mediawiki/extensions/CognitiveProcessDesigner: REL1_43 (log #2417065)

source • patches

This run took 76 seconds.

From eb42d0d83111482843bdead1998f2634d90d6356 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 29 Mar 2026 05:03:54 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
  * https://github.com/advisories/GHSA-f886-m6hf-6m8v
* handlebars: 4.7.8 → 4.7.9
  * https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
  * https://github.com/advisories/GHSA-2w6w-674q-4c4q
  * https://github.com/advisories/GHSA-3mfm-83xf-c92r
  * https://github.com/advisories/GHSA-9cx6-37pm-9jff
  * https://github.com/advisories/GHSA-xhpv-hc6g-r9c6
  * https://github.com/advisories/GHSA-xjpj-3mr7-gcpf
* node-forge: 1.3.2 → 1.4.0
  * https://github.com/advisories/GHSA-2328-f5f3-gj25
  * https://github.com/advisories/GHSA-5m6q-g25r-mvwx
  * https://github.com/advisories/GHSA-ppp5-5v6c-4jwp
  * https://github.com/advisories/GHSA-q67f-28xg-22rw
* path-to-regexp: 0.1.12, 6.3.0 → 0.1.13, 6.3.0
  * https://github.com/advisories/GHSA-37ch-88jc-xwx2

Change-Id: I50b6c4de32f0a65811763f8839fc11be1aaf34ee
---
 package-lock.json | 81 +++++++++++++++++++++++------------------------
 1 file changed, 40 insertions(+), 41 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 5ebbbb4..cc5973c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2111,9 +2111,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -2210,9 +2210,9 @@
 			}
 		},
 		"node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -4139,9 +4139,9 @@
 			}
 		},
 		"node_modules/@wikimedia/mw-node-qunit/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -5078,9 +5078,9 @@
 			"license": "MIT"
 		},
 		"node_modules/brace-expansion": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-			"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+			"integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0"
@@ -7139,9 +7139,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/eslint-plugin-unicorn/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -7443,9 +7443,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/eslint/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -7840,11 +7840,10 @@
 			"license": "MIT"
 		},
 		"node_modules/express/node_modules/path-to-regexp": {
-			"version": "0.1.12",
-			"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-			"integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
-			"dev": true,
-			"license": "MIT"
+			"version": "0.1.13",
+			"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+			"integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+			"dev": true
 		},
 		"node_modules/extend": {
 			"version": "3.0.2",
@@ -8383,9 +8382,9 @@
 			"dev": true
 		},
 		"node_modules/glob/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -8798,9 +8797,9 @@
 			}
 		},
 		"node_modules/grunt/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -8850,9 +8849,9 @@
 			"license": "MIT"
 		},
 		"node_modules/handlebars": {
-			"version": "4.7.8",
-			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
-			"integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+			"version": "4.7.9",
+			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+			"integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
 			"dev": true,
 			"dependencies": {
 				"minimist": "^1.2.5",
@@ -11610,9 +11609,9 @@
 			}
 		},
 		"node_modules/multimatch/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -11765,9 +11764,9 @@
 			}
 		},
 		"node_modules/node-forge": {
-			"version": "1.3.2",
-			"resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.2.tgz",
-			"integrity": "sha512-6xKiQ+cph9KImrRh0VsjH2d8/GXA4FIMlgU4B757iI1ApvcyA9VlouP0yZJha01V+huImO+kKMU7ih+2+E14fw==",
+			"version": "1.4.0",
+			"resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+			"integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
 			"dev": true,
 			"engines": {
 				"node": ">= 6.13.0"
@@ -14972,9 +14971,9 @@
 			}
 		},
 		"node_modules/test-exclude/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
-- 
2.47.3


$ date
--- stdout ---
Sun Mar 29 05:02:42 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-CognitiveProcessDesigner.git /src/repo --depth=1 -b REL1_43
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_43
--- stdout ---
af230374dad24f99232b365be76b50e9b0991c4d refs/heads/REL1_43

