$ date
--- stdout ---
Wed Nov 20 08:33:59 UTC 2024
--- end ---
$ git clone file:///srv/git/oojs-core.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
3cd7c2a26c838cfd887b8abdebc7a88b5ee67e7e refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"bin-check": {
"name": "bin-check",
"severity": "high",
"isDirect": false,
"via": [
"execa"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.1.0",
"nodes": [
"node_modules/bin-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version": {
"name": "bin-version",
"severity": "high",
"isDirect": false,
"via": [
"find-versions"
],
"effects": [
"bin-version-check"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version-check": {
"name": "bin-version-check",
"severity": "high",
"isDirect": false,
"via": [
"bin-version"
],
"effects": [
"bin-wrapper"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-wrapper": {
"name": "bin-wrapper",
"severity": "high",
"isDirect": false,
"via": [
"bin-check",
"bin-version-check",
"download"
],
"effects": [
"saucelabs"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/bin-wrapper"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cacheable-request": {
"name": "cacheable-request",
"severity": "high",
"isDirect": false,
"via": [
"http-cache-semantics"
],
"effects": [
"got"
],
"range": "0.1.0 - 2.1.4",
"nodes": [
"node_modules/download/node_modules/cacheable-request"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100555,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1100556,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"execa"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/bin-version/node_modules/cross-spawn",
"node_modules/cross-spawn",
"node_modules/execa/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/download"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"execa": {
"name": "execa",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"bin-check"
],
"range": "0.5.0 - 0.9.0",
"nodes": [
"node_modules/execa"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"find-versions": {
"name": "find-versions",
"severity": "high",
"isDirect": false,
"via": [
"semver-regex"
],
"effects": [
"bin-version"
],
"range": "<=3.2.0",
"nodes": [
"node_modules/find-versions"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"got": {
"name": "got",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088948,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
},
"cacheable-request"
],
"effects": [
"download"
],
"range": "<=11.8.3",
"nodes": [
"node_modules/download/node_modules/got"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"gulp-util": {
"name": "gulp-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash.template"
],
"effects": [
"remap-istanbul"
],
"range": ">=1.1.0",
"nodes": [
"node_modules/gulp-util"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"http-cache-semantics": {
"name": "http-cache-semantics",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092316,
"name": "http-cache-semantics",
"dependency": "http-cache-semantics",
"title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.1.1"
}
],
"effects": [
"cacheable-request"
],
"range": "<4.1.1",
"nodes": [
"node_modules/download/node_modules/http-cache-semantics"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"karma-remap-istanbul": {
"name": "karma-remap-istanbul",
"severity": "high",
"isDirect": true,
"via": [
"remap-istanbul"
],
"effects": [],
"range": ">=0.0.3",
"nodes": [
"node_modules/karma-remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"karma-sauce-launcher": {
"name": "karma-sauce-launcher",
"severity": "moderate",
"isDirect": true,
"via": [
"saucelabs"
],
"effects": [],
"range": ">=4.1.5",
"nodes": [
"node_modules/karma-sauce-launcher"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"lodash.template": {
"name": "lodash.template",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096993,
"name": "lodash.template",
"dependency": "lodash.template",
"title": "Command Injection in lodash",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"severity": "high",
"cwe": [
"CWE-77",
"CWE-94"
],
"cvss": {
"score": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=4.5.0"
}
],
"effects": [
"gulp-util"
],
"range": "*",
"nodes": [
"node_modules/lodash.template"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"meow": {
"name": "meow",
"severity": "high",
