mediawiki/services/push-notifications: main (log #963046)

sourcepatches

This run took 53 seconds.

$ date
--- stdout ---
Mon Mar 20 06:34:42 UTC 2023

--- end ---
$ git clone file:///srv/git/mediawiki-services-push-notifications.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
5e7d387660ff5c58d0a66dd1d1fc57efc7e8f825 refs/heads/master

--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wikimedia/apn": {
      "name": "@wikimedia/apn",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "jsonwebtoken",
        "node-forge"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/@wikimedia/apn"
      ],
      "fixAvailable": false
    },
    "ansi-regex": {
      "name": "ansi-regex",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091188,
          "name": "ansi-regex",
          "dependency": "ansi-regex",
          "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
          "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
          "severity": "high",
          "cwe": [
            "CWE-697",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.0.1"
        },
        {
          "source": 1091189,
          "name": "ansi-regex",
          "dependency": "ansi-regex",
          "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
          "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
          "severity": "high",
          "cwe": [
            "CWE-697",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.1.1"
        }
      ],
      "effects": [],
      "range": "3.0.0 || 4.0.0 - 4.1.0",
      "nodes": [
        "node_modules/ansi-align/node_modules/ansi-regex",
        "node_modules/concurrently/node_modules/ansi-regex",
        "node_modules/rewire/node_modules/ansi-regex",
        "node_modules/service-runner/node_modules/ansi-regex",
        "node_modules/wide-align/node_modules/ansi-regex"
      ],
      "fixAvailable": true
    },
    "body-parser": {
      "name": "body-parser",
      "severity": "high",
      "isDirect": true,
      "via": [
        "qs"
      ],
      "effects": [],
      "range": "1.19.0",
      "nodes": [
        "node_modules/body-parser"
      ],
      "fixAvailable": true
    },
    "cookiejar": {
      "name": "cookiejar",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088659,
          "name": "cookiejar",
          "dependency": "cookiejar",
          "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function",
          "url": "https://github.com/advisories/GHSA-h452-7996-h45h",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<2.1.4"
        }
      ],
      "effects": [],
      "range": "<2.1.4",
      "nodes": [
        "node_modules/cookiejar"
      ],
      "fixAvailable": true
    },
    "degenerator": {
      "name": "degenerator",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090403,
          "name": "degenerator",
          "dependency": "degenerator",
          "title": "Code Injection in pac-resolver",
          "url": "https://github.com/advisories/GHSA-9j49-mfvp-vmhm",
          "severity": "high",
          "cwe": [
            "CWE-94"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<3.0.1"
        }
      ],
      "effects": [
        "pac-resolver"
      ],
      "range": "<3.0.1",
      "nodes": [
        "node_modules/degenerator"
      ],
      "fixAvailable": {
        "name": "proxy-agent",
        "version": "5.0.0",
        "isSemVerMajor": true
      }
    },
    "dicer": {
      "name": "dicer",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1088997,
          "name": "dicer",
          "dependency": "dicer",
          "title": "Crash in HeaderParser in dicer",
          "url": "https://github.com/advisories/GHSA-wm7h-9275-46v2",
          "severity": "high",
          "cwe": [
            "CWE-248"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=0.3.1"
        }
      ],
      "effects": [
        "firebase-admin"
      ],
      "range": "*",
      "nodes": [
        "node_modules/dicer"
      ],
      "fixAvailable": {
        "name": "firebase-admin",
        "version": "11.5.0",
        "isSemVerMajor": true
      }
    },
    "express": {
      "name": "express",
      "severity": "high",
      "isDirect": true,
      "via": [
        "body-parser",
        "qs"
      ],
      "effects": [],
      "range": "4.17.0 - 4.17.1 || 5.0.0-alpha.1 - 5.0.0-alpha.8",
      "nodes": [
        "node_modules/express"
      ],
      "fixAvailable": true
    },
    "firebase-admin": {
      "name": "firebase-admin",
      "severity": "high",
      "isDirect": true,
      "via": [
        "dicer",
        "jsonwebtoken",
        "node-forge"
      ],
      "effects": [],
      "range": "4.0.0 - 11.4.0",
      "nodes": [
        "node_modules/firebase-admin"
      ],
      "fixAvailable": {
        "name": "firebase-admin",
        "version": "11.5.0",
        "isSemVerMajor": true
      }
    },
    "google-gax": {
      "name": "google-gax",
      "severity": "high",
      "isDirect": false,
      "via": [
        "protobufjs"
      ],
      "effects": [],
      "range": "2.2.1-pre - 2.2.1-pre.2 || 2.21.1 - 2.30.4 || 3.0.0 - 3.0.1",
      "nodes": [
        "node_modules/google-gax"
      ],
      "fixAvailable": true
    },
    "google-p12-pem": {
      "name": "google-p12-pem",
      "severity": "low",
      "isDirect": false,
      "via": [
        "node-forge"
      ],
      "effects": [],
      "range": "<=3.1.2",
      "nodes": [
        "node_modules/google-p12-pem"
      ],
      "fixAvailable": true
    },
    "got": {
      "name": "got",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088948,
          "name": "got",
          "dependency": "got",
