mediawiki/extensions/CirrusSearch: REL1_46 (log #2502910)

source • patches

This run took 107 seconds.

From 0d4ec8e4321176bf5116eaf672e371334941543f Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 14 Jun 2026 03:35:03 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* esbuild: 0.25.12 → 0.28.1
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr
* tsx: 4.20.6 → 4.22.4
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr

Change-Id: I348273894b846adf28a7f1dd4bd19bfd90a47a87
---
 package-lock.json | 251 ++++++++++++++++++++--------------------------
 1 file changed, 111 insertions(+), 140 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 31d8bc5..11bb450 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -796,14 +796,13 @@
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-			"integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+			"integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
 			"cpu": [
 				"ppc64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"aix"
@@ -813,14 +812,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-			"integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+			"integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
 			"cpu": [
 				"arm"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -830,14 +828,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-			"integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+			"integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -847,14 +844,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-			"integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+			"integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -864,14 +860,13 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-			"integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+			"integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"darwin"
@@ -881,14 +876,13 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-			"integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+			"integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"darwin"
@@ -898,14 +892,13 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"freebsd"
@@ -915,14 +908,13 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-			"integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"freebsd"
@@ -932,14 +924,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-			"integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+			"integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
 			"cpu": [
 				"arm"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -949,14 +940,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-			"integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+			"integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -966,14 +956,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ia32": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-			"integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+			"integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
 			"cpu": [
 				"ia32"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -983,14 +972,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-loong64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-			"integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+			"integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
 			"cpu": [
 				"loong64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1000,14 +988,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-mips64el": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-			"integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+			"integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
 			"cpu": [
 				"mips64el"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1017,14 +1004,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ppc64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-			"integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+			"integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
 			"cpu": [
 				"ppc64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1034,14 +1020,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-riscv64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-			"integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+			"integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
 			"cpu": [
 				"riscv64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1051,14 +1036,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-s390x": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-			"integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+			"integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
 			"cpu": [
 				"s390x"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1068,14 +1052,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-			"integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+			"integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1085,14 +1068,13 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"netbsd"
@@ -1102,14 +1084,13 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-			"integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"netbsd"
@@ -1119,14 +1100,13 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openbsd"
@@ -1136,14 +1116,13 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-			"integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openbsd"
@@ -1153,14 +1132,13 @@
 			}
 		},
 		"node_modules/@esbuild/openharmony-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-			"integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+			"integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openharmony"
@@ -1170,14 +1148,13 @@
 			}
 		},
 		"node_modules/@esbuild/sunos-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-			"integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+			"integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"sunos"
@@ -1187,14 +1164,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-			"integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+			"integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -1204,14 +1180,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-ia32": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-			"integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+			"integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
 			"cpu": [
 				"ia32"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -1221,14 +1196,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-			"integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+			"integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -5656,12 +5630,11 @@
 			}
 		},
 		"node_modules/esbuild": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-			"integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+			"integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
 			"dev": true,
 			"hasInstallScript": true,
-			"license": "MIT",
 			"bin": {
 				"esbuild": "bin/esbuild"
 			},
@@ -5669,32 +5642,32 @@
 				"node": ">=18"
 			},
 			"optionalDependencies": {
-				"@esbuild/aix-ppc64": "0.25.12",
-				"@esbuild/android-arm": "0.25.12",
-				"@esbuild/android-arm64": "0.25.12",
-				"@esbuild/android-x64": "0.25.12",
-				"@esbuild/darwin-arm64": "0.25.12",
-				"@esbuild/darwin-x64": "0.25.12",
-				"@esbuild/freebsd-arm64": "0.25.12",
-				"@esbuild/freebsd-x64": "0.25.12",
-				"@esbuild/linux-arm": "0.25.12",
-				"@esbuild/linux-arm64": "0.25.12",
-				"@esbuild/linux-ia32": "0.25.12",
-				"@esbuild/linux-loong64": "0.25.12",
-				"@esbuild/linux-mips64el": "0.25.12",
-				"@esbuild/linux-ppc64": "0.25.12",
-				"@esbuild/linux-riscv64": "0.25.12",
-				"@esbuild/linux-s390x": "0.25.12",
-				"@esbuild/linux-x64": "0.25.12",
-				"@esbuild/netbsd-arm64": "0.25.12",
-				"@esbuild/netbsd-x64": "0.25.12",
-				"@esbuild/openbsd-arm64": "0.25.12",
-				"@esbuild/openbsd-x64": "0.25.12",
-				"@esbuild/openharmony-arm64": "0.25.12",
-				"@esbuild/sunos-x64": "0.25.12",
-				"@esbuild/win32-arm64": "0.25.12",
-				"@esbuild/win32-ia32": "0.25.12",
-				"@esbuild/win32-x64": "0.25.12"
+				"@esbuild/aix-ppc64": "0.28.1",
+				"@esbuild/android-arm": "0.28.1",
+				"@esbuild/android-arm64": "0.28.1",
+				"@esbuild/android-x64": "0.28.1",
+				"@esbuild/darwin-arm64": "0.28.1",
+				"@esbuild/darwin-x64": "0.28.1",
+				"@esbuild/freebsd-arm64": "0.28.1",
+				"@esbuild/freebsd-x64": "0.28.1",
+				"@esbuild/linux-arm": "0.28.1",
+				"@esbuild/linux-arm64": "0.28.1",
+				"@esbuild/linux-ia32": "0.28.1",
+				"@esbuild/linux-loong64": "0.28.1",
+				"@esbuild/linux-mips64el": "0.28.1",
+				"@esbuild/linux-ppc64": "0.28.1",
+				"@esbuild/linux-riscv64": "0.28.1",
+				"@esbuild/linux-s390x": "0.28.1",
+				"@esbuild/linux-x64": "0.28.1",
+				"@esbuild/netbsd-arm64": "0.28.1",
+				"@esbuild/netbsd-x64": "0.28.1",
+				"@esbuild/openbsd-arm64": "0.28.1",
+				"@esbuild/openbsd-x64": "0.28.1",
+				"@esbuild/openharmony-arm64": "0.28.1",
+				"@esbuild/sunos-x64": "0.28.1",
+				"@esbuild/win32-arm64": "0.28.1",
+				"@esbuild/win32-ia32": "0.28.1",
+				"@esbuild/win32-x64": "0.28.1"
 			}
 		},
 		"node_modules/escalade": {
@@ -13915,14 +13888,12 @@
 			"license": "0BSD"
 		},
 		"node_modules/tsx": {
-			"version": "4.20.6",
-			"resolved": "https://registry.npmjs.org/tsx/-/tsx-4.20.6.tgz",
-			"integrity": "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==",
+			"version": "4.22.4",
+			"resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
+			"integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
 			"dev": true,
-			"license": "MIT",
 			"dependencies": {
-				"esbuild": "~0.25.0",
-				"get-tsconfig": "^4.7.5"
+				"esbuild": "~0.28.0"
 			},
 			"bin": {
 				"tsx": "dist/cli.mjs"
-- 
2.47.3


$ date
--- stdout ---
Sun Jun 14 03:33:44 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-CirrusSearch.git /src/repo --depth=1 -b REL1_46
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_46
--- stdout ---
9ec2678bea77e8a55af7671751d89a3b6288dcce refs/heads/REL1_46

