This run took 24 seconds.
$ date
--- stdout ---
Fri Mar 28 00:07:10 UTC 2025
--- end ---
$ git clone file:///srv/git/design-codex.git repo --depth=1 -b main
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/main
--- stdout ---
3c9c5b98cb33bba1fe2c65cf2da308ab70d93509 refs/heads/main
--- end ---
$ /usr/bin/npm i --package-lock-only
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-design-tokens@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'rimraf@6.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-design-tokens@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
up to date, audited 2635 packages in 5s
465 packages are looking for funding
run `npm fund` for details
20 vulnerabilities (17 moderate, 3 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
Editing .gitignore to remove package-lock.json
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1103026,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@netlify/build": {
"name": "@netlify/build",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/edge-bundler",
"@netlify/functions-utils",
"@netlify/zip-it-and-ship-it"
],
"effects": [
"netlify-cli"
],
"range": "0.0.24 - 0.0.26 || 9.1.0 - 11.17.0 || 11.37.2 - 12.1.2 || 16.0.0-rc || >=29.20.8",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"@netlify/edge-bundler": {
"name": "@netlify/edge-bundler",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"netlify-cli"
],
"range": "8.20.0 - 11.4.0 || >=12.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/zip-it-and-ship-it"
],
"effects": [
"@netlify/build"
],
"range": "1.3.14 - 1.3.29 || 1.3.41 || >=5.2.24",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"@netlify/zip-it-and-ship-it": {
"name": "@netlify/zip-it-and-ship-it",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"@netlify/functions-utils",
"netlify-cli"
],
"range": "2.2.0 - 4.2.7 || >=9.17.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"@octokit/endpoint": {
"name": "@octokit/endpoint",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102258,
"name": "@octokit/endpoint",
"dependency": "@octokit/endpoint",
"title": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-x4c5-c7rf-jjgv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.0.5 <9.0.6"
}
],
"effects": [],
"range": "9.0.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/endpoint"
],
"fixAvailable": true
},
"@octokit/plugin-paginate-rest": {
"name": "@octokit/plugin-paginate-rest",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102899,
"name": "@octokit/plugin-paginate-rest",
"dependency": "@octokit/plugin-paginate-rest",
"title": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.3.0-beta.1 <11.4.1"
}
],
"effects": [
"@octokit/rest"
],
"range": "9.3.0-beta.1 - 11.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/plugin-paginate-rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"@octokit/request": {
"name": "@octokit/request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102896,
"name": "@octokit/request",
"dependency": "@octokit/request",
"title": "@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-rmvr-2pp2-xj38",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <8.4.1"
}
],
"effects": [],
"range": "<=8.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request"
],
"fixAvailable": true
},
"@octokit/request-error": {
"name": "@octokit/request-error",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102256,
"name": "@octokit/request-error",
"dependency": "@octokit/request-error",
"title": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-xx4v-prfh-6cgc",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <5.1.1"
}
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request-error"
],
"fixAvailable": true
},
"@octokit/rest": {
"name": "@octokit/rest",
"severity": "moderate",
"isDirect": false,
"via": [
"@octokit/plugin-paginate-rest"
],
"effects": [
"netlify-cli"
],
"range": "20.1.1 || 21.0.0-beta.1 - 21.0.0-beta.4",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1102472,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.8.2"
}
],
"effects": [
"wait-on"
],
"range": "<=1.8.1",
"nodes": [
"node_modules/wait-on/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"tsx",
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/esbuild",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/esbuild",
"node_modules/netlify-cli/node_modules/esbuild",
"node_modules/vite/node_modules/esbuild",
"node_modules/vitepress/node_modules/esbuild"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"@netlify/build",
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"@octokit/rest"
],
"effects": [],
"range": "2.19.1 - 2.19.2 || 3.8.2 - 3.29.14 || 3.37.7 - 3.37.26 || >=16.2.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.1.0",
"isSemVerMajor": true
}
},
"prismjs": {
"name": "prismjs",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1102459,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [],
