This run took 116 seconds.
$ date
--- stdout ---
Wed Apr 3 17:45:08 UTC 2024
--- end ---
$ git clone file:///srv/git/wikidata-query-builder.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
9fd0744110d2d4eaa55d044edb951c680b254b0a refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@vue/component-compiler-utils": {
"name": "@vue/component-compiler-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"@vue/vue2-jest",
"vite-plugin-vue2"
],
"range": "*",
"nodes": [
"node_modules/@vue/component-compiler-utils"
],
"fixAvailable": false
},
"@vue/vue2-jest": {
"name": "@vue/vue2-jest",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@vue/vue2-jest"
],
"fixAvailable": false
},
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096526,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [],
"range": "1.0.0 - 1.5.1",
"nodes": [
"node_modules/netlify-cli/node_modules/axios"
],
"fixAvailable": true
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": ">=15.0.3",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@vue/component-compiler-utils"
],
"range": "<8.4.31",
"nodes": [
"node_modules/@vue/component-compiler-utils/node_modules/postcss",
"node_modules/netlify-cli/node_modules/postcss"
],
"fixAvailable": false
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1089122,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
},
{
"source": 1094738,
"name": "vite",
"dependency": "vite",
"title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)",
"url": "https://github.com/advisories/GHSA-353f-5xf4-qw67",
"severity": "high",
"cwe": [
"CWE-50",
"CWE-200",
"CWE-706"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<2.9.16"
},
{
"source": 1095469,
"name": "vite",
"dependency": "vite",
"title": "Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem",
"url": "https://github.com/advisories/GHSA-c24v-8rfc-w8vw",
"severity": "high",
"cwe": [
"CWE-178",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.16"
},
{
"source": 1096870,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs.deny` did not deny requests for patterns with directories.",
"url": "https://github.com/advisories/GHSA-8jhw-289h-jh2g",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.17"
}
],
"effects": [],
"range": "<=2.9.17",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.18",
"isSemVerMajor": false
}
},
"vite-plugin-vue2": {
"name": "vite-plugin-vue2",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/vite-plugin-vue2"
],
"fixAvailable": false
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1095091,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/netlify-cli/node_modules/word-wrap"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 9,
"high": 1,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 103,
"dev": 2622,
"optional": 94,
"peer": 63,
"peerOptional": 0,
"total": 2724
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@vue/component-compiler-utils": {
"name": "@vue/component-compiler-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"@vue/vue2-jest",
"vite-plugin-vue2"
],
"range": "*",
"nodes": [
"node_modules/@vue/component-compiler-utils"
],
"fixAvailable": false
},
"@vue/vue2-jest": {
"name": "@vue/vue2-jest",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@vue/vue2-jest"
],
"fixAvailable": false
},
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096526,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [],
"range": "1.0.0 - 1.5.1",
"nodes": [
"node_modules/netlify-cli/node_modules/axios"
],
"fixAvailable": true
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": ">=15.0.3",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@vue/component-compiler-utils"
],
"range": "<8.4.31",
"nodes": [
"node_modules/@vue/component-compiler-utils/node_modules/postcss",
"node_modules/netlify-cli/node_modules/postcss"
],
"fixAvailable": false
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1089122,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
},
{
"source": 1094738,
"name": "vite",
"dependency": "vite",
"title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)",
"url": "https://github.com/advisories/GHSA-353f-5xf4-qw67",
"severity": "high",
"cwe": [
"CWE-50",
"CWE-200",
"CWE-706"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<2.9.16"
},
{
"source": 1095469,
"name": "vite",
"dependency": "vite",
"title": "Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem",
"url": "https://github.com/advisories/GHSA-c24v-8rfc-w8vw",
"severity": "high",
"cwe": [
"CWE-178",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.16"
},
{
"source": 1096870,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs.deny` did not deny requests for patterns with directories.",
"url": "https://github.com/advisories/GHSA-8jhw-289h-jh2g",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.17"
}
],
"effects": [],
"range": "<=2.9.17",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.18",
"isSemVerMajor": false
}
},
"vite-plugin-vue2": {
"name": "vite-plugin-vue2",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/vite-plugin-vue2"
],
"fixAvailable": false
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1095091,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/netlify-cli/node_modules/word-wrap"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 9,
"high": 1,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 103,
"dev": 2622,
"optional": 94,
"peer": 63,
"peerOptional": 0,
"total": 2724
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
"added": 1310,
"removed": 0,
"changed": 0,
"audited": 2725,
"funding": 334,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@vue/component-compiler-utils": {
"name": "@vue/component-compiler-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss"
],
"effects": [
"@vue/vue2-jest",