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@cucumber/cucumber": {
      "name": "@cucumber/cucumber",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/gherkin-utils",
        "@cucumber/messages",
        "tmp"
      ],
      "effects": [],
      "range": "<=12.2.0",
      "nodes": [
        "node_modules/@cucumber/cucumber"
      ],
      "fixAvailable": true
    },
    "@cucumber/gherkin": {
      "name": "@cucumber/gherkin",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/messages"
      ],
      "effects": [
        "@cucumber/gherkin-utils"
      ],
      "range": "<=34.0.0",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/@cucumber/gherkin",
        "node_modules/@cucumber/gherkin",
        "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/gherkin"
      ],
      "fixAvailable": true
    },
    "@cucumber/gherkin-utils": {
      "name": "@cucumber/gherkin-utils",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/messages"
      ],
      "effects": [
        "@cucumber/cucumber"
      ],
      "range": "<=10.0.0",
      "nodes": [
        "node_modules/@cucumber/gherkin-utils"
      ],
      "fixAvailable": true
    },
    "@cucumber/messages": {
      "name": "@cucumber/messages",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [
        "@cucumber/cucumber",
        "@cucumber/gherkin",
        "@cucumber/gherkin-utils",
        "@wdio/cucumber-framework"
      ],
      "range": "<=28.1.0",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/@cucumber/messages",
        "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/messages",
        "node_modules/@cucumber/gherkin/node_modules/@cucumber/messages",
        "node_modules/@cucumber/messages"
      ],
      "fixAvailable": {
        "name": "@wdio/cucumber-framework",
        "version": "6.11.1",
        "isSemVerMajor": true
      }
    },
    "@fastify/ajv-compiler": {
      "name": "@fastify/ajv-compiler",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-uri"
      ],
      "effects": [
        "fastify"
      ],
      "range": "3.1.0 - 3.6.0",
      "nodes": [
        "node_modules/@fastify/ajv-compiler"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "@fastify/fast-json-stringify-compiler": {
      "name": "@fastify/fast-json-stringify-compiler",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-json-stringify"
      ],
      "effects": [],
      "range": "3.0.0 - 5.0.0-pre.fv5.1",
      "nodes": [
        "node_modules/@fastify/fast-json-stringify-compiler"
      ],
      "fixAvailable": true
    },
    "@wdio/cucumber-framework": {
      "name": "@wdio/cucumber-framework",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/messages"
      ],
      "effects": [],
      "range": ">=7.0.0-beta.0",
      "nodes": [
        "node_modules/@wdio/cucumber-framework"
      ],
      "fixAvailable": {
        "name": "@wdio/cucumber-framework",
        "version": "6.11.1",
        "isSemVerMajor": true
      }
    },
    "@wdio/mocha-framework": {
      "name": "@wdio/mocha-framework",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mocha"
      ],
      "effects": [],
      "range": ">=7.7.4",
      "nodes": [
        "node_modules/@wdio/mocha-framework"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "esbuild": {
      "name": "esbuild",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120679,
          "name": "esbuild",
          "dependency": "esbuild",
          "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",
          "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr",
          "severity": "high",
          "cwe": [
            "CWE-426",
            "CWE-494"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=0.17.0 <0.28.1"
        }
      ],
      "effects": [
        "tsx"
      ],
      "range": "0.17.0 - 0.28.0",
      "nodes": [
        "node_modules/esbuild"
      ],
      "fixAvailable": true
    },
    "fast-json-stringify": {
      "name": "fast-json-stringify",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-uri"
      ],
      "effects": [
        "@fastify/fast-json-stringify-compiler",
        "fastify"
      ],
      "range": "3.1.0 - 6.0.0",
      "nodes": [
        "node_modules/fast-json-stringify"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "fast-uri": {
      "name": "fast-uri",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1117870,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
          "url": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=3.1.0"
        },
        {
          "source": 1117884,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
          "url": "https://github.com/advisories/GHSA-v39h-62p7-jpjc",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=3.1.1"
        }
      ],
      "effects": [
        "@fastify/ajv-compiler",
        "fast-json-stringify"
      ],
      "range": "<=3.1.1",
      "nodes": [
        "node_modules/fast-uri"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "fastify": {
      "name": "fastify",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@fastify/ajv-compiler",
        "@fastify/fast-json-stringify-compiler",
        {
          "source": 1112876,
          "name": "fastify",
          "dependency": "fastify",
          "title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
          "url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c",
          "severity": "low",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=5.7.2"
        },
        {
          "source": 1112877,
          "name": "fastify",
          "dependency": "fastify",
          "title": "Fastify's Content-Type header tab character allows body validation bypass",
          "url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<5.7.2"
        },
        {
          "source": 1115367,
          "name": "fastify",
          "dependency": "fastify",
          "title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
          "url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf",
          "severity": "moderate",
          "cwe": [
            "CWE-348"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
          },
          "range": "<=5.8.2"
        },
        "fast-json-stringify"
      ],
      "effects": [],
      "range": "<=5.8.2",
      "nodes": [
        "node_modules/fastify"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "mocha": {
      "name": "mocha",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "serialize-javascript"
      ],
      "effects": [
        "@wdio/mocha-framework"
      ],
      "range": "8.2.0 - 12.0.0-beta-2",
      "nodes": [
        "node_modules/mocha"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": "0.1.6 - 2.1.3",
      "nodes": [
        "node_modules/mwbot",
        "node_modules/wdio-mediawiki/node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113719,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "moderate",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": true,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie",
        "uuid"
      ],
      "effects": [
        "mwbot",
        "request-promise-core",
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "request-promise-core": {
      "name": "request-promise-core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request-promise-core"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-native": {
      "name": "request-promise-native",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-core"
      ],
      "effects": [],
      "range": ">=1.0.0",
      "nodes": [
        "node_modules/request-promise-native"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "serialize-javascript": {
      "name": "serialize-javascript",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113686,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
          "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
          "severity": "high",
          "cwe": [
            "CWE-96"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=7.0.2"
        },
        {
          "source": 1119440,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
          "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-834"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=5.0.0 <7.0.5"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<=7.0.4",
      "nodes": [
        "node_modules/serialize-javascript"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        },
        {
          "source": 1120654,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
          "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.2.6"
        }
      ],
      "effects": [
        "@cucumber/cucumber"
      ],
      "range": "<=0.2.5",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": true
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "tsx": {
      "name": "tsx",
      "severity": "high",
      "isDirect": false,
      "via": [
        "esbuild"
      ],
      "effects": [],
      "range": "3.13.0 - 4.21.1",
      "nodes": [
        "node_modules/tsx"
      ],
      "fixAvailable": true
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "@cucumber/messages",
        "request"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/uuid",
        "node_modules/@cucumber/gherkin-utils/node_modules/uuid",
        "node_modules/@cucumber/gherkin/node_modules/uuid",
        "node_modules/request/node_modules/uuid",
        "node_modules/uuid"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [],
      "range": "<=5.1.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.5.2",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 14,
      "high": 9,
      "critical": 2,
      "total": 25
    },
    "dependencies": {
      "prod": 114,
      "dev": 1009,
      "optional": 38,
      "peer": 2,
      "peerOptional": 0,
      "total": 1123
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 40 installs, 0 updates, 0 removals
  - Locking composer/pcre (dev-main d5a341b)
  - Locking composer/semver (dev-main 09af5e8)
  - Locking composer/spdx-licenses (1.5.10)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking danog/advanced-json-rpc (v3.2.3)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.1)
  - Locking doctrine/deprecations (1.2.x-dev a2d13f1)
  - Locking mediawiki/mediawiki-codesniffer (v50.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.20.0)
  - Locking mediawiki/minus-x (2.0.1)
  - Locking mediawiki/phan-taint-check-plugin (9.1.0)
  - Locking netresearch/jsonmapper (v5.0.1)
  - Locking phan/phan (6.0.2)
  - Locking phan/tolerant-php-parser (v0.2.0)
  - Locking phan/var_representation_polyfill (0.1.4)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.4.0)
