mediawiki/skins/MinervaNeue: main (log #958414)

sourcepatches

This run took 64 seconds.

$ date
--- stdout ---
Fri Mar 17 22:35:54 UTC 2023

--- end ---
$ git clone file:///srv/git/mediawiki-skins-MinervaNeue.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
4ed759482836bf10d9cb517045b7545da87ae2f7 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@storybook/components": {
      "name": "@storybook/components",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "react-syntax-highlighter"
      ],
      "effects": [
        "@storybook/ui"
      ],
      "range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28",
      "nodes": [
        "node_modules/@storybook/components"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "@storybook/core": {
      "name": "@storybook/core",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "@storybook/ui",
        "ejs",
        "react-dev-utils"
      ],
      "effects": [
        "@storybook/html"
      ],
      "range": "4.0.0-alpha.0 - 6.1.19 || 6.2.0-alpha.0 - 6.2.0-rc.13",
      "nodes": [
        "node_modules/@storybook/core"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "@storybook/html": {
      "name": "@storybook/html",
      "severity": "critical",
      "isDirect": true,
      "via": [
        "@storybook/core"
      ],
      "effects": [],
      "range": "<=6.0.0-rc.30",
      "nodes": [
        "node_modules/@storybook/html"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "@storybook/ui": {
      "name": "@storybook/ui",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@storybook/components"
      ],
      "effects": [
        "@storybook/core"
      ],
      "range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28",
      "nodes": [
        "node_modules/@storybook/ui"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "browserslist": {
      "name": "browserslist",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1089762,
          "name": "browserslist",
          "dependency": "browserslist",
          "title": "Regular Expression Denial of Service in browserslist",
          "url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <4.16.5"
        }
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "4.0.0 - 4.16.4",
      "nodes": [
        "node_modules/react-dev-utils/node_modules/browserslist"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "chokidar": {
      "name": "chokidar",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob-parent"
      ],
      "effects": [
        "fork-ts-checker-webpack-plugin",
        "watchpack-chokidar2"
      ],
      "range": "1.0.0-rc1 - 2.1.8",
      "nodes": [
        "node_modules/fork-ts-checker-webpack-plugin/node_modules/chokidar",
        "node_modules/watchpack-chokidar2/node_modules/chokidar"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "ejs": {
      "name": "ejs",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1089270,
          "name": "ejs",
          "dependency": "ejs",
          "title": "ejs template injection vulnerability",
          "url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q",
          "severity": "critical",
          "cwe": [
            "CWE-74"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<3.1.7"
        }
      ],
      "effects": [
        "@storybook/core"
      ],
      "range": "<3.1.7",
      "nodes": [
        "node_modules/ejs"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "fast-glob": {
      "name": "fast-glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        "glob-parent"
      ],
      "effects": [
        "globby"
      ],
      "range": "<=2.2.7",
      "nodes": [
        "node_modules/fast-glob"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "fork-ts-checker-webpack-plugin": {
      "name": "fork-ts-checker-webpack-plugin",
      "severity": "high",
      "isDirect": false,
      "via": [
        "chokidar"
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "<=3.1.0",
      "nodes": [
        "node_modules/fork-ts-checker-webpack-plugin"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "glob-parent": {
      "name": "glob-parent",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091181,
          "name": "glob-parent",
          "dependency": "glob-parent",
          "title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
          "url": "https://github.com/advisories/GHSA-ww39-953v-wcq6",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<5.1.2"
        }
      ],
      "effects": [
        "chokidar",
        "fast-glob"
      ],
      "range": "<5.1.2",
      "nodes": [
        "node_modules/fast-glob/node_modules/glob-parent",
        "node_modules/fork-ts-checker-webpack-plugin/node_modules/glob-parent",
        "node_modules/watchpack-chokidar2/node_modules/glob-parent"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "globby": {
      "name": "globby",
      "severity": "high",
      "isDirect": false,
      "via": [
        "fast-glob"
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "8.0.0 - 9.2.0",
      "nodes": [
        "node_modules/globby"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "highlight.js": {
      "name": "highlight.js",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1086450,
          "name": "highlight.js",
          "dependency": "highlight.js",
          "title": "ReDOS vulnerabities: multiple grammars",
          "url": "https://github.com/advisories/GHSA-7wwv-vh3v-89cq",
          "severity": "moderate",
          "cwe": [
            "CWE-20",
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=9.0.0 <10.4.1"
        },
        {
          "source": 1090060,
          "name": "highlight.js",
          "dependency": "highlight.js",
          "title": "Prototype Pollution in highlight.js",
          "url": "https://github.com/advisories/GHSA-vfrc-7r7c-w9mx",
          "severity": "moderate",
          "cwe": [
            "CWE-471"
          ],
          "cvss": {
            "score": 5.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N"
          },
          "range": "<9.18.2"
        }
      ],
      "effects": [
        "lowlight",
        "react-syntax-highlighter"
      ],
      "range": "<=10.4.0",
      "nodes": [
        "node_modules/highlight.js"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "immer": {
      "name": "immer",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1089281,
          "name": "immer",
          "dependency": "immer",
          "title": "Prototype Pollution in immer",
          "url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx",
          "severity": "high",
          "cwe": [
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<9.0.6"
        },
        {
          "source": 1089656,
          "name": "immer",
          "dependency": "immer",
          "title": "Prototype Pollution in immer",
          "url": "https://github.com/advisories/GHSA-33f9-j839-rf8h",