          "title": "Got allows a redirect to a UNIX socket",
          "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
          "severity": "moderate",
          "cwe": [],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<11.8.5"
        }
      ],
      "effects": [
        "package-json"
      ],
      "range": "<11.8.5",
      "nodes": [
        "node_modules/got"
      ],
      "fixAvailable": true
    },
    "http-cache-semantics": {
      "name": "http-cache-semantics",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090532,
          "name": "http-cache-semantics",
          "dependency": "http-cache-semantics",
          "title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<4.1.1"
        }
      ],
      "effects": [],
      "range": "<4.1.1",
      "nodes": [
        "node_modules/http-cache-semantics"
      ],
      "fixAvailable": true
    },
    "ini": {
      "name": "ini",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091252,
          "name": "ini",
          "dependency": "ini",
          "title": "ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse",
          "url": "https://github.com/advisories/GHSA-qqgx-2p2h-9c37",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "<1.3.6"
        }
      ],
      "effects": [],
      "range": "<1.3.6",
      "nodes": [
        "node_modules/gc-stats/node_modules/ini"
      ],
      "fixAvailable": true
    },
    "jose": {
      "name": "jose",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088856,
          "name": "jose",
          "dependency": "jose",
          "title": "JOSE vulnerable to resource exhaustion via specifically crafted JWE",
          "url": "https://github.com/advisories/GHSA-jv3g-j58f-9mq9",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0 <=2.0.5"
        }
      ],
      "effects": [],
      "range": ">=2.0 <=2.0.5",
      "nodes": [
        "node_modules/jose"
      ],
      "fixAvailable": true
    },
    "json-schema": {
      "name": "json-schema",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1089513,
          "name": "json-schema",
          "dependency": "json-schema",
          "title": "json-schema is vulnerable to Prototype Pollution",
          "url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
          "severity": "critical",
          "cwe": [
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<0.4.0"
        }
      ],
      "effects": [
        "jsprim"
      ],
      "range": "<0.4.0",
      "nodes": [
        "node_modules/json-schema"
      ],
      "fixAvailable": true
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091148,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": ">=2.0.0 <2.2.2"
        }
      ],
      "effects": [],
      "range": "2.0.0 - 2.2.1",
      "nodes": [
        "node_modules/json5"
      ],
      "fixAvailable": true
    },
    "jsonwebtoken": {
      "name": "jsonwebtoken",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1089434,
          "name": "jsonwebtoken",
          "dependency": "jsonwebtoken",
          "title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ",
          "url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33",
          "severity": "moderate",
          "cwe": [
            "CWE-327"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=8.5.1"
        },
        {
          "source": 1091087,
          "name": "jsonwebtoken",
          "dependency": "jsonwebtoken",
          "title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC",
          "url": "https://github.com/advisories/GHSA-hjrf-2m68-5959",
          "severity": "moderate",
          "cwe": [
            "CWE-287"
          ],
          "cvss": {
            "score": 5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "<=8.5.1"
        },
        {
          "source": 1091170,
          "name": "jsonwebtoken",
          "dependency": "jsonwebtoken",
          "title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()",
          "url": "https://github.com/advisories/GHSA-qwph-4952-7xr6",
          "severity": "moderate",
          "cwe": [
            "CWE-287",
            "CWE-327"
          ],
          "cvss": {
            "score": 6.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
          },
          "range": "<9.0.0"
        }
      ],
      "effects": [
        "firebase-admin"
      ],
      "range": "<=8.5.1",
      "nodes": [
        "node_modules/jsonwebtoken"
      ],
      "fixAvailable": {
        "name": "firebase-admin",
        "version": "11.5.0",
        "isSemVerMajor": true
      }
    },
    "jsprim": {
      "name": "jsprim",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "json-schema"
      ],
      "effects": [],
      "range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
      "nodes": [
        "node_modules/jsprim"
      ],
      "fixAvailable": true
    },
    "latest-version": {
      "name": "latest-version",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "package-json"
      ],
      "effects": [
        "update-notifier"
      ],
      "range": "0.2.0 - 5.1.0",
      "nodes": [
        "node_modules/latest-version"
      ],
      "fixAvailable": true
    },
    "limitation": {
      "name": "limitation",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "wikimedia-kad-fork"
      ],
      "effects": [],
      "range": ">=0.2.3",
      "nodes": [
        "node_modules/limitation"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091174,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS vulnerability",
          "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.5"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<3.0.5",