  - Locking phpcsstandards/phpcsutils (dev-develop 0faa84f)
  - Locking phpdocumentor/reflection-common (dev-master a0eeab5)
  - Locking phpdocumentor/reflection-docblock (6.x-dev 7bae675)
  - Locking phpdocumentor/type-resolver (2.x-dev b2abba8)
  - Locking phpstan/phpdoc-parser (2.3.x-dev 0693faf)
  - Locking psr/container (dev-master 7079847)
  - Locking psr/log (1.1.4)
  - Locking sabre/event (6.1.0)
  - Locking squizlabs/php_codesniffer (3.13.5)
  - Locking symfony/console (8.2.x-dev a48e111)
  - Locking symfony/deprecation-contracts (dev-main f3202fa)
  - Locking symfony/polyfill-ctype (1.x-dev 141046a)
  - Locking symfony/polyfill-intl-grapheme (1.x-dev e9247d2)
  - Locking symfony/polyfill-intl-normalizer (1.x-dev 2d446c2)
  - Locking symfony/polyfill-mbstring (1.x-dev d3d318b)
  - Locking symfony/polyfill-php85 (1.x-dev ba2ba04)
  - Locking symfony/service-contracts (dev-main bdb19e0)
  - Locking symfony/string (8.2.x-dev afd5944)
  - Locking webmozart/assert (2.4.0)
  - Locking wikimedia/lucene-explain-parser (2.0.0)
  - Locking wikimedia/textcat (2.0.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 40 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing squizlabs/php_codesniffer (3.13.5): Extracting archive
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.1): Extracting archive
  - Installing composer/pcre (dev-main d5a341b): Extracting archive
  - Installing phpcsstandards/phpcsutils (dev-develop 0faa84f): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
  - Installing symfony/polyfill-mbstring (1.x-dev d3d318b): Extracting archive
  - Installing composer/spdx-licenses (1.5.10): Extracting archive
  - Installing composer/semver (dev-main 09af5e8): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v50.0.0): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (1.x-dev 2d446c2): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (1.x-dev e9247d2): Extracting archive
  - Installing symfony/polyfill-ctype (1.x-dev 141046a): Extracting archive
  - Installing symfony/string (8.2.x-dev afd5944): Extracting archive
  - Installing symfony/deprecation-contracts (dev-main f3202fa): Extracting archive
  - Installing psr/container (dev-master 7079847): Extracting archive
  - Installing symfony/service-contracts (dev-main bdb19e0): Extracting archive
  - Installing symfony/polyfill-php85 (1.x-dev ba2ba04): Extracting archive
  - Installing symfony/console (8.2.x-dev a48e111): Extracting archive
  - Installing sabre/event (6.1.0): Extracting archive
  - Installing phan/var_representation_polyfill (0.1.4): Extracting archive
  - Installing phan/tolerant-php-parser (v0.2.0): Extracting archive
  - Installing netresearch/jsonmapper (v5.0.1): Extracting archive
  - Installing webmozart/assert (2.4.0): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.x-dev 0693faf): Extracting archive
  - Installing phpdocumentor/reflection-common (dev-master a0eeab5): Extracting archive
  - Installing doctrine/deprecations (1.2.x-dev a2d13f1): Extracting archive
  - Installing phpdocumentor/type-resolver (2.x-dev b2abba8): Extracting archive
  - Installing phpdocumentor/reflection-docblock (6.x-dev 7bae675): Extracting archive
  - Installing danog/advanced-json-rpc (v3.2.3): Extracting archive
  - Installing psr/log (1.1.4): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (6.0.2): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (9.1.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.20.0): Extracting archive
  - Installing mediawiki/minus-x (2.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  - Installing wikimedia/lucene-explain-parser (2.0.0): Extracting archive
  - Installing wikimedia/textcat (2.0.0): Extracting archive
  0/38 [>---------------------------]   0%
 29/38 [=====================>------]  76%
 37/38 [===========================>]  97%
 38/38 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
17 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@cucumber/cucumber": {
      "name": "@cucumber/cucumber",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/gherkin-utils",
        "@cucumber/messages",
        "tmp"
      ],
      "effects": [],
      "range": "<=12.2.0",
      "nodes": [
        "node_modules/@cucumber/cucumber"
      ],
      "fixAvailable": true
    },
    "@cucumber/gherkin": {
      "name": "@cucumber/gherkin",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/messages"
      ],
      "effects": [
        "@cucumber/gherkin-utils"
      ],
      "range": "<=34.0.0",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/@cucumber/gherkin",
        "node_modules/@cucumber/gherkin",
        "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/gherkin"
      ],
      "fixAvailable": true
    },
    "@cucumber/gherkin-utils": {
      "name": "@cucumber/gherkin-utils",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/messages"
      ],
      "effects": [
        "@cucumber/cucumber"
      ],
      "range": "<=10.0.0",
      "nodes": [
        "node_modules/@cucumber/gherkin-utils"
      ],
      "fixAvailable": true
    },
    "@cucumber/messages": {
      "name": "@cucumber/messages",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [
        "@cucumber/cucumber",
        "@cucumber/gherkin",
        "@cucumber/gherkin-utils",
        "@wdio/cucumber-framework"
      ],
      "range": "<=28.1.0",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/@cucumber/messages",
        "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/messages",
        "node_modules/@cucumber/gherkin/node_modules/@cucumber/messages",
        "node_modules/@cucumber/messages"
      ],
      "fixAvailable": {
        "name": "@wdio/cucumber-framework",
        "version": "6.11.1",
        "isSemVerMajor": true
      }
    },
    "@fastify/ajv-compiler": {
      "name": "@fastify/ajv-compiler",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-uri"
      ],
      "effects": [
        "fastify"
      ],
      "range": "3.1.0 - 3.6.0",
      "nodes": [
        "node_modules/@fastify/ajv-compiler"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "@fastify/fast-json-stringify-compiler": {
      "name": "@fastify/fast-json-stringify-compiler",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-json-stringify"
      ],
      "effects": [],
      "range": "3.0.0 - 5.0.0-pre.fv5.1",
      "nodes": [
        "node_modules/@fastify/fast-json-stringify-compiler"
      ],
      "fixAvailable": true
    },
    "@wdio/cucumber-framework": {
      "name": "@wdio/cucumber-framework",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "@cucumber/gherkin",
        "@cucumber/messages"
      ],
      "effects": [],
      "range": ">=7.0.0-beta.0",
      "nodes": [
        "node_modules/@wdio/cucumber-framework"
      ],
      "fixAvailable": {
        "name": "@wdio/cucumber-framework",
        "version": "6.11.1",
        "isSemVerMajor": true
      }
    },
    "@wdio/mocha-framework": {
      "name": "@wdio/mocha-framework",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mocha"
      ],
      "effects": [],
      "range": ">=7.7.4",
      "nodes": [
        "node_modules/@wdio/mocha-framework"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "esbuild": {
      "name": "esbuild",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120679,
          "name": "esbuild",
          "dependency": "esbuild",
          "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",
          "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr",
          "severity": "high",
          "cwe": [
            "CWE-426",
            "CWE-494"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=0.17.0 <0.28.1"
        }
      ],
      "effects": [
        "tsx"
      ],
      "range": "0.17.0 - 0.28.0",
      "nodes": [
        "node_modules/esbuild"
      ],
      "fixAvailable": true
    },
    "fast-json-stringify": {
      "name": "fast-json-stringify",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-uri"
      ],
      "effects": [
        "@fastify/fast-json-stringify-compiler",
        "fastify"
      ],
      "range": "3.1.0 - 6.0.0",
      "nodes": [
        "node_modules/fast-json-stringify"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "fast-uri": {
      "name": "fast-uri",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1117870,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
          "url": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=3.1.0"
        },
        {
          "source": 1117884,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
          "url": "https://github.com/advisories/GHSA-v39h-62p7-jpjc",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=3.1.1"
        }
      ],
      "effects": [
        "@fastify/ajv-compiler",
        "fast-json-stringify"
      ],
      "range": "<=3.1.1",
      "nodes": [
        "node_modules/fast-uri"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "fastify": {
      "name": "fastify",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@fastify/ajv-compiler",
        "@fastify/fast-json-stringify-compiler",
        {
          "source": 1112876,
          "name": "fastify",
          "dependency": "fastify",
          "title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
          "url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c",
          "severity": "low",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=5.7.2"
        },
        {
          "source": 1112877,
          "name": "fastify",
          "dependency": "fastify",
          "title": "Fastify's Content-Type header tab character allows body validation bypass",
          "url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<5.7.2"
        },
        {
          "source": 1115367,
          "name": "fastify",
          "dependency": "fastify",
          "title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
          "url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf",
          "severity": "moderate",
          "cwe": [
            "CWE-348"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
          },
          "range": "<=5.8.2"
        },
        "fast-json-stringify"
      ],
      "effects": [],
      "range": "<=5.8.2",
      "nodes": [
        "node_modules/fastify"
      ],
      "fixAvailable": {
        "name": "fastify",
        "version": "5.8.5",
        "isSemVerMajor": true
      }
    },
    "form-data": {
      "name": "form-data",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109540,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data uses unsafe random function in form-data for choosing boundary",
          "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
          "severity": "critical",
