$ date
--- stdout ---
Mon Apr 27 13:17:15 UTC 2026
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-LiquidThreads.git /src/repo --depth=1 -b master
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
7036c9b837d5ee70f4f8a8695239d04f32ba6224 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1117015,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<8.5.10"
}
],
"effects": [],
"range": "<8.5.10",
"nodes": [
"node_modules/postcss"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 430,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 430
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 38 installs, 0 updates, 0 removals
- Locking composer/installers (v2.3.0)
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.4)
- Locking composer/spdx-licenses (1.5.10)
- Locking composer/xdebug-handler (3.0.5)
- Locking danog/advanced-json-rpc (v3.2.3)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
- Locking doctrine/deprecations (1.1.6)
- Locking mediawiki/mediawiki-codesniffer (v50.0.0)
- Locking mediawiki/mediawiki-phan-config (0.20.0)
- Locking mediawiki/minus-x (2.0.1)
- Locking mediawiki/phan-taint-check-plugin (9.1.0)
- Locking netresearch/jsonmapper (v5.0.1)
- Locking phan/phan (6.0.2)
- Locking phan/tolerant-php-parser (v0.2.0)
- Locking phan/var_representation_polyfill (0.1.4)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.4.0)
- Locking phpcsstandards/phpcsutils (1.2.2)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (6.0.3)
- Locking phpdocumentor/type-resolver (2.0.0)
- Locking phpstan/phpdoc-parser (2.3.2)
- Locking psr/container (2.0.2)
- Locking psr/log (3.0.2)
- Locking sabre/event (6.0.1)
- Locking squizlabs/php_codesniffer (3.13.5)
- Locking symfony/console (v8.0.8)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.37.0)
- Locking symfony/polyfill-intl-grapheme (v1.37.0)
- Locking symfony/polyfill-intl-normalizer (v1.37.0)
- Locking symfony/polyfill-mbstring (v1.37.0)
- Locking symfony/service-contracts (v3.6.1)
- Locking symfony/string (v8.0.8)
- Locking webmozart/assert (2.3.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 38 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Installing composer/installers (v2.3.0): Extracting archive
- Installing squizlabs/php_codesniffer (3.13.5): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v1.2.0): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing phpcsstandards/phpcsutils (1.2.2): Extracting archive
- Installing phpcsstandards/phpcsextra (1.4.0): Extracting archive
- Installing symfony/polyfill-mbstring (v1.37.0): Extracting archive
- Installing composer/spdx-licenses (1.5.10): Extracting archive
- Installing composer/semver (3.4.4): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v50.0.0): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.37.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.37.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.37.0): Extracting archive
- Installing symfony/string (v8.0.8): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.1): Extracting archive
- Installing symfony/console (v8.0.8): Extracting archive
- Installing sabre/event (6.0.1): Extracting archive
- Installing phan/var_representation_polyfill (0.1.4): Extracting archive
- Installing phan/tolerant-php-parser (v0.2.0): Extracting archive
- Installing netresearch/jsonmapper (v5.0.1): Extracting archive
- Installing webmozart/assert (2.3.0): Extracting archive
- Installing phpstan/phpdoc-parser (2.3.2): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.6): Extracting archive
- Installing phpdocumentor/type-resolver (2.0.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (6.0.3): Extracting archive
- Installing danog/advanced-json-rpc (v3.2.3): Extracting archive
- Installing psr/log (3.0.2): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (6.0.2): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (9.1.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.20.0): Extracting archive
- Installing mediawiki/minus-x (2.0.1): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
0/35 [>---------------------------] 0%
27/35 [=====================>------] 77%
34/35 [===========================>] 97%