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@tootallnate/once": {
      "name": "@tootallnate/once",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1113977,
          "name": "@tootallnate/once",
          "dependency": "@tootallnate/once",
          "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
          "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
          "severity": "low",
          "cwe": [
            "CWE-705"
          ],
          "cvss": {
            "score": 3.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<3.0.1"
        }
      ],
      "effects": [
        "http-proxy-agent"
      ],
      "range": "<3.0.1",
      "nodes": [
        "node_modules/@tootallnate/once"
      ],
      "fixAvailable": {
        "name": "jest-environment-jsdom",
        "version": "30.3.0",
        "isSemVerMajor": true
      }
    },
    "@wikimedia/mw-node-qunit": {
      "name": "@wikimedia/mw-node-qunit",
      "severity": "low",
      "isDirect": true,
      "via": [
        "jsdom"
      ],
      "effects": [],
      "range": ">=6.3.0",
      "nodes": [
        "node_modules/@wikimedia/mw-node-qunit"
      ],
      "fixAvailable": {
        "name": "@wikimedia/mw-node-qunit",
        "version": "6.2.1",
        "isSemVerMajor": true
      }
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1115540,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.13"
        },
        {
          "source": 1115541,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.0.3"
        }
      ],
      "effects": [],
      "range": "<1.1.13 || >=2.0.0 <2.0.3",
      "nodes": [
        "node_modules/@eslint/eslintrc/node_modules/brace-expansion",
        "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion",
        "node_modules/@wikimedia/mw-node-qunit/node_modules/brace-expansion",
        "node_modules/brace-expansion",
        "node_modules/eslint-plugin-unicorn/node_modules/brace-expansion",
        "node_modules/eslint/node_modules/brace-expansion",
        "node_modules/glob/node_modules/brace-expansion",
        "node_modules/grunt/node_modules/brace-expansion",
        "node_modules/multimatch/node_modules/brace-expansion",
        "node_modules/test-exclude/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "grunt": {
      "name": "grunt",
      "severity": "high",
      "isDirect": true,
      "via": [
        "minimatch"
      ],
      "effects": [
        "grunt-eslint"
      ],
      "range": ">=0.4.0-a",
      "nodes": [
        "node_modules/grunt"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "grunt-eslint": {
      "name": "grunt-eslint",
      "severity": "high",
      "isDirect": true,
      "via": [
        "grunt"
      ],
      "effects": [],
      "range": "<=1.0.0 || >=18.1.0",
      "nodes": [
        "node_modules/grunt-eslint"
      ],
      "fixAvailable": {
        "name": "grunt-eslint",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "handlebars": {
      "name": "handlebars",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1115514,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options",
          "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf",
          "severity": "high",
          "cwe": [
            "CWE-79",
            "CWE-94",
            "CWE-116"
          ],
          "cvss": {
            "score": 8.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115515,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial",
          "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6",
          "severity": "high",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115516,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation",
          "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff",
          "severity": "high",
          "cwe": [
            "CWE-754"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115538,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
          "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r",
          "severity": "high",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115539,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion",
          "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q",
          "severity": "critical",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115544,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection",
          "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9",
          "severity": "moderate",
          "cwe": [
            "CWE-79",
            "CWE-1321"
          ],
          "cvss": {
            "score": 4.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=4.0.0 <4.7.9"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.7.8",
      "nodes": [
        "node_modules/handlebars"
      ],
      "fixAvailable": true
    },
    "http-proxy-agent": {
      "name": "http-proxy-agent",
      "severity": "low",
      "isDirect": false,
      "via": [
        "@tootallnate/once"
      ],
      "effects": [
        "jsdom"
      ],
      "range": "4.0.1 - 5.0.0",
      "nodes": [
        "node_modules/http-proxy-agent"
      ],
      "fixAvailable": {
        "name": "jest-environment-jsdom",
        "version": "30.3.0",
        "isSemVerMajor": true
      }
    },
    "jest-environment-jsdom": {
      "name": "jest-environment-jsdom",
      "severity": "low",
      "isDirect": true,
      "via": [
        "jsdom"
      ],
      "effects": [],
      "range": "27.0.1 - 30.0.0-rc.1",
      "nodes": [
        "node_modules/jest-environment-jsdom"
      ],
      "fixAvailable": {
        "name": "jest-environment-jsdom",
        "version": "30.3.0",
        "isSemVerMajor": true
      }
    },
    "jsdom": {
      "name": "jsdom",
      "severity": "low",
      "isDirect": false,
      "via": [
        "http-proxy-agent"
      ],
      "effects": [
        "@wikimedia/mw-node-qunit",
        "jest-environment-jsdom"
      ],
      "range": "16.6.0 - 22.1.0",
      "nodes": [
        "node_modules/jest-environment-jsdom/node_modules/jsdom",
        "node_modules/jsdom"
      ],
      "fixAvailable": {
        "name": "jest-environment-jsdom",
        "version": "30.3.0",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113538,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
          "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113546,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
          "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.4"
        }
      ],
      "effects": [
        "grunt"
      ],
      "range": "<=3.1.3",
      "nodes": [
        "node_modules/grunt/node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "node-forge": {
      "name": "node-forge",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1115545,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
          "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
          "severity": "high",
          "cwe": [
            "CWE-295"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<=1.3.3"
        },
        {
          "source": 1115546,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has signature forgery in Ed25519 due to missing S > L check",
          "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.4.0"
        },
        {
          "source": 1115547,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  ",
          "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.4.0"
        },
        {
          "source": 1115548,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
          "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.4.0"
        }
      ],
      "effects": [],
      "range": "<=1.3.3",
      "nodes": [
        "node_modules/node-forge"
      ],
      "fixAvailable": true
    },
    "path-to-regexp": {
      "name": "path-to-regexp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1115527,
          "name": "path-to-regexp",
          "dependency": "path-to-regexp",
          "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
          "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.1.13"
        }
      ],
      "effects": [],
      "range": "<0.1.13",
      "nodes": [
        "node_modules/express/node_modules/path-to-regexp"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 5,