"range": "<1.30.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "prismjs",
"version": "1.30.0",
"isSemVerMajor": false
}
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "high",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
},
"tsx": {
"name": "tsx",
"severity": "moderate",
"isDirect": true,
"via": [
"esbuild"
],
"effects": [],
"range": "3.13.0 - 4.19.2",
"nodes": [
"node_modules/tsx"
],
"fixAvailable": {
"name": "tsx",
"version": "4.19.3",
"isSemVerMajor": false
}
},
"undici": {
"name": "undici",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101609,
"name": "undici",
"dependency": "undici",
"title": "Use of Insufficiently Random Values in undici",
"url": "https://github.com/advisories/GHSA-c76h-2ccp-4975",
"severity": "moderate",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 6.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": ">=6.0.0 <6.21.1"
}
],
"effects": [],
"range": "6.0.0 - 6.21.0",
"nodes": [
"node_modules/undici"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1102437,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=5.0.0 <=5.4.11"
},
{
"source": 1102438,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <=6.0.8"
},
{
"source": 1103517,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=5.0.0 <5.4.15"
},
{
"source": 1103518,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.12"
},
"esbuild"
],
"effects": [],
"range": "0.11.0 - 6.1.2",
"nodes": [
"node_modules/vite",
"node_modules/vitepress/node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "6.2.3",
"isSemVerMajor": false
}
},
"wait-on": {
"name": "wait-on",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 17,
"high": 3,
"critical": 0,
"total": 20
},
"dependencies": {
"prod": 167,
"dev": 2468,
"optional": 234,
"peer": 84,
"peerOptional": 0,
"total": 2634
}
}
}
--- end ---
$ /usr/bin/npm i --package-lock-only
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-design-tokens@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'rimraf@6.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@1.21.1',
npm WARN EBADENGINE required: { npm: '>=10.8.1', node: '>=20' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'glob@11.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'jackspeak@4.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'lru-cache@11.0.2',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'minimatch@10.0.1',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'path-scurry@2.0.0',
npm WARN EBADENGINE required: { node: '20 || >=22' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-design-tokens@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wikimedia/codex-icons@1.21.1',
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: undefined,
npm WARN EBADENGINE required: { node: '>=20', npm: '>=10.8.1' },
npm WARN EBADENGINE current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
up to date, audited 2635 packages in 4s
465 packages are looking for funding
run `npm fund` for details
20 vulnerabilities (17 moderate, 3 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
Editing .gitignore to remove package-lock.json
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1103026,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@netlify/build": {
"name": "@netlify/build",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/edge-bundler",
"@netlify/functions-utils",
"@netlify/zip-it-and-ship-it"
],
"effects": [
"netlify-cli"
],
"range": "0.0.24 - 0.0.26 || 9.1.0 - 11.17.0 || 11.37.2 - 12.1.2 || 16.0.0-rc || >=29.20.8",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"@netlify/edge-bundler": {
"name": "@netlify/edge-bundler",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"netlify-cli"
],
"range": "8.20.0 - 11.4.0 || >=12.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/zip-it-and-ship-it"
],
"effects": [
"@netlify/build"
],
"range": "1.3.14 - 1.3.29 || 1.3.41 || >=5.2.24",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"@netlify/zip-it-and-ship-it": {
"name": "@netlify/zip-it-and-ship-it",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"@netlify/functions-utils",
"netlify-cli"
],
"range": "2.2.0 - 4.2.7 || >=9.17.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"@octokit/endpoint": {
"name": "@octokit/endpoint",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102258,
"name": "@octokit/endpoint",
"dependency": "@octokit/endpoint",
"title": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-x4c5-c7rf-jjgv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.0.5 <9.0.6"
}
],
"effects": [],
"range": "9.0.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/endpoint"
],
"fixAvailable": true
},
"@octokit/plugin-paginate-rest": {
"name": "@octokit/plugin-paginate-rest",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102899,
"name": "@octokit/plugin-paginate-rest",
