This run took 109 seconds.
$ date
--- stdout ---
Thu Jan 19 13:37:23 UTC 2023
--- end ---
$ git clone file:///srv/git/wikidata-query-builder.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
c0dbe7ce9cd25ffbcdc2dafd2df2ba19e0633a73 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@netlify/build": {
"name": "@netlify/build",
"severity": "high",
"isDirect": false,
"via": [
"@netlify/cache-utils",
"@netlify/functions-utils",
"got",
"update-notifier"
],
"effects": [
"netlify-cli"
],
"range": ">=0.1.31",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": true
},
"@netlify/cache-utils": {
"name": "@netlify/cache-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/cache-utils"
],
"fixAvailable": true
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": true
},
"all-node-versions": {
"name": "all-node-versions",
"severity": "moderate",
"isDirect": false,
"via": [
"fetch-node-website"
],
"effects": [
"node-version-alias",
"normalize-node-version"
],
"range": "2.0.0 - 8.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/all-node-versions"
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "high",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@netlify/cache-utils",
"@netlify/functions-utils"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1087979,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
"node_modules/netlify-cli/node_modules/decode-uri-component"
],
"fixAvailable": true
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"gh-release-fetch"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/download"
],
"fixAvailable": true
},
"fast-glob": {
"name": "fast-glob",
"severity": "high",
"isDirect": false,
"via": [
"glob-parent"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/fast-glob"
],
"fixAvailable": true
},
"fetch-node-website": {
"name": "fetch-node-website",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"all-node-versions"
],
"range": "2.0.0 - 5.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/fetch-node-website"
],
"fixAvailable": true
},
"formidable": {
"name": "formidable",
"severity": "high",
"isDirect": false,
"via": [
"qs"
],
"effects": [],
"range": "2.0.0-canary.20200129.2 - 2.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/formidable"
],
"fixAvailable": true
},
"gh-release-fetch": {
"name": "gh-release-fetch",
"severity": "moderate",
"isDirect": false,
"via": [
"download"
],
"effects": [
"netlify-cli"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/gh-release-fetch"
],
"fixAvailable": true
},
"glob-parent": {
"name": "glob-parent",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088261,
"name": "glob-parent",
"dependency": "glob-parent",
"title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
"url": "https://github.com/advisories/GHSA-ww39-953v-wcq6",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.1.2"
}
],
"effects": [
"fast-glob"
],
"range": "<5.1.2",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/glob-parent"
],
"fixAvailable": true
},
"globby": {
"name": "globby",
"severity": "high",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/globby"
],
"fixAvailable": true
},
"got": {
"name": "got",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088468,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
}
],
"effects": [
"@netlify/build",
"download",
"fetch-node-website",
"package-json"
],
"range": "<11.8.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/got",
"node_modules/netlify-cli/node_modules/download/node_modules/got",
"node_modules/netlify-cli/node_modules/fetch-node-website/node_modules/got",
"node_modules/netlify-cli/node_modules/package-json/node_modules/got"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088341,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1088342,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"node_modules/json5",
"node_modules/netlify-cli/node_modules/json5",
"node_modules/netlify-cli/node_modules/tsconfig-paths/node_modules/json5"
],
"fixAvailable": true
},
"jsonwebtoken": {
"name": "jsonwebtoken",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1085321,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC",
"url": "https://github.com/advisories/GHSA-hjrf-2m68-5959",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-1259"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<=8.5.1"
},
{
"source": 1085403,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ",
"url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33",
"severity": "moderate",
"cwe": [
"CWE-327"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=8.5.1"
},
{
"source": 1087848,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()",
"url": "https://github.com/advisories/GHSA-qwph-4952-7xr6",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-327"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<9.0.0"
},
{
"source": 1088370,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken has insecure input validation in jwt.verify function",
"url": "https://github.com/advisories/GHSA-27h2-hvpr-p74q",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<=8.5.1"
}
],
"effects": [
"netlify-cli",
"verdaccio"
],
"range": "<=8.5.1",
"nodes": [
"node_modules/netlify-cli/node_modules/jsonwebtoken"
],
"fixAvailable": true
},
"latest-version": {
"name": "latest-version",
"severity": "moderate",
"isDirect": false,
"via": [
"package-json"
],
"effects": [
"update-notifier"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/latest-version"
],
"fixAvailable": true
},
"luxon": {
"name": "luxon",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1087862,
"name": "luxon",
"dependency": "luxon",