35/35 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
17 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1117015,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<8.5.10"
}
],
"effects": [],
"range": "<8.5.10",
"nodes": [
"node_modules/postcss"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 430,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 430
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 430,
"removed": 0,
"changed": 0,
"audited": 431,
"funding": 105,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1117015,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<8.5.10"
}
],
"effects": [],
"range": "<8.5.10",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 1,
"high": 0,
"critical": 0,
"total": 1
},
"dependencies": {
"prod": 1,
"dev": 430,
"optional": 0,
"peer": 1,
"peerOptional": 0,
"total": 430
}
}
}
}
--- end ---
{"added": 430, "removed": 0, "changed": 0, "audited": 431, "funding": 105, "audit": {"auditReportVersion": 2, "vulnerabilities": {"postcss": {"name": "postcss", "severity": "moderate", "isDirect": false, "via": [{"source": 1117015, "name": "postcss", "dependency": "postcss", "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<8.5.10"}], "effects": [], "range": "<8.5.10", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 1, "high": 0, "critical": 0, "total": 1}, "dependencies": {"prod": 1, "dev": 430, "optional": 0, "peer": 1, "peerOptional": 0, "total": 430}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 430 packages, and audited 431 packages in 4s
105 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
npm WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
--- stdout ---
added 430 packages, and audited 431 packages in 5s
105 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
--- end ---
$ /usr/bin/npm test
--- stdout ---
> test
> grunt test
Running "eslint:all" (eslint) task
/src/repo/jquery/jquery.thread_collapse.js
56:6 warning '$thread' is never reassigned. Use 'const' instead prefer-const
/src/repo/lqt.js
37:4 warning '$container' is never reassigned. Use 'const' instead prefer-const
38:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
41:58 warning Selector extensions are not allowed no-jquery/no-sizzle
46:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
107:5 warning 'talkpage' is never reassigned. Use 'const' instead prefer-const
128:4 warning '$parent' is never reassigned. Use 'const' instead prefer-const
130:4 warning '$container' is never reassigned. Use 'const' instead prefer-const
135:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
145:4 warning '$loadSpinner' is never reassigned. Use 'const' instead prefer-const
151:6 warning 'targetOffset' is never reassigned. Use 'const' instead prefer-const
152:6 warning 'windowHeight' is never reassigned. Use 'const' instead prefer-const
153:6 warning 'editBoxHeight' is never reassigned. Use 'const' instead prefer-const
171:5 warning '$editLink' is never reassigned. Use 'const' instead prefer-const
193:5 warning '$cancelButton' is never reassigned. Use 'const' instead prefer-const
237:4 warning Prefer .then to .done no-jquery/no-done-fail
289:5 warning '$post' is never reassigned. Use 'const' instead prefer-const
290:5 warning '$toolbar' is never reassigned. Use 'const' instead prefer-const
291:5 warning 'threadID' is never reassigned. Use 'const' instead prefer-const
292:5 warning '$menu' is never reassigned. Use 'const' instead prefer-const
293:5 warning '$menuContainer' is never reassigned. Use 'const' instead prefer-const
299:4 warning '$replyLink' is never reassigned. Use 'const' instead prefer-const
316:4 warning '$trigger' is never reassigned. Use 'const' instead prefer-const
336:6 warning 'windowHeight' is never reassigned. Use 'const' instead prefer-const
337:6 warning 'toolbarOffset' is never reassigned. Use 'const' instead prefer-const
338:6 warning 'scrollPos' is never reassigned. Use 'const' instead prefer-const
340:6 warning 'menuBottom' is never reassigned. Use 'const' instead prefer-const
360:4 warning '$editSubjectField' is never reassigned. Use 'const' instead prefer-const
361:4 warning '$editSubjectLink' is never reassigned. Use 'const' instead prefer-const
382:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
