$ date
--- stdout ---
Wed Jul 30 07:07:32 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-extensions-WikibaseMediaInfo.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
e9a178ff9b23ef9e516719df5ce94ba3ac03af24 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
},
"jpeg-js": {
"name": "jpeg-js",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1088964,
"name": "jpeg-js",
"dependency": "jpeg-js",
"title": "Infinite loop in jpeg-js",
"url": "https://github.com/advisories/GHSA-xvf7-4v9q-58w6",
"severity": "high",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.4.4"
},
{
"source": 1093580,
"name": "jpeg-js",
"dependency": "jpeg-js",
"title": "Uncontrolled resource consumption in jpeg-js",
"url": "https://github.com/advisories/GHSA-w7q9-p3jq-fmhm",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<0.4.0"
}
],
"effects": [],
"range": "<=0.4.3",
"nodes": [
"node_modules/jpeg-js"
],
"fixAvailable": {
"name": "jpeg-js",
"version": "0.4.4",
"isSemVerMajor": true
}
},
"jquery": {
"name": "jquery",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102093,
"name": "jquery",
"dependency": "jquery",
"title": "Potential XSS vulnerability in jQuery",
"url": "https://github.com/advisories/GHSA-jpcq-cgw6-v4j6",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": ">=1.0.3 <3.5.0"
},
{
"source": 1102100,
"name": "jquery",
"dependency": "jquery",
"title": "Potential XSS vulnerability in jQuery",
"url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": ">=1.2.0 <3.5.0"
}
],
"effects": [
"oojs-ui"
],
"range": "<=3.4.1",
"nodes": [
"node_modules/oojs-ui/node_modules/jquery"
],
"fixAvailable": {
"name": "oojs-ui",
"version": "0.52.0",
"isSemVerMajor": true
}
},
"jsdom": {
"name": "jsdom",
"severity": "moderate",
"isDirect": true,
"via": [
"request",
"request-promise-native",
"tough-cookie"
],
"effects": [],
"range": "0.1.20 || 0.2.0 - 16.5.3",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
},
"mockery": {
"name": "mockery",
"severity": "critical",
"isDirect": true,
"via": [
{
"source": 1092753,
"name": "mockery",
"dependency": "mockery",
"title": "mockery is vulnerable to prototype pollution",
"url": "https://github.com/advisories/GHSA-gmwp-3pwc-3j3g",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=2.1.0"
}
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/mockery"
],
"fixAvailable": false
},
"oojs-ui": {
"name": "oojs-ui",
"severity": "moderate",
"isDirect": true,
"via": [
"jquery"
],
"effects": [],
"range": "0.11.0 - 0.38.1",
"nodes": [
"node_modules/oojs-ui"
],
"fixAvailable": {
"name": "oojs-ui",
"version": "0.52.0",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"jsdom",
"request-promise-core",
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
},
"request-promise-core": {
"name": "request-promise-core",
"severity": "moderate",
"isDirect": false,
"via": [
"request"
],
"effects": [
"request-promise-native"
],
"range": "*",
"nodes": [
"node_modules/request-promise-core"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
},
"request-promise-native": {
"name": "request-promise-native",
"severity": "moderate",
"isDirect": false,
"via": [
"request",
"request-promise-core",
"tough-cookie"
],
"effects": [
"jsdom"
],
"range": ">=1.0.0",
"nodes": [
"node_modules/request-promise-native"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"jsdom",
"request",
"request-promise-native"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": {
"name": "jsdom",
"version": "26.1.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 6,
"high": 1,
"critical": 3,
"total": 10
},
"dependencies": {
"prod": 1,
"dev": 680,
"optional": 5,
"peer": 5,
"peerOptional": 0,
"total": 680
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 39 installs, 0 updates, 0 removals
- Locking composer/pcre (3.3.2)
- Locking composer/semver (3.4.3)
- Locking composer/spdx-licenses (1.5.9)
- Locking composer/xdebug-handler (3.0.5)
- Locking dealerdirect/phpcodesniffer-composer-installer (v1.1.2)
- Locking doctrine/deprecations (1.1.5)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mediawiki/mediawiki-codesniffer (v47.0.0)
- Locking mediawiki/mediawiki-phan-config (0.16.0)
- Locking mediawiki/minus-x (1.1.3)
