$ date
--- stdout ---
Fri Jul 4 06:05:58 UTC 2025
--- end ---
$ git clone file:///srv/git/oojs-core.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
300262fbb7c0847db8ed9a22c99fb6a2453fcc66 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"bin-check": {
"name": "bin-check",
"severity": "high",
"isDirect": false,
"via": [
"execa"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.1.0",
"nodes": [
"node_modules/bin-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version": {
"name": "bin-version",
"severity": "high",
"isDirect": false,
"via": [
"find-versions"
],
"effects": [
"bin-version-check"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version-check": {
"name": "bin-version-check",
"severity": "high",
"isDirect": false,
"via": [
"bin-version"
],
"effects": [
"bin-wrapper"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-wrapper": {
"name": "bin-wrapper",
"severity": "high",
"isDirect": false,
"via": [
"bin-check",
"bin-version-check",
"download"
],
"effects": [
"saucelabs"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/bin-wrapper"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
},
{
"source": 1105444,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <=2.0.1"
}
],
"effects": [],
"range": "1.0.0 - 1.1.11 || 2.0.0 - 2.0.1",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion",
"node_modules/eslint-plugin-n/node_modules/brace-expansion"
],
"fixAvailable": true
},
"cacheable-request": {
"name": "cacheable-request",
"severity": "high",
"isDirect": false,
"via": [
"http-cache-semantics"
],
"effects": [
"got"
],
"range": "0.1.0 - 2.1.4",
"nodes": [
"node_modules/download/node_modules/cacheable-request"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1104663,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
}
],
"effects": [
"execa"
],
"range": "<6.0.6",
"nodes": [
"node_modules/execa/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/download"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"execa": {
"name": "execa",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"bin-check"
],
"range": "0.5.0 - 0.9.0",
"nodes": [
"node_modules/execa"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"find-versions": {
"name": "find-versions",
"severity": "high",
"isDirect": false,
"via": [
"semver-regex"
],
"effects": [
"bin-version"
],
"range": "<=3.2.0",
"nodes": [
"node_modules/find-versions"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"got": {
"name": "got",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088948,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
},
"cacheable-request"
],
"effects": [
"download"
],
"range": "<=11.8.3",
"nodes": [
"node_modules/download/node_modules/got"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"gulp-util": {
"name": "gulp-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash.template"
],
"effects": [
"remap-istanbul"
],
"range": ">=1.1.0",
"nodes": [
"node_modules/gulp-util"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"http-cache-semantics": {
"name": "http-cache-semantics",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1102456,
"name": "http-cache-semantics",
"dependency": "http-cache-semantics",
"title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.1.1"
}
],
"effects": [
"cacheable-request"
],
"range": "<4.1.1",
"nodes": [
"node_modules/download/node_modules/http-cache-semantics"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"karma-remap-istanbul": {
"name": "karma-remap-istanbul",
"severity": "high",
"isDirect": true,
"via": [
"remap-istanbul"
],
"effects": [],
"range": ">=0.0.3",
"nodes": [
"node_modules/karma-remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"karma-sauce-launcher": {
"name": "karma-sauce-launcher",
"severity": "moderate",
"isDirect": true,
"via": [
"saucelabs"
],
"effects": [],
"range": ">=4.1.5",
"nodes": [
"node_modules/karma-sauce-launcher"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"lodash.template": {
"name": "lodash.template",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096993,
"name": "lodash.template",
"dependency": "lodash.template",
"title": "Command Injection in lodash",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"severity": "high",
"cwe": [
"CWE-77",
"CWE-94"
],
"cvss": {
"score": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=4.5.0"
}
],
"effects": [
"gulp-util"
],
"range": "*",
"nodes": [
"node_modules/lodash.template"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"meow": {
"name": "meow",
"severity": "high",
"isDirect": false,
"via": [
"trim-newlines"
],
"effects": [],
"range": "3.4.0 - 5.0.0",
"nodes": [
"node_modules/meow"
],
"fixAvailable": true
},
"remap-istanbul": {
"name": "remap-istanbul",
"severity": "high",
"isDirect": false,
"via": [
"gulp-util"
],
"effects": [
"karma-remap-istanbul"
],
"range": "<=0.9.6",
"nodes": [
"node_modules/remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"saucelabs": {
"name": "saucelabs",
"severity": "moderate",
"isDirect": false,
"via": [
"bin-wrapper"
],
"effects": [
"karma-sauce-launcher"
],
"range": "4.1.0 - 7.1.2",
"nodes": [
"node_modules/saucelabs"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"semver-regex": {
"name": "semver-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092475,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "semver-regex Regular Expression Denial of Service (ReDOS)",
"url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1092605,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "Regular expression denial of service in semver-regex",
"url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch",
"severity": "low",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.4"
}
],
"effects": [
"find-versions"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/semver-regex"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1105197,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
}
],
"effects": [],
"range": "2.0.0 - 2.1.2",
"nodes": [
"node_modules/tar-fs"
],
"fixAvailable": true
},
"trim-newlines": {
"name": "trim-newlines",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095100,
"name": "trim-newlines",
"dependency": "trim-newlines",
"title": "Uncontrolled Resource Consumption in trim-newlines",
"url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.1"
}
],
"effects": [
"meow"
],
"range": "<3.0.1",
"nodes": [
"node_modules/trim-newlines"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 3,
"high": 18,
"critical": 0,
"total": 22
},
"dependencies": {
"prod": 1,
"dev": 921,
"optional": 3,
"peer": 1,
"peerOptional": 0,
"total": 921
}
}
}
--- end ---
Upgrading n:eslint-config-wikimedia from 0.29.1 -> 0.30.0
$ /usr/bin/npm install
--- stdout ---
added 920 packages, and audited 921 packages in 18s
103 packages are looking for funding
run `npm fund` for details
22 vulnerabilities (1 low, 3 moderate, 18 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(
ESLint: 8.57.0
ESLint couldn't find the config "wikimedia/client-es6" to extend from. Please check that the name of the config is correct.
The config "wikimedia/client-es6" was referenced from the config file in "/src/repo/.eslintrc.json".
If you still have problems, please stop by https://eslint.org/chat/help to chat with the team.
--- stdout ---
--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(
ESLint: 8.57.0
ESLint couldn't find the config "wikimedia/client-es6" to extend from. Please check that the name of the config is correct.
The config "wikimedia/client-es6" was referenced from the config file in "/src/repo/.eslintrc.json".
If you still have problems, please stop by https://eslint.org/chat/help to chat with the team.
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 2026, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1962, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1253, in npm_upgrade
hook(update)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1642, in _handle_eslint
errors = json.loads(
^^^^^^^^^^^
File "/usr/lib/python3.11/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)