      "moderate": 1,
      "high": 5,
      "critical": 1,
      "total": 12
    },
    "dependencies": {
      "prod": 40,
      "dev": 1172,
      "optional": 3,
      "peer": 0,
      "peerOptional": 0,
      "total": 1211
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 44 installs, 0 updates, 0 removals
  - Locking composer/installers (v2.3.0)
  - Locking composer/pcre (3.3.2)
  - Locking composer/semver (3.4.3)
  - Locking composer/spdx-licenses (1.5.9)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
  - Locking doctrine/deprecations (1.1.6)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking mediawiki/mediawiki-codesniffer (v46.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.15.1)
  - Locking mediawiki/minus-x (1.1.3)
  - Locking mediawiki/phan-taint-check-plugin (6.1.0)
  - Locking microsoft/tolerant-php-parser (v0.1.2)
  - Locking mwstake/mediawiki-component-commonuserinterface (8.0.0)
  - Locking mwstake/mediawiki-component-processmanager (4.0.4)
  - Locking mwstake/mediawiki-componentloader (1.0.1)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking phan/phan (5.4.5)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.2.1)
  - Locking phpcsstandards/phpcsutils (1.0.12)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.6.7)
  - Locking phpdocumentor/type-resolver (1.12.0)
  - Locking phpstan/phpdoc-parser (2.3.2)
  - Locking psr/container (2.0.2)
  - Locking psr/log (3.0.2)
  - Locking sabre/event (5.1.7)
  - Locking squizlabs/php_codesniffer (3.11.3)
  - Locking symfony/console (v7.4.7)
  - Locking symfony/deprecation-contracts (v3.6.0)
  - Locking symfony/filesystem (v3.4.47)
  - Locking symfony/polyfill-ctype (v1.33.0)
  - Locking symfony/polyfill-intl-grapheme (v1.33.0)
  - Locking symfony/polyfill-intl-normalizer (v1.33.0)
  - Locking symfony/polyfill-mbstring (v1.33.0)
  - Locking symfony/polyfill-php80 (v1.33.0)
  - Locking symfony/process (v6.4.33)
  - Locking symfony/service-contracts (v3.6.1)
  - Locking symfony/string (v8.0.6)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (2.1.6)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 44 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing composer/installers (v2.3.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.11.3): Extracting archive
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
  - Installing composer/pcre (3.3.2): Extracting archive
  - Installing symfony/polyfill-php80 (v1.33.0): Extracting archive
  - Installing phpcsstandards/phpcsutils (1.0.12): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.33.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.9): Extracting archive
  - Installing composer/semver (3.4.3): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v46.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.33.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.33.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.33.0): Extracting archive
  - Installing symfony/string (v8.0.6): Extracting archive
  - Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.6.1): Extracting archive
  - Installing symfony/console (v7.4.7): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
  - Installing webmozart/assert (2.1.6): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.6): Extracting archive
  - Installing phpdocumentor/type-resolver (1.12.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.6.7): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (3.0.2): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.4.5): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (6.1.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.15.1): Extracting archive
  - Installing mediawiki/minus-x (1.1.3): Extracting archive
  - Installing mwstake/mediawiki-componentloader (1.0.1): Extracting archive
  - Installing mwstake/mediawiki-component-commonuserinterface (8.0.0): Extracting archive
  - Installing symfony/process (v6.4.33): Extracting archive
  - Installing symfony/filesystem (v3.4.47): Extracting archive
  - Installing mwstake/mediawiki-component-processmanager (4.0.4): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  0/41 [>---------------------------]   0%
 28/41 [===================>--------]  68%
 41/41 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
20 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@tootallnate/once": {
      "name": "@tootallnate/once",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1113977,
          "name": "@tootallnate/once",
          "dependency": "@tootallnate/once",
          "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
          "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
          "severity": "low",
          "cwe": [
            "CWE-705"
          ],
          "cvss": {
            "score": 3.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<3.0.1"
        }
      ],
      "effects": [
        "http-proxy-agent"
      ],
      "range": "<3.0.1",
      "nodes": [
        "node_modules/@tootallnate/once"
      ],
      "fixAvailable": {
        "name": "@wikimedia/mw-node-qunit",
        "version": "6.2.1",
        "isSemVerMajor": true
      }
    },
    "@wikimedia/mw-node-qunit": {
      "name": "@wikimedia/mw-node-qunit",
      "severity": "low",
      "isDirect": true,
      "via": [
        "jsdom"
      ],
      "effects": [],
      "range": ">=6.3.0",
      "nodes": [
        "node_modules/@wikimedia/mw-node-qunit"
      ],
      "fixAvailable": {
        "name": "@wikimedia/mw-node-qunit",
        "version": "6.2.1",
        "isSemVerMajor": true
      }
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1115540,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.13"
        },
        {
          "source": 1115541,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.0.3"
        }
      ],
      "effects": [],
      "range": "<1.1.13 || >=2.0.0 <2.0.3",
      "nodes": [
        "node_modules/@eslint/eslintrc/node_modules/brace-expansion",
        "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion",
        "node_modules/@wikimedia/mw-node-qunit/node_modules/brace-expansion",
        "node_modules/brace-expansion",
        "node_modules/eslint-plugin-unicorn/node_modules/brace-expansion",
        "node_modules/eslint/node_modules/brace-expansion",
        "node_modules/glob/node_modules/brace-expansion",
        "node_modules/grunt/node_modules/brace-expansion",
        "node_modules/multimatch/node_modules/brace-expansion",
        "node_modules/test-exclude/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "grunt": {
      "name": "grunt",
      "severity": "high",
      "isDirect": true,
      "via": [
        "minimatch"
      ],
      "effects": [
        "grunt-eslint"
      ],
      "range": ">=0.4.0-a",
      "nodes": [
        "node_modules/grunt"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "grunt-eslint": {
      "name": "grunt-eslint",
      "severity": "high",
      "isDirect": true,
      "via": [
        "grunt"
      ],
      "effects": [],
      "range": "<=1.0.0 || >=18.1.0",
      "nodes": [
        "node_modules/grunt-eslint"
      ],
      "fixAvailable": {
        "name": "grunt-eslint",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "handlebars": {
      "name": "handlebars",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1115514,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options",
          "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf",
          "severity": "high",
          "cwe": [
            "CWE-79",
            "CWE-94",
            "CWE-116"
          ],
          "cvss": {
            "score": 8.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115515,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial",
          "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6",
          "severity": "high",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115516,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation",
          "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff",
          "severity": "high",
          "cwe": [
            "CWE-754"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115538,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
          "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r",
