This run took 41 seconds.
$ date --- stdout --- Fri Mar 17 21:05:15 UTC 2023 --- end --- $ git clone file:///srv/git/mediawiki-extensions-RelatedArticles.git repo --depth=1 -b master --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/master --- stdout --- 111f0f89f2b2bc2918ef37e04d701c895b0472ea refs/heads/master --- end --- $ /usr/bin/npm audit --json --legacy-peer-deps --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@wikimedia/mw-node-qunit": { "name": "@wikimedia/mw-node-qunit", "severity": "moderate", "isDirect": true, "via": [ "jsdom" ], "effects": [], "range": "<=6.2.1", "nodes": [ "node_modules/@wikimedia/mw-node-qunit" ], "fixAvailable": { "name": "@wikimedia/mw-node-qunit", "version": "6.4.1", "isSemVerMajor": false } }, "decode-uri-component": { "name": "decode-uri-component", "severity": "low", "isDirect": false, "via": [ { "source": 1088828, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to Denial of Service (DoS)", "url": "https://github.com/advisories/GHSA-w573-4hg7-7wgq", "severity": "low", "cwe": [ "CWE-20" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.2.1" } ], "effects": [], "range": "<0.2.1", "nodes": [ "node_modules/decode-uri-component" ], "fixAvailable": true }, "ejs": { "name": "ejs", "severity": "critical", "isDirect": false, "via": [ { "source": 1089270, "name": "ejs", "dependency": "ejs", "title": "ejs template injection vulnerability", "url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q", "severity": "critical", "cwe": [ "CWE-74" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<3.1.7" } ], "effects": [], "range": "<3.1.7", "nodes": [ "node_modules/ejs" ], "fixAvailable": true }, "got": { "name": "got", "severity": "moderate", "isDirect": false, "via": [ { "source": 1088948, "name": "got", "dependency": "got", "title": "Got allows a redirect to a UNIX socket", "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97", "severity": "moderate", "cwe": [], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<11.8.5" } ], "effects": [], "range": "<11.8.5", "nodes": [ "node_modules/got" ], "fixAvailable": true }, "http-cache-semantics": { "name": "http-cache-semantics", "severity": "high", "isDirect": false, "via": [ { "source": 1090532, "name": "http-cache-semantics", "dependency": "http-cache-semantics", "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<4.1.1" } ], "effects": [], "range": "<4.1.1", "nodes": [ "node_modules/http-cache-semantics" ], "fixAvailable": true }, "jsdom": { "name": "jsdom", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089185, "name": "jsdom", "dependency": "jsdom", "title": "Insufficient Granularity of Access Control in JSDom", "url": "https://github.com/advisories/GHSA-f4c9-cqv8-9v98", "severity": "moderate", "cwe": [ "CWE-1220" ], "cvss": { "score": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "range": "<=16.4.0" }, "request" ], "effects": [ "@wikimedia/mw-node-qunit" ], "range": "<=16.5.3", "nodes": [ "node_modules/jsdom" ], "fixAvailable": { "name": "@wikimedia/mw-node-qunit", "version": "6.4.1", "isSemVerMajor": false } }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1091148, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": ">=2.0.0 <2.2.2" } ], "effects": [], "range": "2.0.0 - 2.2.1", "nodes": [ "node_modules/json5" ], "fixAvailable": true }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "mocha", "recursive-readdir" ], "range": "<3.0.5", "nodes": [ "node_modules/minimatch" ], "fixAvailable": true }, "minimist": { "name": "minimist", "severity": "critical", "isDirect": false, "via": [ { "source": 1091173, "name": "minimist", "dependency": "minimist", "title": "Prototype Pollution in minimist", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=1.0.0 <1.2.6" } ], "effects": [], "range": "1.0.0 - 1.2.5", "nodes": [ "node_modules/minimist" ], "fixAvailable": true }, "mocha": { "name": "mocha", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [], "range": "5.1.0 - 9.2.1", "nodes": [ "node_modules/mocha" ], "fixAvailable": true }, "mwbot": { "name": "mwbot", "severity": "moderate", "isDirect": false, "via": [ "request" ], "effects": [ "wdio-mediawiki" ], "range": ">=0.1.6", "nodes": [ "node_modules/mwbot" ], "fixAvailable": false }, "nanoid": { "name": "nanoid", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089011, "name": "nanoid", "dependency": "nanoid", "title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid", "url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2", "severity": "moderate", "cwe": [ "CWE-200" ], "cvss": { "score": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=3.0.0 <3.1.31" } ], "effects": [], "range": "3.0.0 - 3.1.30", "nodes": [ "node_modules/doiuse/node_modules/nanoid", "node_modules/stylelint-no-unsupported-browser-features/node_modules/nanoid" ], "fixAvailable": true }, "recursive-readdir": { "name": "recursive-readdir", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [], "range": "1.2.0 - 2.2.2", "nodes": [ "node_modules/recursive-readdir" ], "fixAvailable": true }, "request": { "name": "request", "severity": "moderate", "isDirect": false, "via": [ { "source": 1091410, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.88.2" } ], "effects": [ "jsdom", "mwbot" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": false }, "ua-parser-js": { "name": "ua-parser-js", "severity": "high", "isDirect": false, "via": [ { "source": 1088696, "name": "ua-parser-js", "dependency": "ua-parser-js", "title": "ReDoS Vulnerability in ua-parser-js version ", "url": "https://github.com/advisories/GHSA-fhg7-m89q-25r3", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=0.8.0 <1.0.33" } ], "effects": [], "range": "0.8.1 - 1.0.32", "nodes": [ "node_modules/ua-parser-js" ], "fixAvailable": true }, "wdio-mediawiki": { "name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": [ "mwbot" ], "effects": [], "range": "*", "nodes": [ "node_modules/wdio-mediawiki" ], "fixAvailable": false } }, "metadata": { "vulnerabilities": { "info": 0, "low": 1, "moderate": 7, "high": 6, "critical": 2, "total": 16 }, "dependencies": { "prod": 1, "dev": 1269, "optional": 4, "peer": 0, "peerOptional": 0, "total": 1269 } } } --- end --- $ /usr/bin/composer install --- stderr --- No lock file found. Updating dependencies instead of installing from lock file. Use composer update over composer install if you do not have a lock file. Loading composer repositories with package information Info from https://repo.packagist.org: [37;44m#StandWith[30;43mUkraine[0m Updating dependencies Lock file operations: 36 installs, 0 updates, 0 removals - Locking composer/pcre (1.0.1) - Locking composer/semver (3.3.2) - Locking composer/spdx-licenses (1.5.7) - Locking composer/xdebug-handler (2.0.5) - Locking doctrine/deprecations (v1.0.0) - Locking felixfbecker/advanced-json-rpc (v3.2.1) - Locking mediawiki/mediawiki-codesniffer (v38.0.0) - Locking mediawiki/mediawiki-phan-config (0.11.1) - Locking mediawiki/minus-x (1.1.1) - Locking mediawiki/phan-taint-check-plugin (3.3.2) - Locking microsoft/tolerant-php-parser (v0.1.2) - Locking netresearch/jsonmapper (v4.1.0) - Locking phan/phan (5.2.0) - Locking php-parallel-lint/php-console-color (v0.3) - Locking php-parallel-lint/php-console-highlighter (v0.5) - Locking php-parallel-lint/php-parallel-lint (v1.3.1) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.3.0) - Locking phpdocumentor/type-resolver (1.7.0) - Locking phpstan/phpdoc-parser (1.16.1) - Locking psr/container (1.1.2) - Locking psr/log (1.1.4) - Locking sabre/event (5.1.4) - Locking squizlabs/php_codesniffer (3.6.1) - Locking symfony/console (v5.4.21) - Locking symfony/deprecation-contracts (v2.5.2) - Locking symfony/polyfill-ctype (v1.27.0) - Locking symfony/polyfill-intl-grapheme (v1.27.0) - Locking symfony/polyfill-intl-normalizer (v1.27.0) - Locking symfony/polyfill-mbstring (v1.27.0) - Locking symfony/polyfill-php73 (v1.27.0) - Locking symfony/polyfill-php80 (v1.27.0) - Locking symfony/service-contracts (v2.5.2) - Locking symfony/string (v5.4.21) - Locking tysonandre/var_representation_polyfill (0.1.3) - Locking webmozart/assert (1.11.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 36 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] 0 [--->------------------------] - Installing composer/pcre (1.0.1): Extracting archive - Installing squizlabs/php_codesniffer (3.6.1): Extracting archive - Installing symfony/polyfill-mbstring (v1.27.0): Extracting archive - Installing composer/spdx-licenses (1.5.7): Extracting archive - Installing composer/semver (3.3.2): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v38.0.0): Extracting archive - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive - Installing symfony/polyfill-php80 (v1.27.0): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.27.