"isDirect": false,
"via": [
"trim-newlines"
],
"effects": [],
"range": "3.4.0 - 5.0.0",
"nodes": [
"node_modules/meow"
],
"fixAvailable": true
},
"remap-istanbul": {
"name": "remap-istanbul",
"severity": "high",
"isDirect": false,
"via": [
"gulp-util"
],
"effects": [
"karma-remap-istanbul"
],
"range": "<=0.9.6",
"nodes": [
"node_modules/remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"saucelabs": {
"name": "saucelabs",
"severity": "moderate",
"isDirect": false,
"via": [
"bin-wrapper"
],
"effects": [
"karma-sauce-launcher"
],
"range": "4.1.0 - 7.1.2",
"nodes": [
"node_modules/saucelabs"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"semver-regex": {
"name": "semver-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092475,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "semver-regex Regular Expression Denial of Service (ReDOS)",
"url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1092605,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "Regular expression denial of service in semver-regex",
"url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch",
"severity": "low",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.4"
}
],
"effects": [
"find-versions"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/semver-regex"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"trim-newlines": {
"name": "trim-newlines",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095100,
"name": "trim-newlines",
"dependency": "trim-newlines",
"title": "Uncontrolled Resource Consumption in trim-newlines",
"url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.1"
}
],
"effects": [
"meow"
],
"range": "<3.0.1",
"nodes": [
"node_modules/trim-newlines"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 3,
"high": 17,
"critical": 0,
"total": 20
},
"dependencies": {
"prod": 1,
"dev": 937,
"optional": 3,
"peer": 1,
"peerOptional": 0,
"total": 937
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"bin-check": {
"name": "bin-check",
"severity": "high",
"isDirect": false,
"via": [
"execa"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.1.0",
"nodes": [
"node_modules/bin-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version": {
"name": "bin-version",
"severity": "high",
"isDirect": false,
"via": [
"find-versions"
],
"effects": [
"bin-version-check"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version-check": {
"name": "bin-version-check",
"severity": "high",
"isDirect": false,
"via": [
"bin-version"
],
"effects": [
"bin-wrapper"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-wrapper": {
"name": "bin-wrapper",
"severity": "high",
"isDirect": false,
"via": [
"bin-check",
"bin-version-check",
"download"
],
"effects": [
"saucelabs"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/bin-wrapper"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cacheable-request": {
"name": "cacheable-request",
"severity": "high",
"isDirect": false,
"via": [
"http-cache-semantics"
],
"effects": [
"got"
],
"range": "0.1.0 - 2.1.4",
"nodes": [
"node_modules/download/node_modules/cacheable-request"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100555,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1100556,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"execa"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/bin-version/node_modules/cross-spawn",
"node_modules/cross-spawn",
"node_modules/execa/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/download"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"execa": {
"name": "execa",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"bin-check"
],
"range": "0.5.0 - 0.9.0",
"nodes": [
"node_modules/execa"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"find-versions": {
"name": "find-versions",
"severity": "high",
"isDirect": false,
"via": [
"semver-regex"
],
"effects": [
"bin-version"
],
"range": "<=3.2.0",
"nodes": [
"node_modules/find-versions"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"got": {
"name": "got",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088948,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
},
"cacheable-request"
],
"effects": [
"download"
],
"range": "<=11.8.3",
"nodes": [
"node_modules/download/node_modules/got"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"gulp-util": {
"name": "gulp-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash.template"