      "nodes": [
        "node_modules/gc-stats/node_modules/minimatch",
        "node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.2.0",
        "isSemVerMajor": true
      }
    },
    "minimist": {
      "name": "minimist",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1090097,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.6,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": ">=1.0.0 <1.2.3"
        },
        {
          "source": 1090098,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.6,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "<0.2.1"
        },
        {
          "source": 1091172,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<0.2.4"
        },
        {
          "source": 1091173,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.0.0 <1.2.6"
        }
      ],
      "effects": [
        "mkdirp"
      ],
      "range": "<=0.2.3 || 1.0.0 - 1.2.5",
      "nodes": [
        "node_modules/gc-stats/node_modules/minimist",
        "node_modules/gc-stats/node_modules/rc/node_modules/minimist",
        "node_modules/minimist"
      ],
      "fixAvailable": true
    },
    "mkdirp": {
      "name": "mkdirp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "minimist"
      ],
      "effects": [],
      "range": "0.4.1 - 0.5.1",
      "nodes": [
        "node_modules/gc-stats/node_modules/mkdirp"
      ],
      "fixAvailable": true
    },
    "mocha": {
      "name": "mocha",
      "severity": "high",
      "isDirect": true,
      "via": [
        "minimatch",
        "nanoid"
      ],
      "effects": [],
      "range": "5.1.0 - 9.2.1",
      "nodes": [
        "node_modules/mocha"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.2.0",
        "isSemVerMajor": true
      }
    },
    "moment": {
      "name": "moment",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090141,
          "name": "moment",
          "dependency": "moment",
          "title": "Moment.js vulnerable to Inefficient Regular Expression Complexity",
          "url": "https://github.com/advisories/GHSA-wc69-rhjr-hc9g",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.18.0 <2.29.4"
        },
        {
          "source": 1090142,
          "name": "moment",
          "dependency": "moment",
          "title": "Path Traversal: 'dir/../../filename' in moment.locale",
          "url": "https://github.com/advisories/GHSA-8hfj-j24r-96c4",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-27"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<2.29.2"
        }
      ],
      "effects": [],
      "range": "<=2.29.3",
      "nodes": [
        "node_modules/moment"
      ],
      "fixAvailable": true
    },
    "ms": {
      "name": "ms",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088818,
          "name": "ms",
          "dependency": "ms",
          "title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
          "url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<2.0.0"
        }
      ],
      "effects": [
        "wikimedia-kad-fork"
      ],
      "range": "<2.0.0",
      "nodes": [
        "node_modules/wikimedia-kad-fork/node_modules/ms"
      ],
      "fixAvailable": true
    },
    "nanoid": {
      "name": "nanoid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1089011,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
          "url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
          "severity": "moderate",
          "cwe": [
            "CWE-200"
          ],
          "cvss": {
            "score": 5.5,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=3.0.0 <3.1.31"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "3.0.0 - 3.1.30",
      "nodes": [
        "node_modules/nanoid"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.2.0",
        "isSemVerMajor": true
      }
    },
    "netmask": {
      "name": "netmask",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1089900,
          "name": "netmask",
          "dependency": "netmask",
          "title": "Improper parsing of octal bytes in netmask",
          "url": "https://github.com/advisories/GHSA-4c7m-wxvm-r7gc",
          "severity": "critical",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<1.1.0"
        },
        {
          "source": 1089963,
          "name": "netmask",
          "dependency": "netmask",
          "title": "netmask npm package vulnerable to octal input data",
          "url": "https://github.com/advisories/GHSA-pch5-whg9-qr2r",
          "severity": "moderate",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<2.0.1"
        }
      ],
      "effects": [
        "pac-resolver"
      ],
      "range": "<=2.0.0",
      "nodes": [
        "node_modules/netmask"
      ],
      "fixAvailable": {
        "name": "proxy-agent",
        "version": "5.0.0",
        "isSemVerMajor": true
      }
    },
    "node-fetch": {
      "name": "node-fetch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1091239,
          "name": "node-fetch",
          "dependency": "node-fetch",
          "title": "node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor",
          "url": "https://github.com/advisories/GHSA-r683-j2x4-v87g",
          "severity": "high",
          "cwe": [
            "CWE-173",
            "CWE-200",
            "CWE-601"
          ],
          "cvss": {
            "score": 8.8,
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<2.6.7"
        }
      ],
      "effects": [],
      "range": "<2.6.7",
      "nodes": [
        "node_modules/node-fetch"
      ],
      "fixAvailable": true
    },
    "node-forge": {