          "cwe": [
            "CWE-330"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "mocha": {
      "name": "mocha",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "serialize-javascript"
      ],
      "effects": [
        "@wdio/mocha-framework"
      ],
      "range": "8.2.0 - 12.0.0-beta-2",
      "nodes": [
        "node_modules/mocha"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": "0.1.6 - 2.1.3",
      "nodes": [
        "node_modules/mwbot",
        "node_modules/wdio-mediawiki/node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "mwbot",
        "version": "2.3.3",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113719,
          "name": "qs",
          "dependency": "qs",
          "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
          "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
          "severity": "moderate",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<6.14.1"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<6.14.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "critical",
      "isDirect": true,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "form-data",
        "qs",
        "tough-cookie",
        "uuid"
      ],
      "effects": [
        "mwbot",
        "request-promise-core",
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-core": {
      "name": "request-promise-core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request-promise-core"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-native": {
      "name": "request-promise-native",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-core"
      ],
      "effects": [],
      "range": ">=1.0.0",
      "nodes": [
        "node_modules/request-promise-native"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "serialize-javascript": {
      "name": "serialize-javascript",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113686,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
          "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
          "severity": "high",
          "cwe": [
            "CWE-96"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=7.0.2"
        },
        {
          "source": 1119440,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
          "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-834"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=5.0.0 <7.0.5"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<=7.0.4",
      "nodes": [
        "node_modules/serialize-javascript"
      ],
      "fixAvailable": {
        "name": "@wdio/mocha-framework",
        "version": "7.7.3",
        "isSemVerMajor": true
      }
    },
    "tmp": {
      "name": "tmp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109537,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
          "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
          "severity": "low",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 2.5,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=0.2.3"
        },
        {
          "source": 1120654,
          "name": "tmp",
          "dependency": "tmp",
          "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
          "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.2.6"
        }
      ],
      "effects": [
        "@cucumber/cucumber"
      ],
      "range": "<=0.2.5",
      "nodes": [
        "node_modules/tmp"
      ],
      "fixAvailable": true
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "tsx": {
      "name": "tsx",
      "severity": "high",
      "isDirect": false,
      "via": [
        "esbuild"
      ],
      "effects": [],
      "range": "3.13.0 - 4.21.1",
      "nodes": [
        "node_modules/tsx"
      ],
      "fixAvailable": true
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "@cucumber/messages",
        "request"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/@cucumber/cucumber/node_modules/uuid",
        "node_modules/@cucumber/gherkin-utils/node_modules/uuid",
        "node_modules/@cucumber/gherkin/node_modules/uuid",
        "node_modules/request/node_modules/uuid",
        "node_modules/uuid"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [],
      "range": "<=5.1.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "6.5.2",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 14,
      "high": 9,
      "critical": 2,
      "total": 25
    },
    "dependencies": {
      "prod": 114,
      "dev": 1009,
      "optional": 38,
      "peer": 2,
      "peerOptional": 0,
      "total": 1123
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
  "added": 1123,
  "removed": 0,
  "changed": 0,
  "audited": 1124,
  "funding": 220,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@cucumber/cucumber": {
        "name": "@cucumber/cucumber",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "@cucumber/gherkin",
          "@cucumber/gherkin-utils",
          "@cucumber/messages",
          "tmp"
        ],
        "effects": [],
        "range": "<=12.2.0",
        "nodes": [
          "node_modules/@cucumber/cucumber"
        ],
        "fixAvailable": true
      },
      "@cucumber/gherkin": {
        "name": "@cucumber/gherkin",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "@cucumber/messages"
        ],
        "effects": [
          "@cucumber/gherkin-utils"
        ],
        "range": "<=34.0.0",
        "nodes": [
          "node_modules/@cucumber/cucumber/node_modules/@cucumber/gherkin",
          "node_modules/@cucumber/gherkin",
          "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/gherkin"
        ],
        "fixAvailable": true
      },
      "@cucumber/gherkin-utils": {
        "name": "@cucumber/gherkin-utils",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "@cucumber/gherkin",
          "@cucumber/messages"
        ],
        "effects": [
          "@cucumber/cucumber"
        ],
        "range": "<=10.0.0",
        "nodes": [
          "node_modules/@cucumber/gherkin-utils"
        ],
        "fixAvailable": true
      },
      "@cucumber/messages": {
        "name": "@cucumber/messages",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "uuid"
        ],
        "effects": [
          "@cucumber/cucumber",
          "@cucumber/gherkin",
          "@cucumber/gherkin-utils",
          "@wdio/cucumber-framework"
        ],
        "range": "<=28.1.0",
        "nodes": [
          "node_modules/@cucumber/cucumber/node_modules/@cucumber/messages",
          "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/messages",
          "node_modules/@cucumber/gherkin/node_modules/@cucumber/messages",
          "node_modules/@cucumber/messages"
        ],
        "fixAvailable": {
          "name": "@wdio/cucumber-framework",
          "version": "6.11.1",
          "isSemVerMajor": true
        }
      },
      "@fastify/ajv-compiler": {
        "name": "@fastify/ajv-compiler",
        "severity": "high",
        "isDirect": false,
        "via": [
          "fast-uri"
        ],
        "effects": [
          "fastify"
        ],
        "range": "3.1.0 - 3.6.0",
        "nodes": [
          "node_modules/@fastify/ajv-compiler"
        ],
        "fixAvailable": {
          "name": "fastify",
          "version": "5.8.5",
          "isSemVerMajor": true
        }
      },
      "@fastify/fast-json-stringify-compiler": {
        "name": "@fastify/fast-json-stringify-compiler",
        "severity": "high",
        "isDirect": false,
        "via": [
          "fast-json-stringify"
        ],
        "effects": [],
        "range": "3.0.0 - 5.0.0-pre.fv5.1",
        "nodes": [
          "node_modules/@fastify/fast-json-stringify-compiler"
        ],
        "fixAvailable": true
      },
      "@wdio/cucumber-framework": {
        "name": "@wdio/cucumber-framework",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "@cucumber/gherkin",
          "@cucumber/messages"
        ],
        "effects": [],
        "range": ">=7.0.0-beta.0",
        "nodes": [
          "node_modules/@wdio/cucumber-framework"
        ],
        "fixAvailable": {
          "name": "@wdio/cucumber-framework",
          "version": "6.11.1",
          "isSemVerMajor": true
        }
      },
      "@wdio/mocha-framework": {
        "name": "@wdio/mocha-framework",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "mocha"
        ],
        "effects": [],
        "range": ">=7.7.4",
        "nodes": [
          "node_modules/@wdio/mocha-framework"
        ],
        "fixAvailable": {
          "name": "@wdio/mocha-framework",
          "version": "7.7.3",
          "isSemVerMajor": true
        }
      },
      "esbuild": {
        "name": "esbuild",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1120679,
            "name": "esbuild",
            "dependency": "esbuild",
            "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",
            "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr",
            "severity": "high",
            "cwe": [
              "CWE-426",
              "CWE-494"
            ],
            "cvss": {
              "score": 8.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=0.17.0 <0.28.1"
          }
        ],
        "effects": [
          "tsx"
        ],
        "range": "0.17.0 - 0.28.0",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "fast-json-stringify": {
        "name": "fast-json-stringify",
        "severity": "high",
        "isDirect": false,
        "via": [
          "fast-uri"
        ],
        "effects": [
          "@fastify/fast-json-stringify-compiler",
          "fastify"
        ],
        "range": "3.1.0 - 6.0.0",
        "nodes": [
          "node_modules/fast-json-stringify"
        ],
        "fixAvailable": {
          "name": "fastify",
          "version": "5.8.5",
          "isSemVerMajor": true
        }
      },
      "fast-uri": {
        "name": "fast-uri",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1117870,
            "name": "fast-uri",
            "dependency": "fast-uri",
            "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
            "url": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<=3.1.0"
          },
          {
            "source": 1117884,
            "name": "fast-uri",
            "dependency": "fast-uri",
            "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
            "url": "https://github.com/advisories/GHSA-v39h-62p7-jpjc",
            "severity": "high",
            "cwe": [
              "CWE-436"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<=3.1.1"
          }
        ],
        "effects": [
          "@fastify/ajv-compiler",
          "fast-json-stringify"
        ],
        "range": "<=3.1.1",