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.27.0): Extracting archive - Installing symfony/polyfill-ctype (v1.27.0): Extracting archive - Installing symfony/string (v5.4.21): Extracting archive - Installing symfony/deprecation-contracts (v2.5.2): Extracting archive - Installing psr/container (1.1.2): Extracting archive - Installing symfony/service-contracts (v2.5.2): Extracting archive - Installing symfony/polyfill-php73 (v1.27.0): Extracting archive - Installing symfony/console (v5.4.21): Extracting archive - Installing sabre/event (5.1.4): Extracting archive - Installing netresearch/jsonmapper (v4.1.0): Extracting archive - Installing microsoft/tolerant-php-parser (v0.1.2): Extracting archive - Installing webmozart/assert (1.11.0): Extracting archive - Installing phpstan/phpdoc-parser (1.16.1): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing doctrine/deprecations (v1.0.0): Extracting archive - Installing phpdocumentor/type-resolver (1.7.0): Extracting archive - Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive - Installing psr/log (1.1.4): Extracting archive - Installing composer/xdebug-handler (2.0.5): Extracting archive - Installing phan/phan (5.2.0): Extracting archive - Installing mediawiki/phan-taint-check-plugin (3.3.2): Extracting archive - Installing mediawiki/mediawiki-phan-config (0.11.1): Extracting archive - Installing mediawiki/minus-x (1.1.1): Extracting archive - Installing php-parallel-lint/php-console-color (v0.3): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v0.5): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.3.1): Extracting archive 0/27 [>---------------------------] 0% 10/27 [==========>-----------------] 37% 20/27 [====================>-------] 74% 27/27 [============================] 100%4 package suggestions were added by new dependencies, use `composer suggest` to see details. Generating autoload files 14 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- --- end --- Upgrading n:eslint-config-wikimedia from 0.20.0 -> 0.24.0 Upgrading n:grunt-banana-checker from 0.9.0 -> 0.10.0 Upgrading n:stylelint-config-wikimedia from 0.11.1 -> 0.14.0 $ /usr/bin/npm install --- stderr --- npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142 npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated har-validator@5.1.5: this library is no longer supported npm WARN deprecated date-format@0.0.2: 0.x is no longer supported. Please upgrade to 4.x or higher. npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin. npm WARN deprecated sane@4.1.0: some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added npm WARN deprecated samsam@1.3.0: This package has been deprecated in favour of @sinonjs/samsam npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 --- stdout --- added 1281 packages, and audited 1282 packages in 16s 110 packages are looking for funding run `npm fund` for details 17 vulnerabilities (1 low, 8 moderate, 6 high, 2 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible, run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ ./node_modules/.bin/eslint . --fix --- stderr --- Oops! Something went wrong! :( ESLint: 7.32.0 ESLint couldn't find the plugin "eslint-plugin-unicorn". (The package "eslint-plugin-unicorn" was not found when loaded as a Node module from the directory "/src/repo".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: npm install eslint-plugin-unicorn@latest --save-dev The plugin "eslint-plugin-unicorn" was referenced from the config file in ".eslintrc.json » eslint-config-wikimedia/client-es6 » ./language/es6 » ./rules-es6". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team. --- stdout --- --- end --- $ ./node_modules/.bin/eslint . -f json --- stderr --- Oops! Something went wrong! :( ESLint: 7.32.0 ESLint couldn't find the plugin "eslint-plugin-unicorn". (The package "eslint-plugin-unicorn" was not found when loaded as a Node module from the directory "/src/repo".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: npm install eslint-plugin-unicorn@latest --save-dev The plugin "eslint-plugin-unicorn" was referenced from the config file in ".eslintrc.json » eslint-config-wikimedia/client-es6 » ./language/es6 » ./rules-es6". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team. --- stdout --- --- end --- Traceback (most recent call last): File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run self.npm_upgrade(plan) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade hook(update) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint errors = json.loads(self.check_call([ File "/usr/lib/python3.9/json/__init__.py", line 346, in loads return _default_decoder.decode(s) File "/usr/lib/python3.9/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)