oojs/core (main)

sourcepatches
$ date
--- stdout ---
Mon Jun 16 08:04:37 UTC 2025

--- end ---
$ git clone file:///srv/git/oojs-core.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
300262fbb7c0847db8ed9a22c99fb6a2453fcc66 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "bin-check": {
      "name": "bin-check",
      "severity": "high",
      "isDirect": false,
      "via": [
        "execa"
      ],
      "effects": [
        "bin-wrapper"
      ],
      "range": ">=4.1.0",
      "nodes": [
        "node_modules/bin-check"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "bin-version": {
      "name": "bin-version",
      "severity": "high",
      "isDirect": false,
      "via": [
        "find-versions"
      ],
      "effects": [
        "bin-version-check"
      ],
      "range": "<=4.0.0",
      "nodes": [
        "node_modules/bin-version"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "bin-version-check": {
      "name": "bin-version-check",
      "severity": "high",
      "isDirect": false,
      "via": [
        "bin-version"
      ],
      "effects": [
        "bin-wrapper"
      ],
      "range": "<=4.0.0",
      "nodes": [
        "node_modules/bin-version-check"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "bin-wrapper": {
      "name": "bin-wrapper",
      "severity": "high",
      "isDirect": false,
      "via": [
        "bin-check",
        "bin-version-check",
        "download"
      ],
      "effects": [
        "saucelabs"
      ],
      "range": ">=0.4.0",
      "nodes": [
        "node_modules/bin-wrapper"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1105443,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion Regular Expression Denial of Service vulnerability",
          "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
          "severity": "low",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 3.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=1.0.0 <=1.1.11"
        },
        {
          "source": 1105444,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion Regular Expression Denial of Service vulnerability",
          "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
          "severity": "low",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 3.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0 <=2.0.1"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1",
      "nodes": [
        "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
        "node_modules/brace-expansion",
        "node_modules/eslint-plugin-n/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "cacheable-request": {
      "name": "cacheable-request",
      "severity": "high",
      "isDirect": false,
      "via": [
        "http-cache-semantics"
      ],
      "effects": [
        "got"
      ],
      "range": "0.1.0 - 2.1.4",
      "nodes": [
        "node_modules/download/node_modules/cacheable-request"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104663,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        }
      ],
      "effects": [
        "execa"
      ],
      "range": "<6.0.6",
      "nodes": [
        "node_modules/execa/node_modules/cross-spawn"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "download": {
      "name": "download",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "got"
      ],
      "effects": [
        "bin-wrapper"
      ],
      "range": ">=4.0.0",
      "nodes": [
        "node_modules/download"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "execa": {
      "name": "execa",
      "severity": "high",
      "isDirect": false,
      "via": [
        "cross-spawn"
      ],
      "effects": [
        "bin-check"
      ],
      "range": "0.5.0 - 0.9.0",
      "nodes": [
        "node_modules/execa"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "find-versions": {
      "name": "find-versions",
      "severity": "high",
      "isDirect": false,
      "via": [
        "semver-regex"
      ],
      "effects": [
        "bin-version"
      ],
      "range": "<=3.2.0",
      "nodes": [
        "node_modules/find-versions"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "got": {
      "name": "got",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1088948,
          "name": "got",
          "dependency": "got",
          "title": "Got allows a redirect to a UNIX socket",
          "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
          "severity": "moderate",
          "cwe": [],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<11.8.5"
        },
        "cacheable-request"
      ],
      "effects": [
        "download"
      ],
      "range": "<=11.8.3",
      "nodes": [
        "node_modules/download/node_modules/got"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "gulp-util": {
      "name": "gulp-util",
      "severity": "high",
      "isDirect": false,
      "via": [
        "lodash.template"
      ],
      "effects": [
        "remap-istanbul"
      ],
      "range": ">=1.1.0",
      "nodes": [
        "node_modules/gulp-util"
      ],
      "fixAvailable": {
        "name": "karma-remap-istanbul",
        "version": "0.0.2",
        "isSemVerMajor": true
      }
    },
    "http-cache-semantics": {
      "name": "http-cache-semantics",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1102456,
          "name": "http-cache-semantics",
          "dependency": "http-cache-semantics",
          "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<4.1.1"
        }
      ],
      "effects": [
        "cacheable-request"
      ],
      "range": "<4.1.1",
      "nodes": [
        "node_modules/download/node_modules/http-cache-semantics"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "karma-remap-istanbul": {
      "name": "karma-remap-istanbul",
      "severity": "high",
      "isDirect": true,
      "via": [
        "remap-istanbul"
      ],
      "effects": [],
      "range": ">=0.0.3",
      "nodes": [
        "node_modules/karma-remap-istanbul"
      ],
      "fixAvailable": {
        "name": "karma-remap-istanbul",
        "version": "0.0.2",
        "isSemVerMajor": true
      }
    },
    "karma-sauce-launcher": {
      "name": "karma-sauce-launcher",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "saucelabs"
      ],
      "effects": [],
      "range": ">=4.1.5",
      "nodes": [
        "node_modules/karma-sauce-launcher"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "lodash.template": {
      "name": "lodash.template",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096993,
          "name": "lodash.template",
          "dependency": "lodash.template",
          "title": "Command Injection in lodash",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "severity": "high",
          "cwe": [
            "CWE-77",
            "CWE-94"
          ],
          "cvss": {
            "score": 7.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=4.5.0"
        }
      ],
      "effects": [
        "gulp-util"
      ],
      "range": "*",
      "nodes": [
        "node_modules/lodash.template"
      ],
      "fixAvailable": {
        "name": "karma-remap-istanbul",
        "version": "0.0.2",
        "isSemVerMajor": true
      }
    },
    "meow": {
      "name": "meow",
      "severity": "high",
      "isDirect": false,
      "via": [
        "trim-newlines"
      ],
      "effects": [],
      "range": "3.4.0 - 5.0.0",
      "nodes": [
        "node_modules/meow"
      ],
      "fixAvailable": true
    },
    "remap-istanbul": {
      "name": "remap-istanbul",
      "severity": "high",
      "isDirect": false,
      "via": [
        "gulp-util"
      ],
      "effects": [
        "karma-remap-istanbul"
      ],
      "range": "<=0.9.6",
      "nodes": [
        "node_modules/remap-istanbul"
      ],
      "fixAvailable": {
        "name": "karma-remap-istanbul",
        "version": "0.0.2",
        "isSemVerMajor": true
      }
    },
    "saucelabs": {
      "name": "saucelabs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "bin-wrapper"
      ],
      "effects": [
        "karma-sauce-launcher"
      ],
      "range": "4.1.0 - 7.1.2",
      "nodes": [
        "node_modules/saucelabs"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "semver-regex": {
      "name": "semver-regex",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1092475,
          "name": "semver-regex",
          "dependency": "semver-regex",
          "title": "semver-regex Regular Expression Denial of Service (ReDOS)",
          "url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.3"
        },
        {
          "source": 1092605,
          "name": "semver-regex",
          "dependency": "semver-regex",
          "title": "Regular expression denial of service in semver-regex",
          "url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch",
          "severity": "low",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.4"
        }
      ],
      "effects": [
        "find-versions"
      ],
      "range": "<=3.1.3",
      "nodes": [
        "node_modules/semver-regex"
      ],
      "fixAvailable": {
        "name": "karma-sauce-launcher",
        "version": "4.1.4",
        "isSemVerMajor": true
      }
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1105197,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.1.3"
        }
      ],
      "effects": [],
      "range": "2.0.0 - 2.1.2",
      "nodes": [
        "node_modules/tar-fs"
      ],
      "fixAvailable": true
    },
    "trim-newlines": {
      "name": "trim-newlines",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1095100,
          "name": "trim-newlines",
          "dependency": "trim-newlines",
          "title": "Uncontrolled Resource Consumption in trim-newlines",
          "url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.1"
        }
      ],
      "effects": [
        "meow"
      ],
      "range": "<3.0.1",
      "nodes": [
        "node_modules/trim-newlines"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 3,
      "high": 18,
      "critical": 0,
      "total": 22
    },
    "dependencies": {
      "prod": 1,
      "dev": 921,
      "optional": 3,
      "peer": 1,
      "peerOptional": 0,
      "total": 921
    }
  }
}