],
"effects": [
"remap-istanbul"
],
"range": ">=1.1.0",
"nodes": [
"node_modules/gulp-util"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"http-cache-semantics": {
"name": "http-cache-semantics",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092316,
"name": "http-cache-semantics",
"dependency": "http-cache-semantics",
"title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.1.1"
}
],
"effects": [
"cacheable-request"
],
"range": "<4.1.1",
"nodes": [
"node_modules/download/node_modules/http-cache-semantics"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"karma-remap-istanbul": {
"name": "karma-remap-istanbul",
"severity": "high",
"isDirect": true,
"via": [
"remap-istanbul"
],
"effects": [],
"range": ">=0.0.3",
"nodes": [
"node_modules/karma-remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"karma-sauce-launcher": {
"name": "karma-sauce-launcher",
"severity": "moderate",
"isDirect": true,
"via": [
"saucelabs"
],
"effects": [],
"range": ">=4.1.5",
"nodes": [
"node_modules/karma-sauce-launcher"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"lodash.template": {
"name": "lodash.template",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096993,
"name": "lodash.template",
"dependency": "lodash.template",
"title": "Command Injection in lodash",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"severity": "high",
"cwe": [
"CWE-77",
"CWE-94"
],
"cvss": {
"score": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=4.5.0"
}
],
"effects": [
"gulp-util"
],
"range": "*",
"nodes": [
"node_modules/lodash.template"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"meow": {
"name": "meow",
"severity": "high",
"isDirect": false,
"via": [
"trim-newlines"
],
"effects": [],
"range": "3.4.0 - 5.0.0",
"nodes": [
"node_modules/meow"
],
"fixAvailable": true
},
"remap-istanbul": {
"name": "remap-istanbul",
"severity": "high",
"isDirect": false,
"via": [
"gulp-util"
],
"effects": [
"karma-remap-istanbul"
],
"range": "<=0.9.6",
"nodes": [
"node_modules/remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"saucelabs": {
"name": "saucelabs",
"severity": "moderate",
"isDirect": false,
"via": [
"bin-wrapper"
],
"effects": [
"karma-sauce-launcher"
],
"range": "4.1.0 - 7.1.2",
"nodes": [
"node_modules/saucelabs"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"semver-regex": {
"name": "semver-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092475,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "semver-regex Regular Expression Denial of Service (ReDOS)",
"url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1092605,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "Regular expression denial of service in semver-regex",
"url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch",
"severity": "low",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.4"
}
],
"effects": [
"find-versions"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/semver-regex"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"trim-newlines": {
"name": "trim-newlines",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095100,
"name": "trim-newlines",
"dependency": "trim-newlines",
"title": "Uncontrolled Resource Consumption in trim-newlines",
"url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.1"
}
],
"effects": [
"meow"
],
"range": "<3.0.1",
"nodes": [
"node_modules/trim-newlines"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 3,
"high": 17,
"critical": 0,
"total": 20
},
"dependencies": {
"prod": 1,
"dev": 937,
"optional": 3,
"peer": 1,
"peerOptional": 0,
"total": 937
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 937,
"removed": 0,
"changed": 0,
"audited": 938,
"funding": 103,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"bin-check": {
"name": "bin-check",
"severity": "high",
"isDirect": false,
"via": [
"execa"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.1.0",
"nodes": [
"node_modules/bin-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version": {
"name": "bin-version",
"severity": "high",
"isDirect": false,
"via": [
"find-versions"
],
"effects": [
"bin-version-check"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-version-check": {
"name": "bin-version-check",
"severity": "high",
"isDirect": false,
"via": [
"bin-version"
],
"effects": [
"bin-wrapper"
],
"range": "<=4.0.0",
"nodes": [