        "nodes": [
          "node_modules/fast-uri"
        ],
        "fixAvailable": {
          "name": "fastify",
          "version": "5.8.5",
          "isSemVerMajor": true
        }
      },
      "fastify": {
        "name": "fastify",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@fastify/ajv-compiler",
          "@fastify/fast-json-stringify-compiler",
          {
            "source": 1112876,
            "name": "fastify",
            "dependency": "fastify",
            "title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
            "url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c",
            "severity": "low",
            "cwe": [
              "CWE-770"
            ],
            "cvss": {
              "score": 3.7,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
            },
            "range": "<=5.7.2"
          },
          {
            "source": 1112877,
            "name": "fastify",
            "dependency": "fastify",
            "title": "Fastify's Content-Type header tab character allows body validation bypass",
            "url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq",
            "severity": "high",
            "cwe": [
              "CWE-436"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<5.7.2"
          },
          {
            "source": 1115367,
            "name": "fastify",
            "dependency": "fastify",
            "title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
            "url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf",
            "severity": "moderate",
            "cwe": [
              "CWE-348"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
            },
            "range": "<=5.8.2"
          },
          "fast-json-stringify"
        ],
        "effects": [],
        "range": "<=5.8.2",
        "nodes": [
          "node_modules/fastify"
        ],
        "fixAvailable": {
          "name": "fastify",
          "version": "5.8.5",
          "isSemVerMajor": true
        }
      },
      "form-data": {
        "name": "form-data",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1109540,
            "name": "form-data",
            "dependency": "form-data",
            "title": "form-data uses unsafe random function in form-data for choosing boundary",
            "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
            "severity": "critical",
            "cwe": [
              "CWE-330"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<2.5.4"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<2.5.4",
        "nodes": [
          "node_modules/form-data"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "mocha": {
        "name": "mocha",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "serialize-javascript"
        ],
        "effects": [
          "@wdio/mocha-framework"
        ],
        "range": "8.2.0 - 12.0.0-beta-2",
        "nodes": [
          "node_modules/mocha"
        ],
        "fixAvailable": {
          "name": "@wdio/mocha-framework",
          "version": "7.7.3",
          "isSemVerMajor": true
        }
      },
      "mwbot": {
        "name": "mwbot",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "request"
        ],
        "effects": [
          "wdio-mediawiki"
        ],
        "range": "0.1.6 - 2.1.3",
        "nodes": [
          "node_modules/mwbot",
          "node_modules/wdio-mediawiki/node_modules/mwbot"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "qs": {
        "name": "qs",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1113719,
            "name": "qs",
            "dependency": "qs",
            "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
            "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
            "severity": "moderate",
            "cwe": [
              "CWE-20"
            ],
            "cvss": {
              "score": 3.7,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
            },
            "range": "<6.14.1"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<6.14.1",
        "nodes": [
          "node_modules/qs"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "request": {
        "name": "request",
        "severity": "critical",
        "isDirect": true,
        "via": [
          {
            "source": 1096727,
            "name": "request",
            "dependency": "request",
            "title": "Server-Side Request Forgery in Request",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "severity": "moderate",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<=2.88.2"
          },
          "form-data",
          "qs",
          "tough-cookie",
          "uuid"
        ],
        "effects": [
          "mwbot",
          "request-promise-core",
          "request-promise-native"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "request-promise-core": {
        "name": "request-promise-core",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "request"
        ],
        "effects": [
          "request-promise-native"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request-promise-core"
        ],
        "fixAvailable": {
          "name": "request-promise-native",
          "version": "0.0.0",
          "isSemVerMajor": true
        }
      },
      "request-promise-native": {
        "name": "request-promise-native",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "request",
          "request-promise-core"
        ],
        "effects": [],
        "range": ">=1.0.0",
        "nodes": [
          "node_modules/request-promise-native"
        ],
        "fixAvailable": {
          "name": "request-promise-native",
          "version": "0.0.0",
          "isSemVerMajor": true
        }
      },
      "serialize-javascript": {
        "name": "serialize-javascript",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1113686,
            "name": "serialize-javascript",
            "dependency": "serialize-javascript",
            "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
            "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
            "severity": "high",
            "cwe": [
              "CWE-96"
            ],
            "cvss": {
              "score": 8.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": "<=7.0.2"
          },
          {
            "source": 1119440,
            "name": "serialize-javascript",
            "dependency": "serialize-javascript",
            "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
            "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
            "severity": "moderate",
            "cwe": [
              "CWE-400",
              "CWE-834"
            ],
            "cvss": {
              "score": 5.9,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=5.0.0 <7.0.5"
          }
        ],
        "effects": [
          "mocha"
        ],
        "range": "<=7.0.4",
        "nodes": [
          "node_modules/serialize-javascript"
        ],
        "fixAvailable": {
          "name": "@wdio/mocha-framework",
          "version": "7.7.3",
          "isSemVerMajor": true
        }
      },
      "tmp": {
        "name": "tmp",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1109537,
            "name": "tmp",
            "dependency": "tmp",
            "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
            "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
            "severity": "low",
            "cwe": [
              "CWE-59"
            ],
            "cvss": {
              "score": 2.5,
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
            },
            "range": "<=0.2.3"
          },
          {
            "source": 1120654,
            "name": "tmp",
            "dependency": "tmp",
            "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
            "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65",
            "severity": "high",
            "cwe": [
              "CWE-22"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<0.2.6"
          }
        ],
        "effects": [
          "@cucumber/cucumber"
        ],
        "range": "<=0.2.5",
        "nodes": [
          "node_modules/tmp"
        ],
        "fixAvailable": true
      },
      "tough-cookie": {
        "name": "tough-cookie",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1097682,
            "name": "tough-cookie",
            "dependency": "tough-cookie",
            "title": "tough-cookie Prototype Pollution vulnerability",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "range": "<4.1.3"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<4.1.3",
        "nodes": [
          "node_modules/tough-cookie"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "tsx": {
        "name": "tsx",
        "severity": "high",
        "isDirect": false,
        "via": [
          "esbuild"
        ],
        "effects": [],
        "range": "3.13.0 - 4.21.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "uuid": {
        "name": "uuid",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1119441,
            "name": "uuid",
            "dependency": "uuid",
            "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
            "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
            "severity": "moderate",
            "cwe": [
              "CWE-787",
              "CWE-1285"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<11.1.1"
          }
        ],
        "effects": [
          "@cucumber/messages",
          "request"
        ],
        "range": "<11.1.1",
        "nodes": [
          "node_modules/@cucumber/cucumber/node_modules/uuid",
          "node_modules/@cucumber/gherkin-utils/node_modules/uuid",
          "node_modules/@cucumber/gherkin/node_modules/uuid",
          "node_modules/request/node_modules/uuid",
          "node_modules/uuid"
        ],
        "fixAvailable": {
          "name": "mwbot",
          "version": "2.3.3",
          "isSemVerMajor": true
        }
      },
      "wdio-mediawiki": {
        "name": "wdio-mediawiki",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "mwbot"
        ],
        "effects": [],
        "range": "<=5.1.0",
        "nodes": [
          "node_modules/wdio-mediawiki"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "6.5.2",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 14,
        "high": 9,
        "critical": 2,
        "total": 25
      },
      "dependencies": {
        "prod": 114,
        "dev": 1009,
        "optional": 38,
        "peer": 2,
        "peerOptional": 0,
        "total": 1123
      }
    }
  }
}