--- end ---
Upgrading n:eslint-config-wikimedia from 0.29.1 -> 0.30.0
$ /usr/bin/npm install
--- stdout ---

added 920 packages, and audited 921 packages in 18s

103 packages are looking for funding
  run `npm fund` for details

22 vulnerabilities (1 low, 3 moderate, 18 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(

ESLint: 8.57.0

ESLint couldn't find the config "wikimedia/client-es6" to extend from. Please check that the name of the config is correct.

The config "wikimedia/client-es6" was referenced from the config file in "/src/repo/.eslintrc.json".

If you still have problems, please stop by https://eslint.org/chat/help to chat with the team.
--- stdout ---

--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(

ESLint: 8.57.0

ESLint couldn't find the config "wikimedia/client-es6" to extend from. Please check that the name of the config is correct.

The config "wikimedia/client-es6" was referenced from the config file in "/src/repo/.eslintrc.json".

If you still have problems, please stop by https://eslint.org/chat/help to chat with the team.
--- stdout ---

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 2026, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1962, in run
    self.npm_upgrade(plan)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1253, in npm_upgrade
    hook(update)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1642, in _handle_eslint
    errors = json.loads(
             ^^^^^^^^^^^
  File "/usr/lib/python3.11/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

npm dependencies

Development dependencies

Logs

Source code is licensed under the AGPL.