"node_modules/bin-version-check"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"bin-wrapper": {
"name": "bin-wrapper",
"severity": "high",
"isDirect": false,
"via": [
"bin-check",
"bin-version-check",
"download"
],
"effects": [
"saucelabs"
],
"range": ">=0.4.0",
"nodes": [
"node_modules/bin-wrapper"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cacheable-request": {
"name": "cacheable-request",
"severity": "high",
"isDirect": false,
"via": [
"http-cache-semantics"
],
"effects": [
"got"
],
"range": "0.1.0 - 2.1.4",
"nodes": [
"node_modules/download/node_modules/cacheable-request"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100555,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1100556,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [
"execa"
],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"",
"",
"node_modules/execa/node_modules/cross-spawn"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"bin-wrapper"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/download"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"execa": {
"name": "execa",
"severity": "high",
"isDirect": false,
"via": [
"cross-spawn"
],
"effects": [
"bin-check"
],
"range": "0.5.0 - 0.9.0",
"nodes": [
"node_modules/execa"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"find-versions": {
"name": "find-versions",
"severity": "high",
"isDirect": false,
"via": [
"semver-regex"
],
"effects": [
"bin-version"
],
"range": "<=3.2.0",
"nodes": [
"node_modules/find-versions"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"got": {
"name": "got",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088948,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
},
"cacheable-request"
],
"effects": [
"download"
],
"range": "<=11.8.3",
"nodes": [
"node_modules/download/node_modules/got"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"gulp-util": {
"name": "gulp-util",
"severity": "high",
"isDirect": false,
"via": [
"lodash.template"
],
"effects": [
"remap-istanbul"
],
"range": ">=1.1.0",
"nodes": [
"node_modules/gulp-util"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"http-cache-semantics": {
"name": "http-cache-semantics",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092316,
"name": "http-cache-semantics",
"dependency": "http-cache-semantics",
"title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.1.1"
}
],
"effects": [
"cacheable-request"
],
"range": "<4.1.1",
"nodes": [
"node_modules/download/node_modules/http-cache-semantics"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"karma-remap-istanbul": {
"name": "karma-remap-istanbul",
"severity": "high",
"isDirect": true,
"via": [
"remap-istanbul"
],
"effects": [],
"range": ">=0.0.3",
"nodes": [
"node_modules/karma-remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"karma-sauce-launcher": {
"name": "karma-sauce-launcher",
"severity": "moderate",
"isDirect": true,
"via": [
"saucelabs"
],
"effects": [],
"range": ">=4.1.5",
"nodes": [
"node_modules/karma-sauce-launcher"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"lodash.template": {
"name": "lodash.template",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1096993,
"name": "lodash.template",
"dependency": "lodash.template",
"title": "Command Injection in lodash",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"severity": "high",
"cwe": [
"CWE-77",
"CWE-94"
],
"cvss": {
"score": 7.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=4.5.0"
}
],
"effects": [
"gulp-util"
],
"range": "*",
"nodes": [
"node_modules/lodash.template"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"meow": {
"name": "meow",
"severity": "high",
"isDirect": false,
"via": [
"trim-newlines"
],
"effects": [],
"range": "3.4.0 - 5.0.0",
"nodes": [
"node_modules/meow"
],
"fixAvailable": true
},
"remap-istanbul": {
"name": "remap-istanbul",
"severity": "high",
"isDirect": false,
"via": [
"gulp-util"
],
"effects": [
"karma-remap-istanbul"
],
"range": "<=0.9.6",
"nodes": [
"node_modules/remap-istanbul"
],
"fixAvailable": {
"name": "karma-remap-istanbul",
"version": "0.0.2",
"isSemVerMajor": true
}
},
"saucelabs": {
"name": "saucelabs",
"severity": "moderate",
"isDirect": false,
"via": [
"bin-wrapper"
],
"effects": [
"karma-sauce-launcher"
],
"range": "4.1.0 - 7.1.2",
"nodes": [
"node_modules/saucelabs"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"semver-regex": {
