This run took 52 seconds.
$ date
--- stdout ---
Fri Dec 9 05:39:07 UTC 2022
--- end ---
$ git clone file:///srv/git/wikimedia-toolhub.git repo --depth=1 -b main
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/main
--- stdout ---
48342161a082239cec8111363a615f33694db86f refs/heads/main
--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@apollographql/graphql-upload-8-fork": {
"name": "@apollographql/graphql-upload-8-fork",
"severity": "high",
"isDirect": false,
"via": [
"busboy"
],
"effects": [
"apollo-server-core"
],
"range": "*",
"nodes": [
"node_modules/@apollographql/graphql-upload-8-fork"
],
"fixAvailable": true
},
"@vue/cli": {
"name": "@vue/cli",
"severity": "high",
"isDirect": true,
"via": [
"download-git-repo"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@vue/cli"
],
"fixAvailable": false
},
"@vue/cli-plugin-unit-mocha": {
"name": "@vue/cli-plugin-unit-mocha",
"severity": "moderate",
"isDirect": true,
"via": [
"mocha"
],
"effects": [],
"range": ">=5.0.0-alpha.0",
"nodes": [
"node_modules/@vue/cli-plugin-unit-mocha"
],
"fixAvailable": {
"name": "@vue/cli-plugin-unit-mocha",
"version": "4.5.19",
"isSemVerMajor": true
}
},
"@vue/cli-ui": {
"name": "@vue/cli-ui",
"severity": "high",
"isDirect": false,
"via": [
"apollo-server-express"
],
"effects": [],
"range": "5.0.0-alpha.0 - 5.0.6",
"nodes": [
"node_modules/@vue/cli-ui"
],
"fixAvailable": true
},
"ansi-regex": {
"name": "ansi-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1084695,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.0.1"
},
{
"source": 1084696,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.1.1"
},
{
"source": 1084697,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.0.1"
}
],
"effects": [],
"range": "3.0.0 || 4.0.0 - 4.1.0 || 5.0.0",
"nodes": [
"node_modules/ansi-regex",
"node_modules/inquirer/node_modules/ansi-regex",
"node_modules/log-update/node_modules/ansi-regex",
"node_modules/mocha/node_modules/ansi-regex",
"node_modules/nyc/node_modules/ansi-regex",
"node_modules/wide-align/node_modules/ansi-regex"
],
"fixAvailable": true
},
"apollo-server-core": {
"name": "apollo-server-core",
"severity": "high",
"isDirect": false,
"via": [
"@apollographql/graphql-upload-8-fork"
],
"effects": [
"apollo-server-express"
],
"range": "2.21.0-alpha.0 - 2.26.1",
"nodes": [
"node_modules/apollo-server-core"
],
"fixAvailable": true
},
"apollo-server-express": {
"name": "apollo-server-express",
"severity": "high",
"isDirect": false,
"via": [
"apollo-server-core"
],
"effects": [
"@vue/cli-ui"
],
"range": "2.0.1 || 2.21.0-alpha.0 - 2.26.1",
"nodes": [
"node_modules/apollo-server-express"
],
"fixAvailable": true
},
"async": {
"name": "async",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1070440,
"name": "async",
"dependency": "async",
"title": "Prototype Pollution in async",
"url": "https://github.com/advisories/GHSA-fwr7-v2mv-hh25",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.8,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
"range": ">=2.0.0 <2.6.4"
}
],
"effects": [],
"range": "2.0.0 - 2.6.3",
"nodes": [
"node_modules/portfinder/node_modules/async"
],
"fixAvailable": true
},
"busboy": {
"name": "busboy",
"severity": "high",
"isDirect": false,
"via": [
"dicer"
],
"effects": [
"@apollographql/graphql-upload-8-fork"
],
"range": "<=0.3.1",
"nodes": [
"node_modules/busboy"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1085062,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
"node_modules/decode-uri-component"
],
"fixAvailable": true
},
"dicer": {
"name": "dicer",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1070480,
"name": "dicer",
"dependency": "dicer",
"title": "Crash in HeaderParser in dicer",
"url": "https://github.com/advisories/GHSA-wm7h-9275-46v2",
"severity": "high",
"cwe": [
"CWE-248"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.3.1"
}
],
"effects": [
"busboy"
],
"range": "*",
"nodes": [
"node_modules/dicer"
],
"fixAvailable": true
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"download-git-repo"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/download"
],
"fixAvailable": false
},
"download-git-repo": {
"name": "download-git-repo",
"severity": "high",
"isDirect": false,
"via": [
"download",
"git-clone"
],
"effects": [
"@vue/cli"
],
"range": "*",
"nodes": [
"node_modules/download-git-repo"
],
"fixAvailable": false
},
"ejs": {
"name": "ejs",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1083256,
"name": "ejs",
"dependency": "ejs",
"title": "ejs template injection vulnerability",
"url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q",
"severity": "critical",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.1.7"
}
],
"effects": [],
"range": "<3.1.7",
"nodes": [
"node_modules/ejs"
],
"fixAvailable": true
},
"git-clone": {
"name": "git-clone",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1084214,
"name": "git-clone",
"dependency": "git-clone",
"title": "Command injection in git-clone",
"url": "https://github.com/advisories/GHSA-8jmw-wjr8-2x66",
"severity": "high",
"cwe": [
"CWE-74",
"CWE-78"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=0.2.0"
}
],
"effects": [
"download-git-repo"
],
"range": "*",
"nodes": [
"node_modules/git-clone"
],
"fixAvailable": false
},
"got": {
"name": "got",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1080920,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