          "severity": "high",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115539,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has JavaScript Injection via AST Type Confusion",
          "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q",
          "severity": "critical",
          "cwe": [
            "CWE-94",
            "CWE-843"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=4.0.0 <=4.7.8"
        },
        {
          "source": 1115544,
          "name": "handlebars",
          "dependency": "handlebars",
          "title": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection",
          "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9",
          "severity": "moderate",
          "cwe": [
            "CWE-79",
            "CWE-1321"
          ],
          "cvss": {
            "score": 4.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=4.0.0 <4.7.9"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.7.8",
      "nodes": [
        "node_modules/handlebars"
      ],
      "fixAvailable": true
    },
    "http-proxy-agent": {
      "name": "http-proxy-agent",
      "severity": "low",
      "isDirect": false,
      "via": [
        "@tootallnate/once"
      ],
      "effects": [
        "jsdom"
      ],
      "range": "4.0.1 - 5.0.0",
      "nodes": [
        "node_modules/http-proxy-agent"
      ],
      "fixAvailable": {
        "name": "@wikimedia/mw-node-qunit",
        "version": "6.2.1",
        "isSemVerMajor": true
      }
    },
    "jest-environment-jsdom": {
      "name": "jest-environment-jsdom",
      "severity": "low",
      "isDirect": true,
      "via": [
        "jsdom"
      ],
      "effects": [],
      "range": "27.0.1 - 30.0.0-rc.1",
      "nodes": [
        "node_modules/jest-environment-jsdom"
      ],
      "fixAvailable": {
        "name": "jest-environment-jsdom",
        "version": "30.3.0",
        "isSemVerMajor": true
      }
    },
    "jsdom": {
      "name": "jsdom",
      "severity": "low",
      "isDirect": false,
      "via": [
        "http-proxy-agent"
      ],
      "effects": [
        "@wikimedia/mw-node-qunit",
        "jest-environment-jsdom"
      ],
      "range": "16.6.0 - 22.1.0",
      "nodes": [
        "node_modules/jest-environment-jsdom/node_modules/jsdom",
        "node_modules/jsdom"
      ],
      "fixAvailable": {
        "name": "@wikimedia/mw-node-qunit",
        "version": "6.2.1",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113538,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
          "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113546,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
          "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.4"
        }
      ],
      "effects": [
        "grunt"
      ],
      "range": "<=3.1.3",
      "nodes": [
        "node_modules/grunt/node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "grunt",
        "version": "0.3.17",
        "isSemVerMajor": true
      }
    },
    "node-forge": {
      "name": "node-forge",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1115545,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
          "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
          "severity": "high",
          "cwe": [
            "CWE-295"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<=1.3.3"
        },
        {
          "source": 1115546,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has signature forgery in Ed25519 due to missing S > L check",
          "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.4.0"
        },
        {
          "source": 1115547,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  ",
          "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.4.0"
        },
        {
          "source": 1115548,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
          "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.4.0"
        }
      ],
      "effects": [],
      "range": "<=1.3.3",
      "nodes": [
        "node_modules/node-forge"
      ],
      "fixAvailable": true
    },
    "path-to-regexp": {
      "name": "path-to-regexp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1115527,
          "name": "path-to-regexp",
          "dependency": "path-to-regexp",
          "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
          "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.1.13"
        }
      ],
      "effects": [],
      "range": "<0.1.13",
      "nodes": [
        "node_modules/express/node_modules/path-to-regexp"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 5,
      "moderate": 1,
      "high": 5,
      "critical": 1,
      "total": 12
    },
    "dependencies": {
      "prod": 40,
      "dev": 1172,
      "optional": 3,
      "peer": 0,
      "peerOptional": 0,
      "total": 1211
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
  "added": 1211,
  "removed": 0,
  "changed": 0,
  "audited": 1212,
  "funding": 186,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@tootallnate/once": {
        "name": "@tootallnate/once",
        "severity": "low",
        "isDirect": false,
        "via": [
          {
            "source": 1113977,
            "name": "@tootallnate/once",
            "dependency": "@tootallnate/once",
            "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
            "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
            "severity": "low",
            "cwe": [
              "CWE-705"
            ],
            "cvss": {
              "score": 3.3,
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
            },
            "range": "<3.0.1"
          }
        ],
        "effects": [
          "http-proxy-agent"
        ],
        "range": "<3.0.1",
        "nodes": [
          "node_modules/@tootallnate/once"
        ],
        "fixAvailable": {
          "name": "jest-environment-jsdom",
          "version": "30.3.0",
          "isSemVerMajor": true
        }
      },
      "@wikimedia/mw-node-qunit": {
        "name": "@wikimedia/mw-node-qunit",
        "severity": "low",
        "isDirect": true,
        "via": [
          "jsdom"
        ],
        "effects": [],
        "range": ">=6.3.0",
        "nodes": [
          "node_modules/@wikimedia/mw-node-qunit"
        ],
        "fixAvailable": {
          "name": "@wikimedia/mw-node-qunit",
          "version": "6.2.1",
          "isSemVerMajor": true
        }
      },
      "brace-expansion": {
        "name": "brace-expansion",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1115540,
            "name": "brace-expansion",
            "dependency": "brace-expansion",
            "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
            "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
            "severity": "moderate",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
            },
            "range": "<1.1.13"
          },
          {
            "source": 1115541,
            "name": "brace-expansion",
            "dependency": "brace-expansion",
            "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
            "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
            "severity": "moderate",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
            },
            "range": ">=2.0.0 <2.0.3"
          }
        ],
        "effects": [],
        "range": "<1.1.13 || >=2.0.0 <2.0.3",
        "nodes": [
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          "",
          ""
        ],
        "fixAvailable": true
      },
      "grunt": {
        "name": "grunt",
        "severity": "high",
        "isDirect": true,
        "via": [
          "minimatch"
        ],
        "effects": [
          "grunt-eslint"
        ],
        "range": ">=0.4.0-a",
        "nodes": [
          "node_modules/grunt"
        ],
        "fixAvailable": {
          "name": "grunt",
          "version": "0.3.17",
          "isSemVerMajor": true
        }
      },
      "grunt-eslint": {
        "name": "grunt-eslint",
        "severity": "high",
        "isDirect": true,
        "via": [
          "grunt"
        ],
        "effects": [],
        "range": "<=1.0.0 || >=18.1.0",
        "nodes": [
