This run took 106 seconds.
$ date --- stdout --- Thu Oct 31 20:15:21 UTC 2024 --- end --- $ git clone file:///srv/git/wikimedia-toolhub.git repo --depth=1 -b main --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/main --- stdout --- a3af7a528aba2d6809e8a518eab3df7acb9702af refs/heads/main --- end --- $ /usr/bin/npm audit --json --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@apitools/openapi-parser": { "name": "@apitools/openapi-parser", "severity": "low", "isDirect": false, "via": [ "swagger-client" ], "effects": [ "rapidoc" ], "range": "<=0.0.33", "nodes": [ "node_modules/@apitools/openapi-parser" ], "fixAvailable": true }, "@apollographql/graphql-upload-8-fork": { "name": "@apollographql/graphql-upload-8-fork", "severity": "high", "isDirect": false, "via": [ "busboy" ], "effects": [ "apollo-server-core" ], "range": "*", "nodes": [ "node_modules/@apollographql/graphql-upload-8-fork" ], "fixAvailable": true }, "@babel/traverse": { "name": "@babel/traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1096886, "name": "@babel/traverse", "dependency": "@babel/traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [], "range": "<7.23.2", "nodes": [ "node_modules/@babel/traverse" ], "fixAvailable": true }, "@casl/vue": { "name": "@casl/vue", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": "<=2.0.1", "nodes": [ "node_modules/@casl/vue" ], "fixAvailable": { "name": "@casl/vue", "version": "2.2.2", "isSemVerMajor": true } }, "@sideway/formula": { "name": "@sideway/formula", "severity": "moderate", "isDirect": false, "via": [ { "source": 1091026, "name": "@sideway/formula", "dependency": "@sideway/formula", "title": "@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability", "url": "https://github.com/advisories/GHSA-c2jc-4fpr-4vhg", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, "range": "<3.0.1" } ], "effects": [], "range": "3.0.0", "nodes": [ "node_modules/@sideway/formula" ], "fixAvailable": true }, "@vue/cli": { "name": "@vue/cli", "severity": "high", "isDirect": true, "via": [ "download-git-repo", "vue", "vue-codemod" ], "effects": [], "range": "*", "nodes": [ "node_modules/@vue/cli" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "@vue/cli-plugin-babel": { "name": "@vue/cli-plugin-babel", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-service" ], "effects": [], "range": ">=4.0.0-alpha.0", "nodes": [ "node_modules/@vue/cli-plugin-babel" ], "fixAvailable": { "name": "@vue/cli-plugin-babel", "version": "3.12.1", "isSemVerMajor": true } }, "@vue/cli-plugin-eslint": { "name": "@vue/cli-plugin-eslint", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-service" ], "effects": [], "range": ">=4.0.0-alpha.0", "nodes": [ "node_modules/@vue/cli-plugin-eslint" ], "fixAvailable": { "name": "@vue/cli-plugin-eslint", "version": "3.12.1", "isSemVerMajor": true } }, "@vue/cli-plugin-router": { "name": "@vue/cli-plugin-router", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-service" ], "effects": [ "@vue/cli-service" ], "range": "*", "nodes": [ "node_modules/@vue/cli-plugin-router" ], "fixAvailable": false }, "@vue/cli-plugin-unit-mocha": { "name": "@vue/cli-plugin-unit-mocha", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-service", "mocha" ], "effects": [], "range": ">=4.0.0-alpha.0", "nodes": [ "node_modules/@vue/cli-plugin-unit-mocha" ], "fixAvailable": { "name": "@vue/cli-plugin-unit-mocha", "version": "4.5.19", "isSemVerMajor": true } }, "@vue/cli-plugin-vuex": { "name": "@vue/cli-plugin-vuex", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-service" ], "effects": [], "range": "*", "nodes": [ "node_modules/@vue/cli-plugin-vuex" ], "fixAvailable": false }, "@vue/cli-service": { "name": "@vue/cli-service", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-plugin-router", "@vue/cli-plugin-vuex", "@vue/component-compiler-utils", "vue-loader", "vue-template-compiler" ], "effects": [ "@vue/cli-plugin-babel", "@vue/cli-plugin-eslint", "@vue/cli-plugin-router", "@vue/cli-plugin-unit-mocha", "@vue/cli-plugin-vuex" ], "range": "*", "nodes": [ "node_modules/@vue/cli-service" ], "fixAvailable": false }, "@vue/component-compiler-utils": { "name": "@vue/component-compiler-utils", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [ "@vue/cli-service", "vue-loader" ], "range": "*", "nodes": [ "node_modules/@vue/component-compiler-utils" ], "fixAvailable": false }, "@vue/test-utils": { "name": "@vue/test-utils", "severity": "moderate", "isDirect": true, "via": [ "vue", "vue-template-compiler" ], "effects": [], "range": "<=1.3.6", "nodes": [ "node_modules/@vue/test-utils" ], "fixAvailable": { "name": "@vue/test-utils", "version": "2.4.6", "isSemVerMajor": true } }, "@wikimedia/jsonschema-tools": { "name": "@wikimedia/jsonschema-tools", "severity": "critical", "isDirect": true, "via": [ "json-schema-faker" ], "effects": [], "range": ">=0.10.3", "nodes": [ "node_modules/@wikimedia/jsonschema-tools" ], "fixAvailable": { "name": "@wikimedia/jsonschema-tools", "version": "0.10.2", "isSemVerMajor": true } }, "ansi-regex": { "name": "ansi-regex", "severity": "high", "isDirect": false, "via": [ { "source": 1094090, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": [ "CWE-697", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.0.1" }, { "source": 1094091, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": [ "CWE-697", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=4.0.0 <4.1.1" }, { "source": 1094092, "name": "ansi-regex", "dependency": "ansi-regex", "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex", "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw", "severity": "high", "cwe": [ "CWE-697", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=5.0.0 <5.0.1" } ], "effects": [], "range": "3.0.0 || 4.0.0 - 4.1.0 || 5.0.0", "nodes": [ "node_modules/ansi-regex", "node_modules/inquirer/node_modules/ansi-regex", "node_modules/log-update/node_modules/ansi-regex", "node_modules/mocha/node_modules/ansi-regex", "node_modules/nyc/node_modules/ansi-regex", "node_modules/wide-align/node_modules/ansi-regex" ], "fixAvailable": true }, "apollo-server-core": { "name": "apollo-server-core", "severity": "high", "isDirect": false, "via": [ "@apollographql/graphql-upload-8-fork", { "source": 1093178, "name": "apollo-server-core", "dependency": "apollo-server-core", "title": "Prevent logging invalid header values", "url": "https://github.com/advisories/GHSA-j5g3-5c8r-7qfx", "severity": "low", "cwe": [], "cvss": { "score": 0, "vectorString": null }, "range": "<2.26.1" } ], "effects": [], "range": "<=2.26.2", "nodes": [ "node_modules/apollo-server-core" ], "fixAvailable": true }, "async": { "name": "async", "severity": "high", "isDirect": false, "via": [ { "source": 1097691, "name": "async", "dependency": "async", "title": "Prototype Pollution in async", "url": "https://github.com/advisories/GHSA-fwr7-v2mv-hh25", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=2.0.0 <2.6.4" } ], "effects": [], "range": "2.0.0 - 2.6.3", "nodes": [ "node_modules/portfinder/node_modules/async" ], "fixAvailable": true }, "body-parser": { "name": "body-parser", "severity": "high", "isDirect": false, "via": [ { "source": 1099520, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to denial of service when url encoding is enabled", "url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7", "severity": "high", "cwe": [ "CWE-405" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.20.3" } ], "effects": [ "express" ], "range": "<1.20.3", "nodes": [ "node_modules/body-parser" ], "fixAvailable": true }, "braces": { "name": "braces", "severity": "high", "isDirect": false, "via": [ { "source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": [ "CWE-400", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.3" } ], "effects": [ "micromatch" ], "range": "<3.0.3", "nodes": [ "node_modules/@vue/cli-plugin-unit-mocha/node_modules/braces", "node_modules/braces", "node_modules/chokidar/node_modules/braces", "node_modules/eslint-webpack-plugin/node_modules/braces", "node_modules/fast-glob/node_modules/braces", "node_modules/http-proxy-middleware/node_modules/braces", "node_modules/mocha/node_modules/braces", "node_modules/stylelint-config-wikimedia/node_modules/braces", "node_modules/stylelint/node_modules/braces", "node_modules/webpack-dev-server/node_modules/braces" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "busboy": { "name": "busboy", "severity": "high", "isDirect": false, "via": [ "dicer" ], "effects": [ "@apollographql/graphql-upload-8-fork" ], "range": "<=0.3.1", "nodes": [ "node_modules/busboy" ], "fixAvailable": true }, "cacheable-request": { "name": "cacheable-request", "severity": "high", "isDirect": false, "via": [ "http-cache-semantics" ], "effects": [ "got" ], "range": "0.1.0 - 2.1.4", "nodes": [ "node_modules/cacheable-request" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "cookie": { "name": "cookie", "severity": "low", "isDirect": false, "via": [ { "source": 1099846, "name": "cookie", "dependency": "cookie", "title": "cookie accepts cookie name, path, and domain with out of bounds characters", "url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x", "severity": "low", "cwe": [ "CWE-74" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.7.0" } ], "effects": [ "express", "swagger-client" ], "range": "<0.7.0", "nodes": [ "node_modules/cookie" ], "fixAvailable": true }, "core-js-compat": { "name": "core-js-compat", "severity": "high", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0 - 3.25.0", "nodes": [ "node_modules/core-js-compat" ], "fixAvailable": true }, "decode-uri-component": { "name": "decode-uri-component", "severity": "high", "isDirect": false, "via": [ { "source": 1094087, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to Denial of Service (DoS)", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "severity": "high", "cwe": [ "CWE-20" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<0.2.1" } ], "effects": [], "range": "<0.2.1", "nodes": [ "node_modules/decode-uri-component" ], "fixAvailable": true }, "dicer": { "name": "dicer", "severity": "high", "isDirect": false, "via": [ { "source": 1093150, "name": "dicer", "dependency": "dicer", "title": "Crash in HeaderParser in dicer", "url": "https://github.com/advisories/GHSA-wm7h-9275-46v2", "severity": "high", "cwe": [ "CWE-248" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=0.3.1" } ], "effects": [ "busboy" ], "range": "*", "nodes": [ "node_modules/dicer" ], "fixAvailable": true }, "download": { "name": "download", "severity": "moderate", "isDirect": false, "via": [ "got" ], "effects": [ "download-git-repo" ], "range": ">=4.0.0", "nodes": [ "node_modules/download" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "download-git-repo": { "name": "download-git-repo", "severity": "high", "isDirect": false, "via": [ "download", "git-clone" ], "effects": [ "@vue/cli" ], "range": "*", "nodes": [ "node_modules/download-git-repo" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "ejs": { "name": "ejs", "severity": "critical", "isDirect": false, "via": [ { "source": 1089270, "name": "ejs", "dependency": "ejs", "title": "ejs template injection vulnerability", "url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q", "severity": "critical", "cwe": [ "CWE-74" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<3.1.7" }, { "source": 1098366, "name": "ejs", "dependency": "ejs", "title": "ejs lacks certain pollution protection", "url": "https://github.com/advisories/GHSA-ghr5-ch3p-vcr6", "severity": "moderate", "cwe": [ "CWE-693", "CWE-1321" ], "cvss": { "score": 4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<3.1.10" } ], "effects": [], "range": "<=3.1.9", "nodes": [ "node_modules/ejs" ], "fixAvailable": true }, "eslint-plugin-compat": { "name": "eslint-plugin-compat", "severity": "high", "isDirect": false, "via": [ "semver" ], "effects": [], "range": "3.6.0-0 - 4.1.4", "nodes": [ "node_modules/eslint-plugin-compat" ], "fixAvailable": true }, "express": { "name": "express", "severity": "high", "isDirect": false, "via": [ { "source": 1096820, "name": "express", "dependency": "express", "title": "Express.js Open Redirect in malformed URLs", "url": "https://github.com/advisories/GHSA-rv95-896h-c2vc", "severity": "moderate", "cwe": [ "CWE-601", "CWE-1286" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<4.19.2" }, { "source": 1099529, "name": "express", "dependency": "express", "title": "express vulnerable to XSS via response.redirect()", "url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<4.20.0" }, "body-parser", "cookie", "path-to-regexp", "send", "serve-static" ], "effects": [], "range": "<=4.21.0 || 5.0.0-alpha.1 - 5.0.0", "nodes": [ "node_modules/express" ], "fixAvailable": true }, "follow-redirects": { "name": "follow-redirects", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096353, "name": "follow-redirects", "dependency": "follow-redirects", "title": "Follow Redirects improperly handles URLs in the url.parse() function", "url": "https://github.com/advisories/GHSA-jchw-25xp-jwwc", "severity": "moderate", "cwe": [ "CWE-20", "CWE-601" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<1.15.4" }, { "source": 1096856, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects' Proxy-Authorization header kept across hosts", "url": "https://github.com/advisories/GHSA-cxjh-pqwp-8mfp", "severity": "moderate", "cwe": [ "CWE-200" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=1.15.5" } ], "effects": [], "range": "<=1.15.5", "nodes": [ "node_modules/follow-redirects" ], "fixAvailable": true }, "get-func-name": { "name": "get-func-name", "severity": "high", "isDirect": false, "via": [ { "source": 1094574, "name": "get-func-name", "dependency": "get-func-name", "title": "Chaijs/get-func-name vulnerable to ReDoS", "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [], "range": "<2.0.1", "nodes": [ "node_modules/get-func-name" ], "fixAvailable": true }, "git-clone": { "name": "git-clone", "severity": "high", "isDirect": false, "via": [ { "source": 1093404, "name": "git-clone", "dependency": "git-clone", "title": "Command injection in git-clone", "url": "https://github.com/advisories/GHSA-8jmw-wjr8-2x66", "severity": "high", "cwe": [ "CWE-77", "CWE-88" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=0.2.0" } ], "effects": [ "download-git-repo" ], "range": "*", "nodes": [ "node_modules/git-clone" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "got": { "name": "got", "severity": "high", "isDirect": false, "via": [ { "source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<11.8.5" }, "cacheable-request" ], "effects": [ "download" ], "range": "<=11.8.3", "nodes": [ "node_modules/got" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "http-cache-semantics": { "name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [ { "source": 1092316, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.1.1" } ], "effects": [ "cacheable-request" ], "range": "<4.1.1", "nodes": [ "node_modules/http-cache-semantics" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "http-proxy-middleware": { "name": "http-proxy-middleware", "severity": "high", "isDirect": false, "via": [ { "source": 1100223, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "Denial of service in http-proxy-middleware", "url": "https://github.com/advisories/GHSA-c7qv-q95q-8v27", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.7" } ], "effects": [], "range": "<2.0.7", "nodes": [ "node_modules/http-proxy-middleware" ], "fixAvailable": true }, "ip": { "name": "ip", "severity": "high", "isDirect": false, "via": [ { "source": 1097720, "name": "ip", "dependency": "ip", "title": "NPM IP package incorrectly identifies some private IP addresses as public", "url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22", "severity": "low", "cwe": [ "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.1.9" }, { "source": 1099357, "name": "ip", "dependency": "ip", "title": "ip SSRF improper categorization in isPublic", "url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp", "severity": "high", "cwe": [ "CWE-918" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=2.0.1" } ], "effects": [], "range": "*", "nodes": [ "node_modules/ip" ], "fixAvailable": true }, "jscodeshift": { "name": "jscodeshift", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "vue-codemod" ], "range": "0.3.20 - 0.13.1", "nodes": [ "node_modules/jscodeshift" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "json-pointer": { "name": "json-pointer", "severity": "critical", "isDirect": true, "via": [ { "source": 1088901, "name": "json-pointer", "dependency": "json-pointer", "title": "Prototype Pollution in json-pointer", "url": "https://github.com/advisories/GHSA-v5vg-g7rq-363w", "severity": "moderate", "cwe": [ "CWE-843", "CWE-1321" ], "cvss": { "score": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "range": "<=0.6.1" }, { "source": 1096878, "name": "json-pointer", "dependency": "json-pointer", "title": "json-pointer vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-6xrf-q977-5vgc", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<0.6.2" } ], "effects": [], "range": "<=0.6.1", "nodes": [ "node_modules/json-pointer" ], "fixAvailable": true }, "json-schema-faker": { "name": "json-schema-faker", "severity": "critical", "isDirect": false, "via": [ "jsonpath-plus" ], "effects": [ "@wikimedia/jsonschema-tools" ], "range": "0.5.0-rc1 - 0.5.0-rcv.46 || >=0.5.2", "nodes": [ "node_modules/json-schema-faker" ], "fixAvailable": { "name": "@wikimedia/jsonschema-tools", "version": "0.10.2", "isSemVerMajor": true } }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096543, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": "<1.0.2" }, { "source": 1096544, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "<1.0.2 || >=2.0.0 <2.2.2", "nodes": [ "node_modules/json5", "node_modules/loader-utils/node_modules/json5" ], "fixAvailable": true }, "jsonpath-plus": { "name": "jsonpath-plus", "severity": "critical", "isDirect": false, "via": [ { "source": 1100203, "name": "jsonpath-plus", "dependency": "jsonpath-plus", "title": "JSONPath Plus Remote Code Execution (RCE) Vulnerability", "url": "https://github.com/advisories/GHSA-pppg-cpfq-h7wr", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<10.0.0" } ], "effects": [ "json-schema-faker" ], "range": "<10.0.0", "nodes": [ "node_modules/jsonpath-plus" ], "fixAvailable": { "name": "@wikimedia/jsonschema-tools", "version": "0.10.2", "isSemVerMajor": true } }, "loader-utils": { "name": "loader-utils", "severity": "critical", "isDirect": false, "via": [ { "source": 1094088, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.4.1" }, { "source": 1094089, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=2.0.0 <2.0.3" }, { "source": 1095054, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable", "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.0.4" }, { "source": 1095055, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable", "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.4.2" }, { "source": 1097142, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.0.4" }, { "source": 1097143, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.4.2" } ], "effects": [], "range": "<=1.4.1 || 2.0.0 - 2.0.3", "nodes": [ "node_modules/loader-utils", "node_modules/null-loader/node_modules/loader-utils", "node_modules/thread-loader/node_modules/loader-utils", "node_modules/vue-loader/node_modules/loader-utils", "node_modules/vuetify-loader/node_modules/loader-utils" ], "fixAvailable": true }, "marked": { "name": "marked", "severity": "high", "isDirect": false, "via": [ { "source": 1095051, "name": "marked", "dependency": "marked", "title": "Inefficient Regular Expression Complexity in marked", "url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.0.10" }, { "source": 1095052, "name": "marked", "dependency": "marked", "title": "Inefficient Regular Expression Complexity in marked", "url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.0.10" } ], "effects": [ "rapidoc" ], "range": "<=4.0.9", "nodes": [ "node_modules/marked" ], "fixAvailable": true }, "micromatch": { "name": "micromatch", "severity": "high", "isDirect": false, "via": [ { "source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<4.0.8" }, "braces" ], "effects": [ "jscodeshift" ], "range": "<=4.0.7", "nodes": [ "node_modules/eslint-webpack-plugin/node_modules/micromatch", "node_modules/fast-glob/node_modules/micromatch", "node_modules/http-proxy-middleware/node_modules/micromatch", "node_modules/micromatch", "node_modules/stylelint-config-wikimedia/node_modules/micromatch", "node_modules/stylelint/node_modules/micromatch" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1096485, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "mocha" ], "range": "<3.0.5", "nodes": [ "node_modules/minimatch" ], "fixAvailable": { "name": "@vue/cli-plugin-unit-mocha", "version": "4.5.19", "isSemVerMajor": true } }, "minimist": { "name": "minimist", "severity": "critical", "isDirect": false, "via": [ { "source": 1097678, "name": "minimist", "dependency": "minimist", "title": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.0.0 <1.2.6" } ], "effects": [], "range": "1.0.0 - 1.2.5", "nodes": [ "node_modules/minimist" ], "fixAvailable": true }, "mocha": { "name": "mocha", "severity": "high", "isDirect": true, "via": [ "minimatch", "nanoid" ], "effects": [ "@vue/cli-plugin-unit-mocha" ], "range": "5.1.0 - 9.2.1", "nodes": [ "node_modules/@vue/cli-plugin-unit-mocha/node_modules/mocha", "node_modules/mocha" ], "fixAvailable": { "name": "@vue/cli-plugin-unit-mocha", "version": "4.5.19", "isSemVerMajor": true } }, "moment": { "name": "moment", "severity": "high", "isDirect": false, "via": [ { "source": 1095072, "name": "moment", "dependency": "moment", "title": "Moment.js vulnerable to Inefficient Regular Expression Complexity", "url": "https://github.com/advisories/GHSA-wc69-rhjr-hc9g", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.18.0 <2.29.4" }, { "source": 1095083, "name": "moment", "dependency": "moment", "title": "Path Traversal: 'dir/../../filename' in moment.locale", "url": "https://github.com/advisories/GHSA-8hfj-j24r-96c4", "severity": "high", "cwe": [ "CWE-22", "CWE-27" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<2.29.2" } ], "effects": [], "range": "<=2.29.3", "nodes": [ "node_modules/moment" ], "fixAvailable": true }, "nanoid": { "name": "nanoid", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089011, "name": "nanoid", "dependency": "nanoid", "title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid", "url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2", "severity": "moderate", "cwe": [ "CWE-200" ], "cvss": { "score": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=3.0.0 <3.1.31" } ], "effects": [ "mocha" ], "range": "3.0.0 - 3.1.30", "nodes": [ "node_modules/@vue/cli-plugin-unit-mocha/node_modules/nanoid" ], "fixAvailable": { "name": "@vue/cli-plugin-unit-mocha", "version": "4.5.19", "isSemVerMajor": true } }, "node-forge": { "name": "node-forge", "severity": "high", "isDirect": false, "via": [ { "source": 1088746, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in `node-forge`", "url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr", "severity": "moderate", "cwe": [ "CWE-347" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<1.3.0" }, { "source": 1095012, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" }, { "source": 1095013, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" } ], "effects": [], "range": "<=1.2.1", "nodes": [ "node_modules/node-forge" ], "fixAvailable": true }, "path-to-regexp": { "name": "path-to-regexp", "severity": "high", "isDirect": false, "via": [ { "source": 1099561, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp outputs backtracking regular expressions", "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=0.2.0 <1.9.0" }, { "source": 1099562, "name": "path-to-regexp", "dependency": "path-to-regexp", "title": "path-to-regexp outputs backtracking regular expressions", "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<0.1.10" } ], "effects": [ "express" ], "range": "<=0.1.9 || 0.2.0 - 1.8.0", "nodes": [ "node_modules/nise/node_modules/path-to-regexp", "node_modules/path-to-regexp" ], "fixAvailable": true }, "postcss": { "name": "postcss", "severity": "moderate", "isDirect": false, "via": [ { "source": 1094544, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" } ], "effects": [ "@vue/component-compiler-utils" ], "range": "<8.4.31", "nodes": [ "node_modules/@vue/component-compiler-utils/node_modules/postcss", "node_modules/postcss" ], "fixAvailable": false }, "prismjs": { "name": "prismjs", "severity": "high", "isDirect": false, "via": [ { "source": 1090424, "name": "prismjs", "dependency": "prismjs", "title": "Cross-site Scripting in Prism", "url": "https://github.com/advisories/GHSA-3949-f494-cm99", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L" }, "range": ">=1.14.0 <1.27.0" } ], "effects": [], "range": "1.14.0 - 1.26.0", "nodes": [ "node_modules/prismjs" ], "fixAvailable": true }, "rapidoc": { "name": "rapidoc", "severity": "high", "isDirect": true, "via": [ "@apitools/openapi-parser", "marked" ], "effects": [], "range": "*", "nodes": [ "node_modules/rapidoc" ], "fixAvailable": true }, "rss-parser": { "name": "rss-parser", "severity": "moderate", "isDirect": false, "via": [ "xml2js" ], "effects": [], "range": "<=3.12.0", "nodes": [ "node_modules/rss-parser" ], "fixAvailable": true }, "semver": { "name": "semver", "severity": "high", "isDirect": false, "via": [ { "source": 1098562, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=7.0.0 <7.5.2" }, { "source": 1098563, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<5.7.2" }, { "source": 1098564, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=6.0.0 <6.3.1" } ], "effects": [ "core-js-compat", "eslint-plugin-compat" ], "range": "<=5.7.1 || 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1", "nodes": [ "node_modules/@babel/register/node_modules/semver", "node_modules/@intlify/eslint-plugin-vue-i18n/node_modules/semver", "node_modules/@vue/cli-plugin-babel/node_modules/semver", "node_modules/@vue/cli-shared-utils/node_modules/semver", "node_modules/core-js-compat/node_modules/semver", "node_modules/cross-spawn/node_modules/semver", "node_modules/css-loader/node_modules/semver", "node_modules/editorconfig/node_modules/semver", "node_modules/eslint-plugin-compat/node_modules/semver", "node_modules/eslint-plugin-jsdoc/node_modules/semver", "node_modules/eslint-plugin-unicorn/node_modules/semver", "node_modules/eslint-plugin-vue/node_modules/semver", "node_modules/find-cache-dir/node_modules/semver", "node_modules/jsonc-eslint-parser/node_modules/semver", "node_modules/meow/node_modules/semver", "node_modules/node-notifier/node_modules/semver", "node_modules/normalize-package-data/node_modules/semver", "node_modules/postcss-loader/node_modules/semver", "node_modules/semver", "node_modules/stylelint-config-recommended-vue/node_modules/semver", "node_modules/vue-cli-plugin-vuetify/node_modules/semver", "node_modules/vue-eslint-parser/node_modules/semver" ], "fixAvailable": true }, "send": { "name": "send", "severity": "moderate", "isDirect": false, "via": [ { "source": 1099525, "name": "send", "dependency": "send", "title": "send vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<0.19.0" } ], "effects": [ "express", "serve-static" ], "range": "<0.19.0", "nodes": [ "node_modules/send" ], "fixAvailable": true }, "serve-static": { "name": "serve-static", "severity": "moderate", "isDirect": false, "via": [ { "source": 1099527, "name": "serve-static", "dependency": "serve-static", "title": "serve-static vulnerable to template injection that can lead to XSS", "url": "https://github.com/advisories/GHSA-cm22-4g7w-348p", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, "range": "<1.16.0" }, "send" ], "effects": [], "range": "<=1.16.0", "nodes": [ "node_modules/serve-static" ], "fixAvailable": true }, "shelljs": { "name": "shelljs", "severity": "high", "isDirect": false, "via": [ { "source": 1088208, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj", "severity": "moderate", "cwe": [ "CWE-269" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.8.5" }, { "source": 1095126, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6", "severity": "high", "cwe": [ "CWE-269" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, "range": "<0.8.5" } ], "effects": [], "range": "<=0.8.4", "nodes": [ "node_modules/shelljs" ], "fixAvailable": true }, "swagger-client": { "name": "swagger-client", "severity": "low", "isDirect": true, "via": [ "cookie" ], "effects": [ "@apitools/openapi-parser" ], "range": "3.3.0 - 3.29.3", "nodes": [ "node_modules/swagger-client" ], "fixAvailable": true }, "terser": { "name": "terser", "severity": "high", "isDirect": false, "via": [ { "source": 1091690, "name": "terser", "dependency": "terser", "title": "Terser insecure use of regular expressions leads to ReDoS", "url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=5.0.0 <5.14.2" } ], "effects": [], "range": "5.0.0 - 5.14.1", "nodes": [ "node_modules/terser" ], "fixAvailable": true }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [], "range": "<4.1.3", "nodes": [ "node_modules/tough-cookie" ], "fixAvailable": true }, "vue": { "name": "vue", "severity": "low", "isDirect": true, "via": [ { "source": 1100238, "name": "vue", "dependency": "vue", "title": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function", "url": "https://github.com/advisories/GHSA-5j4c-8p2g-v4jx", "severity": "low", "cwe": [ "CWE-1333" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0-alpha.1 <3.0.0-alpha.0" } ], "effects": [ "@casl/vue", "@vue/cli", "@vue/test-utils", "vue-async-computed", "vue-frag", "vuetify", "vuex" ], "range": "2.0.0-alpha.1 - 2.7.16", "nodes": [ "node_modules/vue" ], "fixAvailable": { "name": "vue", "version": "3.5.12", "isSemVerMajor": true } }, "vue-async-computed": { "name": "vue-async-computed", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": "2.0.0-rc.1 - 4.0.0-mixin.0", "nodes": [ "node_modules/vue-async-computed" ], "fixAvailable": { "name": "vue-async-computed", "version": "4.0.1", "isSemVerMajor": true } }, "vue-codemod": { "name": "vue-codemod", "severity": "moderate", "isDirect": false, "via": [ "jscodeshift" ], "effects": [ "@vue/cli" ], "range": "*", "nodes": [ "node_modules/vue-codemod" ], "fixAvailable": { "name": "@vue/cli", "version": "4.2.2", "isSemVerMajor": true } }, "vue-frag": { "name": "vue-frag", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": ">=1.3.1", "nodes": [ "node_modules/vue-frag" ], "fixAvailable": { "name": "vue-frag", "version": "1.3.0", "isSemVerMajor": true } }, "vue-loader": { "name": "vue-loader", "severity": "moderate", "isDirect": false, "via": [ "@vue/component-compiler-utils" ], "effects": [ "@vue/cli-service" ], "range": "15.0.0-beta.1 - 15.11.1", "nodes": [ "node_modules/@vue/vue-loader-v15" ], "fixAvailable": false }, "vue-template-compiler": { "name": "vue-template-compiler", "severity": "moderate", "isDirect": true, "via": [ { "source": 1098721, "name": "vue-template-compiler", "dependency": "vue-template-compiler", "title": "vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)", "url": "https://github.com/advisories/GHSA-g3ch-rx76-35fx", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 4.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=2.0.0 <3.0.0" } ], "effects": [ "@vue/cli-service", "vuetify-loader" ], "range": ">=2.0.0", "nodes": [ "node_modules/vue-template-compiler" ], "fixAvailable": false }, "vuetify": { "name": "vuetify", "severity": "moderate", "isDirect": true, "via": [ { "source": 1089240, "name": "vuetify", "dependency": "vuetify", "title": "Vuetify Cross-site Scripting vulnerability", "url": "https://github.com/advisories/GHSA-q4q5-c5cv-2p68", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, "range": ">=2.0.0-beta.4 <2.6.10" }, "vue" ], "effects": [], "range": "<=0.2.0 || 0.8.8 - 0.14.2 || 0.16.7 - 2.7.2", "nodes": [ "node_modules/vuetify" ], "fixAvailable": true }, "vuetify-loader": { "name": "vuetify-loader", "severity": "moderate", "isDirect": true, "via": [ "vue-template-compiler" ], "effects": [], "range": "1.0.0 - 1.8.0", "nodes": [ "node_modules/vuetify-loader" ], "fixAvailable": true }, "vuex": { "name": "vuex", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": "3.1.3 - 3.6.2", "nodes": [ "node_modules/vuex" ], "fixAvailable": { "name": "vuex", "version": "4.1.0", "isSemVerMajor": true } }, "webpack": { "name": "webpack", "severity": "critical", "isDirect": false, "via": [ { "source": 1094471, "name": "webpack", "dependency": "webpack", "title": "Cross-realm object access in Webpack 5", "url": "https://github.com/advisories/GHSA-hc6q-2mpp-qw7j", "severity": "critical", "cwe": [], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=5.0.0 <5.76.0" }, { "source": 1099351, "name": "webpack", "dependency": "webpack", "title": "Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS", "url": "https://github.com/advisories/GHSA-4vvj-4cpr-p986", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H" }, "range": ">=5.0.0-alpha.0 <5.94.0" } ], "effects": [], "range": "5.0.0-alpha.0 - 5.93.0", "nodes": [ "node_modules/webpack" ], "fixAvailable": true }, "webpack-dev-middleware": { "name": "webpack-dev-middleware", "severity": "high", "isDirect": false, "via": [ { "source": 1096729, "name": "webpack-dev-middleware", "dependency": "webpack-dev-middleware", "title": "Path traversal in webpack-dev-middleware", "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" }, "range": "<=5.3.3" } ], "effects": [], "range": "<=5.3.3", "nodes": [ "node_modules/webpack-dev-middleware" ], "fixAvailable": true }, "word-wrap": { "name": "word-wrap", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097681, "name": "word-wrap", "dependency": "word-wrap", "title": "word-wrap vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-j8xg-fqg3-53r7", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.2.4" } ], "effects": [], "range": "<1.2.4", "nodes": [ "node_modules/word-wrap" ], "fixAvailable": true }, "ws": { "name": "ws", "severity": "high", "isDirect": false, "via": [ { "source": 1098392, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": [ "CWE-476" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=8.0.0 <8.17.1" }, { "source": 1098393, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": [ "CWE-476" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=7.0.0 <7.5.10" } ], "effects": [], "range": "7.0.0 - 7.5.9 || 8.0.0 - 8.17.0", "nodes": [ "node_modules/subscriptions-transport-ws/node_modules/ws", "node_modules/webpack-bundle-analyzer/node_modules/ws", "node_modules/ws" ], "fixAvailable": true }, "xml2js": { "name": "xml2js", "severity": "moderate", "isDirect": false, "via": [ { "source": 1096693, "name": "xml2js", "dependency": "xml2js", "title": "xml2js is vulnerable to prototype pollution", "url": "https://github.com/advisories/GHSA-776f-qx25-q3cc", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<0.5.0" } ], "effects": [ "rss-parser" ], "range": "<0.5.0", "nodes": [ "node_modules/xml2js" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 8, "moderate": 25, "high": 36, "critical": 