log #522771 - libup

$ date
Thu Nov  4 17:56:01 UTC 2021

$ git clone file:///srv/git/mediawiki-extensions-Newsletter.git repo --depth=1 -b REL1_37
Cloning into 'repo'...

$ git config user.name libraryupgrader

$ git config user.email tools.libraryupgrader@tools.wmflabs.org

$ git submodule update --init

$ grr init
Installed commit-msg hook.

$ git show-ref refs/heads/REL1_37
a4dd44a1375a472e3a2cb4960abcf1cef4be4297 refs/heads/REL1_37

$ composer install
Loading composer repositories with package information
Warning from https://repo.packagist.org: Support for Composer 1 is deprecated and some packages will not be available. You should upgrade to Composer 2. See https://blog.packagist.com/deprecating-composer-1-support/
Updating dependencies (including require-dev)
Package operations: 34 installs, 0 updates, 0 removals
  - Installing squizlabs/php_codesniffer (3.6.0): Loading from cache
  - Installing sebastian/diff (3.0.3): Loading from cache
  - Installing composer/spdx-licenses (1.5.5): Loading from cache
  - Installing composer/semver (3.2.6): Loading from cache
  - Installing mediawiki/mediawiki-codesniffer (v37.0.0): Loading from cache
  - Installing tysonandre/var_representation_polyfill (0.1.1): Loading from cache
  - Installing symfony/polyfill-php80 (v1.23.1): Loading from cache
  - Installing symfony/polyfill-mbstring (v1.23.1): Loading from cache
  - Installing symfony/polyfill-intl-normalizer (v1.23.0): Loading from cache
  - Installing symfony/polyfill-intl-grapheme (v1.23.1): Loading from cache
  - Installing symfony/polyfill-ctype (v1.23.0): Loading from cache
  - Installing symfony/string (v5.3.10): Loading from cache
  - Installing psr/container (1.1.1): Loading from cache
  - Installing symfony/service-contracts (v2.4.0): Loading from cache
  - Installing symfony/polyfill-php73 (v1.23.0): Loading from cache
  - Installing symfony/deprecation-contracts (v2.4.0): Loading from cache
  - Installing symfony/console (v5.3.10): Loading from cache
  - Installing psr/log (1.1.4): Loading from cache
  - Installing sabre/event (5.1.4): Loading from cache
  - Installing netresearch/jsonmapper (v4.0.0): Loading from cache
  - Installing microsoft/tolerant-php-parser (v0.1.1): Loading from cache
  - Installing phpdocumentor/reflection-common (2.2.0): Loading from cache
  - Installing webmozart/assert (1.10.0): Loading from cache
  - Installing phpdocumentor/type-resolver (1.5.1): Loading from cache
  - Installing phpdocumentor/reflection-docblock (5.3.0): Loading from cache
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Loading from cache
  - Installing composer/xdebug-handler (2.0.2): Loading from cache
  - Installing phan/phan (5.2.0): Loading from cache
  - Installing mediawiki/phan-taint-check-plugin (3.3.2): Loading from cache
  - Installing mediawiki/mediawiki-phan-config (0.11.0): Loading from cache
  - Installing mediawiki/minus-x (1.1.1): Loading from cache
  - Installing php-parallel-lint/php-console-color (v0.3): Loading from cache
  - Installing php-parallel-lint/php-console-highlighter (v0.5): Loading from cache
  - Installing php-parallel-lint/php-parallel-lint (v1.3.1): Loading from cache
tysonandre/var_representation_polyfill suggests installing ext-var_representation (*)
symfony/service-contracts suggests installing symfony/service-implementation
symfony/console suggests installing symfony/event-dispatcher
symfony/console suggests installing symfony/lock
symfony/console suggests installing symfony/process
phan/phan suggests installing ext-ast (Needed for parsing ASTs (unless --use-fallback-parser is used). 1.0.1+ is needed, 1.0.14+ is recommended.)
phan/phan suggests installing ext-var_representation (Suggested for converting values to strings in issue messages)
Writing lock file
Generating autoload files
14 packages you are using are looking for funding.
Use the `composer fund` command to find out more!

