mediawiki/services/cxserver: main (log #2507792)

sourcepatches

This run took 88 seconds.

$ date
--- stdout ---
Mon Jun 15 09:36:39 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-services-cxserver.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
a3f27fb1754d4c79215d2f7cec471eedc05132e3 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "body-parser": {
      "name": "body-parser",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "qs"
      ],
      "effects": [],
      "range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
      "nodes": [
        "node_modules/express/node_modules/body-parser"
      ],
      "fixAvailable": true
    },
    "express": {
      "name": "express",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "qs"
      ],
      "effects": [],
      "range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
      "nodes": [
        "node_modules/express"
      ],
      "fixAvailable": true
    },
    "istanbul-lib-processinfo": {
      "name": "istanbul-lib-processinfo",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [
        "nyc"
      ],
      "range": "<=3.0.0",
      "nodes": [
        "node_modules/istanbul-lib-processinfo"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "nyc": {
      "name": "nyc",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "istanbul-lib-processinfo"
      ],
      "effects": [],
      "range": "15.0.0-alpha.0 - 17.1.0",
      "nodes": [
        "node_modules/nyc"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119502,
          "name": "qs",
          "dependency": "qs",
          "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
          "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
          "severity": "moderate",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.11.1 <=6.15.1"
        }
      ],
      "effects": [
        "body-parser",
        "express"
      ],
      "range": "6.11.1 - 6.15.1",
      "nodes": [
        "node_modules/express/node_modules/qs",
        "node_modules/qs"
      ],
      "fixAvailable": true
    },
    "swagger-router": {
      "name": "swagger-router",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "uuid"
      ],
      "effects": [],
      "range": ">=0.7.4",
      "nodes": [
        "node_modules/swagger-router"
      ],
      "fixAvailable": {
        "name": "swagger-router",
        "version": "0.7.3",
        "isSemVerMajor": true
      }
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "istanbul-lib-processinfo",
        "swagger-router"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/swagger-router/node_modules/uuid",
        "node_modules/uuid"
      ],
      "fixAvailable": {
        "name": "swagger-router",
        "version": "0.7.3",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 7,
      "high": 0,
      "critical": 0,
      "total": 7
    },
    "dependencies": {
      "prod": 221,
      "dev": 599,
      "optional": 7,
      "peer": 39,
      "peerOptional": 0,
      "total": 825
    }
  }
}

