This run took 64 seconds.
$ date --- stdout --- Wed Mar 22 22:30:47 UTC 2023 --- end --- $ git clone file:///srv/git/mediawiki-skins-MinervaNeue.git repo --depth=1 -b master --- stderr --- Cloning into 'repo'... --- stdout --- --- end --- $ git config user.name libraryupgrader --- stdout --- --- end --- $ git config user.email tools.libraryupgrader@tools.wmflabs.org --- stdout --- --- end --- $ git submodule update --init --- stdout --- --- end --- $ grr init --- stdout --- Installed commit-msg hook. --- end --- $ git show-ref refs/heads/master --- stdout --- 8944fd90e689f6f86646d628ddb9a24002801758 refs/heads/master --- end --- $ /usr/bin/npm audit --json --legacy-peer-deps --- stdout --- { "auditReportVersion": 2, "vulnerabilities": { "@storybook/components": { "name": "@storybook/components", "severity": "moderate", "isDirect": false, "via": [ "react-syntax-highlighter" ], "effects": [ "@storybook/ui" ], "range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28", "nodes": [ "node_modules/@storybook/components" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "@storybook/core": { "name": "@storybook/core", "severity": "critical", "isDirect": false, "via": [ "@storybook/ui", "ejs", "react-dev-utils" ], "effects": [ "@storybook/html" ], "range": "4.0.0-alpha.0 - 6.1.19 || 6.2.0-alpha.0 - 6.2.0-rc.13", "nodes": [ "node_modules/@storybook/core" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "@storybook/html": { "name": "@storybook/html", "severity": "critical", "isDirect": true, "via": [ "@storybook/core" ], "effects": [], "range": "<=6.0.0-rc.30", "nodes": [ "node_modules/@storybook/html" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "@storybook/ui": { "name": "@storybook/ui", "severity": "moderate", "isDirect": false, "via": [ "@storybook/components" ], "effects": [ "@storybook/core" ], "range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28", "nodes": [ "node_modules/@storybook/ui" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "browserslist": { "name": "browserslist", "severity": "moderate", "isDirect": false, "via": [ { "source": 1089762, "name": "browserslist", "dependency": "browserslist", "title": "Regular Expression Denial of Service in browserslist", "url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=4.0.0 <4.16.5" } ], "effects": [ "react-dev-utils" ], "range": "4.0.0 - 4.16.4", "nodes": [ "node_modules/react-dev-utils/node_modules/browserslist" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "chokidar": { "name": "chokidar", "severity": "high", "isDirect": false, "via": [ "glob-parent" ], "effects": [ "fork-ts-checker-webpack-plugin", "watchpack-chokidar2" ], "range": "1.0.0-rc1 - 2.1.8", "nodes": [ "node_modules/fork-ts-checker-webpack-plugin/node_modules/chokidar", "node_modules/watchpack-chokidar2/node_modules/chokidar" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "ejs": { "name": "ejs", "severity": "critical", "isDirect": false, "via": [ { "source": 1089270, "name": "ejs", "dependency": "ejs", "title": "ejs template injection vulnerability", "url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q", "severity": "critical", "cwe": [ "CWE-74" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<3.1.7" } ], "effects": [ "@storybook/core" ], "range": "<3.1.7", "nodes": [ "node_modules/ejs" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "fast-glob": { "name": "fast-glob", "severity": "high", "isDirect": false, "via": [ "glob-parent" ], "effects": [ "globby" ], "range": "<=2.2.7", "nodes": [ "node_modules/fast-glob" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "fork-ts-checker-webpack-plugin": { "name": "fork-ts-checker-webpack-plugin", "severity": "high", "isDirect": false, "via": [ "chokidar" ], "effects": [ "react-dev-utils" ], "range": "<=3.1.0", "nodes": [ "node_modules/fork-ts-checker-webpack-plugin" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "glob-parent": { "name": "glob-parent", "severity": "high", "isDirect": false, "via": [ { "source": 1091181, "name": "glob-parent", "dependency": "glob-parent", "title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex", "url": "https://github.com/advisories/GHSA-ww39-953v-wcq6", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<5.1.2" } ], "effects": [ "chokidar", "fast-glob" ], "range": "<5.1.2", "nodes": [ "node_modules/fast-glob/node_modules/glob-parent", "node_modules/fork-ts-checker-webpack-plugin/node_modules/glob-parent", "node_modules/watchpack-chokidar2/node_modules/glob-parent" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "globby": { "name": "globby", "severity": "high", "isDirect": false, "via": [ "fast-glob" ], "effects": [ "react-dev-utils" ], "range": "8.0.0 - 9.2.0", "nodes": [ "node_modules/globby" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "highlight.js": { "name": "highlight.js", "severity": "moderate", "isDirect": false, "via": [ { "source": 1086450, "name": "highlight.js", "dependency": "highlight.js", "title": "ReDOS vulnerabities: multiple grammars", "url": "https://github.com/advisories/GHSA-7wwv-vh3v-89cq", "severity": "moderate", "cwe": [ "CWE-20", "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=9.0.0 <10.4.1" }, { "source": 1090060, "name": "highlight.js", "dependency": "highlight.js", "title": "Prototype Pollution in highlight.js", "url": "https://github.com/advisories/GHSA-vfrc-7r7c-w9mx", "severity": "moderate", "cwe": [ "CWE-471" ], "cvss": { "score": 5.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N" }, "range": "<9.18.2" } ], "effects": [ "lowlight", "react-syntax-highlighter" ], "range": "<=10.4.0", "nodes": [ "node_modules/highlight.js" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "immer": { "name": "immer", "severity": "critical", "isDirect": false, "via": [ { "source": 1089281, "name": "immer", "dependency": "immer", "title": "Prototype Pollution in immer", "url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx", "severity": "high", "cwe": [ "CWE-915", "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<9.0.6" }, { "source": 1089656, "name": "immer", "dependency": "immer", "title": "Prototype Pollution in immer", "url": "https://github.com/advisories/GHSA-33f9-j839-rf8h", "severity": "critical", "cwe": [ "CWE-843", "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<9.0.6" }, { "source": 1090038, "name": "immer", "dependency": "immer", "title": "Prototype Pollution in immer", "url": "https://github.com/advisories/GHSA-9qmh-276g-x5pj", "severity": "high", "cwe": [ "CWE-471" ], "cvss": { "score": 0, "vectorString": null }, "range": "<8.0.1" } ], "effects": [ "react-dev-utils" ], "range": "<=9.0.5", "nodes": [ "node_modules/immer" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "jsdoc": { "name": "jsdoc", "severity": "high", "isDirect": true, "via": [ "taffydb" ], "effects": [], "range": "3.2.0-dev - 3.6.11", "nodes": [ "node_modules/jsdoc" ], "fixAvailable": { "name": "jsdoc", "version": "4.0.2", "isSemVerMajor": true } }, "less": { "name": "less", "severity": "moderate", "isDirect": true, "via": [ "request" ], "effects": [], "range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3", "nodes": [ "node_modules/less" ], "fixAvailable": { "name": "less", "version": "3.13.1", "isSemVerMajor": false } }, "loader-utils": { "name": "loader-utils", "severity": "critical", "isDirect": false, "via": [ { "source": 1091186, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.4.1" }, { "source": 1091248, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable", "url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.4.2" }, { "source": 1091251, "name": "loader-utils", "dependency": "loader-utils", "title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.4.2" } ], "effects": [ "react-dev-utils" ], "range": "<=1.4.1", "nodes": [ "node_modules/react-dev-utils/node_modules/loader-utils" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "lowlight": { "name": "lowlight", "severity": "moderate", "isDirect": false, "via": [ "highlight.js" ], "effects": [ "react-syntax-highlighter" ], "range": "1.2.0 - 1.13.1", "nodes": [ "node_modules/lowlight" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "minimatch": { "name": "minimatch", "severity": "high", "isDirect": false, "via": [ { "source": 1091174, "name": "minimatch", "dependency": "minimatch", "title": "minimatch ReDoS vulnerability", "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.5" } ], "effects": [ "recursive-readdir" ], "range": "<3.0.5", "nodes": [ "node_modules/recursive-readdir/node_modules/minimatch" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "mwbot": { "name": "mwbot", "severity": "moderate", "isDirect": true, "via": [ "request" ], "effects": [ "wdio-mediawiki" ], "range": ">=0.1.6", "nodes": [ "node_modules/mwbot" ], "fixAvailable": false }, "prismjs": { "name": "prismjs", "severity": "high", "isDirect": false, "via": [ { "source": 1087445, "name": "prismjs", "dependency": "prismjs", "title": "Cross-Site Scripting in Prism", "url": "https://github.com/advisories/GHSA-wvhm-4hhf-97x9", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L" }, "range": ">=1.1.0 <1.21.0" }, { "source": 1089189, "name": "prismjs", "dependency": "prismjs", "title": "prismjs Regular Expression Denial of Service vulnerability", "url": "https://github.com/advisories/GHSA-hqhp-5p83-hx96", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, "range": "<1.25.0" }, { "source": 1089716, "name": "prismjs", "dependency": "prismjs", "title": "Regular Expression Denial of Service (ReDoS) in Prism", "url": "https://github.com/advisories/GHSA-gj77-59wh-66hg", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H" }, "range": "<1.24.0" }, { "source": 1090014, "name": "prismjs", "dependency": "prismjs", "title": "Denial of service in prismjs", "url": "https://github.com/advisories/GHSA-h4hr-7fg3-h35w", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.23.0" }, { "source": 1090424, "name": "prismjs", "dependency": "prismjs", "title": "Cross-site Scripting in Prism", "url": "https://github.com/advisories/GHSA-3949-f494-cm99", "severity": "high", "cwe": [ "CWE-79" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L" }, "range": ">=1.14.0 <1.27.0" } ], "effects": [ "refractor" ], "range": "<=1.26.0", "nodes": [ "node_modules/refractor/node_modules/prismjs" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "react-dev-utils": { "name": "react-dev-utils", "severity": "critical", "isDirect": false, "via": [ { "source": 1089062, "name": "react-dev-utils", "dependency": "react-dev-utils", "title": "react-dev-utils OS Command Injection in function `getProcessForPort`", "url": "https://github.com/advisories/GHSA-5q6m-3h65-w53x", "severity": "moderate", "cwe": [ "CWE-78" ], "cvss": { "score": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "range": ">=0.4.0 <11.0.4" }, "browserslist", "fork-ts-checker-webpack-plugin", "globby", "immer", "loader-utils", "recursive-readdir", "shell-quote" ], "effects": [ "@storybook/core" ], "range": "0.4.0 - 12.0.0-next.60", "nodes": [ "node_modules/react-dev-utils" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "react-syntax-highlighter": { "name": "react-syntax-highlighter", "severity": "moderate", "isDirect": false, "via": [ "highlight.js", "lowlight", "refractor" ], "effects": [ "@storybook/components" ], "range": "2.0.4 - 12.2.1", "nodes": [ "node_modules/react-syntax-highlighter" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "recursive-readdir": { "name": "recursive-readdir", "severity": "high", "isDirect": false, "via": [ "minimatch" ], "effects": [ "react-dev-utils" ], "range": "1.2.0 - 2.2.2", "nodes": [ "node_modules/recursive-readdir" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "refractor": { "name": "refractor", "severity": "moderate", "isDirect": false, "via": [ "prismjs" ], "effects": [ "react-syntax-highlighter" ], "range": "<=3.4.0 || 4.0.0 - 4.1.1", "nodes": [ "node_modules/refractor" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "request": { "name": "request", "severity": "moderate", "isDirect": false, "via": [ { "source": 1091459, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" } ], "effects": [ "less", "mwbot" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": false }, "shell-quote": { "name": "shell-quote", "severity": "critical", "isDirect": false, "via": [ { "source": 1091418, "name": "shell-quote", "dependency": "shell-quote", "title": "Improper Neutralization of Special Elements used in a Command in Shell-quote", "url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7", "severity": "critical", "cwe": [ "CWE-77" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=1.7.2" } ], "effects": [ "react-dev-utils" ], "range": "<=1.7.2", "nodes": [ "node_modules/shell-quote" ], "fixAvailable": { "name": "@storybook/html", "version": "6.5.16", "isSemVerMajor": true } }, "taffydb": { "name": "taffydb", "severity": "high", "isDirect": false, "via": [ { "source": 1089386, "name": "taffydb", "dependency": "taffydb", "title": "TaffyDB can allow access to any data items in the DB", "url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6", "severity": "high", "cwe": [ "CWE-20", "CWE-668" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=2.7.3" } ], "effects": [ "jsdoc" ], "range": "*", "nodes": [ "node_modules/taffydb" ], "fixAvailable": { "name": "jsdoc", "version": "4.0.2", "isSemVerMajor": true } }, "watchpack": { "name": "watchpack", "severity": "high", "isDirect": false, "via": [ "watchpack-chokidar2" ], "effects": [ "webpack" ], "range": "1.7.2 - 1.7.5", "nodes": [ "node_modules/watchpack" ], "fixAvailable": true }, "watchpack-chokidar2": { "name": "watchpack-chokidar2", "severity": "high", "isDirect": false, "via": [ "chokidar" ], "effects": [ "watchpack" ], "range": "*", "nodes": [ "node_modules/watchpack-chokidar2" ], "fixAvailable": true }, "wdio-mediawiki": { "name": "wdio-mediawiki", "severity": "moderate", "isDirect": true, "via": [ "mwbot" ], "effects": [], "range": "*", "nodes": [ "node_modules/wdio-mediawiki" ], "fixAvailable": false }, "webpack": { "name": "webpack", "severity": "high", "isDirect": false, "via": [ "watchpack" ], "effects": [], "range": "4.44.0 - 4.46.0", "nodes": [ "node_modules/webpack" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 0, "moderate": 11, "high": 13, "critical": 7, "total": 31 }, "dependencies": { "prod": 1, "dev": 2065, "optional": 38, "peer": 0, "peerOptional": 0, "total": 2065 } } } --- end --- $ /usr/bin/composer install --- stderr --- No lock file found. Updating dependencies instead of installing from lock file. Use composer update over composer install if you do not have a lock file. Loading composer repositories with package information Info from https://repo.packagist.org: [37;44m#StandWith[30;43mUkraine[0m Updating dependencies Lock file operations: 36 installs, 0 updates, 0 removals - Locking composer/pcre (3.1.0) - Locking composer/semver (3.3.2) - Locking composer/spdx-licenses (1.5.7) - Locking composer/xdebug-handler (3.0.3) - Locking doctrine/deprecations (v1.0.0) - Locking felixfbecker/advanced-json-rpc (v3.2.1) - Locking mediawiki/mediawiki-codesniffer (v41.0.0) - Locking mediawiki/mediawiki-phan-config (0.12.0) - Locking mediawiki/minus-x (1.1.1) - Locking mediawiki/phan-taint-check-plugin (4.0.0) - Locking microsoft/tolerant-php-parser (v0.1.1) - Locking netresearch/jsonmapper (v4.1.0) - Locking phan/phan (5.4.1) - Locking php-parallel-lint/php-console-color (v1.0.1) - Locking php-parallel-lint/php-console-highlighter (v1.0.0) - Locking php-parallel-lint/php-parallel-lint (v1.3.2) - Locking phpdocumentor/reflection-common (2.2.0) - Locking phpdocumentor/reflection-docblock (5.3.0) - Locking phpdocumentor/type-resolver (1.7.0) - Locking phpstan/phpdoc-parser (1.16.1) - Locking psr/container (1.1.2) - Locking psr/log (1.1.4) - Locking sabre/event (5.1.4) - Locking squizlabs/php_codesniffer (3.7.2) - Locking symfony/console (v5.4.21) - Locking symfony/deprecation-contracts (v2.5.2) - Locking symfony/polyfill-ctype (v1.27.0) - Locking symfony/polyfill-intl-grapheme (v1.27.0) - Locking symfony/polyfill-intl-normalizer (v1.27.0) - Locking symfony/polyfill-mbstring (v1.27.0) - Locking symfony/polyfill-php73 (v1.27.0) - Locking symfony/polyfill-php80 (v1.27.0) - Locking symfony/service-contracts (v2.5.2) - Locking symfony/string (v5.4.21) - Locking tysonandre/var_representation_polyfill (0.1.3) - Locking webmozart/assert (1.11.0) Writing lock file Installing dependencies from lock file (including require-dev) Package operations: 36 installs, 0 updates, 0 removals 0 [>---------------------------] 0 [->--------------------------] 0 [--->------------------------] - Installing composer/pcre (3.1.0): Extracting archive - Installing symfony/polyfill-php80 (v1.27.0): Extracting archive - Installing squizlabs/php_codesniffer (3.7.2): Extracting archive - Installing symfony/polyfill-mbstring (v1.27.0): Extracting archive - Installing composer/spdx-licenses (1.5.7): Extracting archive - Installing composer/semver (3.3.2): Extracting archive - Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive - Installing symfony/polyfill-intl-normalizer (v1.27.0): Extracting archive - Installing symfony/polyfill-intl-grapheme (v1.27.0): Extracting archive - Installing symfony/polyfill-ctype (v1.27.0): Extracting archive - Installing symfony/string (v5.4.21): Extracting archive - Installing symfony/deprecation-contracts (v2.5.2): Extracting archive - Installing psr/container (1.1.2): Extracting archive - Installing symfony/service-contracts (v2.5.2): Extracting archive - Installing symfony/polyfill-php73 (v1.27.0): Extracting archive - Installing symfony/console (v5.4.21): Extracting archive - Installing sabre/event (5.1.4): Extracting archive - Installing netresearch/jsonmapper (v4.1.0): Extracting archive - Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive - Installing webmozart/assert (1.11.0): Extracting archive - Installing phpstan/phpdoc-parser (1.16.1): Extracting archive - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive - Installing doctrine/deprecations (v1.0.0): Extracting archive - Installing phpdocumentor/type-resolver (1.7.0): Extracting archive - Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive - Installing psr/log (1.1.4): Extracting archive - Installing composer/xdebug-handler (3.0.3): Extracting archive - Installing phan/phan (5.4.1): Extracting archive - Installing mediawiki/phan-taint-check-plugin (4.0.0): Extracting archive - Installing mediawiki/mediawiki-phan-config (0.12.0): Extracting archive - Installing mediawiki/minus-x (1.1.1): Extracting archive - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive - Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive 0/27 [>---------------------------] 0% 10/27 [==========>-----------------] 37% 19/27 [===================>--------] 70% 26/27 [==========================>-] 96% 27/27 [============================] 100%4 package suggestions were added by new dependencies, use `composer suggest` to see details. Generating autoload files 14 packages you are using are looking for funding. Use the `composer fund` command to find out more! --- stdout --- --- end --- Upgrading n:eslint-config-wikimedia from 0.22.1 -> 0.24.0 Upgrading n:stylelint-config-wikimedia from 0.13.0 -> 0.14.0 $ /usr/bin/npm install --- stderr --- npm WARN ERESOLVE overriding peer dependency npm WARN While resolving: @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7 npm WARN Found: @babel/core@7.7.7 npm WARN node_modules/@babel/core npm WARN dev @babel/core@"7.7.7" from the root project npm WARN 72 more (@babel/helper-compilation-targets, ...) npm WARN npm WARN Could not resolve dependency: npm WARN peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7 npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining npm WARN @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10 npm WARN node_modules/@babel/preset-env npm WARN npm WARN Conflicting peer dependency: @babel/core@7.21.3 npm WARN node_modules/@babel/core npm WARN peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7 npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining npm WARN @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10 npm WARN node_modules/@babel/preset-env npm WARN ERESOLVE overriding peer dependency npm WARN While resolving: @babel/plugin-proposal-class-static-block@7.17.6 npm WARN Found: @babel/core@7.7.7 npm WARN node_modules/@babel/core npm WARN dev @babel/core@"7.7.7" from the root project npm WARN 72 more (@babel/helper-compilation-targets, ...) npm WARN npm WARN Could not resolve dependency: npm WARN peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6 npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block npm WARN @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10 npm WARN node_modules/@babel/preset-env npm WARN npm WARN Conflicting peer dependency: @babel/core@7.21.3 npm WARN node_modules/@babel/core npm WARN peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6 npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block npm WARN @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10 npm WARN node_modules/@babel/preset-env npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: '@wdio/sync@7.19.5', npm WARN EBADENGINE required: { node: '>=12.0.0 <16' }, npm WARN EBADENGINE current: { node: 'v16.17.1', npm: '8.15.0' } npm WARN EBADENGINE } npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated har-validator@5.1.5: this library is no longer supported npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 npm WARN deprecated highlight.js@9.12.0: Version no longer supported. Upgrade to @latest npm WARN deprecated puppeteer@9.1.1: Version no longer supported. Upgrade to @latest npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js. --- stdout --- added 2058 packages, and audited 2059 packages in 29s 188 packages are looking for funding run `npm fund` for details 31 vulnerabilities (11 moderate, 13 high, 7 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ package-lock-lint package-lock.json --- stdout --- Checking package-lock.json --- end --- $ ./node_modules/.bin/eslint . --fix --- stderr --- Oops! Something went wrong! :( ESLint: 8.36.0 Error: Cannot read config file: /src/repo/resources/.eslintrc.js Error: Cannot find module 'eslint-config-wikimedia/language/merge.js' Require stack: - /src/repo/resources/.eslintrc.js - /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs - /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js - /src/repo/node_modules/eslint/lib/eslint/eslint.js - /src/repo/node_modules/eslint/lib/eslint/index.js - /src/repo/node_modules/eslint/lib/cli.js - /src/repo/node_modules/eslint/bin/eslint.js Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15) at Function.Module._load (node:internal/modules/cjs/loader:804:27) at Module.require (node:internal/modules/cjs/loader:1028:19) at require (node:internal/modules/cjs/helpers:102:18) at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15) at Module._compile (node:internal/modules/cjs/loader:1126:14) at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10) at Module.load (node:internal/modules/cjs/loader:1004:32) at Function.Module._load (node:internal/modules/cjs/loader:839:12) at Module.require (node:internal/modules/cjs/loader:1028:19) --- stdout --- --- end --- $ ./node_modules/.bin/eslint . -f json --- stderr --- Oops! Something went wrong! :( ESLint: 8.36.0 Error: Cannot read config file: /src/repo/resources/.eslintrc.js Error: Cannot find module 'eslint-config-wikimedia/language/merge.js' Require stack: - /src/repo/resources/.eslintrc.js - /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs - /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js - /src/repo/node_modules/eslint/lib/eslint/eslint.js - /src/repo/node_modules/eslint/lib/eslint/index.js - /src/repo/node_modules/eslint/lib/cli.js - /src/repo/node_modules/eslint/bin/eslint.js Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15) at Function.Module._load (node:internal/modules/cjs/loader:804:27) at Module.require (node:internal/modules/cjs/loader:1028:19) at require (node:internal/modules/cjs/helpers:102:18) at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15) at Module._compile (node:internal/modules/cjs/loader:1126:14) at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10) at Module.load (node:internal/modules/cjs/loader:1004:32) at Function.Module._load (node:internal/modules/cjs/loader:839:12) at Module.require (node:internal/modules/cjs/loader:1028:19) --- stdout --- --- end --- Traceback (most recent call last): File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main libup.run(args.repo, args.output, args.branch) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run self.npm_upgrade(plan) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade hook(update) File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint errors = json.loads(self.check_call([ File "/usr/lib/python3.9/json/__init__.py", line 346, in loads return _default_decoder.decode(s) File "/usr/lib/python3.9/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)