          "node_modules/grunt-eslint"
        ],
        "fixAvailable": {
          "name": "grunt-eslint",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "handlebars": {
        "name": "handlebars",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1115514,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options",
            "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf",
            "severity": "high",
            "cwe": [
              "CWE-79",
              "CWE-94",
              "CWE-116"
            ],
            "cvss": {
              "score": 8.3,
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
            },
            "range": ">=4.0.0 <=4.7.8"
          },
          {
            "source": 1115515,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial",
            "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6",
            "severity": "high",
            "cwe": [
              "CWE-94",
              "CWE-843"
            ],
            "cvss": {
              "score": 8.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=4.0.0 <=4.7.8"
          },
          {
            "source": 1115516,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation",
            "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff",
            "severity": "high",
            "cwe": [
              "CWE-754"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=4.0.0 <=4.7.8"
          },
          {
            "source": 1115538,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
            "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r",
            "severity": "high",
            "cwe": [
              "CWE-94",
              "CWE-843"
            ],
            "cvss": {
              "score": 8.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=4.0.0 <=4.7.8"
          },
          {
            "source": 1115539,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has JavaScript Injection via AST Type Confusion",
            "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q",
            "severity": "critical",
            "cwe": [
              "CWE-94",
              "CWE-843"
            ],
            "cvss": {
              "score": 9.8,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=4.0.0 <=4.7.8"
          },
          {
            "source": 1115544,
            "name": "handlebars",
            "dependency": "handlebars",
            "title": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection",
            "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9",
            "severity": "moderate",
            "cwe": [
              "CWE-79",
              "CWE-1321"
            ],
            "cvss": {
              "score": 4.7,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": ">=4.0.0 <4.7.9"
          }
        ],
        "effects": [],
        "range": "4.0.0 - 4.7.8",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "http-proxy-agent": {
        "name": "http-proxy-agent",
        "severity": "low",
        "isDirect": false,
        "via": [
          "@tootallnate/once"
        ],
        "effects": [
          "jsdom"
        ],
        "range": "4.0.1 - 5.0.0",
        "nodes": [
          "node_modules/http-proxy-agent"
        ],
        "fixAvailable": {
          "name": "jest-environment-jsdom",
          "version": "30.3.0",
          "isSemVerMajor": true
        }
      },
      "jest-environment-jsdom": {
        "name": "jest-environment-jsdom",
        "severity": "low",
        "isDirect": true,
        "via": [
          "jsdom"
        ],
        "effects": [],
        "range": "27.0.1 - 30.0.0-rc.1",
        "nodes": [
          "node_modules/jest-environment-jsdom"
        ],
        "fixAvailable": {
          "name": "jest-environment-jsdom",
          "version": "30.3.0",
          "isSemVerMajor": true
        }
      },
      "jsdom": {
        "name": "jsdom",
        "severity": "low",
        "isDirect": false,
        "via": [
          "http-proxy-agent"
        ],
        "effects": [
          "@wikimedia/mw-node-qunit",
          "jest-environment-jsdom"
        ],
        "range": "16.6.0 - 22.1.0",
        "nodes": [
          "node_modules/jest-environment-jsdom/node_modules/jsdom",
          "node_modules/jsdom"
        ],
        "fixAvailable": {
          "name": "jest-environment-jsdom",
          "version": "30.3.0",
          "isSemVerMajor": true
        }
      },
      "minimatch": {
        "name": "minimatch",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113459,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
            "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<3.1.3"
          },
          {
            "source": 1113538,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
            "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
            "severity": "high",
            "cwe": [
              "CWE-407"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<3.1.3"
          },
          {
            "source": 1113546,
            "name": "minimatch",
            "dependency": "minimatch",
            "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
            "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<3.1.4"
          }
        ],
        "effects": [
          "grunt"
        ],
        "range": "<=3.1.3",
        "nodes": [
          "node_modules/grunt/node_modules/minimatch"
        ],
        "fixAvailable": {
          "name": "grunt",
          "version": "0.3.17",
          "isSemVerMajor": true
        }
      },
      "node-forge": {
        "name": "node-forge",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1115545,
            "name": "node-forge",
            "dependency": "node-forge",
            "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
            "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
            "severity": "high",
            "cwe": [
              "CWE-295"
            ],
            "cvss": {
              "score": 7.4,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
            },
            "range": "<=1.3.3"
          },
          {
            "source": 1115546,
            "name": "node-forge",
            "dependency": "node-forge",
            "title": "Forge has signature forgery in Ed25519 due to missing S > L check",
            "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
            "severity": "high",
            "cwe": [
              "CWE-347"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<1.4.0"
          },
          {
            "source": 1115547,
            "name": "node-forge",
            "dependency": "node-forge",
            "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  ",
            "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
            "severity": "high",
            "cwe": [
              "CWE-20",
              "CWE-347"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<1.4.0"
          },
          {
            "source": 1115548,
            "name": "node-forge",
            "dependency": "node-forge",
            "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
            "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
            "severity": "high",
            "cwe": [
              "CWE-835"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<1.4.0"
          }
        ],
        "effects": [],
        "range": "<=1.3.3",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "path-to-regexp": {
        "name": "path-to-regexp",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1115527,
            "name": "path-to-regexp",
            "dependency": "path-to-regexp",
            "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
            "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": "<0.1.13"
          }
        ],
        "effects": [],
        "range": "<0.1.13",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 5,
        "moderate": 1,
        "high": 5,
        "critical": 1,
        "total": 12
      },
      "dependencies": {
        "prod": 40,
        "dev": 1172,
        "optional": 3,
        "peer": 0,
        "peerOptional": 0,
        "total": 1211
      }
    }
  }
}

