mediawiki/extensions/CommunityConfiguration (REL1_46)

sourcepatches
From ed5f223c732b0f452cbb6d1a8d1042dfe77d929b Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 14 Jun 2026 04:31:04 +0000
Subject: [PATCH] build: Updating shell-quote to 1.8.4

* https://github.com/advisories/GHSA-w7jw-789q-3m8p

Change-Id: Ic7a73c3f3a3ef8d60aefd06297ddc78eb121e1db
---
 package-lock.json | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0a38b2c..d8f153a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13904,11 +13904,10 @@
 			}
 		},
 		"node_modules/shell-quote": {
-			"version": "1.8.3",
-			"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-			"integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+			"version": "1.8.4",
+			"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
+			"integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
 			"dev": true,
-			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
 			},
-- 
2.47.3

$ date
--- stdout ---
Sun Jun 14 04:29:27 UTC 2026

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-CommunityConfiguration.git /src/repo --depth=1 -b REL1_46
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_46
--- stdout ---
8b352e1a1303aac54054c6a7a827986090eb820e refs/heads/REL1_46

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "shell-quote": {
      "name": "shell-quote",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1120422,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "shell-quote quote() does not escape newlines in object .op values",
          "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p",
          "severity": "critical",
          "cwe": [
            "CWE-77",
            "CWE-78"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.1.0 <=1.8.3"
        }
      ],
      "effects": [],
      "range": "1.1.0 - 1.8.3",
      "nodes": [
        "node_modules/shell-quote"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 0,
      "critical": 1,
      "total": 1
    },
    "dependencies": {
      "prod": 1,
      "dev": 1203,
      "optional": 4,
      "peer": 2,
      "peerOptional": 0,
      "total": 1203
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 38 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.4.0)
  - Locking composer/semver (3.4.4)
  - Locking composer/spdx-licenses (1.5.10)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking danog/advanced-json-rpc (v3.2.3)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.1)
  - Locking doctrine/deprecations (1.1.6)
  - Locking mediawiki/mediawiki-codesniffer (v50.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.20.0)
  - Locking mediawiki/minus-x (2.0.1)
  - Locking mediawiki/phan-taint-check-plugin (9.1.0)
  - Locking netresearch/jsonmapper (v5.0.1)
  - Locking phan/phan (6.0.2)
  - Locking phan/tolerant-php-parser (v0.2.0)
  - Locking phan/var_representation_polyfill (0.1.4)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.4.0)
  - Locking phpcsstandards/phpcsutils (1.2.2)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (6.0.3)
  - Locking phpdocumentor/type-resolver (2.0.0)
  - Locking phpstan/phpdoc-parser (2.3.2)
  - Locking psr/container (2.0.2)
  - Locking psr/log (3.0.2)
  - Locking sabre/event (6.1.0)
  - Locking squizlabs/php_codesniffer (3.13.5)
  - Locking symfony/console (v8.1.0)
  - Locking symfony/deprecation-contracts (v3.7.0)
  - Locking symfony/polyfill-ctype (v1.37.0)
  - Locking symfony/polyfill-intl-grapheme (v1.38.1)
  - Locking symfony/polyfill-intl-normalizer (v1.38.0)
  - Locking symfony/polyfill-mbstring (v1.38.2)
  - Locking symfony/polyfill-php85 (v1.38.1)
  - Locking symfony/service-contracts (v3.7.0)
  - Locking symfony/string (v8.1.0)
  - Locking webmozart/assert (2.4.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 38 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing squizlabs/php_codesniffer (3.13.5): Extracting archive
  - Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.1): Extracting archive
  - Installing composer/pcre (3.4.0): Extracting archive
  - Installing phpcsstandards/phpcsutils (1.2.2): Extracting archive
  - Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.38.2): Extracting archive
  - Installing composer/spdx-licenses (1.5.10): Extracting archive
  - Installing composer/semver (3.4.4): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v50.0.0): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.38.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.38.1): Extracting archive
