitlesById' is never reassigned. Use 'const' instead prefer-const
204:4 warning 'updateTimestampsByTopicId' is never reassigned. Use 'const' instead prefer-const
205:4 warning 'topics' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/dm/mw.flow.dm.Topic.js
73:4 warning 'topics' is never reassigned. Use 'const' instead prefer-const
97:10 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
/src/repo/modules/flow/ui/widgets/editor/mw.flow.ui.AnonWarningWidget.js
14:4 warning 'widget' is never reassigned. Use 'const' instead prefer-const
26:3 warning 'shouldDisplay' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/editor/mw.flow.ui.CanNotEditWidget.js
57:4 warning Prefer .then to .done no-jquery/no-done-fail
77:2 warning Found more than one @return declaration jsdoc/require-returns
77:2 warning Found more than one @return declaration jsdoc/require-returns-check
92:3 warning 'dfd' is never reassigned. Use 'const' instead prefer-const
113:5 warning Prefer .then to .done no-jquery/no-done-fail
113:5 warning Prefer .then to .fail no-jquery/no-done-fail
160:7 warning 'isGroupRequired' is never reassigned. Use 'const' instead prefer-const
161:4 warning 'userGroups' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/editor/mw.flow.ui.EditorWidget.js
270:4 warning 'deferred' is never reassigned. Use 'const' instead prefer-const
417:2 warning Found more than one @return declaration jsdoc/require-returns
417:2 warning Found more than one @return declaration jsdoc/require-returns-check
439:3 warning 'dom' is never reassigned. Use 'const' instead prefer-const
516:3 warning Prefer .then to .done no-jquery/no-done-fail
516:3 warning Prefer .then to .fail no-jquery/no-done-fail
/src/repo/modules/flow/ui/widgets/mw.flow.ui.BoardDescriptionWidget.js
58:46 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
185:7 warning 'content' is never reassigned. Use 'const' instead prefer-const
186:7 warning 'format' is never reassigned. Use 'const' instead prefer-const
235:7 warning 'widget' is never reassigned. Use 'const' instead prefer-const
240:3 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
282:6 warning 'categories' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.CaptchaWidget.js
30:2 warning Found more than one @return declaration jsdoc/require-returns
30:2 warning Found more than one @return declaration jsdoc/require-returns-check
38:7 warning '$captchaField' is never reassigned. Use 'const' instead prefer-const
75:4 warning Prefer .then to .fail no-jquery/no-done-fail
/src/repo/modules/flow/ui/widgets/mw.flow.ui.CategoriesWidget.js
24:40 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
69:4 warning 'widgets' is never reassigned. Use 'const' instead prefer-const
87:4 warning 'widgets' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.CategoryItemWidget.js
24:3 warning 'prefixedCleanName' is never reassigned. Use 'const' instead prefer-const
26:3 warning '$link' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.EditPostWidget.js
33:46 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
103:3 warning 'widget' is never reassigned. Use 'const' instead prefer-const
104:3 warning 'contentFormat' is never reassigned. Use 'const' instead prefer-const
148:7 warning 'widget' is never reassigned. Use 'const' instead prefer-const
151:3 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.EditTopicSummaryWidget.js
21:46 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
92:3 warning 'widget' is never reassigned. Use 'const' instead prefer-const
93:3 warning 'contentFormat' is never reassigned. Use 'const' instead prefer-const
98:6 warning 'content' is never reassigned. Use 'const' instead prefer-const
99:6 warning 'format' is never reassigned. Use 'const' instead prefer-const
140:7 warning 'widget' is never reassigned. Use 'const' instead prefer-const
143:3 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.NavigationWidget.js
55:1 warning The type 'loadTopic' is undefined jsdoc/no-undefined-types
66:1 warning The type 'reorderTopics' is undefined jsdoc/no-undefined-types
83:4 warning 'isElementInView' is never reassigned. Use 'const' instead prefer-const
84:9 warning 'scrollTop' is already declared in the upper scope on line 76 column 7 no-shadow
85:6 warning 'height' is never reassigned. Use 'const' instead prefer-const
86:6 warning 'top' is never reassigned. Use 'const' instead prefer-const
87:6 warning 'bottom' is never reassigned. Use 'const' instead prefer-const
89:5 warning 'scrollTop' is never reassigned. Use 'const' instead prefer-const
90:5 warning 'containerHeight' is never reassigned. Use 'const' instead prefer-const
118:3 warning 'scrollTop' is never reassigned. Use 'const' instead prefer-const