--- end ---
{"added": 1211, "removed": 0, "changed": 0, "audited": 1212, "funding": 186, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@tootallnate/once": {"name": "@tootallnate/once", "severity": "low", "isDirect": false, "via": [{"source": 1113977, "name": "@tootallnate/once", "dependency": "@tootallnate/once", "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping", "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6", "severity": "low", "cwe": ["CWE-705"], "cvss": {"score": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "range": "<3.0.1"}], "effects": ["http-proxy-agent"], "range": "<3.0.1", "nodes": ["node_modules/@tootallnate/once"], "fixAvailable": {"name": "jest-environment-jsdom", "version": "30.3.0", "isSemVerMajor": true}}, "@wikimedia/mw-node-qunit": {"name": "@wikimedia/mw-node-qunit", "severity": "low", "isDirect": true, "via": ["jsdom"], "effects": [], "range": ">=6.3.0", "nodes": ["node_modules/@wikimedia/mw-node-qunit"], "fixAvailable": {"name": "@wikimedia/mw-node-qunit", "version": "6.2.1", "isSemVerMajor": true}}, "brace-expansion": {"name": "brace-expansion", "severity": "moderate", "isDirect": false, "via": [{"source": 1115540, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<1.1.13"}, {"source": 1115541, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.3"}], "effects": [], "range": "<1.1.13 || >=2.0.0 <2.0.3", "nodes": ["", "", "", "", "", "", "", "", "", ""], "fixAvailable": true}, "grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": ["minimatch"], "effects": ["grunt-eslint"], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "grunt-eslint": {"name": "grunt-eslint", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": "<=1.0.0 || >=18.1.0", "nodes": ["node_modules/grunt-eslint"], "fixAvailable": {"name": "grunt-eslint", "version": "18.0.0", "isSemVerMajor": true}}, "handlebars": {"name": "handlebars", "severity": "critical", "isDirect": false, "via": [{"source": 1115514, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options", "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf", "severity": "high", "cwe": ["CWE-79", "CWE-94", "CWE-116"], "cvss": {"score": 8.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, {"source": 1115515, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial", "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6", "severity": "high", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, {"source": 1115516, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation", "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff", "severity": "high", "cwe": ["CWE-754"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <=4.7.8"}, {"source": 1115538, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block", "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r", "severity": "high", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, {"source": 1115539, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion", "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q", "severity": "critical", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, {"source": 1115544, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection", "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9", "severity": "moderate", "cwe": ["CWE-79", "CWE-1321"], "cvss": {"score": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": ">=4.0.0 <4.7.9"}], "effects": [], "range": "4.0.0 - 4.7.8", "nodes": [""], "fixAvailable": true}, "http-proxy-agent": {"name": "http-proxy-agent", "severity": "low", "isDirect": false, "via": ["@tootallnate/once"], "effects": ["jsdom"], "range": "4.0.1 - 5.0.0", "nodes": ["node_modules/http-proxy-agent"], "fixAvailable": {"name": "jest-environment-jsdom", "version": "30.3.0", "isSemVerMajor": true}}, "jest-environment-jsdom": {"name": "jest-environment-jsdom", "severity": "low", "isDirect": true, "via": ["jsdom"], "effects": [], "range": "27.0.1 - 30.0.0-rc.1", "nodes": ["node_modules/jest-environment-jsdom"], "fixAvailable": {"name": "jest-environment-jsdom", "version": "30.3.0", "isSemVerMajor": true}}, "jsdom": {"name": "jsdom", "severity": "low", "isDirect": false, "via": ["http-proxy-agent"], "effects": ["@wikimedia/mw-node-qunit", "jest-environment-jsdom"], "range": "16.6.0 - 22.1.0", "nodes": ["node_modules/jest-environment-jsdom/node_modules/jsdom", "node_modules/jsdom"], "fixAvailable": {"name": "jest-environment-jsdom", "version": "30.3.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.3"}, {"source": 1113538, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": ["CWE-407"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.3"}, {"source": 1113546, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.4"}], "effects": ["grunt"], "range": "<=3.1.3", "nodes": ["node_modules/grunt/node_modules/minimatch"], "fixAvailable": {"name": "grunt", "version": "0.3.17", "isSemVerMajor": true}}, "node-forge": {"name": "node-forge", "severity": "high", "isDirect": false, "via": [{"source": 1115545, "name": "node-forge", "dependency": "node-forge", "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)", "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25", "severity": "high", "cwe": ["CWE-295"], "cvss": {"score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "range": "<=1.3.3"}, {"source": 1115546, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in Ed25519 due to missing S > L check", "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw", "severity": "high", "cwe": ["CWE-347"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<1.4.0"}, {"source": 1115547, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  ", "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp", "severity": "high", "cwe": ["CWE-20", "CWE-347"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<1.4.0"}, {"source": 1115548, "name": "node-forge", "dependency": "node-forge", "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input", "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx", "severity": "high", "cwe": ["CWE-835"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<1.4.0"}], "effects": [], "range": "<=1.3.3", "nodes": [""], "fixAvailable": true}, "path-to-regexp": {"name": "path-to-regexp", "severity": "high", "isDirect": false, "via": [{"source": 1115527, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters", "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.1.13"}], "effects": [], "range": "<0.1.13", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 5, "moderate": 1, "high": 5, "critical": 1, "total": 12}, "dependencies": {"prod": 40, "dev": 1172, "optional": 3, "peer": 0, "peerOptional": 0, "total": 1211}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated lodash.get@4.4.2: This package is deprecated. Use the optional chaining (?.) operator instead.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated mkdirp@0.3.0: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated sinon@12.0.1: 16.1.1
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 1210 packages, and audited 1211 packages in 17s