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "body-parser": {
      "name": "body-parser",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "qs"
      ],
      "effects": [],
      "range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
      "nodes": [
        "node_modules/express/node_modules/body-parser"
      ],
      "fixAvailable": true
    },
    "express": {
      "name": "express",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "qs"
      ],
      "effects": [],
      "range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
      "nodes": [
        "node_modules/express"
      ],
      "fixAvailable": true
    },
    "istanbul-lib-processinfo": {
      "name": "istanbul-lib-processinfo",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [
        "nyc"
      ],
      "range": "<=3.0.0",
      "nodes": [
        "node_modules/istanbul-lib-processinfo"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "nyc": {
      "name": "nyc",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "istanbul-lib-processinfo"
      ],
      "effects": [],
      "range": "15.0.0-alpha.0 - 17.1.0",
      "nodes": [
        "node_modules/nyc"
      ],
      "fixAvailable": {
        "name": "nyc",
        "version": "18.0.0",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119502,
          "name": "qs",
          "dependency": "qs",
          "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
          "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
          "severity": "moderate",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.11.1 <=6.15.1"
        }
      ],
      "effects": [
        "body-parser",
        "express"
      ],
      "range": "6.11.1 - 6.15.1",
      "nodes": [
        "node_modules/express/node_modules/qs",
        "node_modules/qs"
      ],
      "fixAvailable": true
    },
    "swagger-router": {
      "name": "swagger-router",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "uuid"
      ],
      "effects": [],
      "range": ">=0.7.4",
      "nodes": [
        "node_modules/swagger-router"
      ],
      "fixAvailable": {
        "name": "swagger-router",
        "version": "0.7.3",
        "isSemVerMajor": true
      }
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "istanbul-lib-processinfo",
        "swagger-router"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/swagger-router/node_modules/uuid",
        "node_modules/uuid"
      ],
      "fixAvailable": {
        "name": "swagger-router",
        "version": "0.7.3",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 7,
      "high": 0,
      "critical": 0,
      "total": 7
    },
    "dependencies": {
      "prod": 221,
      "dev": 599,
      "optional": 7,
      "peer": 39,
      "peerOptional": 0,
      "total": 825
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'cxserver@1.2.1',
npm WARN EBADENGINE   required: { node: '>=24' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
  "added": 824,
  "removed": 0,
  "changed": 0,
  "audited": 825,
  "funding": 198,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "body-parser": {
        "name": "body-parser",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "qs"
        ],
        "effects": [],
        "range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "express": {
        "name": "express",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "qs"
        ],
        "effects": [],
        "range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      },
      "istanbul-lib-processinfo": {
        "name": "istanbul-lib-processinfo",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          "uuid"
        ],
        "effects": [
          "nyc"
        ],
        "range": "<=3.0.0",
        "nodes": [
          "node_modules/istanbul-lib-processinfo"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "nyc": {
        "name": "nyc",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "istanbul-lib-processinfo"
        ],
        "effects": [],
        "range": "15.0.0-alpha.0 - 17.1.0",
        "nodes": [
          "node_modules/nyc"
        ],
        "fixAvailable": {
          "name": "nyc",
          "version": "18.0.0",
          "isSemVerMajor": true
        }
      },
      "qs": {
        "name": "qs",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1119502,
            "name": "qs",
            "dependency": "qs",
            "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
            "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
            "severity": "moderate",
            "cwe": [
              "CWE-476"
            ],
            "cvss": {
              "score": 5.3,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
            },
            "range": ">=6.11.1 <=6.15.1"
          }
        ],
        "effects": [
          "body-parser",
          "express"
        ],
        "range": "6.11.1 - 6.15.1",
        "nodes": [
          "",
          ""
        ],
        "fixAvailable": true
      },
      "swagger-router": {
        "name": "swagger-router",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          "uuid"
        ],
        "effects": [],
        "range": ">=0.7.4",
        "nodes": [
          "node_modules/swagger-router"
        ],
        "fixAvailable": {
          "name": "swagger-router",
          "version": "0.7.3",
          "isSemVerMajor": true
        }
      },
      "uuid": {
        "name": "uuid",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1119441,
            "name": "uuid",
            "dependency": "uuid",
            "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
            "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
            "severity": "moderate",
            "cwe": [
              "CWE-787",
              "CWE-1285"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
            },
            "range": "<11.1.1"
          }
        ],
        "effects": [
          "istanbul-lib-processinfo",
          "swagger-router"
        ],
        "range": "<11.1.1",
        "nodes": [
          "node_modules/swagger-router/node_modules/uuid",
          "node_modules/uuid"
        ],
        "fixAvailable": {
          "name": "swagger-router",
          "version": "0.7.3",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 7,
        "high": 0,
        "critical": 0,
        "total": 7
      },
      "dependencies": {
        "prod": 220,
        "dev": 599,
        "optional": 7,
        "peer": 39,
        "peerOptional": 0,
        "total": 824
      }
    }
  }
}