          "severity": "critical",
          "cwe": [
            "CWE-843",
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<9.0.6"
        },
        {
          "source": 1090038,
          "name": "immer",
          "dependency": "immer",
          "title": "Prototype Pollution in immer",
          "url": "https://github.com/advisories/GHSA-9qmh-276g-x5pj",
          "severity": "high",
          "cwe": [
            "CWE-471"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<8.0.1"
        }
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "<=9.0.5",
      "nodes": [
        "node_modules/immer"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "jsdoc": {
      "name": "jsdoc",
      "severity": "high",
      "isDirect": true,
      "via": [
        "taffydb"
      ],
      "effects": [],
      "range": "3.2.0-dev - 3.6.11",
      "nodes": [
        "node_modules/jsdoc"
      ],
      "fixAvailable": {
        "name": "jsdoc",
        "version": "4.0.2",
        "isSemVerMajor": true
      }
    },
    "less": {
      "name": "less",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request"
      ],
      "effects": [],
      "range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3",
      "nodes": [
        "node_modules/less"
      ],
      "fixAvailable": {
        "name": "less",
        "version": "3.13.1",
        "isSemVerMajor": false
      }
    },
    "loader-utils": {
      "name": "loader-utils",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1091186,
          "name": "loader-utils",
          "dependency": "loader-utils",
          "title": "Prototype pollution in webpack loader-utils",
          "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<1.4.1"
        },
        {
          "source": 1091248,
          "name": "loader-utils",
          "dependency": "loader-utils",
          "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
          "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=1.0.0 <1.4.2"
        },
        {
          "source": 1091251,
          "name": "loader-utils",
          "dependency": "loader-utils",
          "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
          "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=1.0.0 <1.4.2"
        }
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "<=1.4.1",
      "nodes": [
        "node_modules/react-dev-utils/node_modules/loader-utils"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "lowlight": {
      "name": "lowlight",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "highlight.js"
      ],
      "effects": [
        "react-syntax-highlighter"
      ],
      "range": "1.2.0 - 1.13.1",
      "nodes": [
        "node_modules/lowlight"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091174,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS vulnerability",
          "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.5"
        }
      ],
      "effects": [
        "recursive-readdir"
      ],
      "range": "<3.0.5",
      "nodes": [
        "node_modules/recursive-readdir/node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": false
    },
    "prismjs": {
      "name": "prismjs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1087445,
          "name": "prismjs",
          "dependency": "prismjs",
          "title": "Cross-Site Scripting in Prism",
          "url": "https://github.com/advisories/GHSA-wvhm-4hhf-97x9",
          "severity": "high",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
          },
          "range": ">=1.1.0 <1.21.0"
        },
        {
          "source": 1089189,
          "name": "prismjs",
          "dependency": "prismjs",
          "title": "prismjs Regular Expression Denial of Service vulnerability",
          "url": "https://github.com/advisories/GHSA-hqhp-5p83-hx96",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<1.25.0"
        },
        {
          "source": 1089716,
          "name": "prismjs",
          "dependency": "prismjs",
          "title": "Regular Expression Denial of Service (ReDoS) in Prism",
          "url": "https://github.com/advisories/GHSA-gj77-59wh-66hg",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"
          },
          "range": "<1.24.0"
        },
        {
          "source": 1090014,
          "name": "prismjs",
          "dependency": "prismjs",
          "title": "Denial of service in prismjs",
          "url": "https://github.com/advisories/GHSA-h4hr-7fg3-h35w",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<1.23.0"
        },
        {
          "source": 1090424,
          "name": "prismjs",
          "dependency": "prismjs",
          "title": "Cross-site Scripting in Prism",
          "url": "https://github.com/advisories/GHSA-3949-f494-cm99",
          "severity": "high",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
          },
          "range": ">=1.14.0 <1.27.0"
        }
      ],
      "effects": [
        "refractor"
      ],
      "range": "<=1.26.0",
      "nodes": [
        "node_modules/refractor/node_modules/prismjs"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "react-dev-utils": {
      "name": "react-dev-utils",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1089062,
          "name": "react-dev-utils",
          "dependency": "react-dev-utils",
          "title": "react-dev-utils OS Command Injection in function `getProcessForPort`",
          "url": "https://github.com/advisories/GHSA-5q6m-3h65-w53x",
          "severity": "moderate",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 5.6,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": ">=0.4.0 <11.0.4"
        },
        "browserslist",
        "fork-ts-checker-webpack-plugin",
        "globby",
        "immer",
        "loader-utils",
        "recursive-readdir",
        "shell-quote"
      ],
      "effects": [
        "@storybook/core"
      ],
      "range": "0.4.0 - 12.0.0-next.60",
      "nodes": [
        "node_modules/react-dev-utils"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "react-syntax-highlighter": {
      "name": "react-syntax-highlighter",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "highlight.js",
        "lowlight",
        "refractor"
      ],
      "effects": [
        "@storybook/components"
      ],
      "range": "2.0.4 - 12.2.1",
      "nodes": [
        "node_modules/react-syntax-highlighter"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "recursive-readdir": {
      "name": "recursive-readdir",
      "severity": "high",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "1.2.0 - 2.2.2",
      "nodes": [
        "node_modules/recursive-readdir"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "refractor": {
      "name": "refractor",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "prismjs"
      ],
      "effects": [
        "react-syntax-highlighter"