"title": "Luxon Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-3xq5-wjfh-ppjc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.2.1"
}
],
"effects": [],
"range": "3.0.0 - 3.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/luxon"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"@netlify/build",
"gh-release-fetch",
"jsonwebtoken",
"node-version-alias"
],
"effects": [],
"range": ">=2.13.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": true
},
"node-version-alias": {
"name": "node-version-alias",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions",
"normalize-node-version"
],
"effects": [
"netlify-cli"
],
"range": "<=1.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/node-version-alias"
],
"fixAvailable": true
},
"normalize-node-version": {
"name": "normalize-node-version",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions"
],
"effects": [],
"range": "2.0.0 - 10.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/normalize-node-version"
],
"fixAvailable": true
},
"package-json": {
"name": "package-json",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"latest-version"
],
"range": "<=6.5.0",
"nodes": [
"node_modules/netlify-cli/node_modules/package-json"
],
"fixAvailable": true
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088643,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.9.0 <6.9.7"
}
],
"effects": [
"formidable"
],
"range": "6.9.0 - 6.9.6",
"nodes": [
"node_modules/netlify-cli/node_modules/formidable/node_modules/qs"
],
"fixAvailable": true
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088439,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.14.2"
}
],
"effects": [],
"range": "5.0.0 - 5.14.1",
"nodes": [
"node_modules/terser"
],
"fixAvailable": true
},
"update-notifier": {
"name": "update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"latest-version"
],
"effects": [
"@netlify/build"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/update-notifier"
],
"fixAvailable": true
},
"verdaccio": {
"name": "verdaccio",
"severity": "moderate",
"isDirect": false,
"via": [
"jsonwebtoken"
],
"effects": [],
"range": "2.2.7-r - 5.18.0",
"nodes": [
"node_modules/netlify-cli/node_modules/verdaccio"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1088406,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
}
],
"effects": [],
"range": "<2.9.13",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.15",
"isSemVerMajor": false
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 13,
"high": 13,
"critical": 0,
"total": 27
},
"dependencies": {
"prod": 736,
"dev": 2586,
"optional": 46,
"peer": 64,
"peerOptional": 0,
"total": 3321
}
}
}
--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@netlify/build": {
"name": "@netlify/build",
"severity": "high",
"isDirect": false,
"via": [
"@netlify/cache-utils",
"@netlify/functions-utils",
"got",
"update-notifier"
],
"effects": [
"netlify-cli"
],
"range": ">=0.1.31",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": true
},
"@netlify/cache-utils": {
"name": "@netlify/cache-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/cache-utils"
],
"fixAvailable": true
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": true
},
"all-node-versions": {
"name": "all-node-versions",
"severity": "moderate",
"isDirect": false,
"via": [
"fetch-node-website"
],
"effects": [
"node-version-alias",
"normalize-node-version"
],
"range": "2.0.0 - 8.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/all-node-versions"
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "high",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@netlify/cache-utils",
"@netlify/functions-utils"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy"
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1087979,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
"node_modules/netlify-cli/node_modules/decode-uri-component"
],
"fixAvailable": true
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"gh-release-fetch"
],
"range": ">=4.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/download"
],
"fixAvailable": true
},
"fast-glob": {
"name": "fast-glob",
"severity": "high",
"isDirect": false,
"via": [
"glob-parent"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/fast-glob"
],
"fixAvailable": true
},
"fetch-node-website": {
"name": "fetch-node-website",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"all-node-versions"
],
"range": "2.0.0 - 5.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/fetch-node-website"
],
"fixAvailable": true
},
"formidable": {
"name": "formidable",
"severity": "high",
"isDirect": false,
"via": [
"qs"
],
"effects": [],
"range": "2.0.0-canary.20200129.2 - 2.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/formidable"
],
"fixAvailable": true
},
"gh-release-fetch": {
"name": "gh-release-fetch",
"severity": "moderate",
"isDirect": false,
"via": [
"download"
],
"effects": [
"netlify-cli"
],
"range": "*",
"nodes": [
"node_modules/netlify-cli/node_modules/gh-release-fetch"
],
"fixAvailable": true
},
"glob-parent": {
"name": "glob-parent",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088261,
"name": "glob-parent",
"dependency": "glob-parent",
"title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
"url": "https://github.com/advisories/GHSA-ww39-953v-wcq6",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.1.2"
}
],
"effects": [
"fast-glob"
],
"range": "<5.1.2",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/glob-parent"
],
"fixAvailable": true
},
"globby": {
"name": "globby",
"severity": "high",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/cpy/node_modules/globby"
],
"fixAvailable": true
},
"got": {
"name": "got",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088468,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