Attempting to npm audit fix
$ npm audit fix --only=dev

> fibers@5.0.0 install /src/repo/node_modules/fibers
> node build.js || nodejs build.js

make: Entering directory '/src/repo/node_modules/fibers/build'
  CXX(target) Release/obj.target/fibers/src/fibers.o
../src/fibers.cc: In function ‘void uni::SetAccessor(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::String>, uni::FunctionType (*)(v8::Local<v8::String>, const GetterCallbackInfo&), void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const SetterCallbackInfo&))’:
../src/fibers.cc:355:87: warning: cast between incompatible function types from ‘uni::FunctionType (*)(v8::Local<v8::String>, const GetterCallbackInfo&)’ {aka ‘void (*)(v8::Local<v8::String>, const v8::PropertyCallbackInfo<v8::Value>&)’} to ‘v8::AccessorNameGetterCallback’ {aka ‘void (*)(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>&)’} [-Wcast-function-type]
   object->SetAccessor(isolate->GetCurrentContext(), name, (AccessorNameGetterCallback)getter, (AccessorNameSetterCallback)setter).ToChecked();
                                                                                       ^~~~~~
../src/fibers.cc:355:123: warning: cast between incompatible function types from ‘void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const SetterCallbackInfo&)’ {aka ‘void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&)’} to ‘v8::AccessorNameSetterCallback’ {aka ‘void (*)(v8::Local<v8::Name>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&)’} [-Wcast-function-type]
   object->SetAccessor(isolate->GetCurrentContext(), name, (AccessorNameGetterCallback)getter, (AccessorNameSetterCallback)setter).ToChecked();
                                                                                                                           ^~~~~~
In file included from ../src/coroutine.h:1,
                 from ../src/fibers.cc:1:
../src/fibers.cc: At global scope:
/cache/node-gyp/10.24.0/include/node/node.h:573:43: warning: cast between incompatible function types from ‘void (*)(v8::Local<v8::Object>)’ to ‘node::addon_register_func’ {aka ‘void (*)(v8::Local<v8::Object>, v8::Local<v8::Value>, void*)’} [-Wcast-function-type]
       (node::addon_register_func) (regfunc),                          \
                                           ^
/cache/node-gyp/10.24.0/include/node/node.h:607:3: note: in expansion of macro ‘NODE_MODULE_X’
   NODE_MODULE_X(modname, regfunc, NULL, 0)  // NOLINT (readability/null_usage)
   ^~~~~~~~~~~~~
../src/fibers.cc:930:1: note: in expansion of macro ‘NODE_MODULE’
 NODE_MODULE(fibers, init)
 ^~~~~~~~~~~
  CXX(target) Release/obj.target/fibers/src/coroutine.o
  CC(target) Release/obj.target/fibers/src/libcoro/coro.o
  SOLINK_MODULE(target) Release/obj.target/fibers.node
  COPY Release/fibers.node
make: Leaving directory '/src/repo/node_modules/fibers/build'
Installed in `/src/repo/node_modules/fibers/bin/linux-x64-64-glibc/fibers.node`

> core-js@3.13.0 postinstall /src/repo/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"

[96mThank you for using core-js ([94m https://github.com/zloirock/core-js [96m) for polyfilling JavaScript standard library![0m

[96mThe project needs your help! Please consider supporting of core-js on Open Collective or Patreon: [0m
[96m>[94m https://opencollective.com/core-js [0m
[96m>[94m https://www.patreon.com/zloirock [0m

[96mAlso, the author of core-js ([94m https://github.com/zloirock [96m) is looking for a good job -)[0m


> core-js-pure@3.14.0 postinstall /src/repo/node_modules/core-js-pure
> node -e "try{require('./postinstall')}catch(e){}"

npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@2.3.2 (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

added 904 packages from 734 contributors in 23.849s

110 packages are looking for funding
  run `npm fund` for details

fixed 1 of 1 vulnerability in 906 scanned packages

$ npm audit fix --only=dev
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@2.3.2 (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

up to date in 16.293s

110 packages are looking for funding
  run `npm fund` for details

fixed 0 of 0 vulnerabilities in 906 scanned packages

$ npm audit fix --only=dev
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@2.3.2 (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

up to date in 5.24s

110 packages are looking for funding
  run `npm fund` for details

fixed 0 of 0 vulnerabilities in 906 scanned packages

$ package-lock-lint package-lock.json
Checking package-lock.json

Verifying that tests still pass
$ npm ci
npm WARN prepare removing existing node_modules/ before installation

> core-js-pure@3.14.0 postinstall /src/repo/node_modules/core-js-pure
> node -e "try{require('./postinstall')}catch(e){}"


> core-js@3.13.0 postinstall /src/repo/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"