"vite-plugin-vue2"
],
"range": "*",
"nodes": [
"node_modules/@vue/component-compiler-utils"
],
"fixAvailable": false
},
"@vue/vue2-jest": {
"name": "@vue/vue2-jest",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@vue/vue2-jest"
],
"fixAvailable": false
},
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096526,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [],
"range": "1.0.0 - 1.5.1",
"nodes": [
""
],
"fixAvailable": true
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
""
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"",
""
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": ">=15.0.3",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "15.0.2",
"isSemVerMajor": true
}
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [
"@vue/component-compiler-utils"
],
"range": "<8.4.31",
"nodes": [
"",
"node_modules/@vue/component-compiler-utils/node_modules/postcss"
],
"fixAvailable": false
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1089122,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
},
{
"source": 1094738,
"name": "vite",
"dependency": "vite",
"title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)",
"url": "https://github.com/advisories/GHSA-353f-5xf4-qw67",
"severity": "high",
"cwe": [
"CWE-50",
"CWE-200",
"CWE-706"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<2.9.16"
},
{
"source": 1095469,
"name": "vite",
"dependency": "vite",
"title": "Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem",
"url": "https://github.com/advisories/GHSA-c24v-8rfc-w8vw",
"severity": "high",
"cwe": [
"CWE-178",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.16"
},
{
"source": 1096870,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs.deny` did not deny requests for patterns with directories.",
"url": "https://github.com/advisories/GHSA-8jhw-289h-jh2g",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.17"
}
],
"effects": [],
"range": "<=2.9.17",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.18",
"isSemVerMajor": false
}
},
"vite-plugin-vue2": {
"name": "vite-plugin-vue2",
"severity": "moderate",
"isDirect": true,
"via": [
"@vue/component-compiler-utils"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/vite-plugin-vue2"
],
"fixAvailable": false
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1095091,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
""
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 9,
"high": 1,
"critical": 0,
"total": 10
},
"dependencies": {
"prod": 102,
"dev": 2623,
"optional": 95,
"peer": 64,
"peerOptional": 0,
"total": 2724
}
}
}
}
--- end ---
{"added": 1310, "removed": 0, "changed": 0, "audited": 2725, "funding": 334, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@vue/component-compiler-utils": {"name": "@vue/component-compiler-utils", "severity": "moderate", "isDirect": false, "via": ["postcss"], "effects": ["@vue/vue2-jest", "vite-plugin-vue2"], "range": "*", "nodes": ["node_modules/@vue/component-compiler-utils"], "fixAvailable": false}, "@vue/vue2-jest": {"name": "@vue/vue2-jest", "severity": "moderate", "isDirect": true, "via": ["@vue/component-compiler-utils"], "effects": [], "range": "*", "nodes": ["node_modules/@vue/vue2-jest"], "fixAvailable": false}, "axios": {"name": "axios", "severity": "moderate", "isDirect": false, "via": [{"source": 1096526, "name": "axios", "dependency": "axios", "title": "Axios Cross-Site Request Forgery Vulnerability", "url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx", "severity": "moderate", "cwe": ["CWE-352"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "range": ">=1.0.0 <1.6.0"}], "effects": [], "range": "1.0.0 - 1.5.1", "nodes": [""], "fixAvailable": true}, "express": {"name": "express", "severity": "moderate", "isDirect": false, "via": [{"source": 1096820, "name": "express", "dependency": "express", "title": "Express.js Open Redirect in malformed URLs", "url": "https://github.com/advisories/GHSA-rv95-896h-c2vc", "severity": "moderate", "cwe": ["CWE-601", "CWE-1286"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<4.19.2"}], "effects": ["netlify-cli"], "range": "<4.19.2", "nodes": [""], "fixAvailable": {"name": "netlify-cli", "version": "15.0.2", "isSemVerMajor": true}}, "follow-redirects": {"name": "follow-redirects", "severity": "moderate", "isDirect": false, "via": [{"source": 1096353, "name": "follow-redirects", "dependency": "follow-redirects", "title": "Follow Redirects improperly handles URLs in the url.parse() function", "url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc", "severity": "moderate", "cwe": ["CWE-20", "CWE-601"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<1.15.4"}, {"source": 1096856, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects' Proxy-Authorization header kept across hosts", "url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp", "severity": "moderate", "cwe": ["CWE-200"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "range": "<=1.15.5"}], "effects": [], "range": "<=1.15.5", "nodes": ["", ""], "fixAvailable": true}, "netlify-cli": {"name": "netlify-cli", "severity": "moderate", "isDirect": true, "via": ["express"], "effects": [], "range": ">=15.0.3", "nodes": ["node_modules/netlify-cli"], "fixAvailable": {"name": "netlify-cli", "version": "15.0.2", "isSemVerMajor": true}}, "postcss": {"name": "postcss", "severity": "moderate", "isDirect": false, "via": [{"source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": ["CWE-74", "CWE-144"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<8.4.31"}], "effects": ["@vue/component-compiler-utils"], "range": "<8.4.31", "nodes": ["", "node_modules/@vue/component-compiler-utils/node_modules/postcss"], "fixAvailable": false}, "vite": {"name": "vite", "severity": "high", "isDirect": true, "via": [{"source": 