  - Installing symfony/polyfill-ctype (v1.37.0): Extracting archive
  - Installing symfony/string (v8.1.0): Extracting archive
  - Installing symfony/deprecation-contracts (v3.7.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.7.0): Extracting archive
  - Installing symfony/polyfill-php85 (v1.38.1): Extracting archive
  - Installing symfony/console (v8.1.0): Extracting archive
  - Installing sabre/event (6.1.0): Extracting archive
  - Installing phan/var_representation_polyfill (0.1.4): Extracting archive
  - Installing phan/tolerant-php-parser (v0.2.0): Extracting archive
  - Installing netresearch/jsonmapper (v5.0.1): Extracting archive
  - Installing webmozart/assert (2.4.0): Extracting archive
  - Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.6): Extracting archive
  - Installing phpdocumentor/type-resolver (2.0.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (6.0.3): Extracting archive
  - Installing danog/advanced-json-rpc (v3.2.3): Extracting archive
  - Installing psr/log (3.0.2): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (6.0.2): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (9.1.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.20.0): Extracting archive
  - Installing mediawiki/minus-x (2.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
  0/36 [>---------------------------]   0%
 28/36 [=====================>------]  77%
 36/36 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
17 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "shell-quote": {
      "name": "shell-quote",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1120422,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "shell-quote quote() does not escape newlines in object .op values",
          "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p",
          "severity": "critical",
          "cwe": [
            "CWE-77",
            "CWE-78"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.1.0 <=1.8.3"
        }
      ],
      "effects": [],
      "range": "1.1.0 - 1.8.3",
      "nodes": [
        "node_modules/shell-quote"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 0,
      "critical": 1,
      "total": 1
    },
    "dependencies": {
      "prod": 1,
      "dev": 1203,
      "optional": 4,
      "peer": 2,
      "peerOptional": 0,
      "total": 1203
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
  "added": 1203,
  "removed": 0,
  "changed": 0,
  "audited": 1204,
  "funding": 243,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "shell-quote": {
        "name": "shell-quote",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1120422,
            "name": "shell-quote",
            "dependency": "shell-quote",
            "title": "shell-quote quote() does not escape newlines in object .op values",
            "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p",
            "severity": "critical",
            "cwe": [
              "CWE-77",
              "CWE-78"
            ],
            "cvss": {
              "score": 8.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            },
            "range": ">=1.1.0 <=1.8.3"
          }
        ],
        "effects": [],
        "range": "1.1.0 - 1.8.3",
        "nodes": [
          ""
        ],
        "fixAvailable": true
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 0,
        "high": 0,
        "critical": 1,
        "total": 1
      },
      "dependencies": {
        "prod": 1,
        "dev": 1203,
        "optional": 4,
        "peer": 2,
        "peerOptional": 0,
        "total": 1203
      }
    }
  }
}

--- end ---
{"added": 1203, "removed": 0, "changed": 0, "audited": 1204, "funding": 243, "audit": {"auditReportVersion": 2, "vulnerabilities": {"shell-quote": {"name": "shell-quote", "severity": "critical", "isDirect": false, "via": [{"source": 1120422, "name": "shell-quote", "dependency": "shell-quote", "title": "shell-quote quote() does not escape newlines in object .op values", "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p", "severity": "critical", "cwe": ["CWE-77", "CWE-78"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.1.0 <=1.8.3"}], "effects": [], "range": "1.1.0 - 1.8.3", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 0, "critical": 1, "total": 1}, "dependencies": {"prod": 1, "dev": 1203, "optional": 4, "peer": 2, "peerOptional": 0, "total": 1203}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 1202 packages, and audited 1203 packages in 34s