119:3 warning 'isScrolledDown' is never reassigned. Use 'const' instead prefer-const
/src/repo/modules/flow/ui/widgets/mw.flow.ui.NewTopicWidget.js
16:4 warning 'widget' is never reassigned. Use 'const' instead prefer-const
25:3 warning 'title' is never reassigned. Use 'const' instead prefer-const
58:46 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
214:7 warning 'widget' is never reassigned. Use 'const' instead prefer-const
215:4 warning 'title' is never reassigned. Use 'const' instead prefer-const
222:3 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
227:3 warning Prefer .then to .done no-jquery/no-done-fail
/src/repo/modules/flow/ui/widgets/mw.flow.ui.ReplyWidget.js
138:7 warning 'widget' is never reassigned. Use 'const' instead prefer-const
141:3 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
177:47 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
/src/repo/modules/flow/ui/widgets/mw.flow.ui.SidebarExpandWidget.js
23:17 warning OOUI button has no label. Even icon-only buttons should set a label with invisibleLabel set to true mediawiki/no-unlabeled-buttonwidget
/src/repo/modules/flow/ui/widgets/mw.flow.ui.TopicMenuSelectWidget.js
76:2 warning JSDoc @return declaration present but return expression not available in function jsdoc/require-returns-check
91:3 warning 'actualHeight' is never reassigned. Use 'const' instead prefer-const
92:3 warning 'naturalHeight' is never reassigned. Use 'const' instead prefer-const
93:3 warning 'scrollTop' is never reassigned. Use 'const' instead prefer-const
94:3 warning 'isNearBottom' is never reassigned. Use 'const' instead prefer-const
105:1 warning The type 'topic' is undefined jsdoc/no-undefined-types
148:4 warning 'widgets' is never reassigned. Use 'const' instead prefer-const
187:4 warning 'widgets' is never reassigned. Use 'const' instead prefer-const
198:2 warning Missing JSDoc @return declaration jsdoc/require-returns
221:2 warning Missing JSDoc @return declaration jsdoc/require-returns
/src/repo/modules/mw.flow.Initializer.js
80:6 warning 'topic' is never reassigned. Use 'const' instead prefer-const
81:6 warning 'data' is never reassigned. Use 'const' instead prefer-const
113:4 warning 'self' is never reassigned. Use 'const' instead prefer-const
333:5 warning '$rendered' is never reassigned. Use 'const' instead prefer-const
497:5 warning '$topic' is never reassigned. Use 'const' instead prefer-const
498:5 warning 'topicId' is never reassigned. Use 'const' instead prefer-const
499:5 warning '$post' is never reassigned. Use 'const' instead prefer-const
500:5 warning '$postMain' is never reassigned. Use 'const' instead prefer-const
501:5 warning 'postId' is never reassigned. Use 'const' instead prefer-const
502:5 warning '$board' is never reassigned. Use 'const' instead prefer-const
503:5 warning 'flowBoard' is never reassigned. Use 'const' instead prefer-const
505:4 warning 'editPostWidget' is never reassigned. Use 'const' instead prefer-const
571:6 warning 'action' is never reassigned. Use 'const' instead prefer-const
572:6 warning '$topic' is never reassigned. Use 'const' instead prefer-const
573:6 warning 'topicId' is never reassigned. Use 'const' instead prefer-const
574:6 warning 'api' is never reassigned. Use 'const' instead prefer-const
582:5 warning Prefer .then to .fail no-jquery/no-done-fail
634:9 warning '$topic' is never reassigned. Use 'const' instead prefer-const
635:6 warning 'topicId' is never reassigned. Use 'const' instead prefer-const
636:6 warning '$container' is never reassigned. Use 'const' instead prefer-const
637:6 warning '$topicTitleViewMode' is never reassigned. Use 'const' instead prefer-const
638:6 warning '$editForm' is never reassigned. Use 'const' instead prefer-const
646:5 warning 'widget' is never reassigned. Use 'const' instead prefer-const
700:5 warning 'href' is never reassigned. Use 'const' instead prefer-const
701:5 warning 'replyTo' is never reassigned. Use 'const' instead prefer-const
702:5 warning '$topic' is never reassigned. Use 'const' instead prefer-const
703:5 warning 'placeholder' is never reassigned. Use 'const' instead prefer-const
707:5 warning '$targetContainer' is never reassigned. Use 'const' instead prefer-const
708:5 warning '$existingWidget' is never reassigned. Use 'const' instead prefer-const
719:4 warning 'replyWidget' is never reassigned. Use 'const' instead prefer-const
790:4 warning 'self' is never reassigned. Use 'const' instead prefer-const
791:4 warning '$topic' is never reassigned. Use 'const' instead prefer-const
792:4 warning '$summaryContainer' is never reassigned. Use 'const' instead prefer-const