186 packages are looking for funding
  run `npm fund` for details

# npm audit report

@tootallnate/once  <3.0.1
@tootallnate/once vulnerable to Incorrect Control Flow Scoping - https://github.com/advisories/GHSA-vpq2-c234-7xj6
fix available via `npm audit fix --force`
Will install jest-environment-jsdom@30.3.0, which is a breaking change
node_modules/@tootallnate/once
  http-proxy-agent  4.0.1 - 5.0.0
  Depends on vulnerable versions of @tootallnate/once
  node_modules/http-proxy-agent
    jsdom  16.6.0 - 22.1.0
    Depends on vulnerable versions of http-proxy-agent
    node_modules/jest-environment-jsdom/node_modules/jsdom
    node_modules/jsdom
      @wikimedia/mw-node-qunit  >=6.3.0
      Depends on vulnerable versions of jsdom
      node_modules/@wikimedia/mw-node-qunit
      jest-environment-jsdom  27.0.1 - 30.0.0-rc.1
      Depends on vulnerable versions of jsdom
      node_modules/jest-environment-jsdom

minimatch  <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix --force`
Will install grunt@0.3.17, which is a breaking change
node_modules/grunt/node_modules/minimatch
  grunt  >=0.4.0-a
  Depends on vulnerable versions of minimatch
  node_modules/grunt
    grunt-eslint  <=1.0.0 || >=18.1.0
    Depends on vulnerable versions of grunt
    node_modules/grunt-eslint

8 vulnerabilities (5 low, 3 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated lodash.get@4.4.2: This package is deprecated. Use the optional chaining (?.) operator instead.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated mkdirp@0.3.0: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated sinon@12.0.1: 16.1.1
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

> cognitive-process-designer@4.0.0 postinstall
> cp -R resources/js/cpd/bpmnlint-plugin-mediawiki-cpd node_modules && npx bpmnlint-pack-config -c .bpmnlintrc -o bpmn-lint.config.js -t es && cp node_modules/bpmn-js/dist/assets/bpmn-font/css/bpmn-embedded.css resources/styles/ext && cp node_modules/bpmn-js/dist/assets/bpmn-js.css resources/styles/ext && cp node_modules/bpmn-js/dist/assets/diagram-js.css resources/styles/ext && cp node_modules/bpmn-js-color-picker/colors/color-picker.css resources/styles/ext && cp node_modules/bpmn-js-bpmnlint/dist/assets/css/bpmn-js-bpmnlint.css resources/styles/ext


added 1210 packages, and audited 1211 packages in 24s

186 packages are looking for funding
  run `npm fund` for details

8 vulnerabilities (5 low, 3 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stderr ---
PASS tests/jest/CpdLinker.test.ts
PASS tests/jest/CpdXml.test.ts

Test Suites: 2 passed, 2 total
Tests:       10 passed, 10 total
Snapshots:   0 total
Time:        5.424 s
Ran all test suites.
--- stdout ---

> cognitive-process-designer@4.0.0 test
> jest && grunt test

Running "eslint:all" (eslint) task

Running "stylelint:all" (stylelint) task
>> Linted 14 files without errors

Running "banana:CognitiveProcessDesigner" (banana) task
>> 1 message directory checked.

Done.

--- end ---
{"1115540": {"source": 1115540, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": "<1.1.13"}, "1115541": {"source": 1115541, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "severity": "moderate", "cwe": ["CWE-400"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "range": ">=2.0.0 <2.0.3"}}
Upgrading n:brace-expansion from 1.1.12, 2.0.2 -> 1.1.13, 2.0.3
{"1115514": {"source": 1115514, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options", "url": "https://github.com/advisories/GHSA-xjpj-3mr7-gcpf", "severity": "high", "cwe": ["CWE-79", "CWE-94", "CWE-116"], "cvss": {"score": 8.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, "1115515": {"source": 1115515, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial", "url": "https://github.com/advisories/GHSA-xhpv-hc6g-r9c6", "severity": "high", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, "1115516": {"source": 1115516, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation", "url": "https://github.com/advisories/GHSA-9cx6-37pm-9jff", "severity": "high", "cwe": ["CWE-754"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=4.0.0 <=4.7.8"}, "1115538": {"source": 1115538, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block", "url": "https://github.com/advisories/GHSA-3mfm-83xf-c92r", "severity": "high", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, "1115539": {"source": 1115539, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has JavaScript Injection via AST Type Confusion", "url": "https://github.com/advisories/GHSA-2w6w-674q-4c4q", "severity": "critical", "cwe": ["CWE-94", "CWE-843"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.7.8"}, "1115544": {"source": 1115544, "name": "handlebars", "dependency": "handlebars", "title": "Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection", "url": "https://github.com/advisories/GHSA-2qvq-rjwj-gvw9", "severity": "moderate", "cwe": ["CWE-79", "CWE-1321"], "cvss": {"score": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": ">=4.0.0 <4.7.9"}}
Upgrading n:handlebars from 4.7.8 -> 4.7.9
{"1115545": {"source": 1115545, "name": "node-forge", "dependency": "node-forge", "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)", "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25", "severity": "high", "cwe": ["CWE-295"], "cvss": {"score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "range": "<=1.3.3"}, "1115546": {"source": 1115546, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in Ed25519 due to missing S > L check", "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw", "severity": "high", "cwe": ["CWE-347"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<1.4.0"}, "1115547": {"source": 1115547, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field  ", "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp", "severity": "high", "cwe": ["CWE-20", "CWE-347"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<1.4.0"}, "1115548": {"source": 1115548, "name": "node-forge", "dependency": "node-forge", "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input", "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx", "severity": "high", "cwe": ["CWE-835"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<1.4.0"}}
Upgrading n:node-forge from 1.3.2 -> 1.4.0
{"1115527": {"source": 1115527, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters", "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<0.1.13"}}
Upgrading n:path-to-regexp from 0.1.12, 6.3.0 -> 0.1.13, 6.3.0
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json

