This run took 32 seconds.
$ date --- stdout --- Sun Mar 12 23:18:35 UTC 2023 --- end --- $ git clone file:///srv/git/mediawiki-extensions-FundraisingEmailUnsubscribe.git repo --depth=1 -b master --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/master --- stdout --- e4fe18e4d888d1a39653171e7389e5ba005180ea refs/heads/master --- end --- $ /usr/bin/npm audit --json --legacy-peer-deps --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "grunt": { "name": "grunt", "severity": "high", "isDirect": true, "via": [ { "source": 1089539, "name": "grunt", "dependency": "grunt", "title": "Race Condition in Grunt", "url": "https://github.com/advisories/GHSA-rm36-94g8-835r", "severity": "high", "cwe": [ "CWE-367" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.5.3" } ], "effects": [], "range": "<1.5.3", "nodes": [ "node_modules/grunt" ], "fixAvailable": { "name": "grunt", "version": "1.6.1", "isSemVerMajor": false } }, "grunt-contrib-jshint": { "name": "grunt-contrib-jshint", "severity": "moderate", "isDirect": true, "via": [ "jshint" ], "effects": [], "range": "0.3.0 - 3.0.0", "nodes": [ "node_modules/grunt-contrib-jshint" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "jshint": { "name": "jshint", "severity": "moderate", "isDirect": false, "via": [ "shelljs" ], "effects": [ "grunt-contrib-jshint" ], "range": "1.1.0 - 2.13.3", "nodes": [ "node_modules/jshint" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [], "range": "<3.0.5", "nodes": [ "node_modules/minimatch" ], "fixAvailable": true }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "shelljs": { "name": "shelljs", "severity": "high", "isDirect": false, "via": [ { "source": 1088208, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj", "severity": "moderate", "cwe": [ "CWE-269" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.8.5" }, { "source": 1090457, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6", "severity": "high", "cwe": [ "CWE-269" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, "range": "<0.8.5" } ], "effects": [ "jshint" ], "range": "<=0.8.4", "nodes": [ "node_modules/shelljs" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1089143, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 2, "high": 3, "critical": 2, "total": 7 }, "dependencies": { "prod": 1, "dev": 335, "optional": 0, "peer": 6, "peerOptional": 0, "total": 335 } } } --- end --- $ /usr/bin/composer install --- stderr --- No lock file found. Updating dependencies instead of installing from lock file. Use composer update over composer install if you do not have a lock file. Loading composer repositories with package information Info from https://repo.packagist.org: [37;44m#StandWith[30;43mUkraine[0m Updating dependencies Lock file operations: 25 installs, 0 updates, 0 removals - Locking clio/clio (0.1.8) - Locking coderkungfu/php-queue (1.0.1) - Locking composer/semver (3.3.2) - Locking composer/spdx-licenses (1.5.7) - Locking mediawiki/mediawiki-codesniffer (v39.0.0) - Locking mediawiki/minus-x (1.1.1) - Locking monolog/monolog (2.9.1) - Locking php-parallel-lint/php-console-color (v1.0.1) - Locking php-parallel-lint/php-console-highlighter (v1.0.0) - Locking php-parallel-lint/php-parallel-lint (v1.3.2) - Locking predis/predis (v1.1.10) - Locking psr/container (1.1.2) - Locking psr/log (1.1.4) - Locking squizlabs/php_codesniffer (3.6.2) - Locking symfony/console (v5.4.21) - Locking symfony/deprecation-contracts (v2.5.2) - Locking symfony/polyfill-ctype (v1.27.0) - Locking symfony/polyfill-intl-grapheme (v1.27.0) - Locking symfony/polyfill-intl-normalizer (v1.27.0) - Locking symfony/polyfill-mbstring (v1.27.0) - Locking symfony/polyfill-php73 (v1.27.0) - Locking symfony/polyfill-php80 (v1.27.0) - Locking symfony/service-contracts (v2.5.2) - Locking symfony/string (v5.4.21) - Locking twig/twig (v1.44.7) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 25 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] 0 [--->------------------------] - Installing psr/log (1.1.4): Extracting archive - Installing monolog/monolog (2.9.1): Extracting archive - Installing clio/clio (0.1.8): Extracting archive - Installing coderkungfu/php-queue (1.0.1): Extracting archive - Installing squizlabs/php_codesniffer (3.6.2): Extracting archive - Installing symfony/polyfill-mbstring (v1.27.0): Extracting archive - Installing composer/spdx-licenses (1.5.7): Extracting archive - Installing composer/semver (3.3.2): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v39.0.0): Extracting archive - Installing symfony/polyfill-php80 (v1.27.0): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.27.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.27.0): Extracting archive - Installing symfony/polyfill-ctype (v1.27.0): Extracting archive - Installing symfony/string (v5.4.21): Extracting archive - Installing symfony/deprecation-contracts (v2.5.2): Extracting archive - Installing psr/container (1.1.2): Extracting archive - Installing symfony/service-contracts (v2.5.2): Extracting archive - Installing symfony/polyfill-php73 (v1.27.0): Extracting archive - Installing symfony/console (v5.4.21): Extracting archive - Installing mediawiki/minus-x (1.1.1): Extracting archive - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive - Installing predis/predis (v1.1.10): Extracting archive - Installing twig/twig (v1.44.7): Extracting archive 0/16 [>---------------------------] 0% 10/16 [=================>----------] 62% 16/16 [============================] 100%23 package suggestions were added by new dependencies, use `composer suggest` to see details. Generating autoload files 15 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- --- end --- Upgrading n:grunt-banana-checker from 0.9.0 -> 0.10.0 Upgrading n:grunt-stylelint from 0.17.0 -> 0.18.0 $ /usr/bin/npm install --- stdout --- added 335 packages, and audited 336 packages in 4s 20 packages are looking for funding run `npm fund` for details 7 vulnerabilities (2 moderate, 3 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ /usr/bin/npm ci --legacy-peer-deps --- stdout --- added 335 packages, and audited 336 packages in 3s 19 packages are looking for funding run `npm fund` for details 7 vulnerabilities (2 moderate, 3 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- $ /usr/bin/npm test --- stdout --- > test > grunt test Running "jsonlint:all" (jsonlint) task >> 79 files lint free. Running "stylelint:all" (stylelint) task >> Linted 1 files without errors Running "banana:FundraisingEmailUnsubscribe" (banana) task >> 1 message directory checked. Running "jshint:all" (jshint) task >> 2 files lint free. Done. --- end --- Upgrading c:mediawiki/mediawiki-codesniffer from 39.0.0 -> 41.0.0 $ /usr/bin/composer update --- stderr --- Loading composer repositories with package information Info from https://repo.packagist.org: [37;44m#StandWith[30;43mUkraine[0m Updating dependencies Lock file operations: 0 installs, 2 updates, 0 removals - Upgrading mediawiki/mediawiki-codesniffer (v39.0.0 => v41.0.0) - Upgrading squizlabs/php_codesniffer (3.6.2 => 3.7.2) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 0 installs, 2 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] 0 [--->------------------------] - Upgrading squizlabs/php_codesniffer (3.6.2 => 3.7.2): Extracting archive - Upgrading mediawiki/mediawiki-codesniffer (v39.0.0 => v41.0.0): Extracting archive 0/2 [>---------------------------] 0% 1/2 [==============>-------------] 50% 2/2 [============================] 100%Generating autoload files 15 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- --- end --- {'MediaWiki.Usage.SuperGlobalsUsage.SuperGlobals', 'MediaWiki.Commenting.MissingCovers.MissingCovers', 'MediaWiki.NamingConventions.LowerCamelFunctionsName.FunctionName', 'PSR12.Properties.ConstantVisibility.NotFound', 'Generic.Files.OneObjectStructurePerFile.MultipleFound', 'Squiz.Scope.MemberVarScope.Missing', 