      ],
      "range": "<=3.4.0 || 4.0.0 - 4.1.1",
      "nodes": [
        "node_modules/refractor"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1091410,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.88.2"
        }
      ],
      "effects": [
        "less",
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": false
    },
    "shell-quote": {
      "name": "shell-quote",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1090195,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "Improper Neutralization of Special Elements used in a Command in Shell-quote",
          "url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7",
          "severity": "critical",
          "cwe": [
            "CWE-77"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=1.7.2"
        }
      ],
      "effects": [
        "react-dev-utils"
      ],
      "range": "<=1.7.2",
      "nodes": [
        "node_modules/shell-quote"
      ],
      "fixAvailable": {
        "name": "@storybook/html",
        "version": "6.5.16",
        "isSemVerMajor": true
      }
    },
    "taffydb": {
      "name": "taffydb",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1089386,
          "name": "taffydb",
          "dependency": "taffydb",
          "title": "TaffyDB can allow access to any data items in the DB",
          "url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-668"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": "<=2.7.3"
        }
      ],
      "effects": [
        "jsdoc"
      ],
      "range": "*",
      "nodes": [
        "node_modules/taffydb"
      ],
      "fixAvailable": {
        "name": "jsdoc",
        "version": "4.0.2",
        "isSemVerMajor": true
      }
    },
    "watchpack": {
      "name": "watchpack",
      "severity": "high",
      "isDirect": false,
      "via": [
        "watchpack-chokidar2"
      ],
      "effects": [
        "webpack"
      ],
      "range": "1.7.2 - 1.7.5",
      "nodes": [
        "node_modules/watchpack"
      ],
      "fixAvailable": true
    },
    "watchpack-chokidar2": {
      "name": "watchpack-chokidar2",
      "severity": "high",
      "isDirect": false,
      "via": [
        "chokidar"
      ],
      "effects": [
        "watchpack"
      ],
      "range": "*",
      "nodes": [
        "node_modules/watchpack-chokidar2"
      ],
      "fixAvailable": true
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": false
    },
    "webpack": {
      "name": "webpack",
      "severity": "high",
      "isDirect": false,
      "via": [
        "watchpack"
      ],
      "effects": [],
      "range": "4.44.0 - 4.46.0",
      "nodes": [
        "node_modules/webpack"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 11,
      "high": 13,
      "critical": 7,
      "total": 31
    },
    "dependencies": {
      "prod": 1,
      "dev": 2065,
      "optional": 38,
      "peer": 0,
      "peerOptional": 0,
      "total": 2065
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No lock file found. Updating dependencies instead of installing from lock file. Use composer update over composer install if you do not have a lock file.
Loading composer repositories with package information
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Lock file operations: 36 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.1.0)
  - Locking composer/semver (3.3.2)
  - Locking composer/spdx-licenses (1.5.7)
  - Locking composer/xdebug-handler (3.0.3)
  - Locking doctrine/deprecations (v1.0.0)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking mediawiki/mediawiki-codesniffer (v41.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.12.0)
  - Locking mediawiki/minus-x (1.1.1)
  - Locking mediawiki/phan-taint-check-plugin (4.0.0)
  - Locking microsoft/tolerant-php-parser (v0.1.1)
  - Locking netresearch/jsonmapper (v4.1.0)
  - Locking phan/phan (5.4.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.3.2)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.3.0)
  - Locking phpdocumentor/type-resolver (1.7.0)
  - Locking phpstan/phpdoc-parser (1.16.1)
  - Locking psr/container (1.1.2)
  - Locking psr/log (1.1.4)
  - Locking sabre/event (5.1.4)
  - Locking squizlabs/php_codesniffer (3.7.2)
  - Locking symfony/console (v5.4.21)
  - Locking symfony/deprecation-contracts (v2.5.2)
  - Locking symfony/polyfill-ctype (v1.27.0)
  - Locking symfony/polyfill-intl-grapheme (v1.27.0)
  - Locking symfony/polyfill-intl-normalizer (v1.27.0)
  - Locking symfony/polyfill-mbstring (v1.27.0)
  - Locking symfony/polyfill-php73 (v1.27.0)
  - Locking symfony/polyfill-php80 (v1.27.0)
  - Locking symfony/service-contracts (v2.5.2)
  - Locking symfony/string (v5.4.21)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 36 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]    0 [--->------------------------]  - Installing composer/pcre (3.1.0): Extracting archive
  - Installing symfony/polyfill-php80 (v1.27.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.7.2): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.27.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.7): Extracting archive
  - Installing composer/semver (3.3.2): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.27.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.27.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.27.0): Extracting archive
  - Installing symfony/string (v5.4.21): Extracting archive
  - Installing symfony/deprecation-contracts (v2.5.2): Extracting archive
  - Installing psr/container (1.1.2): Extracting archive
  - Installing symfony/service-contracts (v2.5.2): Extracting archive
  - Installing symfony/polyfill-php73 (v1.27.0): Extracting archive
  - Installing symfony/console (v5.4.21): Extracting archive
  - Installing sabre/event (5.1.4): Extracting archive
  - Installing netresearch/jsonmapper (v4.1.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive
  - Installing webmozart/assert (1.11.0): Extracting archive
  - Installing phpstan/phpdoc-parser (1.16.1): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (v1.0.0): Extracting archive
  - Installing phpdocumentor/type-resolver (1.7.0): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (1.1.4): Extracting archive
  - Installing composer/xdebug-handler (3.0.3): Extracting archive
  - Installing phan/phan (5.4.1): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (4.0.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.12.0): Extracting archive
  - Installing mediawiki/minus-x (1.1.1): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive
  0/27 [>---------------------------]   0%
 10/27 [==========>-----------------]  37%
 19/27 [===================>--------]  70%
 26/27 [==========================>-]  96%
 27/27 [============================] 100%4 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
14 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---