}
],
"effects": [
"@netlify/build",
"download",
"fetch-node-website",
"package-json"
],
"range": "<11.8.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/got",
"node_modules/netlify-cli/node_modules/download/node_modules/got",
"node_modules/netlify-cli/node_modules/fetch-node-website/node_modules/got",
"node_modules/netlify-cli/node_modules/package-json/node_modules/got"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088341,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1088342,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"node_modules/json5",
"node_modules/netlify-cli/node_modules/json5",
"node_modules/netlify-cli/node_modules/tsconfig-paths/node_modules/json5"
],
"fixAvailable": true
},
"jsonwebtoken": {
"name": "jsonwebtoken",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1085321,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC",
"url": "https://github.com/advisories/GHSA-hjrf-2m68-5959",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-1259"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<=8.5.1"
},
{
"source": 1085403,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ",
"url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33",
"severity": "moderate",
"cwe": [
"CWE-327"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=8.5.1"
},
{
"source": 1087848,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()",
"url": "https://github.com/advisories/GHSA-qwph-4952-7xr6",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-327"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<9.0.0"
},
{
"source": 1088370,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken has insecure input validation in jwt.verify function",
"url": "https://github.com/advisories/GHSA-27h2-hvpr-p74q",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<=8.5.1"
}
],
"effects": [
"netlify-cli",
"verdaccio"
],
"range": "<=8.5.1",
"nodes": [
"node_modules/netlify-cli/node_modules/jsonwebtoken"
],
"fixAvailable": true
},
"latest-version": {
"name": "latest-version",
"severity": "moderate",
"isDirect": false,
"via": [
"package-json"
],
"effects": [
"update-notifier"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/latest-version"
],
"fixAvailable": true
},
"luxon": {
"name": "luxon",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1087862,
"name": "luxon",
"dependency": "luxon",
"title": "Luxon Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-3xq5-wjfh-ppjc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.2.1"
}
],
"effects": [],
"range": "3.0.0 - 3.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/luxon"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": true,
"via": [
"@netlify/build",
"gh-release-fetch",
"jsonwebtoken",
"node-version-alias"
],
"effects": [],
"range": ">=2.13.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": true
},
"node-version-alias": {
"name": "node-version-alias",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions",
"normalize-node-version"
],
"effects": [
"netlify-cli"
],
"range": "<=1.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/node-version-alias"
],
"fixAvailable": true
},
"normalize-node-version": {
"name": "normalize-node-version",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions"
],
"effects": [],
"range": "2.0.0 - 10.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/normalize-node-version"
],
"fixAvailable": true
},
"package-json": {
"name": "package-json",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"latest-version"
],
"range": "<=6.5.0",
"nodes": [
"node_modules/netlify-cli/node_modules/package-json"
],
"fixAvailable": true
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088643,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.9.0 <6.9.7"
}
],
"effects": [
"formidable"
],
"range": "6.9.0 - 6.9.6",
"nodes": [
"node_modules/netlify-cli/node_modules/formidable/node_modules/qs"
],
"fixAvailable": true
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088439,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.14.2"
}
],
"effects": [],
"range": "5.0.0 - 5.14.1",
"nodes": [
"node_modules/terser"
],
"fixAvailable": true
},
"update-notifier": {
"name": "update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"latest-version"
],
"effects": [
"@netlify/build"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/update-notifier"
],
"fixAvailable": true
},
"verdaccio": {
"name": "verdaccio",
"severity": "moderate",
"isDirect": false,
"via": [
"jsonwebtoken"
],
"effects": [],
"range": "2.2.7-r - 5.18.0",
"nodes": [
"node_modules/netlify-cli/node_modules/verdaccio"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1088406,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
}
],
"effects": [],
"range": "<2.9.13",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.15",
"isSemVerMajor": false
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 13,
"high": 13,
"critical": 0,
"total": 27
},
"dependencies": {
"prod": 736,
"dev": 2586,
"optional": 46,
"peer": 64,
"peerOptional": 0,
"total": 3321
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json --legacy-peer-deps
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
--- stdout ---
{
"added": 1165,
"removed": 0,
"changed": 0,
"audited": 2657,
"funding": 283,
"audit": {
"auditReportVersion": 2,
"vulnerabilities": {
"@netlify/build": {
"name": "@netlify/build",
"severity": "high",
"isDirect": false,
"via": [
"@netlify/cache-utils",
"@netlify/functions-utils",
"got",
"update-notifier"
],
"effects": [
"netlify-cli"
],
"range": ">=0.1.31",
"nodes": [
""
],
"fixAvailable": true
},
"@netlify/cache-utils": {
"name": "@netlify/cache-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": true