'MediaWiki.Commenting.PropertyDocumentation.MissingDocumentationProtected', 'MediaWiki.Commenting.FunctionAnnotations.UnrecognizedAnnotation', 'PSR2.Classes.PropertyDeclaration.ScopeMissing', 'MediaWiki.Commenting.FunctionComment.MissingDocumentationPublic', 'MediaWiki.Usage.ExtendClassUsage.FunctionConfigUsage', 'MediaWiki.Commenting.FunctionComment.MissingDocumentationProtected', 'MediaWiki.WhiteSpace.SpaceBeforeSingleLineComment.NewLineComment'} Tests fail! $ git checkout .phpcs.xml --- stderr --- Updated 1 path from the index --- stdout --- --- end --- $ /usr/bin/composer install --- stderr --- Installing dependencies from lock file (including require-dev) Verifying lock file contents can be installed on current platform. Nothing to install, update or remove Generating autoload files 15 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- --- end --- $ /usr/bin/composer test --- stderr --- > parallel-lint . --exclude vendor --exclude node_modules > phpcs -sp --cache > minus-x check . --- stdout --- PHP 7.4.33 | 10 parallel jobs ................ 16/16 (100 %) Checked 16 files in 0.1 seconds No syntax error found ................ 16 / 16 (100%) Time: 48ms; Memory: 8MB MinusX ====== Processing /src/repo... ............................................................. ............................................................. ............. All good! --- end --- $ /usr/bin/npm audit --json --legacy-peer-deps --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "grunt": { "name": "grunt", "severity": "high", "isDirect": true, "via": [ { "source": 1089539, "name": "grunt", "dependency": "grunt", "title": "Race Condition in Grunt", "url": "https://github.com/advisories/GHSA-rm36-94g8-835r", "severity": "high", "cwe": [ "CWE-367" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.5.3" } ], "effects": [], "range": "<1.5.3", "nodes": [ "node_modules/grunt" ], "fixAvailable": { "name": "grunt", "version": "1.6.1", "isSemVerMajor": false } }, "grunt-contrib-jshint": { "name": "grunt-contrib-jshint", "severity": "moderate", "isDirect": true, "via": [ "jshint" ], "effects": [], "range": "0.3.0 - 3.0.0", "nodes": [ "node_modules/grunt-contrib-jshint" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "jshint": { "name": "jshint", "severity": "moderate", "isDirect": false, "via": [ "shelljs" ], "effects": [ "grunt-contrib-jshint" ], "range": "1.1.0 - 2.13.3", "nodes": [ "node_modules/jshint" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [], "range": "<3.0.5", "nodes": [ "node_modules/minimatch" ], "fixAvailable": true }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "shelljs": { "name": "shelljs", "severity": "high", "isDirect": false, "via": [ { "source": 1088208, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj", "severity": "moderate", "cwe": [ "CWE-269" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.8.5" }, { "source": 1090457, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6", "severity": "high", "cwe": [ "CWE-269" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, "range": "<0.8.5" } ], "effects": [ "jshint" ], "range": "<=0.8.4", "nodes": [ "node_modules/shelljs" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1089143, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "node_modules/underscore" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 2, "high": 3, "critical": 2, "total": 7 }, "dependencies": { "prod": 1, "dev": 335, "optional": 0, "peer": 6, "peerOptional": 0, "total": 335 } } } --- end --- Attempting to npm audit fix $ /usr/bin/npm audit fix --dry-run --only=dev --json --legacy-peer-deps --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production --- stdout --- { "added": 0, "removed": 8, "changed": 4, "audited": 328, "funding": 19, "audit": { "auditReportVersion": 2, "vulnerabilities": { "grunt": { "name": "grunt", "severity": "high", "isDirect": true, "via": [ { "source": 1089539, "name": "grunt", "dependency": "grunt", "title": "Race