"name": "semver-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1092475,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "semver-regex Regular Expression Denial of Service (ReDOS)",
"url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1092605,
"name": "semver-regex",
"dependency": "semver-regex",
"title": "Regular expression denial of service in semver-regex",
"url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch",
"severity": "low",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.4"
}
],
"effects": [
"find-versions"
],
"range": "<=3.1.3",
"nodes": [
"node_modules/semver-regex"
],
"fixAvailable": {
"name": "karma-sauce-launcher",
"version": "4.1.4",
"isSemVerMajor": true
}
},
"trim-newlines": {
"name": "trim-newlines",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1095100,
"name": "trim-newlines",
"dependency": "trim-newlines",
"title": "Uncontrolled Resource Consumption in trim-newlines",
"url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.1"
}
],
"effects": [
"meow"
],
"range": "<3.0.1",
"nodes": [
"node_modules/trim-newlines"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 3,
"high": 17,
"critical": 0,
"total": 20
},
"dependencies": {
"prod": 1,
"dev": 937,
"optional": 3,
"peer": 1,
"peerOptional": 0,
"total": 937
}
}
}
}
--- end ---
{"added": 937, "removed": 0, "changed": 0, "audited": 938, "funding": 103, "audit": {"auditReportVersion": 2, "vulnerabilities": {"bin-check": {"name": "bin-check", "severity": "high", "isDirect": false, "via": ["execa"], "effects": ["bin-wrapper"], "range": ">=4.1.0", "nodes": ["node_modules/bin-check"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "bin-version": {"name": "bin-version", "severity": "high", "isDirect": false, "via": ["find-versions"], "effects": ["bin-version-check"], "range": "<=4.0.0", "nodes": ["node_modules/bin-version"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "bin-version-check": {"name": "bin-version-check", "severity": "high", "isDirect": false, "via": ["bin-version"], "effects": ["bin-wrapper"], "range": "<=4.0.0", "nodes": ["node_modules/bin-version-check"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "bin-wrapper": {"name": "bin-wrapper", "severity": "high", "isDirect": false, "via": ["bin-check", "bin-version-check", "download"], "effects": ["saucelabs"], "range": ">=0.4.0", "nodes": ["node_modules/bin-wrapper"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "cacheable-request": {"name": "cacheable-request", "severity": "high", "isDirect": false, "via": ["http-cache-semantics"], "effects": ["got"], "range": "0.1.0 - 2.1.4", "nodes": ["node_modules/download/node_modules/cacheable-request"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "cross-spawn": {"name": "cross-spawn", "severity": "high", "isDirect": false, "via": [{"source": 1100555, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<6.0.6"}, {"source": 1100556, "name": "cross-spawn", "dependency": "cross-spawn", "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <7.0.5"}], "effects": ["execa"], "range": "<6.0.6 || >=7.0.0 <7.0.5", "nodes": ["", "", "node_modules/execa/node_modules/cross-spawn"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "download": {"name": "download", "severity": "moderate", "isDirect": false, "via": ["got"], "effects": ["bin-wrapper"], "range": ">=4.0.0", "nodes": ["node_modules/download"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "execa": {"name": "execa", "severity": "high", "isDirect": false, "via": ["cross-spawn"], "effects": ["bin-check"], "range": "0.5.0 - 0.9.0", "nodes": ["node_modules/execa"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "find-versions": {"name": "find-versions", "severity": "high", "isDirect": false, "via": ["semver-regex"], "effects": ["bin-version"], "range": "<=3.2.0", "nodes": ["node_modules/find-versions"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "got": {"name": "got", "severity": "high", "isDirect": false, "via": [{"source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<11.8.5"}, "cacheable-request"], "effects": ["download"], "range": "<=11.8.3", "nodes": ["node_modules/download/node_modules/got"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "gulp-util": {"name": "gulp-util", "severity": "high", "isDirect": false, "via": ["lodash.template"], "effects": ["remap-istanbul"], "range": ">=1.1.0", "nodes": ["node_modules/gulp-util"], "fixAvailable": {"name": "karma-remap-istanbul", "version": "0.0.2", "isSemVerMajor": true}}, "http-cache-semantics": {"name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [{"source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<4.1.1"}], "effects": ["cacheable-request"], "range": "<4.1.1", "nodes": ["node_modules/download/node_modules/http-cache-semantics"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "karma-remap-istanbul": {"name": "karma-remap-istanbul", "severity": "high", "isDirect": true, "via": ["remap-istanbul"], "effects": [], "range": ">=0.0.3", "nodes": ["node_modules/karma-remap-istanbul"], "fixAvailable": {"name": "karma-remap-istanbul", "version": "0.0.2", "isSemVerMajor": true}}, "karma-sauce-launcher": {"name": "karma-sauce-launcher", "severity": "moderate", "isDirect": true, "via": ["saucelabs"], "effects": [], "range": ">=4.1.5", "nodes": ["node_modules/karma-sauce-launcher"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "lodash.template": {"name": "lodash.template", "severity": "high", "isDirect": false, "via": [{"source": 1096993, "name": "lodash.template", "dependency": "lodash.template", "title": "Command Injection in lodash", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm", "severity": "high", "cwe": ["CWE-77", "CWE-94"], "cvss": {"score": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "range": "<=4.5.0"}], "effects": ["gulp-util"], "range": "*", "nodes": ["node_modules/lodash.template"], "fixAvailable": {"name": "karma-remap-istanbul", "version": "0.0.2", "isSemVerMajor": true}}, "meow": {"name": "meow", "severity": "high", "isDirect": false, "via": ["trim-newlines"], "effects": [], "range": "3.4.0 - 5.0.0", "nodes": ["node_modules/meow"], "fixAvailable": true}, "remap-istanbul": {"name": "remap-istanbul", "severity": "high", "isDirect": false, "via": ["gulp-util"], "effects": ["karma-remap-istanbul"], "range": "<=0.9.6", "nodes": ["node_modules/remap-istanbul"], "fixAvailable": {"name": "karma-remap-istanbul", "version": "0.0.2", "isSemVerMajor": true}}, "saucelabs": {"name": "saucelabs", "severity": "moderate", "isDirect": false, "via": ["bin-wrapper"], "effects": ["karma-sauce-launcher"], "range": "4.1.0 - 7.1.2", "nodes": ["node_modules/saucelabs"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "semver-regex": {"name": "semver-regex", "severity": "high", "isDirect": false, "via": [{"source": 1092475, "name": "semver-regex", "dependency": "semver-regex", "title": "semver-regex Regular Expression Denial of Service (ReDOS)", "url": "https://github.com/advisories/GHSA-44c6-4v22-4mhx", "severity": "high", "cwe": ["CWE-400", "CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.1.3"}, {"source": 1092605, "name": "semver-regex", "dependency": "semver-regex", "title": "Regular expression denial of service in semver-regex", "url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch", "severity": "low", "cwe": ["CWE-1333"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.1.4"}], "effects": ["find-versions"], "range": "<=3.1.3", "nodes": ["node_modules/semver-regex"], "fixAvailable": {"name": "karma-sauce-launcher", "version": "4.1.4", "isSemVerMajor": true}}, "trim-newlines": {"name": "trim-newlines", "severity": "high", "isDirect": false, "via": [{"source": 1095100, "name": "trim-newlines", "dependency": "trim-newlines", "title": "Uncontrolled Resource Consumption in trim-newlines", "url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.1"}], "effects": ["meow"], "range": "<3.0.1", "nodes": ["node_modules/trim-newlines"], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 3, "high": 17, "critical": 0, "total": 20}, "dependencies": {"prod": 1, "dev": 937, "optional": 3, "peer": 1, "peerOptional": 0, "total": 937}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
added 936 packages, and audited 937 packages in 17s
103 packages are looking for funding
run `npm fund` for details
# npm audit report
cross-spawn <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix --force`
Will install karma-sauce-launcher@4.1.4, which is a breaking change
node_modules/execa/node_modules/cross-spawn
execa 0.5.0 - 0.9.0
Depends on vulnerable versions of cross-spawn
node_modules/execa
bin-check >=4.1.0
Depends on vulnerable versions of execa
node_modules/bin-check
