This run took 5 seconds.
$ date --- stdout --- Sun Jun 30 11:14:50 UTC 2024 --- end --- $ git clone file:///srv/git/mediawiki-extensions-SemanticGenealogy.git repo --depth=1 -b REL1_39 --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/REL1_39 --- stdout --- 430f1a9d1bb4c285fae7b59aba1dc339029690ab refs/heads/REL1_39 --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "braces": { "name": "braces", "severity": "high", "isDirect": false, "via": [ { "source": 1097496, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": [ "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.3" } ], "effects": [], "range": "<3.0.3", "nodes": [ "node_modules/braces" ], "fixAvailable": true }, "debug": { "name": "debug", "severity": "low", "isDirect": false, "via": [ { "source": 1096793, "name": "debug", "dependency": "debug", "title": "Regular Expression Denial of Service in debug", "url": "https://github.com/advisories/GHSA-gxpj-cx7g-858c", "severity": "low", "cwe": [ "CWE-400" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=3.2.0 <3.2.7" } ], "effects": [], "range": "3.2.0 - 3.2.6", "nodes": [ "node_modules/debug" ], "fixAvailable": true }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "moderate", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": true }, "semver": { "name": "semver", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096482, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=7.0.0 <7.5.2" }, { "source": 1096483, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.7.2" }, { "source": 1096484, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.0.0 <6.3.1" } ], "effects": [ "eslint-plugin-compat" ], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": [ "node_modules/eslint-plugin-mediawiki/node_modules/semver", "node_modules/eslint-plugin-node/node_modules/semver", "node_modules/normalize-package-data/node_modules/semver", "node_modules/semver" ], "fixAvailable": true }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097681, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 1, "moderate": 3, "high": 1, "critical": 0, "total": 5 }, "dependencies": { "prod": 1, "dev": 350, "optional": 0, "peer": 0, "peerOptional": 0, "total": 350 } } } --- end --- $ /usr/bin/composer install --- stderr --- No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information. Loading composer repositories with package information Updating dependencies Lock file operations: 41 installs, 0 updates, 0 removals - Locking composer/installers (dev-main 12fb2df) - Locking composer/semver (3.3.2) - Locking composer/spdx-licenses (1.5.8) - Locking data-values/common (1.1.0) - Locking data-values/data-values (dev-master 4c557b2) - Locking data-values/interfaces (1.0.0) - Locking data-values/validators (1.0.0) - Locking jeroen/file-fetcher (6.1.0) - Locking justinrainbow/json-schema (5.x-dev fbbe7e5) - Locking mediawiki/http-request (dev-master 5c0ca08) - Locking mediawiki/mediawiki-codesniffer (v39.0.0) - Locking mediawiki/minus-x (1.1.1) - Locking mediawiki/parser-hooks (dev-master 35e4513) - Locking mediawiki/semantic-media-wiki (dev-master 636184f) - Locking onoi/blob-store (dev-master 7753172) - Locking onoi/cache (dev-master 9a8e3ea) - Locking onoi/callback-container (dev-master 70d2266) - Locking onoi/event-dispatcher (dev-master 2af64e3) - Locking onoi/message-reporter (dev-master 5381702) - Locking param-processor/param-processor (dev-master 0850dc2) - Locking php-parallel-lint/php-console-color (v1.0.1) - Locking php-parallel-lint/php-console-highlighter (v1.0.0) - Locking php-parallel-lint/php-parallel-lint (v1.3.2) - Locking psr/container (dev-master 7079847) - Locking psr/log (1.1.4) - Locking seld/jsonlint (1.10.2) - Locking serialization/serialization (dev-master dc380fe) - Locking squizlabs/php_codesniffer (3.6.2) - Locking symfony/console (5.4.x-dev 6473d44) - Locking symfony/css-selector (5.4.x-dev ea43887) - Locking symfony/deprecation-contracts (dev-main 0e0d29c) - Locking symfony/polyfill-ctype (1.x-dev 0424dff) - Locking symfony/polyfill-intl-grapheme (1.x-dev 64647a7) - Locking symfony/polyfill-intl-normalizer (1.x-dev a95281b) - Locking symfony/polyfill-mbstring (1.x-dev 8740a07) - Locking symfony/polyfill-php73 (1.x-dev ec444d3) - Locking symfony/polyfill-php80 (1.x-dev 77fa799) - Locking symfony/service-contracts (dev-main bd1d9e5) - Locking symfony/string (6.4.x-dev 76792db) - Locking wikimedia/cdb (3.0.0) - Locking wikimedia/textcat (2.0.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 41 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] In PluginManager.php line 740: composer/installers contains a Composer plugin which is blocked by your all ow-plugins config. You may add it to the list if you consider it safe. You can run "composer config --no-plugins allow-plugins.composer/installers [true|false]" to enable it (true) or disable it explicitly and suppress th is exception (false) See https://getcomposer.org/allow-plugins install [--prefer-source] [--prefer-dist] [--prefer-install PREFER-INSTALL] [--dry-run] [--download-only] [--dev] [--no-suggest] [--no-dev] [--no-autoloader] [--no-progress] [--no-install] [--audit] [--audit-format AUDIT-FORMAT] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--] [<packages>...] --- stdout --- --- end --- Traceback (most recent call last): File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1789, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1713, in run "composer": self.composer_audit(), ^^^^^^^^^^^^^^^^^^^^^ File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 181, in composer_audit self.ensure_composer_lock() File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 140, in ensure_composer_lock self.check_call(["composer", "install"]) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call res.check_returncode() File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode raise CalledProcessError(self.returncode, self.args, self.stdout, subprocess.CalledProcessError: Command '['/usr/bin/composer', 'install']' returned non-zero exit status 1.