383:4 warning '$header' is never reassigned. Use 'const' instead prefer-const
384:4 warning 'headerText' is never reassigned. Use 'const' instead prefer-const
386:4 warning '$textbox' is never reassigned. Use 'const' instead prefer-const
393:4 warning 'saveText' is never reassigned. Use 'const' instead prefer-const
394:4 warning '$saveButton' is never reassigned. Use 'const' instead prefer-const
399:4 warning '$cancelButton' is never reassigned. Use 'const' instead prefer-const
404:7 warning '$header' is already declared in the upper scope on line 374 column 18 no-shadow
413:4 warning '$subjectForm' is never reassigned. Use 'const' instead prefer-const
423:5 warning '$button' is never reassigned. Use 'const' instead prefer-const
424:5 warning '$subjectForm' is never reassigned. Use 'const' instead prefer-const
425:5 warning '$header' is never reassigned. Use 'const' instead prefer-const
426:5 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
427:5 warning '$textbox' is never reassigned. Use 'const' instead prefer-const
428:5 warning 'newSubject' is never reassigned. Use 'const' instead prefer-const
437:4 warning '$spinner' is never reassigned. Use 'const' instead prefer-const
441:4 warning 'request' is never reassigned. Use 'const' instead prefer-const
450:4 warning Prefer .then to .done no-jquery/no-done-fail
496:5 warning 'threadModifiedTS' is never reassigned. Use 'const' instead prefer-const
497:5 warning 'threads' is never reassigned. Use 'const' instead prefer-const
515:4 warning Prefer .then to .done no-jquery/no-done-fail
521:11 warning 'threads' is already declared in the upper scope on line 497 column 5 no-shadow
525:12 warning 'threadId' is already declared in the upper scope on line 495 column 15 no-shadow
538:5 warning '$threadObject' is never reassigned. Use 'const' instead prefer-const
544:4 warning '$notifier' is never reassigned. Use 'const' instead prefer-const
548:4 warning '$updateButton' is never reassigned. Use 'const' instead prefer-const
572:4 warning Prefer .then to .done no-jquery/no-done-fail
580:6 warning 'html' is never reassigned. Use 'const' instead prefer-const
581:6 warning '$newContent' is never reassigned. Use 'const' instead prefer-const
588:5 warning '$newThread' is never reassigned. Use 'const' instead prefer-const
605:5 warning 'targetOffset' is never reassigned. Use 'const' instead prefer-const
612:5 warning 'prefixLength' is never reassigned. Use 'const' instead prefer-const
615:5 warning '$parentWrapper' is never reassigned. Use 'const' instead prefer-const
624:4 warning '$threadWrapper' is never reassigned. Use 'const' instead prefer-const
625:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
649:9 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
676:4 warning '$thread' is never reassigned. Use 'const' instead prefer-const
677:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
678:4 warning '$replies' is never reassigned. Use 'const' instead prefer-const
679:4 warning '$loader' is never reassigned. Use 'const' instead prefer-const
680:4 warning '$sep' is never reassigned. Use 'const' instead prefer-const
684:4 warning Prefer .then to .done no-jquery/no-done-fail
727:4 warning '$loader' is never reassigned. Use 'const' instead prefer-const
731:4 warning '$thread' is never reassigned. Use 'const' instead prefer-const
732:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
735:4 warning '$startAtField' is never reassigned. Use 'const' instead prefer-const
736:4 warning 'startAt' is never reassigned. Use 'const' instead prefer-const
739:4 warning Prefer .then to .done no-jquery/no-done-fail
747:9 warning 'content' is never reassigned. Use 'const' instead prefer-const
773:5 warning '$button' is never reassigned. Use 'const' instead prefer-const
774:5 warning 'tlcOffset' is never reassigned. Use 'const' instead prefer-const
775:5 warning '$oldButton' is never reassigned. Use 'const' instead prefer-const
777:5 warning '$threadLevelCommands' is never reassigned. Use 'const' instead prefer-const
778:5 warning 'title' is never reassigned. Use 'const' instead prefer-const
782:9 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
786:16 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