--- end ---
{"added": 824, "removed": 0, "changed": 0, "audited": 825, "funding": 198, "audit": {"auditReportVersion": 2, "vulnerabilities": {"body-parser": {"name": "body-parser", "severity": "moderate", "isDirect": false, "via": ["qs"], "effects": [], "range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2", "nodes": [""], "fixAvailable": true}, "express": {"name": "express", "severity": "moderate", "isDirect": false, "via": ["qs"], "effects": [], "range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1", "nodes": [""], "fixAvailable": true}, "istanbul-lib-processinfo": {"name": "istanbul-lib-processinfo", "severity": "moderate", "isDirect": false, "via": ["uuid"], "effects": ["nyc"], "range": "<=3.0.0", "nodes": ["node_modules/istanbul-lib-processinfo"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "nyc": {"name": "nyc", "severity": "moderate", "isDirect": true, "via": ["istanbul-lib-processinfo"], "effects": [], "range": "15.0.0-alpha.0 - 17.1.0", "nodes": ["node_modules/nyc"], "fixAvailable": {"name": "nyc", "version": "18.0.0", "isSemVerMajor": true}}, "qs": {"name": "qs", "severity": "moderate", "isDirect": false, "via": [{"source": 1119502, "name": "qs", "dependency": "qs", "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set", "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26", "severity": "moderate", "cwe": ["CWE-476"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": ">=6.11.1 <=6.15.1"}], "effects": ["body-parser", "express"], "range": "6.11.1 - 6.15.1", "nodes": ["", ""], "fixAvailable": true}, "swagger-router": {"name": "swagger-router", "severity": "moderate", "isDirect": true, "via": ["uuid"], "effects": [], "range": ">=0.7.4", "nodes": ["node_modules/swagger-router"], "fixAvailable": {"name": "swagger-router", "version": "0.7.3", "isSemVerMajor": true}}, "uuid": {"name": "uuid", "severity": "moderate", "isDirect": false, "via": [{"source": 1119441, "name": "uuid", "dependency": "uuid", "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "severity": "moderate", "cwe": ["CWE-787", "CWE-1285"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}, "range": "<11.1.1"}], "effects": ["istanbul-lib-processinfo", "swagger-router"], "range": "<11.1.1", "nodes": ["node_modules/swagger-router/node_modules/uuid", "node_modules/uuid"], "fixAvailable": {"name": "swagger-router", "version": "0.7.3", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 7, "high": 0, "critical": 0, "total": 7}, "dependencies": {"prod": 220, "dev": 599, "optional": 7, "peer": 39, "peerOptional": 0, "total": 824}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'cxserver@1.2.1',
npm WARN EBADENGINE   required: { node: '>=24' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 819 packages, and audited 820 packages in 11s

198 packages are looking for funding
  run `npm fund` for details

# npm audit report

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install swagger-router@0.7.3, which is a breaking change
node_modules/swagger-router/node_modules/uuid
node_modules/uuid
  istanbul-lib-processinfo  <=3.0.0
  Depends on vulnerable versions of uuid
  node_modules/istanbul-lib-processinfo
    nyc  15.0.0-alpha.0 - 17.1.0
    Depends on vulnerable versions of istanbul-lib-processinfo
    node_modules/nyc
  swagger-router  >=0.7.4
  Depends on vulnerable versions of uuid
  node_modules/swagger-router

4 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'cxserver@1.2.1',
npm WARN EBADENGINE   required: { node: '>=24' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 819 packages, and audited 820 packages in 16s

198 packages are looking for funding
  run `npm fund` for details

4 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stdout ---

> cxserver@1.2.1 test
> npm run lint && npm run unittest


> cxserver@1.2.1 lint
> eslint .


/src/repo/app.js
   51:1   warning  The type 'Express' is undefined                                            jsdoc/no-undefined-types
   83:34  warning  Found non-literal argument to RegExp Constructor                           security/detect-non-literal-regexp
   89:25  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  264:9   warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  265:10  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/bin/segment.js
  17:33  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/lib/Config.js
  42:28  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  64:38  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  97:29  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/lib/adaptation/TemplateParameterMapper.js
  110:5  warning  Mixed spaces and tabs                         no-mixed-spaces-and-tabs
  110:7  warning  Expected no linebreak before this expression  implicit-arrow-linebreak
  113:4  warning  Mixed spaces and tabs                         no-mixed-spaces-and-tabs

/src/repo/lib/adaptation/TemplateTransclusion.js
  5:1   warning  The 'sqlite' is still an experimental feature The configured version range is '>=24'  n/no-unsupported-features/node-builtins
  5:30  error    Unable to resolve path to module 'node:sqlite'                                        import/no-unresolved

/src/repo/lib/lineardoc/Doc.js
  81:2  warning  JSDoc @return declaration present but return expression not available in function  jsdoc/require-returns-check

/src/repo/lib/lineardoc/MwContextualizer.js
  140:35  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp

/src/repo/lib/logging.js
  7:1  warning  The type 'winston.Logger' is undefined  jsdoc/no-undefined-types

/src/repo/lib/mw/MWPageLoader.js
  19:33  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/lib/routes/v1.js
  25:1  warning  JSDoc @return declaration present but return expression not available in function  jsdoc/require-returns-check