      "name": "node-forge",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1088227,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Prototype Pollution in node-forge debug API.",
          "url": "https://github.com/advisories/GHSA-5rrq-pxf6-6jx5",
          "severity": "low",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<1.0.0"
        },
        {
          "source": 1088228,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Prototype Pollution in node-forge util.setPath API",
          "url": "https://github.com/advisories/GHSA-wxgw-qj99-44c2",
          "severity": "low",
          "cwe": [],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.10.0"
        },
        {
          "source": 1088229,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "URL parsing in node-forge could lead to undesired behavior.",
          "url": "https://github.com/advisories/GHSA-gf8q-jrpm-jvxq",
          "severity": "low",
          "cwe": [
            "CWE-601"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<1.0.0"
        },
        {
          "source": 1088746,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Improper Verification of Cryptographic Signature in `node-forge`",
          "url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr",
          "severity": "moderate",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<1.3.0"
        },
        {
          "source": 1090460,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Open Redirect in node-forge",
          "url": "https://github.com/advisories/GHSA-8fr3-hfg3-gpgp",
          "severity": "moderate",
          "cwe": [
            "CWE-601"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<1.0.0"
        },
        {
          "source": 1091350,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Improper Verification of Cryptographic Signature in node-forge",
          "url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.3.0"
        },
        {
          "source": 1091351,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Improper Verification of Cryptographic Signature in node-forge",
          "url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<1.3.0"
        },
        {
          "source": 1091353,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Prototype Pollution in node-forge",
          "url": "https://github.com/advisories/GHSA-92xj-mqp7-vmcj",
          "severity": "high",
          "cwe": [
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 8.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
          },
          "range": "<0.10.0"
        }
      ],
      "effects": [
        "@wikimedia/apn",
        "firebase-admin",
        "google-p12-pem"
      ],
      "range": "<=1.2.1",
      "nodes": [
        "node_modules/firebase-admin/node_modules/node-forge",
        "node_modules/google-p12-pem/node_modules/node-forge",
        "node_modules/node-forge"
      ],
      "fixAvailable": {
        "name": "firebase-admin",
        "version": "11.5.0",
        "isSemVerMajor": true
      }
    },
    "nodemon": {
      "name": "nodemon",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "update-notifier"
      ],
      "effects": [],
      "range": "1.3.5 - 2.0.16 || 2.0.18",
      "nodes": [
        "node_modules/nodemon"
      ],
      "fixAvailable": true
    },
    "pac-proxy-agent": {
      "name": "pac-proxy-agent",
      "severity": "high",
      "isDirect": false,
      "via": [
        "pac-resolver"
      ],
      "effects": [
        "proxy-agent"
      ],
      "range": "<=4.1.0",
      "nodes": [
        "node_modules/pac-proxy-agent"
      ],
      "fixAvailable": {
        "name": "proxy-agent",
        "version": "5.0.0",
        "isSemVerMajor": true
      }
    },
    "pac-resolver": {
      "name": "pac-resolver",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1090384,
          "name": "pac-resolver",
          "dependency": "pac-resolver",
          "title": "Code Injection in pac-resolver",
          "url": "https://github.com/advisories/GHSA-9j49-mfvp-vmhm",
          "severity": "high",
          "cwe": [
            "CWE-94"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<5.0.0"
        },
        "degenerator",
        "netmask"
      ],
      "effects": [
        "pac-proxy-agent"
      ],
      "range": "<=4.2.0",
      "nodes": [
        "node_modules/pac-resolver"
      ],
      "fixAvailable": {
        "name": "proxy-agent",
        "version": "5.0.0",
        "isSemVerMajor": true
      }
    },
    "package-json": {
      "name": "package-json",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "got"
      ],
      "effects": [
        "latest-version"
      ],
      "range": "<=6.5.0",
      "nodes": [
        "node_modules/package-json"
      ],
      "fixAvailable": true
    },
    "preq": {
      "name": "preq",
      "severity": "high",
      "isDirect": true,
      "via": [
        "request",
        "requestretry"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/preq"
      ],
      "fixAvailable": false
    },
    "protobufjs": {
      "name": "protobufjs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1089184,
          "name": "protobufjs",
          "dependency": "protobufjs",
          "title": "Prototype Pollution in protobufjs",
          "url": "https://github.com/advisories/GHSA-g954-5hwp-pp24",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=6.11.0 <6.11.3"
        }
      ],
      "effects": [
        "google-gax"
      ],
      "range": "6.11.0 - 6.11.2",
      "nodes": [
        "node_modules/protobufjs"
      ],
      "fixAvailable": true
    },
    "proxy-agent": {
      "name": "proxy-agent",
      "severity": "high",
      "isDirect": true,
      "via": [