bin-wrapper >=0.4.0
Depends on vulnerable versions of bin-check
Depends on vulnerable versions of bin-version-check
Depends on vulnerable versions of download
node_modules/bin-wrapper
saucelabs 4.1.0 - 7.1.2
Depends on vulnerable versions of bin-wrapper
node_modules/saucelabs
karma-sauce-launcher >=4.1.5
Depends on vulnerable versions of saucelabs
node_modules/karma-sauce-launcher
got <=11.8.3
Severity: high
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
Depends on vulnerable versions of cacheable-request
fix available via `npm audit fix --force`
Will install karma-sauce-launcher@4.1.4, which is a breaking change
node_modules/download/node_modules/got
download >=4.0.0
Depends on vulnerable versions of got
node_modules/download
http-cache-semantics <4.1.1
Severity: high
http-cache-semantics vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-rc47-6667-2j5j
fix available via `npm audit fix --force`
Will install karma-sauce-launcher@4.1.4, which is a breaking change
node_modules/download/node_modules/http-cache-semantics
cacheable-request 0.1.0 - 2.1.4
Depends on vulnerable versions of http-cache-semantics
node_modules/download/node_modules/cacheable-request
lodash.template *
Severity: high
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
fix available via `npm audit fix --force`
Will install karma-remap-istanbul@0.0.2, which is a breaking change
node_modules/lodash.template
gulp-util >=1.1.0
Depends on vulnerable versions of lodash.template
node_modules/gulp-util
remap-istanbul <=0.9.6
Depends on vulnerable versions of gulp-util
node_modules/remap-istanbul
karma-remap-istanbul >=0.0.3
Depends on vulnerable versions of remap-istanbul
node_modules/karma-remap-istanbul
semver-regex <=3.1.3
Severity: high
semver-regex Regular Expression Denial of Service (ReDOS) - https://github.com/advisories/GHSA-44c6-4v22-4mhx
Regular expression denial of service in semver-regex - https://github.com/advisories/GHSA-4x5v-gmq8-25ch
fix available via `npm audit fix --force`
Will install karma-sauce-launcher@4.1.4, which is a breaking change
node_modules/semver-regex
find-versions <=3.2.0
Depends on vulnerable versions of semver-regex
node_modules/find-versions
bin-version <=4.0.0
Depends on vulnerable versions of find-versions
node_modules/bin-version
bin-version-check <=4.0.0
Depends on vulnerable versions of bin-version
node_modules/bin-version-check
trim-newlines <3.0.1
Severity: high
Uncontrolled Resource Consumption in trim-newlines - https://github.com/advisories/GHSA-7p7h-4mm5-852v
fix available via `npm audit fix`
node_modules/trim-newlines
meow 3.4.0 - 5.0.0
Depends on vulnerable versions of trim-newlines
node_modules/meow
20 vulnerabilities (3 moderate, 17 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stdout ---
added 936 packages, and audited 937 packages in 22s
103 packages are looking for funding
run `npm fund` for details
20 vulnerabilities (3 moderate, 17 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ /usr/bin/npm test
--- stderr ---
(node:163) Warning: Accessing non-existent property 'VERSION' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)
--- stdout ---
> oojs@7.0.1 test
> npm run build-dev && karma start && qunit --require ./tests/setup-node tests/unit/ && npm run lint && npm run doc
> oojs@7.0.1 build-dev
> grunt build-dev
Running "set-meta" task
Running "set-dev" task
Running "clean:dist" (clean) task
>> 0 paths cleaned.
Running "concat:dev" (concat) task
Done.
[32m20 11 2024 08:34:51.914:INFO [karma-server]: [39mKarma v6.3.18 server started at http://localhost:9876/
[32m20 11 2024 08:34:51.916:INFO [launcher]: [39mLaunching browsers FirefoxHeadless, ChromeCustom with concurrency unlimited
[32m20 11 2024 08:34:51.920:INFO [launcher]: [39mStarting browser FirefoxHeadless
[32m20 11 2024 08:34:51.930:INFO [launcher]: [39mStarting browser ChromeHeadless
[32m20 11 2024 08:34:54.925:INFO [Chrome Headless 126.0.6478.182 (Linux x86_64)]: [39mConnected on socket W5NDzvUTyJxG0iLmAAAB with id 51418884
............................................................
Chrome Headless 126.0.6478.182 (Linux x86_64): Executed 60 of 60 SUCCESS (0.148 secs / 0.109 secs)
[32m20 11 2024 08:34:56.191:INFO [Firefox 115.0 (Linux x86_64)]: [39mConnected on socket --6sv6C9J97ozb1BAAAD with id 74750193
............................................................