243 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wikimedia/codex-icons@2.4.0',
npm WARN EBADENGINE   required: { node: '>=20.19.1', npm: '>=10.8.2' },
npm WARN EBADENGINE   current: { node: 'v20.19.2', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---

added 1202 packages, and audited 1203 packages in 20s

243 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

--- end ---
$ /usr/bin/npm test
--- stderr ---
PASS resources/ext.communityConfiguration.Editor/lib/json-form/core/__tests__/i18n.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/form/composables/useValidationErrors.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/ArrayControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/PageTitleControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/core/__tests__/uischema.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/StringControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/MultiselectEnumControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/complex/EnumControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/form/composables/useJsonForm.test.js
PASS resources/ext.communityConfiguration.Editor/app/App.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/NumberControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/PageTitlesControl.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/api.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/controls/BooleanControl.test.js
PASS resources/ext.communityConfiguration.Editor.common/components/ClientErrorMessage.test.js
PASS resources/ext.communityConfiguration.Editor/lib/json-form/controls-codex/src/mediawiki/NamespacesControl.test.js

Test Suites: 16 passed, 16 total
Tests:       79 passed, 79 total
Snapshots:   1 passed, 1 total
Time:        7.088 s
Ran all test suites.
--- stdout ---

> test
> npm-run-all test:*


> test:lint
> eslint --cache --max-warnings 0 .


> test:types
> tsc --noEmit -p cypress/tsconfig.json


> test:lintcss
> stylelint --cache "**/*.{css,less,vue}"


> test:linti18n
> banana-checker i18n/

Checked 1 message directory.

> test:jest
> jest

--------------------------------------------------|---------|----------|---------|---------|---------------------------------------
File                                              | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                     
--------------------------------------------------|---------|----------|---------|---------|---------------------------------------
All files                                         |   82.82 |    71.39 |   78.13 |   82.91 |                                       
 app                                              |   58.26 |    72.34 |      50 |   58.26 |                                       
  App.vue                                         |   84.81 |    82.92 |   73.33 |   84.81 | 71,79,97,135-136,166-177,251-255      
  MwApiCommunityConfigurationWritingRepository.js |       0 |      100 |       0 |       0 | 1-15                                  
  init.js                                         |       0 |        0 |       0 |       0 | 1-66                                  
 lib/json-form/controls-codex/config              |     100 |      100 |     100 |     100 |                                       
  index.js                                        |     100 |      100 |     100 |     100 |                                       
 lib/json-form/controls-codex/src                 |     100 |      100 |     100 |     100 |                                       
  index.js                                        |     100 |      100 |     100 |     100 |                                       
  utils.js                                        |     100 |      100 |     100 |     100 |                                       
 lib/json-form/controls-codex/src/complex         |   91.56 |    80.76 |   82.69 |   92.35 |                                       
  ArrayControl.vue                                |     100 |       70 |     100 |     100 | 74-122                                
  ChipStringsControl.vue                          |      50 |        0 |       0 |      55 | 29-36,51-58                           
  EnumControl.vue                                 |     100 |      100 |     100 |     100 |                                       
  MultiselectEnumControl.vue                      |   96.87 |     92.3 |   94.73 |   96.61 | 103,155                               
  ObjectControl.vue                               |   95.65 |       75 |    87.5 |   95.65 | 86                                    
  index.js                                        |     100 |      100 |     100 |     100 |                                       
 lib/json-form/controls-codex/src/controls        |   94.11 |    88.46 |    92.3 |   94.87 |                                       
  BooleanControl.vue                              |    90.9 |       75 |     100 |    90.9 | 31-32                                 
  ControlWrapper.vue                              |   93.33 |      100 |   83.33 |   93.33 | 42                                    
  NumberControl.vue                               |   97.29 |     87.5 |     100 |   97.29 | 57                                    
  StringControl.vue                               |   94.44 |    91.66 |     100 |   94.44 | 42-43                                 
  index.js                                        |   88.88 |        0 |      50 |     100 | 17                                    
 lib/json-form/controls-codex/src/mediawiki       |   73.82 |    52.32 |   63.33 |   73.25 |                                       
  CommonsFileControl.vue                          |   19.67 |        0 |       0 |   19.67 | 31-124,146-165                        
  NamespacesControl.vue                           |      86 |    85.71 |   68.75 |   88.88 | 19,71,104-108,121                     
  PageTitleControl.vue                            |   94.33 |       75 |   81.81 |   94.23 | 82,101,139                            
  PageTitlesControl.vue                           |   88.67 |    81.25 |   81.25 |   87.23 | 57-58,63,94,125-129                   
  api.js                                          |   89.47 |     62.5 |     100 |   89.47 | 17,46                                 
  constants.js                                    |     100 |      100 |     100 |     100 |                                       
  index.js                                        |     100 |      100 |     100 |     100 |                                       
 lib/json-form/core                               |   86.13 |    70.58 |   80.64 |   86.86 |                                       
  i18n.js                                         |   98.18 |    95.45 |     100 |   98.14 | 104                                   
  index.js                                        |     100 |      100 |     100 |     100 |                                       
  testers.js                                      |      50 |     6.25 |      40 |      52 | 14-18,31-50,70                        
  uischema.js                                     |     100 |     62.5 |     100 |     100 | 15,19                                 
 lib/json-form/form                               |     100 |      100 |     100 |     100 |                                       
  index.js                                        |     100 |      100 |     100 |     100 |                                       
 lib/json-form/form/components                    |   90.74 |       70 |   69.23 |   90.56 |                                       
  DispatchRenderer.vue                            |   95.65 |    83.33 |   83.33 |   95.45 | 44                                    
  FormLayout.vue                                  |    90.9 |      100 |      50 |    90.9 | 24                                    
  JsonForm.vue                                    |      85 |       50 |      60 |      85 | 47-48,80                              
 lib/json-form/form/composables                   |   90.72 |    75.75 |     100 |   90.54 |                                       
  props.js                                        |     100 |      100 |     100 |     100 |                                       
  useJsonForm.js                                  |   86.04 |    69.23 |     100 |   86.04 | 31-34,56,76,91-92,101,135,182,200,262 
  useValidationErrors.js                          |   96.77 |    85.18 |     100 |   96.66 | 46,195                                
--------------------------------------------------|---------|----------|---------|---------|---------------------------------------