- Locking mediawiki/phan-taint-check-plugin (6.2.1)
- Locking microsoft/tolerant-php-parser (v0.1.2)
- Locking netresearch/jsonmapper (v4.5.0)
- Locking phan/phan (5.5.0)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.4.0)
- Locking phpcsstandards/phpcsextra (1.2.1)
- Locking phpcsstandards/phpcsutils (1.0.12)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.6.2)
- Locking phpdocumentor/type-resolver (1.10.0)
- Locking phpstan/phpdoc-parser (2.2.0)
- Locking psr/container (2.0.2)
- Locking psr/log (3.0.2)
- Locking sabre/event (5.1.7)
- Locking serialization/serialization (4.1.0)
- Locking squizlabs/php_codesniffer (3.12.2)
- Locking symfony/console (v7.3.1)
- Locking symfony/deprecation-contracts (v3.6.0)
- Locking symfony/polyfill-ctype (v1.32.0)
- Locking symfony/polyfill-intl-grapheme (v1.32.0)
- Locking symfony/polyfill-intl-normalizer (v1.32.0)
- Locking symfony/polyfill-mbstring (v1.32.0)
- Locking symfony/polyfill-php80 (v1.32.0)
- Locking symfony/service-contracts (v3.6.0)
- Locking symfony/string (v7.3.0)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 39 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------]
- Installing squizlabs/php_codesniffer (3.12.2): Extracting archive
- Installing dealerdirect/phpcodesniffer-composer-installer (v1.1.2): Extracting archive
- Installing composer/pcre (3.3.2): Extracting archive
- Installing symfony/polyfill-php80 (v1.32.0): Extracting archive
- Installing phpcsstandards/phpcsutils (1.0.12): Extracting archive
- Installing phpcsstandards/phpcsextra (1.2.1): Extracting archive
- Installing symfony/polyfill-mbstring (v1.32.0): Extracting archive
- Installing composer/spdx-licenses (1.5.9): Extracting archive
- Installing composer/semver (3.4.3): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v47.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.32.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.32.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.32.0): Extracting archive
- Installing symfony/string (v7.3.0): Extracting archive
- Installing symfony/deprecation-contracts (v3.6.0): Extracting archive
- Installing psr/container (2.0.2): Extracting archive
- Installing symfony/service-contracts (v3.6.0): Extracting archive
- Installing symfony/console (v7.3.1): Extracting archive
- Installing sabre/event (5.1.7): Extracting archive
- Installing netresearch/jsonmapper (v4.5.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive
- Installing webmozart/assert (1.11.0): Extracting archive
- Installing phpstan/phpdoc-parser (2.2.0): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (1.1.5): Extracting archive
- Installing phpdocumentor/type-resolver (1.10.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.6.2): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (3.0.2): Extracting archive
- Installing composer/xdebug-handler (3.0.5): Extracting archive
- Installing phan/phan (5.5.0): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (6.2.1): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.16.0): Extracting archive
- Installing mediawiki/minus-x (1.1.3): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.4.0): Extracting archive
- Installing serialization/serialization (4.1.0): Extracting archive
0/37 [>---------------------------] 0%
19/37 [==============>-------------] 51%
29/37 [=====================>------] 78%
37/37 [============================] 100%
1 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
17 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
PHP CodeSniffer Config installed_paths set to ../../mediawiki/mediawiki-codesniffer,../../phpcsstandards/phpcsextra,../../phpcsstandards/phpcsutils
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 2026, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1961, in run
plan = planner.check(repo)
^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/httpplan.py", line 38, in check
resp.raise_for_status()
File "/venv/lib/python3.11/site-packages/requests/models.py", line 1021, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 500 Server Error: INTERNAL SERVER ERROR for url: https://libup.wmcloud.org/plan.json?repository=mediawiki%2Fextensions%2FWikibaseMediaInfo&branch=master