Firefox 115.0 (Linux x86_64): Executed 60 of 60 SUCCESS (0.168 secs / 0.153 secs)
TOTAL: 120 SUCCESS
TOTAL: 120 SUCCESS
=============================== Coverage summary ===============================
Statements : 100% ( 446/446 )
Branches : 100% ( 270/270 )
Functions : 100% ( 60/60 )
Lines : 100% ( 429/429 )
================================================================================
TAP version 13
ok 1 EmitterList > addItems
ok 2 EmitterList > moveItem
ok 3 EmitterList > clearItems
ok 4 EmitterList > removeItems
ok 5 EmitterList > aggregate
ok 6 EmitterList > Events
ok 7 EventEmitter > on
ok 8 EventEmitter > once
ok 9 EventEmitter > once - nested
ok 10 EventEmitter > once - off
ok 11 EventEmitter > emit
ok 12 EventEmitter > off
ok 13 EventEmitter > connect
ok 14 EventEmitter > disconnect( host )
ok 15 EventEmitter > disconnect( host, methods )
ok 16 EventEmitter > disconnect( host, array methods )
ok 17 EventEmitter > disconnect( host, unbound methods )
ok 18 EventEmitter > chainable
ok 19 Factory > invalid registration
ok 20 Factory > registeration and lookup [Class.key]
ok 21 Factory > registeration and lookup [Class.static.name]
ok 22 Factory > registeration and lookup [key and name]
ok 23 Factory > registeration and lookup [unknown]
ok 24 Factory > invalid creation
ok 25 Factory > valid creation
ok 26 Registry > register/unregister
ok 27 Registry > lookup
ok 28 SortedEmitterList > addItems
ok 29 SortedEmitterList > Events
ok 30 core > initClass
ok 31 core > inheritClass
ok 32 core > mixinClass
ok 33 core > isSubclass
ok 34 core > getProp( Object )
ok 35 core > getProp( Function )
ok 36 core > getProp( Array )
ok 37 core > setProp( Object )
ok 38 core > setProp( Function )
ok 39 core > setProp( Array )
ok 40 core > deleteProp( Object )
ok 41 core > deleteProp( Function )
ok 42 core > deleteProp( Array )
ok 43 core > cloneObject
ok 44 core > getObjectValues
ok 45 core > binarySearch
ok 46 core > compare
ok 47 core > compare( Node, Node )
ok 48 core > compare( Object, Object, Boolean asymmetrical )
ok 49 core > copy( source )
ok 50 core > copy( source, Function leafCallback )
ok 51 core > copy( source, Function leafCallback, Function nodeCallback )
ok 52 core > getHash: Basic usage
ok 53 core > getHash: Complex usage
ok 54 core > unique
ok 55 core > simpleArrayUnion
ok 56 core > simpleArrayIntersection
ok 57 core > simpleArrayDifference
ok 58 util > isPlainObject
1..58
# pass 58
# skip 0
# todo 0
# fail 0
> oojs@7.0.1 lint
> eslint --cache .
> oojs@7.0.1 doc
> jsdoc -c jsdoc.json
--- end ---
{"1095100": {"source": 1095100, "name": "trim-newlines", "dependency": "trim-newlines", "title": "Uncontrolled Resource Consumption in trim-newlines", "url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.1"}}
{"1095100": {"source": 1095100, "name": "trim-newlines", "dependency": "trim-newlines", "title": "Uncontrolled Resource Consumption in trim-newlines", "url": "https://github.com/advisories/GHSA-7p7h-4mm5-852v", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.1"}}
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
[DNM] there are no updates
$ git add .
--- stdout ---
--- end ---
$ git commit -F /tmp/tmp45zjd_h_
--- stdout ---
[master 5f1f4d1] [DNM] there are no updates
1 file changed, 6 insertions(+), 4 deletions(-)
--- end ---
$ git format-patch HEAD~1 --stdout
--- stdout ---
From 5f1f4d178984f0cf56d6cbca467e28caa177a755 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Wed, 20 Nov 2024 08:35:04 +0000
Subject: [PATCH] [DNM] there are no updates
Change-Id: I53ab414e39fbc845a1f40917692ca9dfe54daca3
---
package-lock.json | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 35724a9..9a9001f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1553,9 +1553,10 @@
}
},
"node_modules/bin-version/node_modules/cross-spawn": {
- "version": "6.0.5",
+ "version": "6.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.6.tgz",
+ "integrity": "sha512-VqCUuhcd1iB+dsv8gxPttb5iZh/D0iubSP21g36KXdEuf6I5JiioesUVjpCdHV9MZRUfVFlvwtIUyPfxo5trtw==",
"dev": true,
- "license": "MIT",
"dependencies": {
"nice-try": "^1.0.4",
"path-key": "^2.0.1",
@@ -2517,9 +2518,10 @@
}
},
"node_modules/cross-spawn": {
- "version": "7.0.3",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
"dev": true,
- "license": "MIT",
"dependencies": {
"path-key": "^3.1.0",
"shebang-command": "^2.0.0",
--
2.39.2
--- end ---