        "pac-proxy-agent"
      ],
      "effects": [],
      "range": "1.1.0 - 4.0.1",
      "nodes": [
        "node_modules/proxy-agent"
      ],
      "fixAvailable": {
        "name": "proxy-agent",
        "version": "5.0.0",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090135,
          "name": "qs",
          "dependency": "qs",
          "title": "qs vulnerable to Prototype Pollution",
          "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.5.0 <6.5.3"
        },
        {
          "source": 1090137,
          "name": "qs",
          "dependency": "qs",
          "title": "qs vulnerable to Prototype Pollution",
          "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.7.0 <6.7.3"
        }
      ],
      "effects": [
        "body-parser",
        "express"
      ],
      "range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2",
      "nodes": [
        "node_modules/preq/node_modules/qs",
        "node_modules/qs",
        "node_modules/request/node_modules/qs"
      ],
      "fixAvailable": true
    },
    "request": {
      "name": "request",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1091410,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.88.2"
        }
      ],
      "effects": [
        "preq"
      ],
      "range": "*",
      "nodes": [
        "node_modules/preq/node_modules/request"
      ],
      "fixAvailable": false
    },
    "requestretry": {
      "name": "requestretry",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090420,
          "name": "requestretry",
          "dependency": "requestretry",
          "title": "Cookie exposure in requestretry",
          "url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
          "severity": "high",
          "cwe": [
            "CWE-200"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": "<7.0.0"
        }
      ],
      "effects": [
        "preq"
      ],
      "range": "<7.0.0",
      "nodes": [
        "node_modules/requestretry"
      ],
      "fixAvailable": false
    },
    "swagger-ui-dist": {
      "name": "swagger-ui-dist",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1085394,
          "name": "swagger-ui-dist",
          "dependency": "swagger-ui-dist",
          "title": "Server side request forgery in SwaggerUI",
          "url": "https://github.com/advisories/GHSA-qrmm-w75w-3wpx",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<4.1.3"
        },
        {
          "source": 1088759,
          "name": "swagger-ui-dist",
          "dependency": "swagger-ui-dist",
          "title": "Spoofing attack in swagger-ui-dist",
          "url": "https://github.com/advisories/GHSA-6c9x-mj3g-h47x",
          "severity": "moderate",
          "cwe": [
            "CWE-1021"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [],
      "range": "<=4.1.2",
      "nodes": [
        "node_modules/swagger-ui-dist"
      ],
      "fixAvailable": {
        "name": "swagger-ui-dist",
        "version": "4.18.1",
        "isSemVerMajor": true
      }
    },
    "tar": {
      "name": "tar",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1089684,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization",
          "url": "https://github.com/advisories/GHSA-3jfq-g458-7qm9",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
          },
          "range": ">=4.0.0 <4.4.14"
        },
        {
          "source": 1091313,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning",
          "url": "https://github.com/advisories/GHSA-r628-mhmh-qjhw",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-23",
            "CWE-59"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
          },
          "range": ">=4.0.0 <4.4.15"
        },
        {
          "source": 1091343,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links",
          "url": "https://github.com/advisories/GHSA-9r2w-394v-53qc",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-59"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
          },
          "range": "<4.4.16"
        },
        {
          "source": 1091346,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization",
          "url": "https://github.com/advisories/GHSA-5955-9wpr-37jh",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
          },
          "range": "<4.4.18"
        },
        {
          "source": 1091349,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links",
          "url": "https://github.com/advisories/GHSA-qq89-hq3f-393p",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-59"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
          },
          "range": "<4.4.18"
        }
      ],
      "effects": [],
      "range": "<=4.4.17",
      "nodes": [
        "node_modules/gc-stats/node_modules/tar"
      ],
      "fixAvailable": true
    },
    "update-notifier": {
      "name": "update-notifier",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "latest-version"
      ],
      "effects": [
        "nodemon"
      ],
      "range": "0.2.0 - 5.1.0",
      "nodes": [
        "node_modules/update-notifier"
      ],
      "fixAvailable": true
    },
    "wikimedia-kad-fork": {
      "name": "wikimedia-kad-fork",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "ms"
      ],
      "effects": [
        "limitation"
      ],
      "range": "*",
      "nodes": [
        "node_modules/wikimedia-kad-fork"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 15,
      "high": 22,
      "critical": 6,
      "total": 44
    },
    "dependencies": {
      "prod": 421,
      "dev": 555,
      "optional": 158,
      "peer": 0,
      "peerOptional": 0,
      "total": 1132
    }
  }
}

