$ date
--- stdout ---
Mon Oct 13 02:29:19 UTC 2025
--- end ---
$ git clone file:///srv/git/mediawiki-services-mobileapps.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
5e5572159521d8cc4f36a7d229a6bde72589637d refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"0x": {
"name": "0x",
"severity": "high",
"isDirect": true,
"via": [
"d3-fg"
],
"effects": [],
"range": ">=4.1.5",
"nodes": [
"node_modules/0x"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cookie": {
"name": "cookie",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1103907,
"name": "cookie",
"dependency": "cookie",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x",
"severity": "low",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.7.0"
}
],
"effects": [
"mock-express-response"
],
"range": "<0.7.0",
"nodes": [
"node_modules/mock-express-response/node_modules/cookie"
],
"fixAvailable": false
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"pre-commit"
],
"range": "<6.0.6",
"nodes": [
"node_modules/pre-commit/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"d3-color": {
"name": "d3-color",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088594,
"name": "d3-color",
"dependency": "d3-color",
"title": "d3-color vulnerable to ReDoS",
"url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.0"
}
],
"effects": [
"d3-interpolate",
"d3-transition"
],
"range": "<3.1.0",
"nodes": [
"node_modules/d3-color",
"node_modules/d3-transition/node_modules/d3-color",
"node_modules/d3-zoom/node_modules/d3-color"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"d3-fg": {
"name": "d3-fg",
"severity": "high",
"isDirect": false,
"via": [
"d3-scale",
"d3-zoom"
],
"effects": [
"0x"
],
"range": ">=6.2.2",
"nodes": [
"node_modules/d3-fg"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"d3-interpolate": {
"name": "d3-interpolate",
"severity": "high",
"isDirect": false,
"via": [
"d3-color"
],
"effects": [
"d3-scale",
"d3-transition"
],
"range": "0.1.3 - 2.0.1",
"nodes": [
"node_modules/d3-interpolate",
"node_modules/d3-transition/node_modules/d3-interpolate",
"node_modules/d3-zoom/node_modules/d3-interpolate"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"d3-scale": {
"name": "d3-scale",
"severity": "high",
"isDirect": false,
"via": [
"d3-interpolate"
],
"effects": [],
"range": "0.1.5 - 3.3.0",
"nodes": [
"node_modules/d3-scale"
],
"fixAvailable": true
},
"d3-transition": {
"name": "d3-transition",
"severity": "high",
"isDirect": false,
"via": [
"d3-color",
"d3-interpolate"
],
"effects": [
"d3-zoom"
],
"range": "0.0.7 - 2.0.0",
"nodes": [
"node_modules/d3-transition"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"d3-zoom": {
"name": "d3-zoom",
"severity": "high",
"isDirect": false,
"via": [
"d3-interpolate",
"d3-transition"
],
"effects": [
"d3-fg"
],
"range": "0.0.2 - 2.0.0",
"nodes": [
"node_modules/d3-zoom"
],
"fixAvailable": {
"name": "0x",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1106509,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<2.5.4"
}
],
"effects": [
"request"
],
"range": "<2.5.4",
"nodes": [
"node_modules/request/node_modules/form-data"
],
"fixAvailable": false
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [
"service-runner"
],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"mock-express-response": {
"name": "mock-express-response",
"severity": "low",
"isDirect": true,
"via": [
"cookie",
"send"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/mock-express-response"
],
"fixAvailable": false
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094419,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"pre-commit": {
"name": "pre-commit",
"severity": "high",
"isDirect": true,
"via": [
"cross-spawn"
],
"effects": [],
"range": ">=1.1.0",
"nodes": [
"node_modules/pre-commit"
],
"fixAvailable": {
"name": "pre-commit",
"version": "1.0.10",
"isSemVerMajor": true
}
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"request": {
"name": "request",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1096727,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
},
"form-data",
"tough-cookie"
],
"effects": [
"preq",
"requestretry"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
},
"request"
],
"effects": [
"preq"
],
"range": "*",
"nodes": [
"node_modules/requestretry"
],
"fixAvailable": false
},
"send": {
"name": "send",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100526,
"name": "send",
"dependency": "send",
"title": "send vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<0.19.0"
}
],
"effects": [],
"range": "<0.19.0",
"nodes": [
"node_modules/mock-express-response/node_modules/send"
],
"fixAvailable": true
},
"service-runner": {
"name": "service-runner",
"severity": "moderate",
"isDirect": true,
"via": [
"limitation"
],
"effects": [],
"range": ">=3.1.0",
"nodes": [
"node_modules/service-runner"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
},
"tough-cookie": {
"name": "tough-cookie",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097682,
"name": "tough-cookie",
"dependency": "tough-cookie",
"title": "tough-cookie Prototype Pollution vulnerability",
"url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [
"request"
],
"range": "<4.1.3",
"nodes": [
"node_modules/tough-cookie"
],
"fixAvailable": false
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": {
"name": "service-runner",
"version": "3.0.0",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 3,
"moderate": 5,
"high": 11,
"critical": 2,
"total": 21
},
"dependencies": {
"prod": 520,
"dev": 578,
"optional": 23,
"peer": 1,
"peerOptional": 0,
"total": 1110
}
}
}
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 2030, in main
libup.run(args.repo, args.output, args.branch)
~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1965, in run
plan = planner.check(repo)
File "/venv/lib/python3.13/site-packages/runner/httpplan.py", line 38, in check
resp.raise_for_status()
~~~~~~~~~~~~~~~~~~~~~^^
File "/venv/lib/python3.13/site-packages/requests/models.py", line 1026, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 500 Server Error: INTERNAL SERVER ERROR for url: https://libup.wmcloud.org/plan.json?repository=mediawiki%2Fservices%2Fmobileapps&branch=master