--- end ---
build: Updating npm dependencies

* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
  * https://github.com/advisories/GHSA-f886-m6hf-6m8v
* handlebars: 4.7.8 → 4.7.9
  * https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
  * https://github.com/advisories/GHSA-2w6w-674q-4c4q
  * https://github.com/advisories/GHSA-3mfm-83xf-c92r
  * https://github.com/advisories/GHSA-9cx6-37pm-9jff
  * https://github.com/advisories/GHSA-xhpv-hc6g-r9c6
  * https://github.com/advisories/GHSA-xjpj-3mr7-gcpf
* node-forge: 1.3.2 → 1.4.0
  * https://github.com/advisories/GHSA-2328-f5f3-gj25
  * https://github.com/advisories/GHSA-5m6q-g25r-mvwx
  * https://github.com/advisories/GHSA-ppp5-5v6c-4jwp
  * https://github.com/advisories/GHSA-q67f-28xg-22rw
* path-to-regexp: 0.1.12, 6.3.0 → 0.1.13, 6.3.0
  * https://github.com/advisories/GHSA-37ch-88jc-xwx2

$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmplyp91ljz
--- stdout ---
[REL1_43 eb42d0d] build: Updating npm dependencies
 1 file changed, 40 insertions(+), 41 deletions(-)

--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From eb42d0d83111482843bdead1998f2634d90d6356 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 29 Mar 2026 05:03:54 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* brace-expansion: 1.1.12, 2.0.2 → 1.1.13, 2.0.3
  * https://github.com/advisories/GHSA-f886-m6hf-6m8v
* handlebars: 4.7.8 → 4.7.9
  * https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
  * https://github.com/advisories/GHSA-2w6w-674q-4c4q
  * https://github.com/advisories/GHSA-3mfm-83xf-c92r
  * https://github.com/advisories/GHSA-9cx6-37pm-9jff
  * https://github.com/advisories/GHSA-xhpv-hc6g-r9c6
  * https://github.com/advisories/GHSA-xjpj-3mr7-gcpf
* node-forge: 1.3.2 → 1.4.0
  * https://github.com/advisories/GHSA-2328-f5f3-gj25
  * https://github.com/advisories/GHSA-5m6q-g25r-mvwx
  * https://github.com/advisories/GHSA-ppp5-5v6c-4jwp
  * https://github.com/advisories/GHSA-q67f-28xg-22rw
* path-to-regexp: 0.1.12, 6.3.0 → 0.1.13, 6.3.0
  * https://github.com/advisories/GHSA-37ch-88jc-xwx2

Change-Id: I50b6c4de32f0a65811763f8839fc11be1aaf34ee
---
 package-lock.json | 81 +++++++++++++++++++++++------------------------
 1 file changed, 40 insertions(+), 41 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 5ebbbb4..cc5973c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2111,9 +2111,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -2210,9 +2210,9 @@
 			}
 		},
 		"node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -4139,9 +4139,9 @@
 			}
 		},
 		"node_modules/@wikimedia/mw-node-qunit/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -5078,9 +5078,9 @@
 			"license": "MIT"
 		},
 		"node_modules/brace-expansion": {
-			"version": "2.0.2",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-			"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+			"integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0"
@@ -7139,9 +7139,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/eslint-plugin-unicorn/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -7443,9 +7443,9 @@
 			"license": "Python-2.0"
 		},
 		"node_modules/eslint/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -7840,11 +7840,10 @@
 			"license": "MIT"
 		},
 		"node_modules/express/node_modules/path-to-regexp": {
-			"version": "0.1.12",
-			"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-			"integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
-			"dev": true,
-			"license": "MIT"
+			"version": "0.1.13",
+			"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+			"integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+			"dev": true
 		},
 		"node_modules/extend": {
 			"version": "3.0.2",
@@ -8383,9 +8382,9 @@
 			"dev": true
 		},
 		"node_modules/glob/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -8798,9 +8797,9 @@
 			}
 		},
 		"node_modules/grunt/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -8850,9 +8849,9 @@
 			"license": "MIT"
 		},
 		"node_modules/handlebars": {
-			"version": "4.7.8",
-			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.8.tgz",
-			"integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+			"version": "4.7.9",
+			"resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
+			"integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
 			"dev": true,
 			"dependencies": {
 				"minimist": "^1.2.5",
@@ -11610,9 +11609,9 @@
 			}
 		},
 		"node_modules/multimatch/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
@@ -11765,9 +11764,9 @@
 			}
 		},
 		"node_modules/node-forge": {
-			"version": "1.3.2",
-			"resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.2.tgz",
-			"integrity": "sha512-6xKiQ+cph9KImrRh0VsjH2d8/GXA4FIMlgU4B757iI1ApvcyA9VlouP0yZJha01V+huImO+kKMU7ih+2+E14fw==",
+			"version": "1.4.0",
+			"resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+			"integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
 			"dev": true,
 			"engines": {
 				"node": ">= 6.13.0"
@@ -14972,9 +14971,9 @@
 			}
 		},
 		"node_modules/test-exclude/node_modules/brace-expansion": {
-			"version": "1.1.12",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-			"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+			"version": "1.1.13",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+			"integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
 			"dev": true,
 			"dependencies": {
 				"balanced-match": "^1.0.0",
-- 
2.47.3


--- end ---
Source code is licensed under the AGPL.