--- end ---
Upgrading n:eslint-config-wikimedia from 0.22.1 -> 0.24.0
Upgrading n:stylelint-config-wikimedia from 0.13.0 -> 0.14.0
$ /usr/bin/npm install
--- stderr ---
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN Found: @babel/core@7.7.7
npm WARN node_modules/@babel/core
npm WARN   dev @babel/core@"7.7.7" from the root project
npm WARN   72 more (@babel/helper-compilation-targets, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining
npm WARN   @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10
npm WARN   node_modules/@babel/preset-env
npm WARN 
npm WARN Conflicting peer dependency: @babel/core@7.21.3
npm WARN node_modules/@babel/core
npm WARN   peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN   node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining
npm WARN     @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10
npm WARN     node_modules/@babel/preset-env
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/plugin-proposal-class-static-block@7.17.6
npm WARN Found: @babel/core@7.7.7
npm WARN node_modules/@babel/core
npm WARN   dev @babel/core@"7.7.7" from the root project
npm WARN   72 more (@babel/helper-compilation-targets, ...)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block
npm WARN   @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10
npm WARN   node_modules/@babel/preset-env
npm WARN 
npm WARN Conflicting peer dependency: @babel/core@7.21.3
npm WARN node_modules/@babel/core
npm WARN   peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6
npm WARN   node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block
npm WARN     @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10
npm WARN     node_modules/@babel/preset-env
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@wdio/sync@7.19.5',
npm WARN EBADENGINE   required: { node: '>=12.0.0 <16' },
npm WARN EBADENGINE   current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
npm WARN deprecated highlight.js@9.12.0: Version no longer supported. Upgrade to @latest
npm WARN deprecated puppeteer@9.1.1: Version no longer supported. Upgrade to @latest
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 2058 packages, and audited 2059 packages in 31s

