This run took 8 seconds.
$ date --- stdout --- Fri Apr 12 21:06:14 UTC 2024 --- end --- $ git clone file:///srv/git/performance-fresnel.git repo --depth=1 -b master --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/master --- stdout --- cb1bfc160145c50c73a5b1c959788e47acf1c62d refs/heads/master --- end --- $ /usr/bin/npm i --package-lock-only --- stdout --- up to date, audited 406 packages in 1s 40 packages are looking for funding run `npm fund` for details 13 vulnerabilities (6 moderate, 5 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- Editing .gitignore to remove package-lock.json $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "node_modules/@babel/traverse" ], "fixAvailable": true }, "ansi-regex": { "name": "ansi-regex", "severity": "high", "isDirect": false, "via": [ { "source": 1094092, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": [ "CWE-697", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=5.0.0 <5.0.1" } ], "effects": [], "range": "5.0.0", "nodes": [ "node_modules/ansi-regex" ], "fixAvailable": true }, "browserslist": { "name": "browserslist", "severity": "moderate", "isDirect": false, "via": [ { "source": 1093035, "name": "browserslist", "dependency": "browserslist", "title": "Regular Expression Denial of Service in browserslist", "url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5", "severity": "moderate", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=4.0.0 <4.16.5" } ], "effects": [], "range": "4.0.0 - 4.16.4", "nodes": [ "node_modules/browserslist" ], "fixAvailable": true }, "eslint-config-wikimedia": { "name": "eslint-config-wikimedia", "severity": "moderate", "isDirect": true, "via": [ "eslint-plugin-compat" ], "effects": [], "range": "0.18.0 - 0.21.0", "nodes": [ "node_modules/eslint-config-wikimedia" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [ "eslint-config-wikimedia" ], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "jsdoc-parse": { "name": "jsdoc-parse", "severity": "high", "isDirect": false, "via": [ "lodash.pick" ], "effects": [], "range": "2.0.2 - 6.2.0", "nodes": [ "node_modules/jsdoc-parse" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "node_modules/json5" ], "fixAvailable": true }, "lodash.pick": { "name": "lodash.pick", "severity": "high", "isDirect": false, "via": [ { "source": 1096303, "name": "lodash.pick", "dependency": "lodash.pick", "title": "Prototype Pollution in lodash", "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw", "severity": "high", "cwe": [ "CWE-770", "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, "range": ">=4.0.0 <=4.4.0" } ], "effects": [ "jsdoc-parse" ], "range": ">=4.0.0", "nodes": [ "node_modules/lodash.pick" ], "fixAvailable": true }, "minimist": { "name": "minimist", "severity": "critical", "isDirect": false, "via": [ { "source": 1096549, "name": "minimist", "dependency": "minimist", "title": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.0.0 <1.2.6" } ], "effects": [], "range": "1.0.0 - 1.2.5", "nodes": [ "node_modules/minimist" ], "fixAvailable": true }, "node-fetch": { "name": "node-fetch", "severity": "high", "isDirect": false, "via": [ { "source": 1095073, "name": "node-fetch", "dependency": "node-fetch", "title": "node-fetch forwards secure headers to untrusted sites", "url": "https://github.com/advisories/GHSA-r683-j2x4-v87g", "severity": "high", "cwe": [ "CWE-173", "CWE-200", "CWE-601" ], "cvss": { "score": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": "<2.6.7" } ], "effects": [], "range": "<2.6.7", "nodes": [ "node_modules/node-fetch" ], "fixAvailable": true }, "path-parse": { "name": "path-parse", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089681, "name": "path-parse", "dependency": "path-parse", "title": "Regular Expression Denial of Service in path-parse", "url": "https://github.com/advisories/GHSA-hj48-42vr-x3v9", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.0.7" } ], "effects": [], "range": "<1.0.7", "nodes": [ "node_modules/path-parse" ], "fixAvailable": true }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" } ], "effects": [ "eslint-plugin-compat" ], "range": "7.0.0 - 7.5.1", "nodes": [ "node_modules/eslint-plugin-compat/node_modules/semver" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 6, "high": 5, "critical": 2, "total": 13 }, "dependencies": { "prod": 58, "dev": 346, "optional": 3, "peer": 0, "peerOptional": 0, "total": 405 } } } --- end --- $ /usr/bin/npm i --package-lock-only --- stdout --- up to date, audited 406 packages in 770ms 40 packages are looking for funding run `npm fund` for details 13 vulnerabilities (6 moderate, 5 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- Editing .gitignore to remove package-lock.json $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "node_modules/@babel/traverse" ], "fixAvailable": true }, "ansi-regex": { "name": "ansi-regex", "severity": "high", "isDirect": false, "via": [ { "source": 1094092, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": [ "CWE-697", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=5.0.0 <5.0.1" } ], "effects": [], "range": "5.0.0", "nodes": [ "node_modules/ansi-regex" ], "fixAvailable": true }, "browserslist": { "name": "browserslist", "severity": "moderate", "isDirect": false, "via": [ { "source": 1093035, "name": "browserslist", "dependency": "browserslist", "title": "Regular Expression Denial of Service in browserslist", "url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5", "severity": "moderate", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=4.0.0 <4.16.5" } ], "effects": [], "range": "4.0.0 - 4.16.4", "nodes": [ "node_modules/browserslist" ], "fixAvailable": true }, "eslint-config-wikimedia": { "name": "eslint-config-wikimedia", "severity": "moderate", "isDirect": true, "via": [ "eslint-plugin-compat" ], "effects": [], "range": "0.18.0 - 0.21.0", "nodes": [ "node_modules/eslint-config-wikimedia" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [ "eslint-config-wikimedia" ], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "jsdoc-parse": { "name": "jsdoc-parse", "severity": "high", "isDirect": false, "via": [ "lodash.pick" ], "effects": [], "range": "2.0.2 - 6.2.0", "nodes": [ "node_modules/jsdoc-parse" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "node_modules/json5" ], "fixAvailable": true }, "lodash.pick": { "name": "lodash.pick", "severity": "high", "isDirect": false, "via": [ { "source": 1096303, "name": "lodash.pick", "dependency": "lodash.pick", "title": "Prototype Pollution in lodash", "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw", "severity": "high", "cwe": [ "CWE-770", "CWE-1321" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, "range": ">=4.0.0 <=4.4.0" } ], "effects": [ "jsdoc-parse" ], "range": ">=4.0.0", "nodes": [ "node_modules/lodash.pick" ], "fixAvailable": true }, "minimist": { "name": "minimist", "severity": "critical", "isDirect": false, "via": [ { "source": 1096549, "name": "minimist", "dependency": "minimist", "title": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.0.0 <1.2.6" } ], "effects": [], "range": "1.0.0 - 1.2.5", "nodes": [ "node_modules/minimist" ], "fixAvailable": true }, "node-fetch": { "name": "node-fetch", "severity": "high", "isDirect": false, "via": [ { "source": 1095073, "name": "node-fetch", "dependency": "node-fetch", "title": "node-fetch forwards secure headers to untrusted sites", "url": "https://github.com/advisories/GHSA-r683-j2x4-v87g", "severity": "high", "cwe": [ "CWE-173", "CWE-200", "CWE-601" ], "cvss": { "score": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": "<2.6.7" } ], "effects": [], "range": "<2.6.7", "nodes": [ "node_modules/node-fetch" ], "fixAvailable": true }, "path-parse": { "name": "path-parse", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089681, "name": "path-parse", "dependency": "path-parse", "title": "Regular Expression Denial of Service in path-parse", "url": "https://github.com/advisories/GHSA-hj48-42vr-x3v9", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.0.7" } ], "effects": [], "range": "<1.0.7", "nodes": [ "node_modules/path-parse" ], "fixAvailable": true }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" } ], "effects": [ "eslint-plugin-compat" ], "range": "7.0.0 - 7.5.1", "nodes": [ "node_modules/eslint-plugin-compat/node_modules/semver" ], "fixAvailable": { "name": "eslint-config-wikimedia", "version": "0.27.0", "isSemVerMajor": true } }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1095091, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 6, "high": 5, "critical": 2, "total": 13 }, "dependencies": { "prod": 58, "dev": 346, "optional": 3, "peer": 0, "peerOptional": 0, "total": 405 } } } --- end --- Attempting to npm audit fix Traceback (most recent call last): File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1534, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1478, in run self.npm_audit_fix(new_npm_audit) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 181, in npm_audit_fix prior_lock = PackageLockJson() ^^^^^^^^^^^^^^^^^ File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 76, in __init__ self.data = load_ordered_json(self.fname) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 30, in load_ordered_json with open(fname) as f: ^^^^^^^^^^^ FileNotFoundError: [Errno 2] No such file or directory: 'package-lock.json'