--- end ---
{"added": 1123, "removed": 0, "changed": 0, "audited": 1124, "funding": 220, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@cucumber/cucumber": {"name": "@cucumber/cucumber", "severity": "moderate", "isDirect": false, "via": ["@cucumber/gherkin", "@cucumber/gherkin-utils", "@cucumber/messages", "tmp"], "effects": [], "range": "<=12.2.0", "nodes": ["node_modules/@cucumber/cucumber"], "fixAvailable": true}, "@cucumber/gherkin": {"name": "@cucumber/gherkin", "severity": "moderate", "isDirect": false, "via": ["@cucumber/messages"], "effects": ["@cucumber/gherkin-utils"], "range": "<=34.0.0", "nodes": ["node_modules/@cucumber/cucumber/node_modules/@cucumber/gherkin", "node_modules/@cucumber/gherkin", "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/gherkin"], "fixAvailable": true}, "@cucumber/gherkin-utils": {"name": "@cucumber/gherkin-utils", "severity": "moderate", "isDirect": false, "via": ["@cucumber/gherkin", "@cucumber/messages"], "effects": ["@cucumber/cucumber"], "range": "<=10.0.0", "nodes": ["node_modules/@cucumber/gherkin-utils"], "fixAvailable": true}, "@cucumber/messages": {"name": "@cucumber/messages", "severity": "moderate", "isDirect": false, "via": ["uuid"], "effects": ["@cucumber/cucumber", "@cucumber/gherkin", "@cucumber/gherkin-utils", "@wdio/cucumber-framework"], "range": "<=28.1.0", "nodes": ["node_modules/@cucumber/cucumber/node_modules/@cucumber/messages", "node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/messages", "node_modules/@cucumber/gherkin/node_modules/@cucumber/messages", "node_modules/@cucumber/messages"], "fixAvailable": {"name": "@wdio/cucumber-framework", "version": "6.11.1", "isSemVerMajor": true}}, "@fastify/ajv-compiler": {"name": "@fastify/ajv-compiler", "severity": "high", "isDirect": false, "via": ["fast-uri"], "effects": ["fastify"], "range": "3.1.0 - 3.6.0", "nodes": ["node_modules/@fastify/ajv-compiler"], "fixAvailable": {"name": "fastify", "version": "5.8.5", "isSemVerMajor": true}}, "@fastify/fast-json-stringify-compiler": {"name": "@fastify/fast-json-stringify-compiler", "severity": "high", "isDirect": false, "via": ["fast-json-stringify"], "effects": [], "range": "3.0.0 - 5.0.0-pre.fv5.1", "nodes": ["node_modules/@fastify/fast-json-stringify-compiler"], "fixAvailable": true}, "@wdio/cucumber-framework": {"name": "@wdio/cucumber-framework", "severity": "moderate", "isDirect": true, "via": ["@cucumber/gherkin", "@cucumber/messages"], "effects": [], "range": ">=7.0.0-beta.0", "nodes": ["node_modules/@wdio/cucumber-framework"], "fixAvailable": {"name": "@wdio/cucumber-framework", "version": "6.11.1", "isSemVerMajor": true}}, "@wdio/mocha-framework": {"name": "@wdio/mocha-framework", "severity": "moderate", "isDirect": true, "via": ["mocha"], "effects": [], "range": ">=7.7.4", "nodes": ["node_modules/@wdio/mocha-framework"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.7.3", "isSemVerMajor": true}}, "esbuild": {"name": "esbuild", "severity": "high", "isDirect": false, "via": [{"source": 1120679, "name": "esbuild", "dependency": "esbuild", "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY", "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr", "severity": "high", "cwe": ["CWE-426", "CWE-494"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=0.17.0 <0.28.1"}], "effects": ["tsx"], "range": "0.17.0 - 0.28.0", "nodes": [""], "fixAvailable": true}, "fast-json-stringify": {"name": "fast-json-stringify", "severity": "high", "isDirect": false, "via": ["fast-uri"], "effects": ["@fastify/fast-json-stringify-compiler", "fastify"], "range": "3.1.0 - 6.0.0", "nodes": ["node_modules/fast-json-stringify"], "fixAvailable": {"name": "fastify", "version": "5.8.5", "isSemVerMajor": true}}, "fast-uri": {"name": "fast-uri", "severity": "high", "isDirect": false, "via": [{"source": 1117870, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to path traversal via percent-encoded dot segments", "url": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<=3.1.0"}, {"source": 1117884, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters", "url": "https://github.com/advisories/GHSA-v39h-62p7-jpjc", "severity": "high", "cwe": ["CWE-436"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<=3.1.1"}], "effects": ["@fastify/ajv-compiler", "fast-json-stringify"], "range": "<=3.1.1", "nodes": ["node_modules/fast-uri"], "fixAvailable": {"name": "fastify", "version": "5.8.5", "isSemVerMajor": true}}, "fastify": {"name": "fastify", "severity": "high", "isDirect": true, "via": ["@fastify/ajv-compiler", "@fastify/fast-json-stringify-compiler", {"source": 1112876, "name": "fastify", "dependency": "fastify", "title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream", "url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c", "severity": "low", "cwe": ["CWE-770"], "cvss": {"score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<=5.7.2"}, {"source": 1112877, "name": "fastify", "dependency": "fastify", "title": "Fastify's Content-Type header tab character allows body validation bypass", "url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq", "severity": "high", "cwe": ["CWE-436"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<5.7.2"}, {"source": 1115367, "name": "fastify", "dependency": "fastify", "title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections", "url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf", "severity": "moderate", "cwe": ["CWE-348"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}, "range": "<=5.8.2"}, "fast-json-stringify"], "effects": [], "range": "<=5.8.2", "nodes": ["node_modules/fastify"], "fixAvailable": {"name": "fastify", "version": "5.8.5", "isSemVerMajor": true}}, "form-data": {"name": "form-data", "severity": "critical", "isDirect": false, "via": [{"source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": ["CWE-330"], "cvss": {"score": 0, "vectorString": null}, "range": "<2.5.4"}], "effects": ["request"], "range": "<2.5.4", "nodes": ["node_modules/form-data"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "mocha": {"name": "mocha", "severity": "moderate", "isDirect": false, "via": ["serialize-javascript"], "effects": ["@wdio/mocha-framework"], "range": "8.2.0 - 12.0.0-beta-2", "nodes": ["node_modules/mocha"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.7.3", "isSemVerMajor": true}}, "mwbot": {"name": "mwbot", "severity": "moderate", "isDirect": true, "via": ["request"], "effects": ["wdio-mediawiki"], "range": "0.1.6 - 2.1.3", "nodes": ["node_modules/mwbot", "node_modules/wdio-mediawiki/node_modules/mwbot"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "moderate", "isDirect": false, "via": [{"source": 1113719, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "moderate", "cwe": ["CWE-20"], "cvss": {"score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<6.14.1"}], "effects": ["request"], "range": "<6.14.1", "nodes": ["node_modules/qs"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "critical", "isDirect": true, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "form-data", "qs", "tough-cookie", "uuid"], "effects": ["mwbot", "request-promise-core", "request-promise-native"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "request-promise-core": {"name": "request-promise-core", "severity": "moderate", "isDirect": false, "via": ["request"], "effects": ["request-promise-native"], "range": "*", "nodes": ["node_modules/request-promise-core"], "fixAvailable": {"name": "request-promise-native", "version": "0.0.0", "isSemVerMajor": true}}, "request-promise-native": {"name": "request-promise-native", "severity": "moderate", "isDirect": true, "via": ["request", "request-promise-core"], "effects": [], "range": ">=1.0.0", "nodes": ["node_modules/request-promise-native"], "fixAvailable": {"name": "request-promise-native", "version": "0.0.0", "isSemVerMajor": true}}, "serialize-javascript": {"name": "serialize-javascript", "severity": "high", "isDirect": false, "via": [{"source": 1113686, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "severity": "high", "cwe": ["CWE-96"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": "<=7.0.2"}, {"source": 1119440, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects", "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v", "severity": "moderate", "cwe": ["CWE-400", "CWE-834"], "cvss": {"score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=5.0.0 <7.0.5"}], "effects": ["mocha"], "range": "<=7.0.4", "nodes": ["node_modules/serialize-javascript"], "fixAvailable": {"name": "@wdio/mocha-framework", "version": "7.7.3", "isSemVerMajor": true}}, "tmp": {"name": "tmp", "severity": "high", "isDirect": false, "via": [{"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}, {"source": 1120654, "name": "tmp", "dependency": "tmp", "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape", "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.2.6"}], "effects": ["@cucumber/cucumber"], "range": "<=0.2.5", "nodes": ["node_modules/tmp"], "fixAvailable": true}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/tough-cookie"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "tsx": {"name": "tsx", "severity": "high", "isDirect": false, "via": ["esbuild"], "effects": [], "range": "3.13.0 - 4.21.1", "nodes": [""], "fixAvailable": true}, "uuid": {"name": "uuid", "severity": "moderate", "isDirect": false, "via": [{"source": 1119441, "name": "uuid", "dependency": "uuid", "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "severity": "moderate", "cwe": ["CWE-787", "CWE-1285"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<11.1.1"}], "effects": ["@cucumber/messages", "request"], "range": "<11.1.1", "nodes": ["node_modules/@cucumber/cucumber/node_modules/uuid", "node_modules/@cucumber/gherkin-utils/node_modules/uuid", "node_modules/@cucumber/gherkin/node_modules/uuid", "node_modules/request/node_modules/uuid", "node_modules/uuid"], "fixAvailable": {"name": "mwbot", "version": "2.3.3", "isSemVerMajor": true}}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": ["mwbot"], "effects": [], "range": "<=5.1.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "6.5.2", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 14, "high": 9, "critical": 2, "total": 25}, "dependencies": {"prod": 114, "dev": 1009, "optional": 38, "peer": 2, "peerOptional": 0, "total": 1123}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated request-promise-native@1.0.5: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated reflect-metadata@0.2.1: This version has a critical bug in fallback handling. Please upgrade to reflect-metadata@0.2.2 or newer.
npm WARN deprecated reflect-metadata@0.2.1: This version has a critical bug in fallback handling. Please upgrade to reflect-metadata@0.2.2 or newer.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 1097 packages, and audited 1098 packages in 21s