188 packages are looking for funding
  run `npm fund` for details

31 vulnerabilities (11 moderate, 13 high, 7 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(

ESLint: 8.36.0

Error: Cannot read config file: /src/repo/resources/.eslintrc.js
Error: Cannot find module 'eslint-config-wikimedia/language/merge.js'
Require stack:
- /src/repo/resources/.eslintrc.js
- /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs
- /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js
- /src/repo/node_modules/eslint/lib/eslint/eslint.js
- /src/repo/node_modules/eslint/lib/eslint/index.js
- /src/repo/node_modules/eslint/lib/cli.js
- /src/repo/node_modules/eslint/bin/eslint.js
Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15)
    at Function.Module._load (node:internal/modules/cjs/loader:804:27)
    at Module.require (node:internal/modules/cjs/loader:1028:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15)
    at Module._compile (node:internal/modules/cjs/loader:1126:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10)
    at Module.load (node:internal/modules/cjs/loader:1004:32)
    at Function.Module._load (node:internal/modules/cjs/loader:839:12)
    at Module.require (node:internal/modules/cjs/loader:1028:19)
--- stdout ---

--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(

ESLint: 8.36.0

Error: Cannot read config file: /src/repo/resources/.eslintrc.js
Error: Cannot find module 'eslint-config-wikimedia/language/merge.js'
Require stack:
- /src/repo/resources/.eslintrc.js
- /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs
- /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js
- /src/repo/node_modules/eslint/lib/eslint/eslint.js
- /src/repo/node_modules/eslint/lib/eslint/index.js
- /src/repo/node_modules/eslint/lib/cli.js
- /src/repo/node_modules/eslint/bin/eslint.js
Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15)
    at Function.Module._load (node:internal/modules/cjs/loader:804:27)
    at Module.require (node:internal/modules/cjs/loader:1028:19)
    at require (node:internal/modules/cjs/helpers:102:18)
    at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15)
    at Module._compile (node:internal/modules/cjs/loader:1126:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10)
    at Module.load (node:internal/modules/cjs/loader:1004:32)
    at Function.Module._load (node:internal/modules/cjs/loader:839:12)
    at Module.require (node:internal/modules/cjs/loader:1028:19)
--- stdout ---

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run
    self.npm_upgrade(plan)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade
    hook(update)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint
    errors = json.loads(self.check_call([
  File "/usr/lib/python3.9/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.9/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Source code is licensed under the AGPL.