Condition in Grunt", "url": "https://github.com/advisories/GHSA-rm36-94g8-835r", "severity": "high", "cwe": [ "CWE-367" ], "cvss": { "score": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.5.3" } ], "effects": [], "range": "<1.5.3", "nodes": [ "node_modules/grunt" ], "fixAvailable": { "name": "grunt", "version": "1.6.1", "isSemVerMajor": false } }, "grunt-contrib-jshint": { "name": "grunt-contrib-jshint", "severity": "moderate", "isDirect": false, "via": [ "jshint" ], "effects": [], "range": "0.3.0 - 3.0.0", "nodes": [ "" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "jshint": { "name": "jshint", "severity": "moderate", "isDirect": false, "via": [ "shelljs" ], "effects": [ "grunt-contrib-jshint" ], "range": "1.1.0 - 2.13.3", "nodes": [ "node_modules/jshint" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [], "range": "<3.0.5", "nodes": [ "" ], "fixAvailable": true }, "nomnom": { "name": "nomnom", "severity": "critical", "isDirect": false, "via": [ "underscore" ], "effects": [], "range": ">=1.6.0", "nodes": [ "node_modules/nomnom" ], "fixAvailable": true }, "shelljs": { "name": "shelljs", "severity": "high", "isDirect": false, "via": [ { "source": 1088208, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj", "severity": "moderate", "cwe": [ "CWE-269" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.8.5" }, { "source": 1090457, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6", "severity": "high", "cwe": [ "CWE-269" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, "range": "<0.8.5" } ], "effects": [ "jshint" ], "range": "<=0.8.4", "nodes": [ "" ], "fixAvailable": { "name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true } }, "underscore": { "name": "underscore", "severity": "critical", "isDirect": false, "via": [ { "source": 1089143, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": [ "CWE-94" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.3.2 <1.12.1" } ], "effects": [ "nomnom" ], "range": "1.3.2 - 1.12.0", "nodes": [ "" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 2, "high": 3, "critical": 2, "total": 7 }, "dependencies": { "prod": 1, "dev": 327, "optional": 0, "peer": 0, "peerOptional": 0, "total": 327 } } } } --- end --- {"added": 0, "removed": 8, "changed": 4, "audited": 328, "funding": 19, "audit": {"auditReportVersion": 2, "vulnerabilities": {"grunt": {"name": "grunt", "severity": "high", "isDirect": true, "via": [{"source": 1089539, "name": "grunt", "dependency": "grunt", "title": "Race Condition in Grunt", "url": "https://github.com/advisories/GHSA-rm36-94g8-835r", "severity": "high", "cwe": ["CWE-367"], "cvss": {"score": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "range": "<1.5.3"}], "effects": [], "range": "<1.5.3", "nodes": ["node_modules/grunt"], "fixAvailable": {"name": "grunt", "version": "1.6.1", "isSemVerMajor": false}}, "grunt-contrib-jshint": {"name": "grunt-contrib-jshint", "severity": "moderate", "isDirect": false, "via": ["jshint"], "effects": [], "range": "0.3.0 - 3.0.0", "nodes": [""], "fixAvailable": {"name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true}}, "jshint": {"name": "jshint", "severity": "moderate", "isDirect": false, "via": ["shelljs"], "effects": ["grunt-contrib-jshint"], "range": "1.1.0 - 2.13.3", "nodes": ["node_modules/jshint"], "fixAvailable": {"name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true}}, "minimatch": {"name": "minimatch", "severity": "high", "isDirect": false, "via": [{"source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": "<3.0.5"}], "effects": [], "range": "<3.0.5", "nodes": [""], "fixAvailable": true}, "nomnom": {"name": "nomnom", "severity": "critical", "isDirect": false, "via": ["underscore"], "effects": [], "range": ">=1.6.0", "nodes": ["node_modules/nomnom"], "fixAvailable": true}, "shelljs": {"name": "shelljs", "severity": "high", "isDirect": false, "via": [{"source": 