220 packages are looking for funding
  run `npm fund` for details

# npm audit report

fast-uri  <=3.1.1
Severity: high
fast-uri vulnerable to path traversal via percent-encoded dot segments - https://github.com/advisories/GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to host confusion via percent-encoded authority delimiters - https://github.com/advisories/GHSA-v39h-62p7-jpjc
fix available via `npm audit fix --force`
Will install fastify@5.8.5, which is a breaking change
node_modules/fast-uri
  @fastify/ajv-compiler  3.1.0 - 3.6.0
  Depends on vulnerable versions of fast-uri
  node_modules/@fastify/ajv-compiler
    fastify  <=5.8.2
    Depends on vulnerable versions of @fastify/ajv-compiler
    Depends on vulnerable versions of @fastify/fast-json-stringify-compiler
    Depends on vulnerable versions of fast-json-stringify
    node_modules/fastify
  fast-json-stringify  3.1.0 - 6.0.0
  Depends on vulnerable versions of fast-uri
  node_modules/fast-json-stringify
    @fastify/fast-json-stringify-compiler  3.0.0 - 5.0.0-pre.fv5.1
    Depends on vulnerable versions of fast-json-stringify
    node_modules/@fastify/fast-json-stringify-compiler


form-data  <2.5.4
Severity: critical
form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
fix available via `npm audit fix --force`
Will install mwbot@2.3.3, which is a breaking change
node_modules/form-data
  request  *
  Depends on vulnerable versions of form-data
  Depends on vulnerable versions of qs
  Depends on vulnerable versions of tough-cookie
  Depends on vulnerable versions of uuid
  node_modules/request
    mwbot  0.1.6 - 2.1.3
    Depends on vulnerable versions of request
    node_modules/mwbot
    node_modules/wdio-mediawiki/node_modules/mwbot
      wdio-mediawiki  <=5.1.0
      Depends on vulnerable versions of mwbot
      node_modules/wdio-mediawiki
    request-promise-core  *
    Depends on vulnerable versions of request
    node_modules/request-promise-core
      request-promise-native  >=1.0.0
      Depends on vulnerable versions of request
      Depends on vulnerable versions of request-promise-core
      node_modules/request-promise-native

qs  <6.14.1
Severity: moderate
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix --force`
Will install mwbot@2.3.3, which is a breaking change
node_modules/qs


serialize-javascript  <=7.0.4
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - https://github.com/advisories/GHSA-qj8w-gfj5-8c6v
fix available via `npm audit fix --force`
Will install @wdio/mocha-framework@7.7.3, which is a breaking change
node_modules/serialize-javascript
  mocha  8.2.0 - 12.0.0-beta-2
  Depends on vulnerable versions of serialize-javascript
  node_modules/mocha
    @wdio/mocha-framework  >=7.7.4
    Depends on vulnerable versions of mocha
    node_modules/@wdio/mocha-framework

tmp  <=0.2.5
Severity: high
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape - https://github.com/advisories/GHSA-ph9p-34f9-6g65
fix available via `npm audit fix`
node_modules/tmp
  @cucumber/cucumber  <=12.2.0
  Depends on vulnerable versions of @cucumber/gherkin
  Depends on vulnerable versions of @cucumber/gherkin-utils
  Depends on vulnerable versions of @cucumber/messages
  Depends on vulnerable versions of tmp
  node_modules/@cucumber/cucumber

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install mwbot@2.3.3, which is a breaking change
node_modules/tough-cookie

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install mwbot@2.3.3, which is a breaking change
node_modules/@cucumber/cucumber/node_modules/uuid
node_modules/@cucumber/gherkin-utils/node_modules/uuid
node_modules/@cucumber/gherkin/node_modules/uuid
node_modules/request/node_modules/uuid
node_modules/uuid
  @cucumber/messages  <=28.1.0
  Depends on vulnerable versions of uuid
  node_modules/@cucumber/cucumber/node_modules/@cucumber/messages
  node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/messages
  node_modules/@cucumber/gherkin/node_modules/@cucumber/messages
  node_modules/@cucumber/messages
    @cucumber/gherkin  <=34.0.0
    Depends on vulnerable versions of @cucumber/messages
    node_modules/@cucumber/cucumber/node_modules/@cucumber/gherkin
    node_modules/@cucumber/gherkin
    node_modules/@cucumber/gherkin-utils/node_modules/@cucumber/gherkin
      @cucumber/gherkin-utils  <=10.0.0
      Depends on vulnerable versions of @cucumber/gherkin
      Depends on vulnerable versions of @cucumber/messages
      node_modules/@cucumber/gherkin-utils
    @wdio/cucumber-framework  >=7.0.0-beta.0
    Depends on vulnerable versions of @cucumber/gherkin
    Depends on vulnerable versions of @cucumber/messages
    node_modules/@wdio/cucumber-framework

23 vulnerabilities (14 moderate, 7 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated osenv@0.1.5: This package is no longer supported.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated request-promise-native@1.0.5: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated reflect-metadata@0.2.1: This version has a critical bug in fallback handling. Please upgrade to reflect-metadata@0.2.2 or newer.
npm WARN deprecated reflect-metadata@0.2.1: This version has a critical bug in fallback handling. Please upgrade to reflect-metadata@0.2.2 or newer.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 1097 packages, and audited 1098 packages in 28s

220 packages are looking for funding
  run `npm fund` for details

23 vulnerabilities (14 moderate, 7 high, 2 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stdout ---

> cirrussearch@0.0.0 test
> grunt test

Running "eslint:all" (eslint) task

/src/repo/tests/integration/config/wdio.conf.js
  312:4  warning  Found unlinkSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/tests/integration/features/step_definitions/page_step_helpers.js
  59:11  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/tests/integration/features/step_definitions/page_steps.js
  127:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  139:5  warning  ES2022 'Array.prototype.at' method is forbidden  es-x/no-array-string-prototype-at
  142:4  warning  ES2022 'Array.prototype.at' method is forbidden  es-x/no-array-string-prototype-at
  164:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  172:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  207:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  227:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  309:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  378:8  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  477:7  warning  Unsafe Regular Expression                        security/detect-unsafe-regex
  608:2  warning  ES2022 'Array.prototype.at' method is forbidden  es-x/no-array-string-prototype-at
  616:2  warning  ES2022 'Array.prototype.at' method is forbidden  es-x/no-array-string-prototype-at

/src/repo/tests/integration/features/support/hooks.js
   31:37  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  142:11  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/tests/integration/features/support/pages/search_results_page.js
  145:2  warning  Missing JSDoc @return declaration  jsdoc/require-returns

/src/repo/tests/integration/lib/tracker.js
  109:6  warning  Don't use process.exit(); throw an error instead  n/no-process-exit
  111:6  warning  Don't use process.exit(); throw an error instead  n/no-process-exit
  114:5  warning  Don't use process.exit(); throw an error instead  n/no-process-exit

✖ 20 problems (0 errors, 20 warnings)


Running "banana:CirrusSearch" (banana) task
>> 2 message directories checked.

Running "stylelint:all" (stylelint) task
>> Linted 0 files without errors

Done.