--- end ---
{"1120422": {"source": 1120422, "name": "shell-quote", "dependency": "shell-quote", "title": "shell-quote quote() does not escape newlines in object .op values", "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p", "severity": "critical", "cwe": ["CWE-77", "CWE-78"], "cvss": {"score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.1.0 <=1.8.3"}}
Upgrading n:shell-quote from 1.8.3 -> 1.8.4
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json

--- end ---
build: Updating shell-quote to 1.8.4

* https://github.com/advisories/GHSA-w7jw-789q-3m8p

$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmpvjl9z0pz
--- stdout ---
[REL1_46 ed5f223] build: Updating shell-quote to 1.8.4
 1 file changed, 3 insertions(+), 4 deletions(-)

--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From ed5f223c732b0f452cbb6d1a8d1042dfe77d929b Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Sun, 14 Jun 2026 04:31:04 +0000
Subject: [PATCH] build: Updating shell-quote to 1.8.4

* https://github.com/advisories/GHSA-w7jw-789q-3m8p

Change-Id: Ic7a73c3f3a3ef8d60aefd06297ddc78eb121e1db
---
 package-lock.json | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0a38b2c..d8f153a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13904,11 +13904,10 @@
 			}
 		},
 		"node_modules/shell-quote": {
-			"version": "1.8.3",
-			"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-			"integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+			"version": "1.8.4",
+			"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
+			"integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
 			"dev": true,
-			"license": "MIT",
 			"engines": {
 				"node": ">= 0.4"
 			},
-- 
2.47.3


--- end ---

composer dependencies

Development dependencies

npm dependencies

Development dependencies

Logs

Source code is licensed under the AGPL.