}
],
"effects": [
"download"
],
"range": "<11.8.5",
"nodes": [
"node_modules/got"
],
"fixAvailable": false
},
"json-pointer": {
"name": "json-pointer",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1081493,
"name": "json-pointer",
"dependency": "json-pointer",
"title": "Prototype Pollution in json-pointer",
"url": "https://github.com/advisories/GHSA-v5vg-g7rq-363w",
"severity": "moderate",
"cwe": [
"CWE-843",
"CWE-1321"
],
"cvss": {
"score": 5.6,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<=0.6.1"
}
],
"effects": [],
"range": "<=0.6.1",
"nodes": [
"node_modules/json-pointer"
],
"fixAvailable": true
},
"loader-utils": {
"name": "loader-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1084924,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.4.1"
},
{
"source": 1084925,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=2.0.0 <2.0.3"
},
{
"source": 1084992,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1084993,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
},
{
"source": 1085033,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.4"
},
{
"source": 1085034,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
}
],
"effects": [],
"range": "<=1.4.1 || 2.0.0 - 2.0.3",
"nodes": [
"node_modules/loader-utils",
"node_modules/null-loader/node_modules/loader-utils",
"node_modules/thread-loader/node_modules/loader-utils",
"node_modules/vue-loader/node_modules/loader-utils",
"node_modules/vuetify-loader/node_modules/loader-utils"
],
"fixAvailable": true
},
"marked": {
"name": "marked",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1084667,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-5v2h-r2cx-5xgj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
},
{
"source": 1084668,
"name": "marked",
"dependency": "marked",
"title": "Inefficient Regular Expression Complexity in marked",
"url": "https://github.com/advisories/GHSA-rrrm-qjm4-v8hf",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.0.10"
}
],
"effects": [
"rapidoc"
],
"range": "<=4.0.9",
"nodes": [
"node_modules/marked"
],
"fixAvailable": true
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1084765,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"mocha"
],
"range": "<3.0.5",
"nodes": [
"node_modules/minimatch"
],
"fixAvailable": {
"name": "@vue/cli-plugin-unit-mocha",
"version": "4.5.19",
"isSemVerMajor": true
}
},
"minimist": {
"name": "minimist",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1067342,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.2.6"
}
],
"effects": [],
"range": "<1.2.6",
"nodes": [
"node_modules/minimist"
],
"fixAvailable": true
},
"mocha": {
"name": "mocha",
"severity": "high",
"isDirect": true,
"via": [
"minimatch",
"nanoid"
],
"effects": [
"@vue/cli-plugin-unit-mocha"
],
"range": "5.1.0 - 9.2.1",
"nodes": [
"node_modules/@vue/cli-plugin-unit-mocha/node_modules/mocha",
"node_modules/mocha"
],
"fixAvailable": {
"name": "@vue/cli-plugin-unit-mocha",
"version": "4.5.19",
"isSemVerMajor": true
}
},
"moment": {
"name": "moment",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1081763,
"name": "moment",
"dependency": "moment",
"title": "Path Traversal: 'dir/../../filename' in moment.locale",
"url": "https://github.com/advisories/GHSA-8hfj-j24r-96c4",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-27"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<2.29.2"
},
{
"source": 1084694,
"name": "moment",
"dependency": "moment",
"title": "Moment.js vulnerable to Inefficient Regular Expression Complexity",
"url": "https://github.com/advisories/GHSA-wc69-rhjr-hc9g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.18.0 <2.29.4"
}
],
"effects": [],
"range": "<=2.29.3",
"nodes": [
"node_modules/moment"
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1081481,
"name": "nanoid",
"dependency": "nanoid",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
"url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.31"
}
],
"effects": [
"mocha"
],
"range": "3.0.0 - 3.1.30",
"nodes": [
"node_modules/@vue/cli-plugin-unit-mocha/node_modules/nanoid"
],
"fixAvailable": {
"name": "@vue/cli-plugin-unit-mocha",
"version": "4.5.19",
"isSemVerMajor": true
}
},
"node-forge": {
"name": "node-forge",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1070354,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in `node-forge`",
"url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr",
"severity": "moderate",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<1.3.0"
},
{
"source": 1070355,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in node-forge",
"url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.3.0"
},
{
"source": 1070356,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in node-forge",
"url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.3.0"
}
],
"effects": [],
"range": "<=1.2.1",
"nodes": [
"node_modules/node-forge"
],
"fixAvailable": true
},
"prismjs": {
"name": "prismjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1067401,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-3949-f494-cm99",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
},
"range": ">=1.14.0 <1.27.0"
}
],
"effects": [],
"range": "1.14.0 - 1.26.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": true
},
"rapidoc": {
