This run took 116 seconds.
$ date
--- stdout ---
Thu Jul 25 17:14:15 UTC 2024
--- end ---
$ git clone file:///srv/git/wikidata-query-builder.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
0a7aed1bc99ae1548b28a03f514fa5ec62934bad refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@grpc/grpc-js": {
"name": "@grpc/grpc-js",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097547,
"name": "@grpc/grpc-js",
"dependency": "@grpc/grpc-js",
"title": "@grpc/grpc-js can allocate memory for incoming messages well above configured limits",
"url": "https://github.com/advisories/GHSA-7v5v-9h63-cj86",
"severity": "moderate",
"cwe": [
"CWE-789"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.9.0 <1.9.15"
}
],
"effects": [],
"range": "1.9.0 - 1.9.14",
"nodes": [
"node_modules/netlify-cli/node_modules/@grpc/grpc-js"
],
"fixAvailable": true
},
"axios": {
"name": "axios",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097680,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=1.0.0 <1.6.0"
}
],
"effects": [],
"range": "1.0.0 - 1.5.1",
"nodes": [
"node_modules/netlify-cli/node_modules/axios"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1098094,
"name": "braces",
"dependency": "braces",
"title": "Uncontrolled resource consumption in braces",
"url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1050"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.3"
}
],
"effects": [
"micromatch"
],
"range": "<3.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/braces",
"node_modules/netlify-cli/node_modules/copy-template-dir/node_modules/braces"
],
"fixAvailable": true
},
"express": {
"name": "express",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096820,
"name": "express",
"dependency": "express",
"title": "Express.js Open Redirect in malformed URLs",
"url": "https://github.com/advisories/GHSA-rv95-896h-c2vc",
"severity": "moderate",
"cwe": [
"CWE-601",
"CWE-1286"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.19.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<4.19.2",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.33.4",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1096353,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "Follow Redirects improperly handles URLs in the url.parse() function",
"url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-601"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<1.15.4"
},
{
"source": 1096856,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects' Proxy-Authorization header kept across hosts",
"url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.5"
}
],
"effects": [],
"range": "<=1.15.5",
"nodes": [
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
"braces"
],
"effects": [
"readdirp"
],
"range": "0.2.0 - 3.1.10",
"nodes": [
"node_modules/netlify-cli/node_modules/copy-template-dir/node_modules/micromatch"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"express"
],
"effects": [],
"range": "15.0.3 - 17.21.1",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.33.4",
"isSemVerMajor": true
}
},
"postcss": {
"name": "postcss",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1094544,
"name": "postcss",
"dependency": "postcss",
"title": "PostCSS line return parsing error",
"url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
"severity": "moderate",
"cwe": [
"CWE-74",
"CWE-144"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<8.4.31"
}
],
"effects": [],
"range": "<8.4.31",
"nodes": [
"node_modules/netlify-cli/node_modules/postcss"
],
"fixAvailable": true
},
"readdirp": {
"name": "readdirp",
"severity": "high",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [],
"range": "2.2.0 - 2.2.1",
"nodes": [
"node_modules/netlify-cli/node_modules/copy-template-dir/node_modules/readdirp"
],
"fixAvailable": true
},
"tar": {
"name": "tar",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097493,
"name": "tar",
"dependency": "tar",
"title": "Denial of service while parsing a tar file due to lack of folders count validation",
"url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<6.2.1"
}
],
"effects": [],
"range": "<6.2.1",
"nodes": [
"node_modules/netlify-cli/node_modules/tar"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1089122,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
},
{
"source": 1094738,
"name": "vite",
"dependency": "vite",
"title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)",
"url": "https://github.com/advisories/GHSA-353f-5xf4-qw67",
"severity": "high",
"cwe": [
"CWE-50",
"CWE-200",
"CWE-706"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<2.9.16"
},
{
"source": 1095469,
"name": "vite",
"dependency": "vite",
"title": "Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem",
"url": "https://github.com/advisories/GHSA-c24v-8rfc-w8vw",
"severity": "high",
"cwe": [
"CWE-178",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.16"
},
{
"source": 1096897,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs.deny` did not deny requests for patterns with directories.",
"url": "https://github.com/advisories/GHSA-8jhw-289h-jh2g",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=2.7.0 <=2.9.17"
}
],
"effects": [],
"range": "<=2.9.17",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.18",
"isSemVerMajor": false
}
},
"word-wrap": {
"name": "word-wrap",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1097681,
"name": "word-wrap",
"dependency": "word-wrap",
"title": "word-wrap vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.2.4"
}
],
"effects": [],
"range": "<1.2.4",
"nodes": [
"node_modules/netlify-cli/node_modules/word-wrap"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 8,
"high": 4,
"critical": 0,
"total": 12
},
"dependencies": {
"prod": 123,
"dev": 2574,
"optional": 95,
"peer": 64,
"peerOptional": 0,
"total": 2696
}
}
}
--- end ---
Upgrading n:eslint from ^8.56.0 -> 8.57.0
Upgrading n:eslint-config-wikimedia from ^0.27.0 -> 0.28.2
Upgrading n:@vue/compiler-sfc from 3.3.8 -> 3.3.9
$ /usr/bin/npm install
--- stderr ---
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @wmde/query-builder@1.0.0
npm WARN Found: eslint-config-wikimedia@0.27.0
npm WARN node_modules/eslint-config-wikimedia
npm WARN dev eslint-config-wikimedia@"0.28.2" from the root project
npm WARN 1 more (@wmde/eslint-config-wikimedia-typescript)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint-config-wikimedia@"^0.27.0" from @wmde/eslint-config-wikimedia-typescript@0.2.9
npm WARN node_modules/@wmde/eslint-config-wikimedia-typescript
npm WARN dev @wmde/eslint-config-wikimedia-typescript@"^0.2.9" from the root project
npm WARN deprecated rdf-js@4.0.2: Use @types/rdf-js instead. See https://github.com/rdfjs/types?tab=readme-ov-file#what-about-typesrdf-js
npm WARN deprecated @types/rdf-js@4.0.2: This is a stub types definition. rdf-js provides its own type definitions, so you do not need this installed.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
npm WARN deprecated vue@2.6.14: Vue 2 has reached EOL and is no longer actively maintained. See https://v2.vuejs.org/eol/ for more details.
--- stdout ---
added 2621 packages, and audited 2623 packages in 1m
362 packages are looking for funding
run `npm fund` for details
12 vulnerabilities (8 moderate, 4 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
node_modules/netlify-cli/tools/lint-rules@unknown: Neither "resolved" nor "version" are present
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1789, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1728, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1180, in npm_upgrade
self.check_package_lock()
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 329, in check_package_lock
self.check_call(["package-lock-lint", "package-lock.json"])
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
res.check_returncode()
File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['package-lock-lint', 'package-lock.json']' returned non-zero exit status 1.