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "high",
"isDirect": false,
"via": [
"cpy"
],
"effects": [
"@netlify/build"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": true
},
"all-node-versions": {
"name": "all-node-versions",
"severity": "moderate",
"isDirect": false,
"via": [
"fetch-node-website"
],
"effects": [
"node-version-alias",
"normalize-node-version"
],
"range": "2.0.0 - 8.0.0",
"nodes": [
""
],
"fixAvailable": true
},
"cpy": {
"name": "cpy",
"severity": "high",
"isDirect": false,
"via": [
"globby"
],
"effects": [
"@netlify/cache-utils",
"@netlify/functions-utils"
],
"range": "7.0.0 - 8.1.2",
"nodes": [
""
],
"fixAvailable": true
},
"decode-uri-component": {
"name": "decode-uri-component",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1087979,
"name": "decode-uri-component",
"dependency": "decode-uri-component",
"title": "decode-uri-component vulnerable to Denial of Service (DoS)",
"url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.2.1"
}
],
"effects": [],
"range": "<0.2.1",
"nodes": [
""
],
"fixAvailable": true
},
"download": {
"name": "download",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"gh-release-fetch"
],
"range": ">=4.0.0",
"nodes": [
""
],
"fixAvailable": true
},
"fast-glob": {
"name": "fast-glob",
"severity": "high",
"isDirect": false,
"via": [
"glob-parent"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
""
],
"fixAvailable": true
},
"fetch-node-website": {
"name": "fetch-node-website",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"all-node-versions"
],
"range": "2.0.0 - 5.0.3",
"nodes": [
""
],
"fixAvailable": true
},
"formidable": {
"name": "formidable",
"severity": "high",
"isDirect": false,
"via": [
"qs"
],
"effects": [],
"range": "2.0.0-canary.20200129.2 - 2.0.1",
"nodes": [
""
],
"fixAvailable": true
},
"gh-release-fetch": {
"name": "gh-release-fetch",
"severity": "moderate",
"isDirect": false,
"via": [
"download"
],
"effects": [
"netlify-cli"
],
"range": "*",
"nodes": [
""
],
"fixAvailable": true
},
"glob-parent": {
"name": "glob-parent",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088261,
"name": "glob-parent",
"dependency": "glob-parent",
"title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
"url": "https://github.com/advisories/GHSA-ww39-953v-wcq6",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.1.2"
}
],
"effects": [
"fast-glob"
],
"range": "<5.1.2",
"nodes": [
""
],
"fixAvailable": true
},
"globby": {
"name": "globby",
"severity": "high",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"cpy"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
""
],
"fixAvailable": true
},
"got": {
"name": "got",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1088468,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
}
],
"effects": [
"@netlify/build",
"download",
"fetch-node-website",
"package-json"
],
"range": "<11.8.5",
"nodes": [
"",
"",
"node_modules/got",
"node_modules/got"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1088341,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": "<1.0.2"
},
{
"source": 1088342,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "<1.0.2 || >=2.0.0 <2.2.2",
"nodes": [
"",
"",
"node_modules/json5"
],
"fixAvailable": true
},
"jsonwebtoken": {
"name": "jsonwebtoken",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1085321,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC",
"url": "https://github.com/advisories/GHSA-hjrf-2m68-5959",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-1259"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<=8.5.1"
},
{
"source": 1085403,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ",
"url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33",
"severity": "moderate",
"cwe": [
"CWE-327"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=8.5.1"
},
{
"source": 1087848,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()",
"url": "https://github.com/advisories/GHSA-qwph-4952-7xr6",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-327"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<9.0.0"
},
{
"source": 1088370,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken has insecure input validation in jwt.verify function",
"url": "https://github.com/advisories/GHSA-27h2-hvpr-p74q",
"severity": "high",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 7.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<=8.5.1"
}
],
"effects": [
"netlify-cli",
"verdaccio"
],
"range": "<=8.5.1",
"nodes": [
""
],
"fixAvailable": true
},
"latest-version": {
"name": "latest-version",
"severity": "moderate",
"isDirect": false,
"via": [
"package-json"
],
"effects": [
"update-notifier"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
""
],
"fixAvailable": true
},
"luxon": {
"name": "luxon",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1087862,
"name": "luxon",
"dependency": "luxon",
"title": "Luxon Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-3xq5-wjfh-ppjc",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.2.1"
}
],
"effects": [],
"range": "3.0.0 - 3.2.0",
"nodes": [
""
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/build",
"gh-release-fetch",
"jsonwebtoken",
"node-version-alias"
],
"effects": [],
"range": ">=2.13.0",
"nodes": [
""
],
"fixAvailable": true
},
"node-version-alias": {
"name": "node-version-alias",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions",
"normalize-node-version"
],
"effects": [
"netlify-cli"
],
"range": "<=1.0.1",
"nodes": [
""
],
"fixAvailable": true
},
"normalize-node-version": {
"name": "normalize-node-version",
"severity": "moderate",
"isDirect": false,
"via": [
"all-node-versions"
],