--- end ---
$ /usr/bin/npm install
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'push-notifications@0.0.1',
npm WARN EBADENGINE   required: { node: '^10' },
npm WARN EBADENGINE   current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
npm WARN deprecated kad-fs@0.0.4: This package is no longer maintained.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated kad-memstore@0.0.1: This package is no longer maintained.
npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated superagent@3.8.3: Please upgrade to v7.0.2+ of superagent.  We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing.  See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>.
--- stdout ---

added 977 packages, and audited 1044 packages in 31s

122 packages are looking for funding
  run `npm fund` for details

24 vulnerabilities (8 moderate, 12 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
Upgrading n:eslint-config-wikimedia from ^0.20.0 -> 0.24.0
$ /usr/bin/npm install
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'push-notifications@0.0.1',
npm WARN EBADENGINE   required: { node: '^10' },
npm WARN EBADENGINE   current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
--- stdout ---

added 65 packages, removed 13 packages, changed 13 packages, and audited 1096 packages in 3s

133 packages are looking for funding
  run `npm fund` for details

24 vulnerabilities (8 moderate, 12 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(

ESLint: 7.32.0

Error: .eslintrc.json » eslint-config-wikimedia/server » ./language/es2018:
	Environment key "es2018" is unknown

    at /src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:175:23
    at Array.forEach (<anonymous>)
    at ConfigValidator.validateEnvironment (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:169:34)
    at ConfigValidator.validateConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:319:18)
    at CascadingConfigArrayFactory._finalizeConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:493:23)
    at CascadingConfigArrayFactory.getConfigArrayForFile (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:299:21)
    at FileEnumerator._iterateFilesRecursive (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:445:49)
    at _iterateFilesRecursive.next (<anonymous>)
    at FileEnumerator.iterateFiles (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:296:49)
    at iterateFiles.next (<anonymous>)
--- stdout ---

--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(

ESLint: 7.32.0

Error: .eslintrc.json » eslint-config-wikimedia/server » ./language/es2018:
	Environment key "es2018" is unknown

    at /src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:175:23
    at Array.forEach (<anonymous>)
    at ConfigValidator.validateEnvironment (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:169:34)
    at ConfigValidator.validateConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:319:18)
    at CascadingConfigArrayFactory._finalizeConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:493:23)
    at CascadingConfigArrayFactory.getConfigArrayForFile (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:299:21)
    at FileEnumerator._iterateFilesRecursive (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:445:49)
    at _iterateFilesRecursive.next (<anonymous>)
    at FileEnumerator.iterateFiles (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:296:49)
    at iterateFiles.next (<anonymous>)
--- stdout ---

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run
    self.npm_upgrade(plan)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade
    hook(update)
  File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint
    errors = json.loads(self.check_call([
  File "/usr/lib/python3.9/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.9/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Source code is licensed under the AGPL.