> fibers@5.0.0 install /src/repo/node_modules/fibers
> node build.js || nodejs build.js

make: Entering directory '/src/repo/node_modules/fibers/build'
  CXX(target) Release/obj.target/fibers/src/fibers.o
../src/fibers.cc: In function ‘void uni::SetAccessor(v8::Isolate*, v8::Local<v8::Object>, v8::Local<v8::String>, uni::FunctionType (*)(v8::Local<v8::String>, const GetterCallbackInfo&), void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const SetterCallbackInfo&))’:
../src/fibers.cc:355:87: warning: cast between incompatible function types from ‘uni::FunctionType (*)(v8::Local<v8::String>, const GetterCallbackInfo&)’ {aka ‘void (*)(v8::Local<v8::String>, const v8::PropertyCallbackInfo<v8::Value>&)’} to ‘v8::AccessorNameGetterCallback’ {aka ‘void (*)(v8::Local<v8::Name>, const v8::PropertyCallbackInfo<v8::Value>&)’} [-Wcast-function-type]
   object->SetAccessor(isolate->GetCurrentContext(), name, (AccessorNameGetterCallback)getter, (AccessorNameSetterCallback)setter).ToChecked();
                                                                                       ^~~~~~
../src/fibers.cc:355:123: warning: cast between incompatible function types from ‘void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const SetterCallbackInfo&)’ {aka ‘void (*)(v8::Local<v8::String>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&)’} to ‘v8::AccessorNameSetterCallback’ {aka ‘void (*)(v8::Local<v8::Name>, v8::Local<v8::Value>, const v8::PropertyCallbackInfo<void>&)’} [-Wcast-function-type]
   object->SetAccessor(isolate->GetCurrentContext(), name, (AccessorNameGetterCallback)getter, (AccessorNameSetterCallback)setter).ToChecked();
                                                                                                                           ^~~~~~
In file included from ../src/coroutine.h:1,
                 from ../src/fibers.cc:1:
../src/fibers.cc: At global scope:
/cache/node-gyp/10.24.0/include/node/node.h:573:43: warning: cast between incompatible function types from ‘void (*)(v8::Local<v8::Object>)’ to ‘node::addon_register_func’ {aka ‘void (*)(v8::Local<v8::Object>, v8::Local<v8::Value>, void*)’} [-Wcast-function-type]
       (node::addon_register_func) (regfunc),                          \
                                           ^
/cache/node-gyp/10.24.0/include/node/node.h:607:3: note: in expansion of macro ‘NODE_MODULE_X’
   NODE_MODULE_X(modname, regfunc, NULL, 0)  // NOLINT (readability/null_usage)
   ^~~~~~~~~~~~~
../src/fibers.cc:930:1: note: in expansion of macro ‘NODE_MODULE’
 NODE_MODULE(fibers, init)
 ^~~~~~~~~~~
  CXX(target) Release/obj.target/fibers/src/coroutine.o
  CC(target) Release/obj.target/fibers/src/libcoro/coro.o
  SOLINK_MODULE(target) Release/obj.target/fibers.node
  COPY Release/fibers.node
make: Leaving directory '/src/repo/node_modules/fibers/build'
Installed in `/src/repo/node_modules/fibers/bin/linux-x64-64-glibc/fibers.node`
added 905 packages in 18.925s

$ npm test

> @ test /src/repo
> grunt test

Running "eslint:all" (eslint) task

Running "banana:Newsletter" (banana) task
>> 2 message directories checked.

Running "stylelint:all" (stylelint) task
>> Linted 2 files without errors

Done.

Upgrading n:validator from 13.6.0 -> 13.7.0
$ package-lock-lint package-lock.json
Checking package-lock.json

$ git add .

$ git commit -F /tmp/tmpwl4766nl
[REL1_37 468633a] build: Updating validator to 13.7.0
 1 file changed, 3 insertions(+), 3 deletions(-)

$ git format-patch HEAD~1 --stdout
From 468633af7d894dccc24b598877c154c56cd11de2 Mon Sep 17 00:00:00 2001
From: libraryupgrader <tools.libraryupgrader@tools.wmflabs.org>
Date: Thu, 4 Nov 2021 17:58:33 +0000
Subject: [PATCH] build: Updating validator to 13.7.0

* https://npmjs.com/advisories/1004784 (CVE-2021-3765)

Change-Id: I6f66386552d12ad71c4bf016004c674aeec95d97
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f1bbfa3..99f0d66 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7523,9 +7523,9 @@
 			}
 		},
 		"validator": {
-			"version": "13.6.0",
-			"resolved": "https://registry.npmjs.org/validator/-/validator-13.6.0.tgz",
-			"integrity": "sha512-gVgKbdbHgtxpRyR8K0O6oFZPhhB5tT1jeEHZR0Znr9Svg03U0+r9DXWMrnRAB+HtCStDQKlaIZm42tVsVjqtjg==",
+			"version": "13.7.0",
+			"resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
+			"integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
 			"dev": true
 		},
 		"verror": {
-- 
2.20.1
mediawiki/extensions/Newsletter: REL1_37 (log #522771)