1088208, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-64g7-mvw6-v9qj", "severity": "moderate", "cwe": ["CWE-269"], "cvss": {"score": 0, "vectorString": null}, "range": "<0.8.5"}, {"source": 1090457, "name": "shelljs", "dependency": "shelljs", "title": "Improper Privilege Management in shelljs", "url": "https://github.com/advisories/GHSA-4rq4-32rv-6wp6", "severity": "high", "cwe": ["CWE-269"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "range": "<0.8.5"}], "effects": ["jshint"], "range": "<=0.8.4", "nodes": [""], "fixAvailable": {"name": "grunt-contrib-jshint", "version": "3.2.0", "isSemVerMajor": true}}, "underscore": {"name": "underscore", "severity": "critical", "isDirect": false, "via": [{"source": 1089143, "name": "underscore", "dependency": "underscore", "title": "Arbitrary Code Execution in underscore", "url": "https://github.com/advisories/GHSA-cf4h-3jhx-xvhq", "severity": "critical", "cwe": ["CWE-94"], "cvss": {"score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "range": ">=1.3.2 <1.12.1"}], "effects": ["nomnom"], "range": "1.3.2 - 1.12.0", "nodes": [""], "fixAvailable": true}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 2, "high": 3, "critical": 2, "total": 7}, "dependencies": {"prod": 1, "dev": 327, "optional": 0, "peer": 0, "peerOptional": 0, "total": 327}}}} {} Upgrading n:grunt from 1.5.2 -> 1.6.1 $ /usr/bin/npm audit fix --only=dev --legacy-peer-deps --- stderr --- npm WARN invalid config only="dev" set in command line options npm WARN invalid config Must be one of: null, prod, production --- stdout --- removed 10 packages, changed 9 packages, and audited 326 packages in 1s 19 packages are looking for funding run `npm fund` for details # npm audit report shelljs <=0.8.4 Severity: high Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-64g7-mvw6-v9qj Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-4rq4-32rv-6wp6 fix available via `npm audit fix --force` Will install grunt-contrib-jshint@3.2.0, which is a breaking change node_modules/shelljs jshint 1.1.0 - 2.13.3 Depends on vulnerable versions of shelljs node_modules/jshint grunt-contrib-jshint 0.3.0 - 3.0.0 Depends on vulnerable versions of jshint node_modules/grunt-contrib-jshint underscore 1.3.2 - 1.12.0 Severity: critical Arbitrary Code Execution in underscore - https://github.com/advisories/GHSA-cf4h-3jhx-xvhq fix available via `npm audit fix` node_modules/underscore nomnom >=1.6.0 Depends on vulnerable versions of underscore node_modules/nomnom 5 vulnerabilities (2 moderate, 1 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- Verifying that tests still pass $ /usr/bin/npm ci --legacy-peer-deps --- stdout --- added 325 packages, and audited 326 packages in 3s 19 packages are looking for funding run `npm fund` for details 5 vulnerabilities (2 moderate, 1 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. --- end --- $ /usr/bin/npm test --- stdout --- > test > grunt test Running "jsonlint:all" (jsonlint) task >> 79 files lint free. Running "stylelint:all" (stylelint) task Warning: Cannot find module 'stylelint' Require stack: - /src/repo/node_modules/grunt-stylelint/tasks/grunt-stylelint.js - /src/repo/node_modules/grunt/lib/grunt/task.js - /src/repo/node_modules/grunt/lib/grunt.js - /src/repo/node_modules/grunt-cli/bin/grunt - /src/repo/node_modules/grunt/bin/grunt Use --force to continue. Aborted due to warnings. --- end --- Traceback (most recent call last): File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1344, in run self.npm_audit_fix(new_npm_audit) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 242, in npm_audit_fix self.check_call(['npm', 'test']) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/shell2.py", line 54, in check_call res.check_returncode() File "/usr/lib/python3.9/subprocess.py", line 460, in check_returncode raise CalledProcessError(self.returncode, self.args, self.stdout, subprocess.CalledProcessError: Command '['/usr/bin/npm', 'test']' returned non-zero exit status 3.