"effects": [],
"range": "2.0.0 - 10.0.0",
"nodes": [
""
],
"fixAvailable": true
},
"package-json": {
"name": "package-json",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"latest-version"
],
"range": "<=6.5.0",
"nodes": [
""
],
"fixAvailable": true
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1088643,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.9.0 <6.9.7"
}
],
"effects": [
"formidable"
],
"range": "6.9.0 - 6.9.6",
"nodes": [
"node_modules/qs"
],
"fixAvailable": true
},
"terser": {
"name": "terser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088439,
"name": "terser",
"dependency": "terser",
"title": "Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS",
"url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc",
"severity": "high",
"cwe": [],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.14.2"
}
],
"effects": [],
"range": "5.0.0 - 5.14.1",
"nodes": [
""
],
"fixAvailable": true
},
"update-notifier": {
"name": "update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"latest-version"
],
"effects": [
"@netlify/build"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
""
],
"fixAvailable": true
},
"verdaccio": {
"name": "verdaccio",
"severity": "moderate",
"isDirect": false,
"via": [
"jsonwebtoken"
],
"effects": [],
"range": "2.2.7-r - 5.18.0",
"nodes": [
""
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1088406,
"name": "vite",
"dependency": "vite",
"title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service",
"url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
"range": "<2.9.13"
}
],
"effects": [],
"range": "<2.9.13",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "2.9.15",
"isSemVerMajor": false
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 13,
"high": 13,
"critical": 0,
"total": 27
},
"dependencies": {
"prod": 96,
"dev": 2561,
"optional": 39,
"peer": 0,
"peerOptional": 0,
"total": 2656
}
}
}
}
--- end ---
{"added": 1165, "removed": 0, "changed": 0, "audited": 2657, "funding": 283, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@netlify/build": {"name": "@netlify/build", "severity": "high", "isDirect": false, "via": ["@netlify/cache-utils", "@netlify/functions-utils", "got", "update-notifier"], "effects": ["netlify-cli"], "range": ">=0.1.31", "nodes": [""], "fixAvailable": true}, "@netlify/cache-utils": {"name": "@netlify/cache-utils", "severity": "high", "isDirect": false, "via": ["cpy"], "effects": ["@netlify/build"], "range": "*", "nodes": [""], "fixAvailable": true}, "@netlify/functions-utils": {"name": "@netlify/functions-utils", "severity": "high", "isDirect": false, "via": ["cpy"], "effects": ["@netlify/build"], "range": "*", "nodes": [""], "fixAvailable": true}, "all-node-versions": {"name": "all-node-versions", "severity": "moderate", "isDirect": false, "via": ["fetch-node-website"], "effects": ["node-version-alias", "normalize-node-version"], "range": "2.0.0 - 8.0.0", "nodes": [""], "fixAvailable": true}, "cpy": {"name": "cpy", "severity": "high", "isDirect": false, "via": ["globby"], "effects": ["@netlify/cache-utils", "@netlify/functions-utils"], "range": "7.0.0 - 8.1.2", "nodes": [""], "fixAvailable": true}, "decode-uri-component": {"name": "decode-uri-component", "severity": "low", "isDirect": false, "via": [{"source": 1087979, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to Denial of Service (DoS)", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "severity": "low", "cwe": ["CWE-20"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.2.1"}], "effects": [], "range": "<0.2.1", "nodes": [""], "fixAvailable": true}, "download": {"name": "download", "severity": "moderate", "isDirect": false, "via": ["got"], "effects": ["gh-release-fetch"], "range": ">=4.0.0", "nodes": [""], "fixAvailable": true}, "fast-glob": {"name": "fast-glob", "severity": "high", "isDirect": false, "via": ["glob-parent"], "effects": ["globby"], "range": "<=2.2.7", "nodes": [""], "fixAvailable": true}, "fetch-node-website": {"name": "fetch-node-website", "severity": "moderate", "isDirect": false, "via": ["got"], "effects": ["all-node-versions"], "range": "2.0.0 - 5.0.3", "nodes": [""], "fixAvailable": true}, "formidable": {"name": "formidable", "severity": "high", "isDirect": false, "via": ["qs"], "effects": [], "range": "2.0.0-canary.20200129.2 - 2.0.1", "nodes": [""], "fixAvailable": true}, "gh-release-fetch": {"name": "gh-release-fetch", "severity": "moderate", "isDirect": false, "via": ["download"], "effects": ["netlify-cli"], "range": "*", "nodes": [""], "fixAvailable": true}, "glob-parent": {"name": "glob-parent", "severity": "high", "isDirect": false, "via": [{"source": 1088261, "name": "glob-parent", "dependency": "glob-parent", "title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex", "url": "https://github.com/advisories/GHSA-ww39-953v-wcq6", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<5.1.2"}], "effects": ["fast-glob"], "range": "<5.1.2", "nodes": [""], "fixAvailable": true}, "globby": {"name": "globby", "severity": "high", "isDirect": false, "via": ["fast-glob"], "effects": ["cpy"], "range": "8.0.0 - 9.2.0", "nodes": [""], "fixAvailable": true}, "got": {"name": "got", "severity": "moderate", "isDirect": true, "via": [{"source": 1088468, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": {"score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "range": "<11.8.5"}], "effects": ["@netlify/build", "download", "fetch-node-website", "package-json"], "range": "<11.8.5", "nodes": ["", "", "node_modules/got", "node_modules/got"], "fixAvailable": true}, "json5": {"name": "json5", "severity": "high", "isDirect": true, "via": [{"source": 