This run took 43 seconds.
$ date
--- stdout ---
Sat Apr 4 10:39:43 UTC 2026
--- end ---
$ git clone file:///srv/git/unicodejs.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
bb791afe4470fd64279894d19842a0023d87058c refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"grunt-legacy-log",
"grunt-legacy-util",
"minimatch"
],
"effects": [
"grunt-contrib-clean",
"grunt-contrib-concat",
"grunt-eslint",
"grunt-karma"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-contrib-clean": {
"name": "grunt-contrib-clean",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt-contrib-clean"
],
"fixAvailable": {
"name": "grunt-contrib-clean",
"version": "0.3.2",
"isSemVerMajor": true
}
},
"grunt-contrib-concat": {
"name": "grunt-contrib-concat",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.1.2-rc5",
"nodes": [
"node_modules/grunt-contrib-concat"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-karma": {
"name": "grunt-karma",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/grunt-karma"
],
"fixAvailable": false
},
"grunt-legacy-log": {
"name": "grunt-legacy-log",
"severity": "high",
"isDirect": false,
"via": [
"grunt-legacy-log-utils",
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-log"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-legacy-log-utils": {
"name": "grunt-legacy-log-utils",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt-legacy-log"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/grunt-legacy-log-utils"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-legacy-util": {
"name": "grunt-legacy-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-util"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"lodash": {
"name": "lodash",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115806,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115810,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [
"grunt-legacy-log",
"grunt-legacy-log-utils",
"grunt-legacy-util"
],
"range": "<=4.17.23",
"nodes": [
"node_modules/lodash"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 10,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 1,
"dev": 556,
"optional": 1,
"peer": 1,
"peerOptional": 0,
"total": 556
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"grunt-legacy-log",
"grunt-legacy-util",
"minimatch"
],
"effects": [
"grunt-contrib-clean",
"grunt-contrib-concat",
"grunt-eslint",
"grunt-karma"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-contrib-clean": {
"name": "grunt-contrib-clean",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt-contrib-clean"
],
"fixAvailable": {
"name": "grunt-contrib-clean",
"version": "0.3.2",
"isSemVerMajor": true
}
},
"grunt-contrib-concat": {
"name": "grunt-contrib-concat",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.1.2-rc5",
"nodes": [
"node_modules/grunt-contrib-concat"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-karma": {
"name": "grunt-karma",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/grunt-karma"
],
"fixAvailable": false
},
"grunt-legacy-log": {
"name": "grunt-legacy-log",
"severity": "high",
"isDirect": false,
"via": [
"grunt-legacy-log-utils",
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-log"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-legacy-log-utils": {
"name": "grunt-legacy-log-utils",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt-legacy-log"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/grunt-legacy-log-utils"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-legacy-util": {
"name": "grunt-legacy-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-util"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"lodash": {
"name": "lodash",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115806,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115810,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [
"grunt-legacy-log",
"grunt-legacy-log-utils",
"grunt-legacy-util"
],
"range": "<=4.17.23",
"nodes": [
"node_modules/lodash"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 10,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 1,
"dev": 556,
"optional": 1,
"peer": 1,
"peerOptional": 0,
"total": 556
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 556,
"removed": 0,
"changed": 0,
"audited": 557,
"funding": 97,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"grunt": {
"name": "grunt",
"severity": "high",
"isDirect": true,
"via": [
"grunt-legacy-log",
"grunt-legacy-util",
"minimatch"
],
"effects": [
"grunt-contrib-clean",
"grunt-contrib-concat",
"grunt-eslint",
"grunt-karma"
],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-contrib-clean": {
"name": "grunt-contrib-clean",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.4.0-a",
"nodes": [
"node_modules/grunt-contrib-clean"
],
"fixAvailable": {
"name": "grunt-contrib-clean",