793:4 warning '$spinner' is never reassigned. Use 'const' instead prefer-const
797:4 warning 'api' is never reassigned. Use 'const' instead prefer-const
798:4 warning 'success' is never reassigned. Use 'const' instead prefer-const
801:4 warning 'error' is never reassigned. Use 'const' instead prefer-const
809:5 warning Prefer .then to .done no-jquery/no-done-fail
809:5 warning Prefer .then to .fail no-jquery/no-done-fail
811:5 warning Prefer .then to .done no-jquery/no-done-fail
811:5 warning Prefer .then to .fail no-jquery/no-done-fail
821:4 warning '$thread' is never reassigned. Use 'const' instead prefer-const
822:4 warning 'linkTitle' is never reassigned. Use 'const' instead prefer-const
838:4 warning 'linkTitle' is never reassigned. Use 'const' instead prefer-const
848:4 warning '$urlLabel' is never reassigned. Use 'const' instead prefer-const
849:4 warning '$urlField' is never reassigned. Use 'const' instead prefer-const
851:4 warning '$urlRow' is never reassigned. Use 'const' instead prefer-const
853:4 warning '$titleLabel' is never reassigned. Use 'const' instead prefer-const
854:4 warning '$titleField' is never reassigned. Use 'const' instead prefer-const
856:4 warning '$titleRow' is never reassigned. Use 'const' instead prefer-const
858:4 warning '$table' is never reassigned. Use 'const' instead prefer-const
861:4 warning '$dialog' is never reassigned. Use 'const' instead prefer-const
871:5 warning '$editform' is never reassigned. Use 'const' instead prefer-const
872:5 warning 'type' is never reassigned. Use 'const' instead prefer-const
873:5 warning 'wikiEditorContext' is never reassigned. Use 'const' instead prefer-const
901:4 warning 'subject' is never reassigned. Use 'const' instead prefer-const
902:4 warning 'replyThread' is never reassigned. Use 'const' instead prefer-const
903:4 warning '$bumpBox' is never reassigned. Use 'const' instead prefer-const
904:4 warning 'bump' is never reassigned. Use 'const' instead prefer-const
906:4 warning '$spinner' is never reassigned. Use 'const' instead prefer-const
914:5 warning Positional selector extensions are not allowed no-jquery/no-sizzle
1017:4 warning '$loadTOCSpinner' is never reassigned. Use 'const' instead prefer-const
1051:4 warning Prefer .then to .done no-jquery/no-done-fail
1051:4 warning Prefer .then to .fail no-jquery/no-done-fail
1078:4 warning Prefer .then to .done no-jquery/no-done-fail
1106:4 warning Prefer .then to .done no-jquery/no-done-fail
1112:5 warning 'text' is never reassigned. Use 'const' instead prefer-const
1113:5 warning '$prevWarning' is never reassigned. Use 'const' instead prefer-const
1146:4 warning '$thread' is never reassigned. Use 'const' instead prefer-const
1147:4 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
1157:9 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
1167:13 warning '$helper' is already declared in the upper scope on line 1141 column 16 no-shadow
1174:4 warning 'draggableOptions' is never reassigned. Use 'const' instead prefer-const
1195:4 warning Positional selector extensions are not allowed no-jquery/no-sizzle
1203:6 warning 'd' is never reassigned. Use 'const' instead prefer-const
1230:6 warning '$curThread' is never reassigned. Use 'const' instead prefer-const
1236:10 warning Positional selector extensions are not allowed no-jquery/no-sizzle
1239:5 warning '$repliesElement' is never reassigned. Use 'const' instead prefer-const
1243:4 warning 'droppableOptions' is never reassigned. Use 'const' instead prefer-const
1260:5 warning '$thread' is never reassigned. Use 'const' instead prefer-const
1263:4 warning 'params' is never reassigned. Use 'const' instead prefer-const
1307:5 warning '$confirmDialog' is never reassigned. Use 'const' instead prefer-const
1310:4 warning '$intro' is never reassigned. Use 'const' instead prefer-const
1314:4 warning '$actionSummary' is never reassigned. Use 'const' instead prefer-const
1323:4 warning 'topLevel' is never reassigned. Use 'const' instead prefer-const
1324:4 warning 'wasTopLevel' is never reassigned. Use 'const' instead prefer-const
1324:18 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