1088341, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": "<1.0.2"}, {"source": 1088342, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": ">=2.0.0 <2.2.2"}], "effects": [], "range": "<1.0.2 || >=2.0.0 <2.2.2", "nodes": ["", "", "node_modules/json5"], "fixAvailable": true}, "jsonwebtoken": {"name": "jsonwebtoken", "severity": "high", "isDirect": false, "via": [{"source": 1085321, "name": "jsonwebtoken", "dependency": "jsonwebtoken", "title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC", "url": "https://github.com/advisories/GHSA-hjrf-2m68-5959", "severity": "moderate", "cwe": ["CWE-287", "CWE-1259"], "cvss": {"score": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}, "range": "<=8.5.1"}, {"source": 1085403, "name": "jsonwebtoken", "dependency": "jsonwebtoken", "title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ", "url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33", "severity": "moderate", "cwe": ["CWE-327"], "cvss": {"score": 0, "vectorString": null}, "range": "<=8.5.1"}, {"source": 1087848, "name": "jsonwebtoken", "dependency": "jsonwebtoken", "title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()", "url": "https://github.com/advisories/GHSA-qwph-4952-7xr6", "severity": "moderate", "cwe": ["CWE-287", "CWE-327"], "cvss": {"score": 6.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"}, "range": "<9.0.0"}, {"source": 1088370, "name": "jsonwebtoken", "dependency": "jsonwebtoken", "title": "jsonwebtoken has insecure input validation in jwt.verify function", "url": "https://github.com/advisories/GHSA-27h2-hvpr-p74q", "severity": "high", "cwe": ["CWE-20"], "cvss": {"score": 7.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"}, "range": "<=8.5.1"}], "effects": ["netlify-cli", "verdaccio"], "range": "<=8.5.1", "nodes": [""], "fixAvailable": true}, "latest-version": {"name": "latest-version", "severity": "moderate", "isDirect": false, "via": ["package-json"], "effects": ["update-notifier"], "range": "0.2.0 - 5.1.0", "nodes": [""], "fixAvailable": true}, "luxon": {"name": "luxon", "severity": "high", "isDirect": false, "via": [{"source": 1087862, "name": "luxon", "dependency": "luxon", "title": "Luxon Inefficient Regular Expression Complexity vulnerability", "url": "https://github.com/advisories/GHSA-3xq5-wjfh-ppjc", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=3.0.0 <3.2.1"}], "effects": [], "range": "3.0.0 - 3.2.0", "nodes": [""], "fixAvailable": true}, "netlify-cli": {"name": "netlify-cli", "severity": "moderate", "isDirect": false, "via": ["@netlify/build", "gh-release-fetch", "jsonwebtoken", "node-version-alias"], "effects": [], "range": ">=2.13.0", "nodes": [""], "fixAvailable": true}, "node-version-alias": {"name": "node-version-alias", "severity": "moderate", "isDirect": false, "via": ["all-node-versions", "normalize-node-version"], "effects": ["netlify-cli"], "range": "<=1.0.1", "nodes": [""], "fixAvailable": true}, "normalize-node-version": {"name": "normalize-node-version", "severity": "moderate", "isDirect": false, "via": ["all-node-versions"], "effects": [], "range": "2.0.0 - 10.0.0", "nodes": [""], "fixAvailable": true}, "package-json": {"name": "package-json", "severity": "moderate", "isDirect": false, "via": ["got"], "effects": ["latest-version"], "range": "<=6.5.0", "nodes": [""], "fixAvailable": true}, "qs": {"name": "qs", "severity": "high", "isDirect": true, "via": [{"source": 1088643, "name": "qs", "dependency": "qs", "title": "qs vulnerable to Prototype Pollution", "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=6.9.0 <6.9.7"}], "effects": ["formidable"], "range": "6.9.0 - 6.9.6", "nodes": ["node_modules/qs"], "fixAvailable": true}, "terser": {"name": "terser", "severity": "high", "isDirect": false, "via": [{"source": 1088439, "name": "terser", "dependency": "terser", "title": "Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS", "url": "https://github.com/advisories/GHSA-4wf5-vphf-c2xc", "severity": "high", "cwe": [], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=5.0.0 <5.14.2"}], "effects": [], "range": "5.0.0 - 5.14.1", "nodes": [""], "fixAvailable": true}, "update-notifier": {"name": "update-notifier", "severity": "moderate", "isDirect": false, "via": ["latest-version"], "effects": ["@netlify/build"], "range": "0.2.0 - 5.1.0", "nodes": [""], "fixAvailable": true}, "verdaccio": {"name": "verdaccio", "severity": "moderate", "isDirect": false, "via": ["jsonwebtoken"], "effects": [], "range": "2.2.7-r - 5.18.0", "nodes": [""], "fixAvailable": true}, "vite": {"name": "vite", "severity": "moderate", "isDirect": true, "via": [{"source": 1088406, "name": "vite", "dependency": "vite", "title": "Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service", "url": "https://github.com/advisories/GHSA-mv48-hcvh-8jj8", "severity": "moderate", "cwe": ["CWE-22"], "cvss": {"score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}, "range": "<2.9.13"}], "effects": [], "range": "<2.9.13", "nodes": ["node_modules/vite"], "fixAvailable": {"name": "vite", "version": "2.9.15", "isSemVerMajor": false}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 1, "moderate": 13, "high": 13, "critical": 0, "total": 27}, "dependencies": {"prod": 96, "dev": 2561, "optional": 39, "peer": 0, "peerOptional": 0, "total": 2656}}}}
{}
Upgrading n:vite from ~2.8.6 -> 2.9.15
$ /usr/bin/npm audit fix --only=dev --legacy-peer-deps
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated statsd-client@0.4.7: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.0: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated @types/rdf-js@4.0.2: This is a stub types definition. rdf-js provides its own type definitions, so you do not need this installed.