793:4 warning '$topicSummary' is never reassigned. Use 'const' instead prefer-const
794:4 warning 'editorOptions' is never reassigned. Use 'const' instead prefer-const
797:4 warning 'pageName' is never reassigned. Use 'const' instead prefer-const
798:4 warning 'title' is never reassigned. Use 'const' instead prefer-const
814:3 warning 'editTopicSummaryWidget' is never reassigned. Use 'const' instead prefer-const
855:7 warning 'editPostWidget' is never reassigned. Use 'const' instead prefer-const
856:4 warning '$post' is never reassigned. Use 'const' instead prefer-const
857:4 warning '$topic' is never reassigned. Use 'const' instead prefer-const
858:4 warning 'self' is never reassigned. Use 'const' instead prefer-const
907:4 warning '$messages' is never reassigned. Use 'const' instead prefer-const
908:4 warning 'isProbablyEditable' is never reassigned. Use 'const' instead prefer-const
909:4 warning 'anonWarning' is never reassigned. Use 'const' instead prefer-const
912:4 warning 'canNotEdit' is never reassigned. Use 'const' instead prefer-const
917:4 warning 'captcha' is never reassigned. Use 'const' instead prefer-const
918:4 warning 'captchaWidget' is never reassigned. Use 'const' instead prefer-const
919:4 warning 'error' is never reassigned. Use 'const' instead prefer-const
922:4 warning 'editor' is never reassigned. Use 'const' instead prefer-const
944:3 warning '$wrapper' is never reassigned. Use 'const' instead prefer-const
965:26 warning 'content' is already declared in the upper scope on line 905 column 79 no-shadow
970:5 warning 'captchaResponse' is never reassigned. Use 'const' instead prefer-const
999:7 warning '$undoForm' is never reassigned. Use 'const' instead prefer-const
1000:4 warning 'undoType' is never reassigned. Use 'const' instead prefer-const
1001:4 warning 'pageName' is never reassigned. Use 'const' instead prefer-const
1002:4 warning 'title' is never reassigned. Use 'const' instead prefer-const
1003:4 warning 'topicId' is never reassigned. Use 'const' instead prefer-const
1004:4 warning 'postId' is never reassigned. Use 'const' instead prefer-const
1005:4 warning 'prevRevId' is never reassigned. Use 'const' instead prefer-const
1006:4 warning 'content' is never reassigned. Use 'const' instead prefer-const
1007:4 warning 'returnToTitle' is never reassigned. Use 'const' instead prefer-const
1020:4 warning 'apiHandler' is never reassigned. Use 'const' instead prefer-const
1024:4 warning 'save' is never reassigned. Use 'const' instead prefer-const
1043:4 warning 'editor' is never reassigned. Use 'const' instead prefer-const
1057:31 warning 'content' is already declared in the upper scope on line 1006 column 4 no-shadow
/src/repo/tests/qunit/engine/misc/test_flow-handlebars.js
4:8 warning 'stub' is never reassigned. Use 'const' instead prefer-const
18:4 warning 'stubUser' is never reassigned. Use 'const' instead prefer-const
92:16 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
/src/repo/tests/qunit/flow/dm/test_mw.flow.dm.Board.js
7:3 warning 'executeOperation' is never reassigned. Use 'const' instead prefer-const
10:3 warning 'cases' is never reassigned. Use 'const' instead prefer-const
158:2 warning 'board' is never reassigned. Use 'const' instead prefer-const
/src/repo/tests/qunit/flow/dm/test_mw.flow.dm.Post.js
7:3 warning 'truncatedApiData' is never reassigned. Use 'const' instead prefer-const
479:2 warning 'topicRevisionData' is never reassigned. Use 'const' instead prefer-const
480:2 warning 'topic' is never reassigned. Use 'const' instead prefer-const
485:2 warning 'replies' is never reassigned. Use 'const' instead prefer-const
486:2 warning 'subreplies' is never reassigned. Use 'const' instead prefer-const
487:2 warning 'subsubreplies' is never reassigned. Use 'const' instead prefer-const
/src/repo/tests/qunit/flow/dm/test_mw.flow.dm.System.js
7:3 warning 'executeOperation' is never reassigned. Use 'const' instead prefer-const
10:3 warning 'truncatedApiData' is never reassigned. Use 'const' instead prefer-const
284:3 warning 'cases' is never reassigned. Use 'const' instead prefer-const
312:2 warning 'system' is never reassigned. Use 'const' instead prefer-const
/src/repo/tests/qunit/flow/dm/test_mw.flow.dm.Topic.js
7:3 warning 'executeOperation' is never reassigned. Use 'const' instead prefer-const
7:38 warning 'operation' is already declared in the upper scope on line 6 column 39 no-shadow
11:2 warning 'cases' is never reassigned. Use 'const' instead prefer-const
✖ 405 problems (0 errors, 405 warnings)
Running "stylelint:all" (stylelint) task
>> Linted 41 files without errors
Running "banana:Flow" (banana) task
>> 2 message directories checked.