"name": "rapidoc",
"severity": "high",
"isDirect": true,
"via": [
"marked"
],
"effects": [],
"range": "<=9.1.3 || 9.1.5",
"nodes": [
"node_modules/rapidoc"
],
"fixAvailable": true
},
"shelljs": {
"name": "shelljs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1067444,
"name": "shelljs",
"dependency": "shelljs",
"title": "Improper Privilege Management in shelljs",
"url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6",
"severity": "high",
"cwe": [
"CWE-269"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
},
"range": "<0.8.5"
},
{
"source": 1067451,
"name": "shelljs",
"dependency": "shelljs",
"title": "Improper Privilege Management in shelljs",
"url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj",
"severity": "moderate",
"cwe": [
"CWE-269"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.8.5"
}
],
"effects": [],
"range": "<=0.8.4",
"nodes": [
"node_modules/shelljs"
],
"fixAvailable": true
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1081698,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.14.2"
}
],
"effects": [],
"range": "5.0.0 - 5.14.1",
"nodes": [
"node_modules/terser"
],
"fixAvailable": true
},
"vuetify": {
"name": "vuetify",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1084526,
"name": "vuetify",
"dependency": "vuetify",
"title": "Vuetify Cross-site Scripting vulnerability",
"url": "https://github.com/advisories/GHSA-q4q5-c5cv-2p68",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
},
"range": ">=2.0.0-beta.4 <2.6.10"
}
],
"effects": [],
"range": "2.0.0-beta.4 - 2.6.9",
"nodes": [
"node_modules/vuetify"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 6,
"high": 20,
"critical": 3,
"total": 30
},
"dependencies": {
"prod": 68,
"dev": 2087,
"optional": 3,
"peer": 3,
"peerOptional": 0,
"total": 2154
}
}
}
--- end ---
Upgrading n:grunt-banana-checker from ^0.9.0 -> 0.10.0
Upgrading n:stylelint from ^14.5.3 -> 14.14.0
Upgrading n:stylelint-config-wikimedia from ^0.12.2 -> 0.13.1
$ /usr/bin/npm install
--- stderr ---
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated apollo-tracing@0.15.0: The `apollo-tracing` package is no longer part of Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#tracing for details
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated graphql-extensions@0.15.0: The `graphql-extensions` API has been removed from Apollo Server 3. Use the plugin API instead: https://www.apollographql.com/docs/apollo-server/integrations/plugins/
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated apollo-cache-control@0.14.0: The functionality provided by the `apollo-cache-control` package is built in to `apollo-server-core` starting with Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#cachecontrol for details.
npm WARN deprecated subscriptions-transport-ws@0.9.19: The `subscriptions-transport-ws` package is no longer maintained. We recommend you use `graphql-ws` instead. For help migrating Apollo software to `graphql-ws`, see https://www.apollographql.com/docs/apollo-server/data/subscriptions/#switching-from-subscriptions-transport-ws For general help using `graphql-ws`, see https://github.com/enisdenjo/graphql-ws/blob/master/README.md
npm WARN deprecated graphql-tools@4.0.8: This package has been deprecated and now it only exports makeExecutableSchema.\nAnd it will no longer receive updates.\nWe recommend you to migrate to scoped packages such as @graphql-tools/schema, @graphql-tools/utils and etc.\nCheck out https://www.graphql-tools.com to learn what package you should use instead
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---
added 2164 packages, and audited 2165 packages in 21s
185 packages are looking for funding
run `npm fund` for details
30 vulnerabilities (1 low, 6 moderate, 20 high, 3 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ ./node_modules/.bin/stylelint vue/src/assets/styles/index.css toolhub/apps/crawler/static/css/admin.css static/css/oauth.css vue/static/vue/css/loading.css docs/_static/css/custom.css -f json
--- stderr ---
Error: Could not find "stylelint-config-wikimedia/grade-a". Do you need a `configBasedir`?
at configurationError (/src/repo/node_modules/stylelint/lib/utils/configurationError.js:11:49)
at getModulePath (/src/repo/node_modules/stylelint/lib/utils/getModulePath.js:28:9)
at loadExtendedConfig (/src/repo/node_modules/stylelint/lib/augmentConfig.js:230:21)
at extendConfig (/src/repo/node_modules/stylelint/lib/augmentConfig.js:201:30)
at augmentConfigBasic (/src/repo/node_modules/stylelint/lib/augmentConfig.js:52:26)
at augmentConfigFull (/src/repo/node_modules/stylelint/lib/augmentConfig.js:106:30)
at Object.transform (/src/repo/node_modules/stylelint/lib/getConfigForFile.js:51:37)
at run (/src/repo/node_modules/cosmiconfig/dist/Explorer.js:42:49)
at async cacheWrapper (/src/repo/node_modules/cosmiconfig/dist/cacheWrapper.js:16:18)
at async cacheWrapper (/src/repo/node_modules/cosmiconfig/dist/cacheWrapper.js:16:18)
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade
hook(update)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1081, in _handle_stylelint
errors = json.loads(self.check_call(['./node_modules/.bin/stylelint'] + files + [
File "/usr/lib/python3.9/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3.9/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)