npm WARN deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---
added 3298 packages, and audited 3299 packages in 1m
283 packages are looking for funding
run `npm fund` for details
# npm audit report
decode-uri-component <0.2.1
decode-uri-component vulnerable to Denial of Service (DoS) - https://github.com/advisories/GHSA-w573-4hg7-7wgq
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/decode-uri-component
glob-parent <5.1.2
Severity: high
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install netlify-cli@2.37.0, which is a breaking change
node_modules/netlify-cli/node_modules/cpy/node_modules/glob-parent
fast-glob <=2.2.7
Depends on vulnerable versions of glob-parent
node_modules/netlify-cli/node_modules/cpy/node_modules/fast-glob
globby 8.0.0 - 9.2.0
Depends on vulnerable versions of fast-glob
node_modules/netlify-cli/node_modules/cpy/node_modules/globby
cpy 7.0.0 - 8.1.2
Depends on vulnerable versions of globby
node_modules/netlify-cli/node_modules/cpy
@netlify/cache-utils *
Depends on vulnerable versions of cpy
node_modules/netlify-cli/node_modules/@netlify/cache-utils
@netlify/build >=0.1.31
Depends on vulnerable versions of @netlify/cache-utils
Depends on vulnerable versions of @netlify/functions-utils
Depends on vulnerable versions of got
Depends on vulnerable versions of update-notifier
node_modules/netlify-cli/node_modules/@netlify/build
netlify-cli >=2.13.0
Depends on vulnerable versions of @netlify/build
Depends on vulnerable versions of gh-release-fetch
Depends on vulnerable versions of node-version-alias
node_modules/netlify-cli
@netlify/functions-utils *
Depends on vulnerable versions of cpy
node_modules/netlify-cli/node_modules/@netlify/functions-utils
got <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install netlify-cli@2.37.0, which is a breaking change
node_modules/netlify-cli/node_modules/@netlify/build/node_modules/got
node_modules/netlify-cli/node_modules/download/node_modules/got
node_modules/netlify-cli/node_modules/fetch-node-website/node_modules/got
node_modules/netlify-cli/node_modules/package-json/node_modules/got
download >=4.0.0
Depends on vulnerable versions of got
node_modules/netlify-cli/node_modules/download
gh-release-fetch *
Depends on vulnerable versions of download
node_modules/netlify-cli/node_modules/gh-release-fetch
fetch-node-website 2.0.0 - 5.0.3
Depends on vulnerable versions of got
node_modules/netlify-cli/node_modules/fetch-node-website
all-node-versions 2.0.0 - 8.0.0
Depends on vulnerable versions of fetch-node-website
node_modules/netlify-cli/node_modules/all-node-versions
node-version-alias <=1.0.1
Depends on vulnerable versions of all-node-versions
Depends on vulnerable versions of normalize-node-version
node_modules/netlify-cli/node_modules/node-version-alias
normalize-node-version 2.0.0 - 10.0.0
Depends on vulnerable versions of all-node-versions
node_modules/netlify-cli/node_modules/normalize-node-version
package-json <=6.5.0
Depends on vulnerable versions of got
node_modules/netlify-cli/node_modules/package-json
latest-version 0.2.0 - 5.1.0
Depends on vulnerable versions of package-json
node_modules/netlify-cli/node_modules/latest-version
update-notifier 0.2.0 - 5.1.0
Depends on vulnerable versions of latest-version
node_modules/netlify-cli/node_modules/@netlify/build/node_modules/update-notifier
json5 <1.0.2 || >=2.0.0 <2.2.2
Severity: high
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/json5
node_modules/netlify-cli/node_modules/tsconfig-paths/node_modules/json5
jsonwebtoken <=8.5.1
Severity: high
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken unrestricted key type could lead to legacy keys usage - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/verdaccio/node_modules/jsonwebtoken
verdaccio 2.2.7-r - 5.18.0
Depends on vulnerable versions of jsonwebtoken
node_modules/netlify-cli/node_modules/verdaccio
luxon 3.0.0 - 3.2.0
Severity: high
Luxon Inefficient Regular Expression Complexity vulnerability - https://github.com/advisories/GHSA-3xq5-wjfh-ppjc
fix available via `npm audit fix`
node_modules/netlify-cli/node_modules/luxon
23 vulnerabilities (1 low, 12 moderate, 10 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm ERR! code EUSAGE
npm ERR!