Done.
--- end ---
{"1115496": {"source": 1115496, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<1.1.13"}, "1115497": {"source": 1115497, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.3"}}
Upgrading n:brace-expansion from 1.1.12, 2.0.2 -> 1.1.13, 2.0.3
{"1115490": {"source": 1115490, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<2.3.2"}, "1115492": {"source": 1115492, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching", "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": ">=4.0.0 <4.0.4"}, "1115493": {"source": 1115493, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<2.3.2"}, "1115495": {"source": 1115495, "name": "picomatch", "dependency": "picomatch", "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers", "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <4.0.4"}}
Upgrading n:picomatch from 2.3.1, 4.0.3 -> 2.3.2, 4.0.4
{"1115369": {"source": 1115369, "name": "yaml", "dependency": "yaml", "title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections", "url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp", "severity": "moderate", "cwe": ["CWE-674"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=2.0.0 <2.8.3"}}
Upgrading n:yaml from 2.8.1 -> 2.8.3
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating npm dependencies
* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
* https://github.com/advisories/GHSA-f886-m6hf-6m8v
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmptstrby6m
--- stdout ---
[master 7586510] build: Updating npm dependencies
1 file changed, 39 insertions(+), 36 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 758651059c18df6ad185198f1e0da2045c8ee5ce Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Fri, 27 Mar 2026 18:44:09 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
* https://github.com/advisories/GHSA-f886-m6hf-6m8v
* picomatch: 2.3.1, 4.0.3 → 2.3.2, 4.0.4
* https://github.com/advisories/GHSA-3v7f-55p6-f55p
* https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
* yaml: 2.8.1 → 2.8.3
* https://github.com/advisories/GHSA-48c2-rrv3-qjmp
Change-Id: Ib3addc4e66c53e5b805f04baa66f806fd688a921
---
package-lock.json | 75 ++++++++++++++++++++++++-----------------------
1 file changed, 39 insertions(+), 36 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index ca46f3e..8125ec5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -452,9 +452,9 @@
}
},
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -709,9 +709,9 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0"
@@ -1015,9 +1015,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"dev": true,
"dependencies": {
"balanced-match": "^1.0.0",
@@ -4357,9 +4357,9 @@
"dev": true
},
"node_modules/picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true,
"engines": {
"node": ">=8.6"
@@ -5688,9 +5688,9 @@
}
},
"node_modules/ts-declaration-location/node_modules/picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true,
"engines": {
"node": ">=12"
@@ -5972,15 +5972,18 @@
}
},
"node_modules/yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true,
"bin": {
"yaml": "bin.mjs"
},
"engines": {
"node": ">= 14.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/eemeli"
}
},
"node_modules/yaml-eslint-parser": {
@@ -6322,9 +6325,9 @@
}
},
"picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true
}
}
@@ -6484,9 +6487,9 @@
},
"dependencies": {
"brace-expansion": {
- "version": "2.0.2",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
- "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+ "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0"
@@ -6710,9 +6713,9 @@
"dev": true
},
"brace-expansion": {
- "version": "1.1.12",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
- "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+ "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0",
@@ -9152,9 +9155,9 @@
"dev": true
},
"picomatch": {
- "version": "2.3.1",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
- "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+ "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
"dev": true
},
"pluralize": {
@@ -10063,9 +10066,9 @@
},
"dependencies": {
"picomatch": {
- "version": "4.0.3",
- "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
- "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+ "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true
}
}
@@ -10257,9 +10260,9 @@
"dev": true
},
"yaml": {
- "version": "2.8.1",
- "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz",
- "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==",
+ "version": "2.8.3",
+ "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+ "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
"dev": true
},
"yaml-eslint-parser": {
--
2.47.3
--- end ---