This run took 20 seconds.
$ date
--- stdout ---
Sat Mar 30 13:09:11 UTC 2024
--- end ---
$ git clone file:///srv/git/design-codex.git repo --depth=1 -b main
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/main
--- stdout ---
ef8a484ee60bfa36cfd98f2b143d0604d26c5c4d refs/heads/main
--- end ---
$ /usr/bin/npm i --package-lock-only
--- stdout ---
up to date, audited 2504 packages in 4s
345 packages are looking for funding
run `npm fund` for details
11 moderate severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
Editing .gitignore to remove package-lock.json
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096525,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1096526,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [
"wait-on"
],
"range": "0.8.1 - 0.27.2 || 1.0.0 - 1.5.1",
"nodes": [
"node_modules/axios",
"node_modules/netlify-cli/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096781,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": ">=15.0.3",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"nodemon": {
"name": "nodemon",
"severity": "moderate",
"isDirect": false,
"via": [
"simple-update-notifier"
],
"effects": [],
"range": "2.0.19 - 2.0.22",
"nodes": [
"node_modules/nodemon"
],
"fixAvailable": true
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [],
"range": "<8.4.31",
"nodes": [
"node_modules/netlify-cli/node_modules/postcss"
],
"fixAvailable": true
},
"semver": {
"name": "semver",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096482,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=7.0.0 <7.5.2"
}
],
"effects": [
"simple-update-notifier"
],
"range": "7.0.0 - 7.5.1",
"nodes": [
"node_modules/simple-update-notifier/node_modules/semver"
],
"fixAvailable": true
},
"simple-update-notifier": {
"name": "simple-update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"semver"
],
"effects": [
"nodemon"
],
"range": "1.0.7 - 1.1.0",
"nodes": [
"node_modules/simple-update-notifier"
],
"fixAvailable": true
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "moderate",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"wait-on": {
"name": "wait-on",
"severity": "moderate",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1095091,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/netlify-cli/node_modules/word-wrap"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 11,
"high": 0,
"critical": 0,
"total": 11
},
"dependencies": {
"prod": 180,
"dev": 2324,
"optional": 82,
"peer": 19,
"peerOptional": 0,
"total": 2503
}
}
}
--- end ---
$ /usr/bin/npm i --package-lock-only
--- stdout ---
up to date, audited 2504 packages in 3s
345 packages are looking for funding
run `npm fund` for details
11 moderate severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
Editing .gitignore to remove package-lock.json
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096525,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1096526,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [
"wait-on"
],
"range": "0.8.1 - 0.27.2 || 1.0.0 - 1.5.1",
"nodes": [
"node_modules/axios",
"node_modules/netlify-cli/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096781,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": ">=15.0.3",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"nodemon": {
"name": "nodemon",
"severity": "moderate",
"isDirect": false,
"via": [
"simple-update-notifier"
],
"effects": [],
"range": "2.0.19 - 2.0.22",
"nodes": [
"node_modules/nodemon"
],
"fixAvailable": true
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [],
"range": "<8.4.31",
"nodes": [
"node_modules/netlify-cli/node_modules/postcss"
],
"fixAvailable": true
},
"semver": {
"name": "semver",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096482,
"name": "semver",
"dependency": "semver",
"title": "semver vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=7.0.0 <7.5.2"
}
],
"effects": [
"simple-update-notifier"
],
"range": "7.0.0 - 7.5.1",
"nodes": [
"node_modules/simple-update-notifier/node_modules/semver"
],
"fixAvailable": true
},
"simple-update-notifier": {
"name": "simple-update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"semver"
],
"effects": [
"nodemon"
],
"range": "1.0.7 - 1.1.0",
"nodes": [
"node_modules/simple-update-notifier"
],
"fixAvailable": true
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "moderate",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"wait-on": {
"name": "wait-on",
"severity": "moderate",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.3",
"isSemVerMajor": true
}
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1095091,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/netlify-cli/node_modules/word-wrap"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 11,
"high": 0,
"critical": 0,
"total": 11
},
"dependencies": {
"prod": 180,
"dev": 2324,
"optional": 82,
"peer": 19,
"peerOptional": 0,
"total": 2503
}
}
}
--- end ---
Attempting to npm audit fix
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1534, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1478, in run
self.npm_audit_fix(new_npm_audit)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 181, in npm_audit_fix
prior_lock = PackageLockJson()
^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 76, in __init__
self.data = load_ordered_json(self.fname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 30, in load_ordered_json
with open(fname) as f:
^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'package-lock.json'