--- end ---
{"1109537": {"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}, "1120654": {"source": 1120654, "name": "tmp", "dependency": "tmp", "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape", "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.2.6"}}
{}
{}
{}
{"1120679": {"source": 1120679, "name": "esbuild", "dependency": "esbuild", "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY", "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr", "severity": "high", "cwe": ["CWE-426", "CWE-494"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=0.17.0 <0.28.1"}}
Upgrading n:esbuild from 0.25.12 -> 0.28.1
{"1109537": {"source": 1109537, "name": "tmp", "dependency": "tmp", "title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter", "url": "https://github.com/advisories/GHSA-52f5-9888-hmc6", "severity": "low", "cwe": ["CWE-59"], "cvss": {"score": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "range": "<=0.2.3"}, "1120654": {"source": 1120654, "name": "tmp", "dependency": "tmp", "title": "tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape", "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65", "severity": "high", "cwe": ["CWE-22"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.2.6"}}
{"1120679": {"source": 1120679, "name": "esbuild", "dependency": "esbuild", "title": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY", "url": "https://github.com/advisories/GHSA-gv7w-rqvm-qjhr", "severity": "high", "cwe": ["CWE-426", "CWE-494"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=0.17.0 <0.28.1"}}
Upgrading n:tsx from 4.20.6 -> 4.22.4
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json

--- end ---
build: Updating npm dependencies

* esbuild: 0.25.12 → 0.28.1
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr
* tsx: 4.20.6 → 4.22.4
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr

$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmpxp9ajb_e
--- stdout ---
[REL1_46 0d4ec8e] build: Updating npm dependencies
 1 file changed, 111 insertions(+), 140 deletions(-)

--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 0d4ec8e4321176bf5116eaf672e371334941543f Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 14 Jun 2026 03:35:03 +0000
Subject: [PATCH] build: Updating npm dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* esbuild: 0.25.12 → 0.28.1
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr
* tsx: 4.20.6 → 4.22.4
  * https://github.com/advisories/GHSA-gv7w-rqvm-qjhr

Change-Id: I348273894b846adf28a7f1dd4bd19bfd90a47a87
---
 package-lock.json | 251 ++++++++++++++++++++--------------------------
 1 file changed, 111 insertions(+), 140 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 31d8bc5..11bb450 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -796,14 +796,13 @@
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-			"integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+			"integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
 			"cpu": [
 				"ppc64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"aix"
@@ -813,14 +812,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-			"integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+			"integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
 			"cpu": [
 				"arm"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -830,14 +828,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-			"integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+			"integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -847,14 +844,13 @@
 			}
 		},
 		"node_modules/@esbuild/android-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-			"integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+			"integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"android"
@@ -864,14 +860,13 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-			"integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+			"integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"darwin"
@@ -881,14 +876,13 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-			"integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+			"integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"darwin"
@@ -898,14 +892,13 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"freebsd"
@@ -915,14 +908,13 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-			"integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"freebsd"
@@ -932,14 +924,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-			"integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+			"integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
 			"cpu": [
 				"arm"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -949,14 +940,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-			"integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+			"integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -966,14 +956,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ia32": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-			"integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+			"integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
 			"cpu": [
 				"ia32"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -983,14 +972,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-loong64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-			"integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+			"integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
 			"cpu": [
 				"loong64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1000,14 +988,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-mips64el": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-			"integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+			"integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
 			"cpu": [
 				"mips64el"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1017,14 +1004,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ppc64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-			"integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+			"integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
 			"cpu": [
 				"ppc64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1034,14 +1020,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-riscv64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-			"integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+			"integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
 			"cpu": [
 				"riscv64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1051,14 +1036,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-s390x": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-			"integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+			"integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
 			"cpu": [
 				"s390x"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1068,14 +1052,13 @@
 			}
 		},
 		"node_modules/@esbuild/linux-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-			"integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+			"integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"linux"
@@ -1085,14 +1068,13 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"netbsd"
@@ -1102,14 +1084,13 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-			"integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"netbsd"
@@ -1119,14 +1100,13 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-			"integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+			"integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openbsd"
@@ -1136,14 +1116,13 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-			"integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+			"integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openbsd"
@@ -1153,14 +1132,13 @@
 			}
 		},
 		"node_modules/@esbuild/openharmony-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-			"integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+			"integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"openharmony"
@@ -1170,14 +1148,13 @@
 			}
 		},
 		"node_modules/@esbuild/sunos-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-			"integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+			"integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"sunos"
@@ -1187,14 +1164,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-arm64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-			"integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+			"integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
 			"cpu": [
 				"arm64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -1204,14 +1180,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-ia32": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-			"integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+			"integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
 			"cpu": [
 				"ia32"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -1221,14 +1196,13 @@
 			}
 		},
 		"node_modules/@esbuild/win32-x64": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-			"integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+			"integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
 			"cpu": [
 				"x64"
 			],
 			"dev": true,
-			"license": "MIT",
 			"optional": true,
 			"os": [
 				"win32"
@@ -5656,12 +5630,11 @@
 			}
 		},
 		"node_modules/esbuild": {
-			"version": "0.25.12",
-			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-			"integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+			"version": "0.28.1",
+			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+			"integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
 			"dev": true,
 			"hasInstallScript": true,
-			"license": "MIT",
 			"bin": {
 				"esbuild": "bin/esbuild"
 			},
@@ -5669,32 +5642,32 @@
 				"node": ">=18"
 			},
 			"optionalDependencies": {
-				"@esbuild/aix-ppc64": "0.25.12",
-				"@esbuild/android-arm": "0.25.12",
-				"@esbuild/android-arm64": "0.25.12",
-				"@esbuild/android-x64": "0.25.12",
-				"@esbuild/darwin-arm64": "0.25.12",
-				"@esbuild/darwin-x64": "0.25.12",
-				"@esbuild/freebsd-arm64": "0.25.12",
-				"@esbuild/freebsd-x64": "0.25.12",
-				"@esbuild/linux-arm": "0.25.12",
-				"@esbuild/linux-arm64": "0.25.12",
-				"@esbuild/linux-ia32": "0.25.12",
-				"@esbuild/linux-loong64": "0.25.12",
-				"@esbuild/linux-mips64el": "0.25.12",
-				"@esbuild/linux-ppc64": "0.25.12",
-				"@esbuild/linux-riscv64": "0.25.12",
-				"@esbuild/linux-s390x": "0.25.12",
-				"@esbuild/linux-x64": "0.25.12",
-				"@esbuild/netbsd-arm64": "0.25.12",
-				"@esbuild/netbsd-x64": "0.25.12",
-				"@esbuild/openbsd-arm64": "0.25.12",
-				"@esbuild/openbsd-x64": "0.25.12",
-				"@esbuild/openharmony-arm64": "0.25.12",
-				"@esbuild/sunos-x64": "0.25.12",
-				"@esbuild/win32-arm64": "0.25.12",
-				"@esbuild/win32-ia32": "0.25.12",
-				"@esbuild/win32-x64": "0.25.12"
+				"@esbuild/aix-ppc64": "0.28.1",
+				"@esbuild/android-arm": "0.28.1",
+				"@esbuild/android-arm64": "0.28.1",
+				"@esbuild/android-x64": "0.28.1",
+				"@esbuild/darwin-arm64": "0.28.1",
+				"@esbuild/darwin-x64": "0.28.1",
+				"@esbuild/freebsd-arm64": "0.28.1",
+				"@esbuild/freebsd-x64": "0.28.1",
+				"@esbuild/linux-arm": "0.28.1",
+				"@esbuild/linux-arm64": "0.28.1",
+				"@esbuild/linux-ia32": "0.28.1",
+				"@esbuild/linux-loong64": "0.28.1",
+				"@esbuild/linux-mips64el": "0.28.1",
+				"@esbuild/linux-ppc64": "0.28.1",
+				"@esbuild/linux-riscv64": "0.28.1",
+				"@esbuild/linux-s390x": "0.28.1",
+				"@esbuild/linux-x64": "0.28.1",
+				"@esbuild/netbsd-arm64": "0.28.1",
+				"@esbuild/netbsd-x64": "0.28.1",
+				"@esbuild/openbsd-arm64": "0.28.1",
+				"@esbuild/openbsd-x64": "0.28.1",
+				"@esbuild/openharmony-arm64": "0.28.1",
+				"@esbuild/sunos-x64": "0.28.1",
+				"@esbuild/win32-arm64": "0.28.1",
+				"@esbuild/win32-ia32": "0.28.1",
+				"@esbuild/win32-x64": "0.28.1"
 			}
 		},
 		"node_modules/escalade": {
@@ -13915,14 +13888,12 @@
 			"license": "0BSD"
 		},
 		"node_modules/tsx": {
-			"version": "4.20.6",
-			"resolved": "https://registry.npmjs.org/tsx/-/tsx-4.20.6.tgz",
-			"integrity": "sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==",
+			"version": "4.22.4",
+			"resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
+			"integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
 			"dev": true,
-			"license": "MIT",
 			"dependencies": {
-				"esbuild": "~0.25.0",
-				"get-tsconfig": "^4.7.5"
+				"esbuild": "~0.28.0"
 			},
 			"bin": {
 				"tsx": "dist/cli.mjs"
-- 
2.47.3


--- end ---
Source code is licensed under the AGPL.