mediawiki/extensions/GPGMail: main (log #1423882)

sourcepatches

This run took 4 seconds.

$ date
--- stdout ---
Fri Jul 26 01:40:54 UTC 2024

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-GPGMail.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
097727cafbb37c6420ba134e6608e88f28d6b222 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "braces": {
      "name": "braces",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098094,
          "name": "braces",
          "dependency": "braces",
          "title": "Uncontrolled resource consumption in braces",
          "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.3"
        }
      ],
      "effects": [],
      "range": "<3.0.3",
      "nodes": [
        "node_modules/braces"
      ],
      "fixAvailable": true
    },
    "eslint-plugin-compat": {
      "name": "eslint-plugin-compat",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "semver"
      ],
      "effects": [],
      "range": "3.6.0-0 - 4.1.4",
      "nodes": [
        "node_modules/eslint-plugin-compat"
      ],
      "fixAvailable": true
    },
    "semver": {
      "name": "semver",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1096482,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=7.0.0 <7.5.2"
        },
        {
          "source": 1096483,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<5.7.2"
        },
        {
          "source": 1096484,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.0.0 <6.3.1"
        }
      ],
      "effects": [
        "eslint-plugin-compat"
      ],
      "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1",
      "nodes": [
        "node_modules/eslint-plugin-jsdoc/node_modules/semver",
        "node_modules/eslint-plugin-node/node_modules/semver",
        "node_modules/normalize-package-data/node_modules/semver",
        "node_modules/semver"
      ],
      "fixAvailable": true
    },
    "word-wrap": {
      "name": "word-wrap",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097681,
          "name": "word-wrap",
          "dependency": "word-wrap",
          "title": "word-wrap vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.2.4"
        }
      ],
      "effects": [],
      "range": "<1.2.4",
      "nodes": [
        "node_modules/word-wrap"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 3,
      "high": 1,
      "critical": 0,
      "total": 4
    },
    "dependencies": {
      "prod": 1,
      "dev": 284,
      "optional": 0,
      "peer": 0,
      "peerOptional": 0,
      "total": 284
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 25 installs, 0 updates, 0 removals
  - Locking composer/installers (v2.3.0)
  - Locking composer/semver (3.4.0)
  - Locking composer/spdx-licenses (1.5.8)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.0.0)
  - Locking mediawiki/mediawiki-codesniffer (v43.0.0)
  - Locking mediawiki/minus-x (1.1.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.3.2)
  - Locking phpcsstandards/phpcsextra (1.1.2)
  - Locking phpcsstandards/phpcsutils (1.0.9)
  - Locking psr/container (2.0.2)
  - Locking psr/log (1.0.0)
  - Locking squizlabs/php_codesniffer (3.8.1)
  - Locking symfony/console (v5.4.41)
  - Locking symfony/deprecation-contracts (v3.5.0)
  - Locking symfony/polyfill-ctype (v1.30.0)
  - Locking symfony/polyfill-intl-grapheme (v1.30.0)
  - Locking symfony/polyfill-intl-normalizer (v1.30.0)
  - Locking symfony/polyfill-mbstring (v1.30.0)
  - Locking symfony/polyfill-php73 (v1.30.0)
  - Locking symfony/polyfill-php80 (v1.30.0)
  - Locking symfony/service-contracts (v3.5.0)
  - Locking symfony/string (v6.4.9)
  - Locking wikimedia/gpglib (0.2.1)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 25 installs, 0 updates, 0 removals
  - Downloading wikimedia/gpglib (0.2.1)
 0/1 [>---------------------------]   0%    Failed to download wikimedia/gpglib from dist: The "https://api.github.com/repos/wikimedia/php-gpglib/zipball/567bea37bb767fb334deaf48bdea97e154366df2" file could not be downloaded (HTTP/2 404 ):
{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#download-a-repository-archive-zip","status":"404"}
    Now trying to download from source
  - Syncing wikimedia/gpglib (0.2.1) into cache

 1/1 [============================] 100%
In Git.php line 471:
                                                                               
  Failed to clone https://github.com/wikimedia/php-gpglib.git via https, ssh   
  protocols, aborting.                                                         
                                                                               
  - https://github.com/wikimedia/php-gpglib.git                                
    Cloning into bare repository '/cache/composer/vcs/https---github.com-wiki  
  media-php-gpglib.git'...                                                     
    remote: Support for password authentication was removed on August 13, 202  
  1.                                                                           
    remote: Please see https://docs.github.com/get-started/getting-started-wi  
  th-git/about-remote-repositories#cloning-with-https-urls for information on  
   currently recommended modes of authentication.                              
    fatal: Authentication failed for 'https://github.com/wikimedia/php-gpglib  
  .git/'                                                                       
                                                                               
  - git@github.com:wikimedia/php-gpglib.git                                    
    Cloning into bare repository '/cache/composer/vcs/https---github.com-wiki  
  media-php-gpglib.git'...                                                     
    Host key verification failed.                                              
    fatal: Could not read from remote repository.                              
                                                                               
    Please make sure you have the correct access rights                        
    and the repository exists.                                                 
                                                                               

install [--prefer-source] [--prefer-dist] [--prefer-install PREFER-INSTALL] [--dry-run] [--download-only] [--dev] [--no-suggest] [--no-dev] [--no-autoloader] [--no-progress] [--no-install] [--audit] [--audit-format AUDIT-FORMAT] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--apcu-autoloader-prefix APCU-AUTOLOADER-PREFIX] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--] [<packages>...]
--- stdout ---

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1789, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1713, in run
    "composer": self.composer_audit(),
                ^^^^^^^^^^^^^^^^^^^^^
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 181, in composer_audit
    self.ensure_composer_lock()
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 140, in ensure_composer_lock
    self.check_call(["composer", "install"])
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
    res.check_returncode()
  File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['/usr/bin/composer', 'install']' returned non-zero exit status 1.
Source code is licensed under the AGPL.