This run took 6 seconds.
$ date --- stdout --- Thu Oct 10 14:47:38 UTC 2024 --- end --- $ git clone file:///srv/git/mediawiki-skins-2018.git repo --depth=1 -b REL1_42 --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/REL1_42 --- stdout --- e4bb8262dec5118e4a8ecbc8214d61f1a9e37072 refs/heads/REL1_42 --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@braintree/sanitize-url": { "name": "@braintree/sanitize-url", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088745, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "Cross-site Scripting in sanitize-url", "url": "https://github.com/advisories/GHSA-hqq7-2q2v-82xq", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": "<6.0.0" }, { "source": 1091262, "name": "@braintree/sanitize-url", "dependency": "@braintree/sanitize-url", "title": "@braintree/sanitize-url Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q8gg-vj6m-hgmj", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<6.0.1" } ], "effects": [ "mermaid" ], "range": "<=6.0.0", "nodes": [ "node_modules/@braintree/sanitize-url" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "braces": { "name": "braces", "severity": "high", "isDirect": false, "via": [ { "source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": [ "CWE-400", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.3" } ], "effects": [], "range": "<3.0.3", "nodes": [ "node_modules/braces" ], "fixAvailable": true }, "d3": { "name": "d3", "severity": "high", "isDirect": false, "via": [ "d3-brush", "d3-color", "d3-interpolate", "d3-scale", "d3-transition", "d3-zoom" ], "effects": [ "dagre-d3" ], "range": "4.0.0-alpha.1 - 6.7.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "d3-brush": { "name": "d3-brush", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.1.0 - 2.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-brush" ], "fixAvailable": true }, "d3-color": { "name": "d3-color", "severity": "high", "isDirect": false, "via": [ { "source": 1088594, "name": "d3-color", "dependency": "d3-color", "title": "d3-color vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-36jr-mh4h-2g58", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": "<3.1.0" } ], "effects": [ "d3", "d3-interpolate", "d3-scale-chromatic", "d3-transition" ], "range": "<3.1.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-color" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "d3-interpolate": { "name": "d3-interpolate", "severity": "high", "isDirect": false, "via": [ "d3-color" ], "effects": [ "d3-brush", "d3-scale", "d3-scale-chromatic", "d3-transition", "d3-zoom" ], "range": "0.1.3 - 2.0.1", "nodes": [ "node_modules/dagre-d3/node_modules/d3-interpolate" ], "fixAvailable": true }, "d3-scale": { "name": "d3-scale", "severity": "high", "isDirect": false, "via": [ "d3-interpolate" ], "effects": [], "range": "0.1.5 - 3.3.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale" ], "fixAvailable": true }, "d3-scale-chromatic": { "name": "d3-scale-chromatic", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.1.0 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-scale-chromatic" ], "fixAvailable": true }, "d3-transition": { "name": "d3-transition", "severity": "high", "isDirect": false, "via": [ "d3-color", "d3-interpolate" ], "effects": [], "range": "0.0.7 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-transition" ], "fixAvailable": true }, "d3-zoom": { "name": "d3-zoom", "severity": "high", "isDirect": false, "via": [ "d3-interpolate", "d3-transition" ], "effects": [], "range": "0.0.2 - 2.0.0", "nodes": [ "node_modules/dagre-d3/node_modules/d3-zoom" ], "fixAvailable": true }, "dagre-d3": { "name": "dagre-d3", "severity": "high", "isDirect": false, "via": [ "d3" ], "effects": [ "mermaid" ], "range": ">=0.5.0", "nodes": [ "node_modules/dagre-d3" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "dompurify": { "name": "dompurify", "severity": "high", "isDirect": false, "via": [ { "source": 1099597, "name": "dompurify", "dependency": "dompurify", "title": "DOMPurify allows tampering by prototype pollution", "url": "https://github.com/advisories/GHSA-mmhx-hmjr-r674", "severity": "high", "cwe": [ "CWE-1321", "CWE-1333" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L" }, "range": "<2.5.4" } ], "effects": [ "mermaid" ], "range": "<2.5.4", "nodes": [ "node_modules/dompurify" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "mermaid": { "name": "mermaid", "severity": "high", "isDirect": true, "via": [ "@braintree/sanitize-url", { "source": 1092622, "name": "mermaid", "dependency": "mermaid", "title": "Possible inject arbitrary `CSS` into the generated graph affecting the container HTML", "url": "https://github.com/advisories/GHSA-x3vm-38hw-55wf", "severity": "moderate", "cwe": [ "CWE-74", "CWE-79" ], "cvss": { "score": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N" }, "range": ">=8.0.0 <9.1.2" }, "dagre-d3", "dompurify" ], "effects": [], "range": "8.0.0 - 10.1.0", "nodes": [ "node_modules/mermaid" ], "fixAvailable": { "name": "mermaid", "version": "11.3.0", "isSemVerMajor": true } }, "micromatch": { "name": "micromatch", "severity": "moderate", "isDirect": false, "via": [ { "source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<4.0.8" } ], "effects": [], "range": "<4.0.8", "nodes": [ "node_modules/micromatch" ], "fixAvailable": true }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1095097, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 2, "high": 12, "critical": 2, "total": 16 }, "dependencies": { "prod": 90, "dev": 650, "optional": 7, "peer": 10, "peerOptional": 0, "total": 739 } } } --- end --- $ /usr/bin/composer install --- stderr --- No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information. Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - composer/semver 1.4.2 requires php ^5.3.2 || ^7.0 -> your php version (8.2.20) does not satisfy that requirement. - mediawiki/mediawiki-codesniffer v21.0.0 requires composer/semver 1.4.2 -> satisfiable by composer/semver[1.4.2]. - Root composer.json requires mediawiki/mediawiki-codesniffer 21.0.0 -> satisfiable by mediawiki/mediawiki-codesniffer[v21.0.0]. --- stdout --- --- end --- Traceback (most recent call last): File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1864, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1788, in run "composer": self.composer_audit(), ^^^^^^^^^^^^^^^^^^^^^ File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 183, in composer_audit self.ensure_composer_lock() File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 142, in ensure_composer_lock self.check_call(["composer", "install"]) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call res.check_returncode() File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode raise CalledProcessError(self.returncode, self.args, self.stdout, subprocess.CalledProcessError: Command '['/usr/bin/composer', 'install']' returned non-zero exit status 2.