"dependency": "@octokit/plugin-paginate-rest",
"title": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.3.0-beta.1 <11.4.1"
}
],
"effects": [
"@octokit/rest"
],
"range": "9.3.0-beta.1 - 11.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/plugin-paginate-rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"@octokit/request": {
"name": "@octokit/request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102896,
"name": "@octokit/request",
"dependency": "@octokit/request",
"title": "@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-rmvr-2pp2-xj38",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <8.4.1"
}
],
"effects": [],
"range": "<=8.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request"
],
"fixAvailable": true
},
"@octokit/request-error": {
"name": "@octokit/request-error",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102256,
"name": "@octokit/request-error",
"dependency": "@octokit/request-error",
"title": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-xx4v-prfh-6cgc",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <5.1.1"
}
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request-error"
],
"fixAvailable": true
},
"@octokit/rest": {
"name": "@octokit/rest",
"severity": "moderate",
"isDirect": false,
"via": [
"@octokit/plugin-paginate-rest"
],
"effects": [
"netlify-cli"
],
"range": "20.1.1 || 21.0.0-beta.1 - 21.0.0-beta.4",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1102472,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.8.2"
}
],
"effects": [
"wait-on"
],
"range": "<=1.8.1",
"nodes": [
"node_modules/wait-on/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"tsx",
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/esbuild",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/esbuild",
"node_modules/netlify-cli/node_modules/esbuild",
"node_modules/vite/node_modules/esbuild",
"node_modules/vitepress/node_modules/esbuild"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"@netlify/build",
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"@octokit/rest"
],
"effects": [],
"range": "3.8.2 - 3.29.14 || 3.37.7 - 3.37.26 || >=16.2.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "16.4.2",
"isSemVerMajor": true
}
},
"prismjs": {
"name": "prismjs",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1102459,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [],
"range": "<1.30.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "prismjs",
"version": "1.30.0",
"isSemVerMajor": false
}
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "high",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
},
"tsx": {
"name": "tsx",
"severity": "moderate",
"isDirect": true,
"via": [
"esbuild"
],
"effects": [],
"range": "3.13.0 - 4.19.2",
"nodes": [
"node_modules/tsx"
],
"fixAvailable": {
"name": "tsx",
"version": "4.19.3",
"isSemVerMajor": false
}
},
"undici": {
"name": "undici",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101609,
"name": "undici",
"dependency": "undici",
"title": "Use of Insufficiently Random Values in undici",
"url": "https://github.com/advisories/GHSA-c76h-2ccp-4975",
"severity": "moderate",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 6.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": ">=6.0.0 <6.21.1"
}
],
"effects": [],
"range": "6.0.0 - 6.21.0",
"nodes": [
"node_modules/undici"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1102437,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=5.0.0 <=5.4.11"
},
{
"source": 1102438,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <=6.0.8"
},
{
"source": 1103517,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=5.0.0 <5.4.15"
},
{
"source": 1103518,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.12"
},
"esbuild"
],
"effects": [],
"range": "0.11.0 - 6.1.2",
"nodes": [
"node_modules/vite",
"node_modules/vitepress/node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "6.2.3",
"isSemVerMajor": false
}
},
"wait-on": {
"name": "wait-on",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "2.0.11",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 17,
"high": 3,
"critical": 0,
"total": 20
},
"dependencies": {
"prod": 167,
"dev": 2468,
"optional": 234,
"peer": 84,
"peerOptional": 0,
"total": 2634
}
}
}
--- end ---
Attempting to npm audit fix
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1964, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1908, in run
self.npm_audit_fix(new_npm_audit)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 209, in npm_audit_fix
prior_lock = PackageLockJson()
^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 89, in __init__
self.data = load_ordered_json(self.fname)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/files.py", line 33, in load_ordered_json
with open(fname) as f:
^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'package-lock.json'