"version": "0.3.2",
"isSemVerMajor": true
}
},
"grunt-contrib-concat": {
"name": "grunt-contrib-concat",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": ">=0.1.2-rc5",
"nodes": [
"node_modules/grunt-contrib-concat"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-eslint": {
"name": "grunt-eslint",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "<=1.0.0 || >=18.1.0",
"nodes": [
"node_modules/grunt-eslint"
],
"fixAvailable": {
"name": "grunt-eslint",
"version": "18.0.0",
"isSemVerMajor": true
}
},
"grunt-karma": {
"name": "grunt-karma",
"severity": "high",
"isDirect": true,
"via": [
"grunt"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/grunt-karma"
],
"fixAvailable": false
},
"grunt-legacy-log": {
"name": "grunt-legacy-log",
"severity": "high",
"isDirect": false,
"via": [
"grunt-legacy-log-utils",
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-log"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-legacy-log-utils": {
"name": "grunt-legacy-log-utils",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt-legacy-log"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/grunt-legacy-log-utils"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"grunt-legacy-util": {
"name": "grunt-legacy-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash"
],
"effects": [
"grunt"
],
"range": ">=1.0.0-rc1",
"nodes": [
"node_modules/grunt-legacy-util"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"lodash": {
"name": "lodash",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115806,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115810,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [
"grunt-legacy-log",
"grunt-legacy-log-utils",
"grunt-legacy-util"
],
"range": "<=4.17.23",
"nodes": [
"node_modules/lodash"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
}
],
"effects": [
"grunt"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": {
"name": "grunt-contrib-concat",
"version": "0.1.1",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 10,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 1,
"dev": 556,
"optional": 1,
"peer": 1,
"peerOptional": 0,
"total": 556
}
}
}
}
--- end ---
{"added": 556, "removed": 0, "changed": 0, "audited": 557, "funding": 97, "audit": {"auditReportVersion": 2, "vulnerabilities": {"grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": ["grunt-legacy-log", "grunt-legacy-util", "minimatch"], "effects": ["grunt-contrib-clean", "grunt-contrib-concat", "grunt-eslint", "grunt-karma"], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "grunt-contrib-clean": {"name": "grunt-contrib-clean", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": ">=0.4.0-a", "nodes": ["node_modules/grunt-contrib-clean"], "fixAvailable": {"name": "grunt-contrib-clean", "version": "0.3.2", "isSemVerMajor": true}}, "grunt-contrib-concat": {"name": "grunt-contrib-concat", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": ">=0.1.2-rc5", "nodes": ["node_modules/grunt-contrib-concat"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "grunt-eslint": {"name": "grunt-eslint", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": "<=1.0.0 || >=18.1.0", "nodes": ["node_modules/grunt-eslint"], "fixAvailable": {"name": "grunt-eslint", "version": "18.0.0", "isSemVerMajor": true}}, "grunt-karma": {"name": "grunt-karma", "severity": "high", "isDirect": true, "via": ["grunt"], "effects": [], "range": "*", "nodes": ["node_modules/grunt-karma"], "fixAvailable": false}, "grunt-legacy-log": {"name": "grunt-legacy-log", "severity": "high", "isDirect": false, "via": ["grunt-legacy-log-utils", "lodash"], "effects": ["grunt"], "range": ">=1.0.0-rc1", "nodes": ["node_modules/grunt-legacy-log"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "grunt-legacy-log-utils": {"name": "grunt-legacy-log-utils", "severity": "high", "isDirect": false, "via": ["lodash"], "effects": ["grunt-legacy-log"], "range": ">=1.0.0", "nodes": ["node_modules/grunt-legacy-log-utils"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "grunt-legacy-util": {"name": "grunt-legacy-util", "severity": "high", "isDirect": false, "via": ["lodash"], "effects": ["grunt"], "range": ">=1.0.0-rc1", "nodes": ["node_modules/grunt-legacy-util"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "lodash": {"name": "lodash", "severity": "high", "isDirect": false, "via": [{"source": 1115806, "name": "lodash", "dependency": "lodash", "title": "lodash vulnerable to Code Injection via `_.template` imports key names", "url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc", "severity": "high", "cwe": ["CWE-94"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=4.0.0 <=4.17.23"}, {"source": 