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR!
npm ERR! Missing: webpack@5.75.0 from lock file
npm ERR! Missing: postcss-html@1.5.0 from lock file
npm ERR! Missing: htmlparser2@8.0.1 from lock file
npm ERR! Missing: js-tokens@8.0.1 from lock file
npm ERR! Missing: domelementtype@2.3.0 from lock file
npm ERR! Missing: domhandler@5.0.3 from lock file
npm ERR! Missing: domutils@3.0.1 from lock file
npm ERR! Missing: entities@4.4.0 from lock file
npm ERR! Missing: dom-serializer@2.0.0 from lock file
npm ERR! Missing: @types/eslint-scope@3.7.4 from lock file
npm ERR! Missing: @types/estree@0.0.51 from lock file
npm ERR! Missing: @webassemblyjs/ast@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/wasm-edit@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/wasm-parser@1.11.1 from lock file
npm ERR! Missing: acorn-import-assertions@1.8.0 from lock file
npm ERR! Missing: chrome-trace-event@1.0.3 from lock file
npm ERR! Missing: enhanced-resolve@5.12.0 from lock file
npm ERR! Missing: es-module-lexer@0.9.3 from lock file
npm ERR! Missing: events@3.3.0 from lock file
npm ERR! Missing: glob-to-regexp@0.4.1 from lock file
npm ERR! Missing: loader-runner@4.3.0 from lock file
npm ERR! Missing: schema-utils@3.1.1 from lock file
npm ERR! Missing: tapable@2.2.1 from lock file
npm ERR! Missing: terser-webpack-plugin@5.3.6 from lock file
npm ERR! Missing: watchpack@2.4.0 from lock file
npm ERR! Missing: webpack-sources@3.2.3 from lock file
npm ERR! Missing: @types/eslint@8.4.10 from lock file
npm ERR! Missing: @webassemblyjs/helper-numbers@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/helper-wasm-bytecode@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/floating-point-hex-parser@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/helper-api-error@1.11.1 from lock file
npm ERR! Missing: @xtuc/long@4.2.2 from lock file
npm ERR! Missing: @webassemblyjs/helper-buffer@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/helper-wasm-section@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/wasm-gen@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/wasm-opt@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/wast-printer@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/ieee754@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/leb128@1.11.1 from lock file
npm ERR! Missing: @webassemblyjs/utf8@1.11.1 from lock file
npm ERR! Missing: @xtuc/ieee754@1.2.0 from lock file
npm ERR! Missing: ajv-keywords@3.5.2 from lock file
npm ERR! Missing: jest-worker@27.5.1 from lock file
npm ERR! Missing: serialize-javascript@6.0.1 from lock file
npm ERR! Missing: terser@5.16.1 from lock file
npm ERR! Missing: randombytes@2.1.0 from lock file
npm ERR! Missing: @jridgewell/source-map@0.3.2 from lock file
npm ERR! Missing: commander@2.20.3 from lock file
npm ERR! Missing: source-map-support@0.5.21 from lock file
npm ERR! Missing: @jridgewell/gen-mapping@0.3.2 from lock file
npm ERR! Missing: supports-color@8.1.1 from lock file
npm ERR! Missing: has-flag@4.0.0 from lock file
npm ERR! Missing: source-map@0.6.1 from lock file
npm ERR!
npm ERR! Clean install a project
npm ERR!
npm ERR! Usage:
npm ERR! npm ci
npm ERR!
npm ERR! Options:
npm ERR! [--no-audit] [--foreground-scripts] [--ignore-scripts]
npm ERR! [--script-shell <script-shell>]
npm ERR!
npm ERR! aliases: clean-install, ic, install-clean, isntall-clean
npm ERR!
npm ERR! Run "npm help ci" for more info
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2023-01-19T13_38_55_516Z-debug-0.log
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1344, in run
self.npm_audit_fix(new_npm_audit)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 241, in npm_audit_fix
self.check_call(['npm', 'ci'])
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/shell2.py", line 54, in check_call
res.check_returncode()
File "/usr/lib/python3.9/subprocess.py", line 460, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['/usr/bin/npm', 'ci']' returned non-zero exit status 1.