/src/repo/lib/suggestion/SectionSuggester.js
   6:1   warning  The 'sqlite' is still an experimental feature The configured version range is '>=24'  n/no-unsupported-features/node-builtins
   6:30  error    Unable to resolve path to module 'node:sqlite'                                        import/no-unresolved
  14:1   warning  Missing JSDoc @param "dbPool" type                                                    jsdoc/require-param-type

/src/repo/lib/swagger-ui.js
  26:9  warning  Found readFile from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/lib/translationunits/MWCategory.js
  15:41  warning  Unsafe Regular Expression  security/detect-unsafe-regex

/src/repo/lib/translationunits/MWFile.js
  44:51  warning  Unsafe Regular Expression  security/detect-unsafe-regex

/src/repo/lib/translationunits/MWImage.js
  123:68  warning  Unsafe Regular Expression  security/detect-unsafe-regex

/src/repo/lib/util.js
  133:23  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  140:1   warning  Missing JSDoc @return declaration                                          jsdoc/require-returns

/src/repo/scripts/SectionTitleAlignment/alignwithmt.js
  2:1   warning  The 'sqlite' is still an experimental feature The configured version range is '>=24'  n/no-unsupported-features/node-builtins
  2:30  error    Unable to resolve path to module 'node:sqlite'                                        import/no-unresolved

/src/repo/scripts/template-mapping.js
    3:1   warning  The 'sqlite' is still an experimental feature The configured version range is '>=24'  n/no-unsupported-features/node-builtins
    3:30  error    Unable to resolve path to module 'node:sqlite'                                        import/no-unresolved
  104:7   warning  Found existsSync from package "fs" with non literal argument at index 0               security/detect-non-literal-fs-filename
  110:14  warning  Found readFileSync from package "fs" with non literal argument at index 0             security/detect-non-literal-fs-filename

/src/repo/spec.yaml
  314:1  warning  This line has a length of 109. Maximum allowed is 100  max-len
  410:1  warning  This line has a length of 109. Maximum allowed is 100  max-len

/src/repo/test/integration/fixtures.yaml
   74:1  warning  This line has a length of 133. Maximum allowed is 100  max-len
   90:1  warning  This line has a length of 133. Maximum allowed is 100  max-len
  180:1  warning  This line has a length of 210. Maximum allowed is 100  max-len
  185:1  warning  This line has a length of 104. Maximum allowed is 100  max-len
  192:1  warning  This line has a length of 210. Maximum allowed is 100  max-len
  219:1  warning  This line has a length of 128. Maximum allowed is 100  max-len
  250:1  warning  This line has a length of 128. Maximum allowed is 100  max-len

/src/repo/test/integration/spec.js
   22:16  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
   39:16  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  189:10  warning  Found non-literal argument to RegExp Constructor                           security/detect-non-literal-regexp

/src/repo/test/unittest/adaptation/SectionTest.js
  31:20  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/lineardoc/LinearDoc.test.js
   28:22  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
   32:24  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
   36:26  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
   78:28  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  101:28  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  156:27  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  249:28  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/mw/MWPageLoaderTest.js
  37:27  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  46:5   warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/mw/SectionWrap.test.js
  22:3  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/segmentation/CXSegmenter.test.js
  28:19  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  34:3   warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/testutils.js
  22:5  warning  Found writeFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/translationunits/MWReference.test.js
  38:21  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename
  55:27  warning  Found readFileSync from package "fs" with non literal argument at index 0  security/detect-non-literal-fs-filename

/src/repo/test/unittest/utils/assert.js
  8:40  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp

✖ 63 problems (4 errors, 59 warnings)


--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1268, in main
    libup.run()
    ~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1208, in run
    self.npm_audit_fix(new_npm_audit)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 239, in npm_audit_fix
    self.npm_test()
    ~~~~~~~~~~~~~^^
  File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 289, in npm_test
    self.check_call(["npm", "test"])
    ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/venv/lib/python3.13/site-packages/runner/shell2.py", line 66, in check_call
    res.check_returncode()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/subprocess.py", line 508, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
                             self.stderr)
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 1.
Source code is licensed under the AGPL.