1089122, "name": "vite", "dependency": "vite", "title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service", "url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8", "severity": "moderate", "cwe": ["CWE-22"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}, "range": "<2.9.13"}, {"source": 1094738, "name": "vite", "dependency": "vite", "title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)", "url": "https://github.com/advisories/GHSA-353f-5xf4-qw67", "severity": "high", "cwe": ["CWE-50", "CWE-200", "CWE-706"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": "<2.9.16"}, {"source": 1095469, "name": "vite", "dependency": "vite", "title": "Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem", "url": "https://github.com/advisories/GHSA-c24v-8rfc-w8vw", "severity": "high", "cwe": ["CWE-178", "CWE-200", "CWE-284"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": ">=2.7.0 <=2.9.16"}, {"source": 1096870, "name": "vite", "dependency": "vite", "title": "Vite's `server.fs.deny` did not deny requests for patterns with directories.", "url": "https://github.com/advisories/GHSA-8jhw-289h-jh2g", "severity": "moderate", "cwe": ["CWE-200", "CWE-284"], "cvss": {"score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "range": ">=2.7.0 <=2.9.17"}], "effects": [], "range": "<=2.9.17", "nodes": ["node_modules/vite"], "fixAvailable": {"name": "vite", "version": "2.9.18", "isSemVerMajor": false}}, "vite-plugin-vue2": {"name": "vite-plugin-vue2", "severity": "moderate", "isDirect": true, "via": ["@vue/component-compiler-utils"], "effects": [], "range": "*", "nodes": ["node_modules/vite-plugin-vue2"], "fixAvailable": false}, "word-wrap": {"name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [{"source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": ["CWE-1333"], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}, "range": "<1.2.4"}], "effects": [], "range": "<1.2.4", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 9, "high": 1, "critical": 0, "total": 10}, "dependencies": {"prod": 102, "dev": 2623, "optional": 95, "peer": 64, "peerOptional": 0, "total": 2724}}}}
{}
Upgrading n:vite from ~2.8.6 -> 2.9.18
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated @types/rdf-js@4.0.2: This is a stub types definition. rdf-js provides its own type definitions, so you do not need this installed.
npm WARN deprecated @babel/plugin-proposal-nullish-coalescing-operator@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.
npm WARN deprecated @babel/plugin-proposal-class-properties@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated @babel/plugin-proposal-optional-chaining@7.21.0: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.
npm WARN deprecated consolidate@0.16.0: Please upgrade to consolidate v1.0.0+ as it has been modernized with several long-awaited fixes implemented. Maintenance is supported by Forward Email at https://forwardemail.net ; follow/watch https://github.com/ladjs/consolidate for updates and release changelog
npm WARN deprecated consolidate@0.15.1: Please upgrade to consolidate v1.0.0+ as it has been modernized with several long-awaited fixes implemented. Maintenance is supported by Forward Email at https://forwardemail.net ; follow/watch https://github.com/ladjs/consolidate for updates and release changelog
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated @babel/plugin-proposal-object-rest-spread@7.20.7: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-object-rest-spread instead.
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
--- stdout ---
added 2649 packages, and audited 2651 packages in 1m
334 packages are looking for funding
run `npm fund` for details
# npm audit report
axios 1.0.0 - 1.5.1
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/axios
express <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
fix available via `npm audit fix --force`
Will install netlify-cli@15.0.2, which is a breaking change
node_modules/netlify-cli/node_modules/express
netlify-cli >=15.0.3
Depends on vulnerable versions of express
node_modules/netlify-cli
follow-redirects <=1.15.5
Severity: moderate
Follow Redirects improperly handles URLs in the url.parse() function - https://github.com/advisories/GHSA-jchw-25xp-jwwc
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/follow-redirects
postcss <8.4.31
Severity: moderate
PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
No fix available
node_modules/@vue/component-compiler-utils/node_modules/postcss
node_modules/netlify-cli/node_modules/postcss
@vue/component-compiler-utils *
Depends on vulnerable versions of postcss
node_modules/@vue/component-compiler-utils
@vue/vue2-jest *
Depends on vulnerable versions of @vue/component-compiler-utils
node_modules/@vue/vue2-jest
vite-plugin-vue2 *
Depends on vulnerable versions of @vue/component-compiler-utils
node_modules/vite-plugin-vue2
word-wrap <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/word-wrap
9 moderate severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
node_modules/netlify-cli/tools/lint-rules@unknown: Neither "resolved" nor "version" are present
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1534, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1478, in run
self.npm_audit_fix(new_npm_audit)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 244, in npm_audit_fix
self.check_package_lock()
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 301, in check_package_lock
self.check_call(['package-lock-lint', 'package-lock.json'])
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 54, in check_call
res.check_returncode()
File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['package-lock-lint', 'package-lock.json']' returned non-zero exit status 1.