1115810, "name": "lodash", "dependency": "lodash", "title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}, "range": "<=4.17.23"}], "effects": ["grunt-legacy-log", "grunt-legacy-log-utils", "grunt-legacy-util"], "range": "<=4.17.23", "nodes": ["node_modules/lodash"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1113459, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.3"}, {"source": 1113538, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "severity": "high", "cwe": ["CWE-407"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.3"}, {"source": 1113546, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.4"}], "effects": ["grunt"], "range": "<=3.1.3", "nodes": ["node_modules/minimatch"], "fixAvailable": {"name": "grunt-contrib-concat", "version": "0.1.1", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 10, "critical": 0, "total": 10}, "dependencies": {"prod": 1, "dev": 556, "optional": 1, "peer": 1, "peerOptional": 0, "total": 556}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 555 packages, and audited 556 packages in 5s
97 packages are looking for funding
run `npm fund` for details
# npm audit report
lodash <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix --force`
Will install grunt-eslint@18.0.0, which is a breaking change
node_modules/lodash
grunt-legacy-log >=1.0.0-rc1
Depends on vulnerable versions of grunt-legacy-log-utils
Depends on vulnerable versions of lodash
node_modules/grunt-legacy-log
grunt >=0.4.0-a
Depends on vulnerable versions of grunt-legacy-log
Depends on vulnerable versions of grunt-legacy-util
Depends on vulnerable versions of minimatch
node_modules/grunt
grunt-contrib-clean >=0.4.0-a
Depends on vulnerable versions of grunt
node_modules/grunt-contrib-clean
grunt-contrib-concat >=0.1.2-rc5
Depends on vulnerable versions of grunt
node_modules/grunt-contrib-concat
grunt-eslint <=1.0.0 || >=18.1.0
Depends on vulnerable versions of grunt
node_modules/grunt-eslint
grunt-karma *
Depends on vulnerable versions of grunt
node_modules/grunt-karma
grunt-legacy-log-utils >=1.0.0
Depends on vulnerable versions of lodash
node_modules/grunt-legacy-log-utils
grunt-legacy-util >=1.0.0-rc1
Depends on vulnerable versions of lodash
node_modules/grunt-legacy-util
minimatch <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix --force`
Will install grunt-eslint@18.0.0, which is a breaking change
node_modules/minimatch
10 high severity vulnerabilities
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 555 packages, and audited 556 packages in 5s
97 packages are looking for funding
run `npm fund` for details
10 high severity vulnerabilities
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stderr ---
[baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`
--- stdout ---
> unicodejs@15.0.0 test
> grunt test
Running "set-meta" task
Running "set-dev" task
Running "clean:dist" (clean) task
>> 0 paths cleaned.
Running "concat:all" (concat) task
Running "copy:dist" (copy) task
Copied 3 files
Running "copy:licence" (copy) task
Copied 1 file
Running "eslint:all" (eslint) task
Running "karma:chrome" (karma) task
04 04 2026 10:40:07.673:INFO [karma-server]: Karma v6.4.4 server started at http://localhost:9876/
04 04 2026 10:40:07.675:INFO [launcher]: Launching browsers ChromeCustom with concurrency unlimited
04 04 2026 10:40:07.680:INFO [launcher]: Starting browser ChromeHeadless
04 04 2026 10:40:08.704:INFO [Chrome Headless 145.0.0.0 (Linux x86_64)]: Connected on socket UuVAyizv-kxl3sCKAAAB with id 71228086
.........
Chrome Headless 145.0.0.0 (Linux x86_64): Executed 9 of 9 SUCCESS (0.103 secs / 0.085 secs)
=============================== Coverage summary ===============================
Statements : 100% ( 248/248 )
Branches : 100% ( 238/238 )
Functions : 100% ( 27/27 )
Lines : 100% ( 246/246 )
================================================================================
Running "karma:firefox" (karma) task
04 04 2026 10:40:09.191:INFO [karma-server]: Karma v6.4.4 server started at http://localhost:9876/
04 04 2026 10:40:09.192:INFO [launcher]: Launching browsers FirefoxHeadless with concurrency unlimited
04 04 2026 10:40:09.194:INFO [launcher]: Starting browser FirefoxHeadless
04 04 2026 10:40:12.791:INFO [Firefox 140.0 (Linux x86_64)]: Connected on socket DKvKR5V4IsL-ga_lAAAD with id 89037090
.........
Firefox 140.0 (Linux x86_64): Executed 9 of 9 SUCCESS (0.148 secs / 0.088 secs)
=============================== Coverage summary ===============================
Statements : 100% ( 248/248 )
Branches : 100% ( 238/238 )
Functions : 100% ( 27/27 )
Lines : 100% ( 246/246 )
================================================================================
Done.
--- end ---
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
[DNM] there are no updates
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmponfmovmw
--- stdout ---
On branch master
Your branch is up to date with 'origin/master'.
nothing to commit, working tree clean
--- end ---