9, "total": 78 }, "dependencies": { "prod": 68, "dev": 2087, "optional": 3, "peer": 3, "peerOptional": 0, "total": 2154 } } } --- end --- Upgrading n:eslint from ^8.10.0 -> 8.57.0 Upgrading n:eslint-config-wikimedia from ^0.22.1 -> 0.28.2 Upgrading n:grunt-banana-checker from 0.10.0 -> 0.13.0 Upgrading n:stylelint from ^14.5.3 -> 16.2.0 Upgrading n:stylelint-config-wikimedia from ^0.12.2 -> 0.17.2 $ /usr/bin/npm install --- stderr --- npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated apollo-tracing@0.15.0: The `apollo-tracing` package is no longer part of Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#tracing for details npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated graphql-extensions@0.15.0: The `graphql-extensions` API has been removed from Apollo Server 3. Use the plugin API instead: https://www.apollographql.com/docs/apollo-server/integrations/plugins/ npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated apollo-cache-control@0.14.0: The functionality provided by the `apollo-cache-control` package is built in to `apollo-server-core` starting with Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#cachecontrol for details. npm WARN deprecated subscriptions-transport-ws@0.9.19: The `subscriptions-transport-ws` package is no longer maintained. We recommend you use `graphql-ws` instead. For help migrating Apollo software to `graphql-ws`, see https://www.apollographql.com/docs/apollo-server/data/subscriptions/#switching-from-subscriptions-transport-ws For general help using `graphql-ws`, see https://github.com/enisdenjo/graphql-ws/blob/master/README.md npm WARN deprecated graphql-tools@4.0.8: This package has been deprecated and now it only exports makeExecutableSchema.\nAnd it will no longer receive updates.\nWe recommend you to migrate to scoped packages such as @graphql-tools/schema, @graphql-tools/utils and etc.\nCheck out https://www.graphql-tools.com to learn what package you should use instead npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options. npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js. --- stdout --- added 2203 packages, and audited 2204 packages in 48s 217 packages are looking for funding run `npm fund` for details 75 vulnerabilities (8 low, 24 moderate, 34 high, 9 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ ./node_modules/.bin/eslint . --fix --- stderr --- Oops! Something went wrong! :( ESLint: 8.57.0 TypeError: Cannot read properties of null (reading 'range') Occurred while linting /src/repo/vue/src/App.vue:200 Rule: "vuetify/grid-unknown-attributes" at SourceCode.getTokenBefore (/src/repo/node_modules/eslint/lib/source-code/token-store/index.js:298:18) at validateNode (/src/repo/node_modules/eslint/lib/rules/operator-linebreak.js:155:42) at EventEmitter.validateBinaryExpression (/src/repo/node_modules/eslint/lib/rules/operator-linebreak.js:226:13) at EventEmitter.emit (node:events:517:28) at NodeEventGenerator.applySelector (/src/repo/node_modules/vue-eslint-parser/index.js:3883:26) at NodeEventGenerator.applySelectors (/src/repo/node_modules/vue-eslint-parser/index.js:3897:22) at NodeEventGenerator.enterNode (/src/repo/node_modules/vue-eslint-parser/index.js:3905:14) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:154:13) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:166:13) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:166:13) --- stdout --- --- end --- $ ./node_modules/.bin/eslint . -f json --- stderr --- Oops! Something went wrong! :( ESLint: 8.57.0 TypeError: Cannot read properties of null (reading 'range') Occurred while linting /src/repo/vue/src/App.vue:200 Rule: "vuetify/grid-unknown-attributes" at SourceCode.getTokenBefore (/src/repo/node_modules/eslint/lib/source-code/token-store/index.js:298:18) at validateNode (/src/repo/node_modules/eslint/lib/rules/operator-linebreak.js:155:42) at EventEmitter.validateBinaryExpression (/src/repo/node_modules/eslint/lib/rules/operator-linebreak.js:226:13) at EventEmitter.emit (node:events:517:28) at NodeEventGenerator.applySelector (/src/repo/node_modules/vue-eslint-parser/index.js:3883:26) at NodeEventGenerator.applySelectors (/src/repo/node_modules/vue-eslint-parser/index.js:3897:22) at NodeEventGenerator.enterNode (/src/repo/node_modules/vue-eslint-parser/index.js:3905:14) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:154:13) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:166:13) at traverse (/src/repo/node_modules/vue-eslint-parser/index.js:166:13) --- stdout --- --- end --- Traceback (most recent call last): File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1864, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1803, in run self.npm_upgrade(plan) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1197, in npm_upgrade hook(update) File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1500, in _handle_eslint errors = json.loads( ^^^^^^^^^^^ File "/usr/lib/python3.11/json/__init__.py", line 346, in loads return _default_decoder.decode(s) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)