mediawiki/skins/2018: REL1_42 (log #1549575)

sourcepatches

This run took 6 seconds.

$ date
--- stdout ---
Thu Oct 10 14:47:38 UTC 2024

--- end ---
$ git clone file:///srv/git/mediawiki-skins-2018.git repo --depth=1 -b REL1_42
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_42
--- stdout ---
e4bb8262dec5118e4a8ecbc8214d61f1a9e37072 refs/heads/REL1_42

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@braintree/sanitize-url": {
      "name": "@braintree/sanitize-url",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088745,
          "name": "@braintree/sanitize-url",
          "dependency": "@braintree/sanitize-url",
          "title": "Cross-site Scripting in sanitize-url",
          "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 5.4,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
          },
          "range": "<6.0.0"
        },
        {
          "source": 1091262,
          "name": "@braintree/sanitize-url",
          "dependency": "@braintree/sanitize-url",
          "title": "@braintree/sanitize-url Cross-site Scripting vulnerability",
          "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<6.0.1"
        }
      ],
      "effects": [
        "mermaid"
      ],
      "range": "<=6.0.0",
      "nodes": [
        "node_modules/@braintree/sanitize-url"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "braces": {
      "name": "braces",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098094,
          "name": "braces",
          "dependency": "braces",
          "title": "Uncontrolled resource consumption in braces",
          "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.3"
        }
      ],
      "effects": [],
      "range": "<3.0.3",
      "nodes": [
        "node_modules/braces"
      ],
      "fixAvailable": true
    },
    "d3": {
      "name": "d3",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-brush",
        "d3-color",
        "d3-interpolate",
        "d3-scale",
        "d3-transition",
        "d3-zoom"
      ],
      "effects": [
        "dagre-d3"
      ],
      "range": "4.0.0-alpha.1 - 6.7.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "d3-brush": {
      "name": "d3-brush",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-interpolate",
        "d3-transition"
      ],
      "effects": [],
      "range": "0.1.0 - 2.1.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-brush"
      ],
      "fixAvailable": true
    },
    "d3-color": {
      "name": "d3-color",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1088594,
          "name": "d3-color",
          "dependency": "d3-color",
          "title": "d3-color vulnerable to ReDoS",
          "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.0"
        }
      ],
      "effects": [
        "d3",
        "d3-interpolate",
        "d3-scale-chromatic",
        "d3-transition"
      ],
      "range": "<3.1.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-color"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "d3-interpolate": {
      "name": "d3-interpolate",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-color"
      ],
      "effects": [
        "d3-brush",
        "d3-scale",
        "d3-scale-chromatic",
        "d3-transition",
        "d3-zoom"
      ],
      "range": "0.1.3 - 2.0.1",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-interpolate"
      ],
      "fixAvailable": true
    },
    "d3-scale": {
      "name": "d3-scale",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-interpolate"
      ],
      "effects": [],
      "range": "0.1.5 - 3.3.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-scale"
      ],
      "fixAvailable": true
    },
    "d3-scale-chromatic": {
      "name": "d3-scale-chromatic",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-color",
        "d3-interpolate"
      ],
      "effects": [],
      "range": "0.1.0 - 2.0.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-scale-chromatic"
      ],
      "fixAvailable": true
    },
    "d3-transition": {
      "name": "d3-transition",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-color",
        "d3-interpolate"
      ],
      "effects": [],
      "range": "0.0.7 - 2.0.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-transition"
      ],
      "fixAvailable": true
    },
    "d3-zoom": {
      "name": "d3-zoom",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3-interpolate",
        "d3-transition"
      ],
      "effects": [],
      "range": "0.0.2 - 2.0.0",
      "nodes": [
        "node_modules/dagre-d3/node_modules/d3-zoom"
      ],
      "fixAvailable": true
    },
    "dagre-d3": {
      "name": "dagre-d3",
      "severity": "high",
      "isDirect": false,
      "via": [
        "d3"
      ],
      "effects": [
        "mermaid"
      ],
      "range": ">=0.5.0",
      "nodes": [
        "node_modules/dagre-d3"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "dompurify": {
      "name": "dompurify",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1099597,
          "name": "dompurify",
          "dependency": "dompurify",
          "title": "DOMPurify allows tampering by prototype pollution",
          "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674",
          "severity": "high",
          "cwe": [
            "CWE-1321",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L"
          },
          "range": "<2.5.4"
        }
      ],
      "effects": [
        "mermaid"
      ],
      "range": "<2.5.4",
      "nodes": [
        "node_modules/dompurify"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "mermaid": {
      "name": "mermaid",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@braintree/sanitize-url",
        {
          "source": 1092622,
          "name": "mermaid",
          "dependency": "mermaid",
          "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML",
          "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf",
          "severity": "moderate",
          "cwe": [
            "CWE-74",
            "CWE-79"
          ],
          "cvss": {
            "score": 4.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N"
          },
          "range": ">=8.0.0 <9.1.2"
        },
        "dagre-d3",
        "dompurify"
      ],
      "effects": [],
      "range": "8.0.0 - 10.1.0",
      "nodes": [
        "node_modules/mermaid"
      ],
      "fixAvailable": {
        "name": "mermaid",
        "version": "11.3.0",
        "isSemVerMajor": true
      }
    },
    "micromatch": {
      "name": "micromatch",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1098681,
          "name": "micromatch",
          "dependency": "micromatch",
          "title": "Regular Expression Denial of Service (ReDoS) in micromatch",
          "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<4.0.8"
        }
      ],
      "effects": [],
      "range": "<4.0.8",
      "nodes": [
        "node_modules/micromatch"
      ],
      "fixAvailable": true
    },
    "nomnom": {
      "name": "nomnom",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "underscore"
      ],
      "effects": [],
      "range": ">=1.6.0",
      "nodes": [
        "node_modules/nomnom"
      ],
      "fixAvailable": true
    },
    "underscore": {
      "name": "underscore",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1095097,
          "name": "underscore",
          "dependency": "underscore",
          "title": "Arbitrary Code Execution in underscore",
          "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq",
          "severity": "critical",
          "cwe": [
            "CWE-94"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.3.2 <1.12.1"
        }
      ],
      "effects": [
        "nomnom"
      ],
      "range": "1.3.2 - 1.12.0",
      "nodes": [
        "node_modules/underscore"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 2,
      "high": 12,
      "critical": 2,
      "total": 16
    },
    "dependencies": {
      "prod": 90,
      "dev": 650,
      "optional": 7,
      "peer": 10,
      "peerOptional": 0,
      "total": 739
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - composer/semver 1.4.2 requires php ^5.3.2 || ^7.0 -> your php version (8.2.20) does not satisfy that requirement.
    - mediawiki/mediawiki-codesniffer v21.0.0 requires composer/semver 1.4.2 -> satisfiable by composer/semver[1.4.2].
    - Root composer.json requires mediawiki/mediawiki-codesniffer 21.0.0 -> satisfiable by mediawiki/mediawiki-codesniffer[v21.0.0].
--- stdout ---

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1864, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1788, in run
    "composer": self.composer_audit(),
                ^^^^^^^^^^^^^^^^^^^^^
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 183, in composer_audit
    self.ensure_composer_lock()
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 142, in ensure_composer_lock
    self.check_call(["composer", "install"])
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
    res.check_returncode()
  File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['/usr/bin/composer', 'install']' returned non-zero exit status 2.
Source code is licensed under the AGPL.