1341:4 warning '$summaryWrapper' is never reassigned. Use 'const' instead prefer-const
1342:4 warning '$summaryPrompt' is never reassigned. Use 'const' instead prefer-const
1343:4 warning '$summaryField' is never reassigned. Use 'const' instead prefer-const
1383:4 warning 'buttons' is never reassigned. Use 'const' instead prefer-const
1417:19 warning Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state
1434:30 warning 'threadId' is already declared in the upper scope on line 1415 column 5 no-shadow
1464:5 warning 'threadId' is never reassigned. Use 'const' instead prefer-const
1538:5 warning Prefer .then to .done no-jquery/no-done-fail
1542:5 warning Prefer .then to .done no-jquery/no-done-fail
1551:4 warning '$container' is never reassigned. Use 'const' instead prefer-const
1558:4 warning '$saveButton' is never reassigned. Use 'const' instead prefer-const
1570:4 warning '$container' is never reassigned. Use 'const' instead prefer-const
1572:4 warning '$spinner' is never reassigned. Use 'const' instead prefer-const
1575:4 warning '$textbox' is never reassigned. Use 'const' instead prefer-const
1576:4 warning '$preview' is never reassigned. Use 'const' instead prefer-const
1580:4 warning Prefer .then to .done no-jquery/no-done-fail
1616:3 warning '$threadContainers' is never reassigned. Use 'const' instead prefer-const
/src/repo/newmessages.js
9:2 warning ES2015 'Object.assign' method is forbidden es-x/no-object-assign
16:6 warning '$row' is never reassigned. Use 'const' instead prefer-const
17:6 warning '$rightCol' is never reassigned. Use 'const' instead prefer-const
21:5 warning 'msg' is never reassigned. Use 'const' instead prefer-const
22:5 warning 'undoMsg' is never reassigned. Use 'const' instead prefer-const
25:5 warning 'placeholderIndex' is never reassigned. Use 'const' instead prefer-const
26:5 warning '$elem' is never reassigned. Use 'const' instead prefer-const
62:5 warning '$undoLink' is never reassigned. Use 'const' instead prefer-const
80:5 warning '$button' is never reassigned. Use 'const' instead prefer-const
102:4 warning Prefer .then to .done no-jquery/no-done-fail
119:4 warning Prefer .then to .done no-jquery/no-done-fail
✖ 167 problems (0 errors, 167 warnings)
Running "banana:LiquidThreads" (banana) task
>> 2 message directories checked.
Running "stylelint:all" (stylelint) task
>> Linted 3 files without errors
Done.
--- end ---
{"1117015": {"source": 1117015, "name": "postcss", "dependency": "postcss", "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "severity": "moderate", "cwe": ["CWE-79"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<8.5.10"}}
Upgrading n:postcss from 8.5.6 -> 8.5.12
$ package-lock-lint /src/repo/package-lock.json
--- stdout ---
Checking /src/repo/package-lock.json
--- end ---
build: Updating postcss to 8.5.12
* https://github.com/advisories/GHSA-qx2v-qp2m-jg93
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmpssclav_3
--- stdout ---
[master 3bdf957] build: Updating postcss to 8.5.12
1 file changed, 6 insertions(+), 6 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 3bdf9578c444fc34193f4d6b0e42b5b56fabbf2a Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Mon, 27 Apr 2026 13:17:47 +0000
Subject: [PATCH] build: Updating postcss to 8.5.12
* https://github.com/advisories/GHSA-qx2v-qp2m-jg93
Change-Id: Ie5581c405504adc4a36daa7ffa9ec703174526e9
---
package-lock.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 6082d48..ccc04ab 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3838,9 +3838,9 @@
}
},
"node_modules/postcss": {
- "version": "8.5.6",
- "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
- "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+ "version": "8.5.12",
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+ "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
"dev": true,
"funding": [
{
@@ -8012,9 +8012,9 @@
"dev": true
},
"postcss": {
- "version": "8.5.6",
- "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
- "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+ "version": "8.5.12",
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz",
+ "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==",
"dev": true,
"requires": {
"nanoid": "^3.3.11",
--
2.47.3
--- end ---