mediawiki/extensions/SearchVue (REL1_41)

sourcepatches
$ date
--- stdout ---
Thu Oct 10 09:33:05 UTC 2024

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-SearchVue.git repo --depth=1 -b REL1_41
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stdout ---

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_41
--- stdout ---
19bda8fa2efa5d5b0a32e21dce1187ff6ffc8fe0 refs/heads/REL1_41

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "babel-core": {
      "name": "babel-core",
      "severity": "critical",
      "isDirect": true,
      "via": [
        "babel-helpers",
        "babel-register",
        "babel-template",
        "babel-traverse",
        "json5"
      ],
      "effects": [
        "babel-register"
      ],
      "range": "5.8.20 - 7.0.0-beta.3",
      "nodes": [
        "node_modules/babel-core"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "babel-helpers": {
      "name": "babel-helpers",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-template"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/babel-helpers"
      ],
      "fixAvailable": true
    },
    "babel-register": {
      "name": "babel-register",
      "severity": "high",
      "isDirect": false,
      "via": [
        "babel-core"
      ],
      "effects": [
        "babel-core"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-register"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "babel-template": {
      "name": "babel-template",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-traverse"
      ],
      "effects": [
        "babel-helpers"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-template"
      ],
      "fixAvailable": true
    },
    "babel-traverse": {
      "name": "babel-traverse",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096879,
          "name": "babel-traverse",
          "dependency": "babel-traverse",
          "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
          "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
          "severity": "critical",
          "cwe": [
            "CWE-184",
            "CWE-697"
          ],
          "cvss": {
            "score": 9.4,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
          },
          "range": "<7.23.2"
        }
      ],
      "effects": [
        "babel-core",
        "babel-template"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-traverse"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096543,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": "<1.0.2"
        }
      ],
      "effects": [
        "babel-core"
      ],
      "range": "<1.0.2",
      "nodes": [
        "node_modules/babel-core/node_modules/json5"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 2,
      "critical": 4,
      "total": 6
    },
    "dependencies": {
      "prod": 1,
      "dev": 992,
      "optional": 1,
      "peer": 331,
      "peerOptional": 0,
      "total": 992
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 36 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.3.1)
  - Locking composer/semver (3.3.2)
  - Locking composer/spdx-licenses (1.5.8)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking doctrine/deprecations (1.1.3)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking mediawiki/mediawiki-codesniffer (v41.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.12.1)
  - Locking mediawiki/minus-x (1.1.1)
  - Locking mediawiki/phan-taint-check-plugin (4.0.0)
  - Locking microsoft/tolerant-php-parser (v0.1.1)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking phan/phan (5.4.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.3.2)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.4.1)
  - Locking phpdocumentor/type-resolver (1.8.2)
  - Locking phpstan/phpdoc-parser (1.32.0)
  - Locking psr/container (2.0.2)
  - Locking psr/log (2.0.0)
  - Locking sabre/event (5.1.7)
  - Locking squizlabs/php_codesniffer (3.7.2)
  - Locking symfony/console (v5.4.44)
  - Locking symfony/deprecation-contracts (v3.5.0)
  - Locking symfony/polyfill-ctype (v1.31.0)
  - Locking symfony/polyfill-intl-grapheme (v1.31.0)
  - Locking symfony/polyfill-intl-normalizer (v1.31.0)
  - Locking symfony/polyfill-mbstring (v1.31.0)
  - Locking symfony/polyfill-php73 (v1.31.0)
  - Locking symfony/polyfill-php80 (v1.31.0)
  - Locking symfony/service-contracts (v3.5.0)
  - Locking symfony/string (v6.4.12)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 36 installs, 0 updates, 0 removals
    0 [>---------------------------]    0 [->--------------------------]
  - Installing composer/pcre (3.3.1): Extracting archive
  - Installing symfony/polyfill-php80 (v1.31.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.7.2): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.31.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.8): Extracting archive
  - Installing composer/semver (3.3.2): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.31.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.31.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.31.0): Extracting archive
  - Installing symfony/string (v6.4.12): Extracting archive
  - Installing symfony/deprecation-contracts (v3.5.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.5.0): Extracting archive
  - Installing symfony/polyfill-php73 (v1.31.0): Extracting archive
  - Installing symfony/console (v5.4.44): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive
  - Installing webmozart/assert (1.11.0): Extracting archive
  - Installing phpstan/phpdoc-parser (1.32.0): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.3): Extracting archive
  - Installing phpdocumentor/type-resolver (1.8.2): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.4.1): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (2.0.0): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.4.1): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (4.0.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.12.1): Extracting archive
  - Installing mediawiki/minus-x (1.1.1): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive
  0/36 [>---------------------------]   0%
 20/36 [===============>------------]  55%
 30/36 [=======================>----]  83%
 36/36 [============================] 100%
3 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
15 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "babel-core": {
      "name": "babel-core",
      "severity": "critical",
      "isDirect": true,
      "via": [
        "babel-helpers",
        "babel-register",
        "babel-template",
        "babel-traverse",
        "json5"
      ],
      "effects": [
        "babel-register"
      ],
      "range": "5.8.20 - 7.0.0-beta.3",
      "nodes": [
        "node_modules/babel-core"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "babel-helpers": {
      "name": "babel-helpers",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-template"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/babel-helpers"
      ],
      "fixAvailable": true
    },
    "babel-register": {
      "name": "babel-register",
      "severity": "high",
      "isDirect": false,
      "via": [
        "babel-core"
      ],
      "effects": [
        "babel-core"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-register"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "babel-template": {
      "name": "babel-template",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-traverse"
      ],
      "effects": [
        "babel-helpers"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-template"
      ],
      "fixAvailable": true
    },
    "babel-traverse": {
      "name": "babel-traverse",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096879,
          "name": "babel-traverse",
          "dependency": "babel-traverse",
          "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
          "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
          "severity": "critical",
          "cwe": [
            "CWE-184",
            "CWE-697"
          ],
          "cvss": {
            "score": 9.4,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
          },
          "range": "<7.23.2"
        }
      ],
      "effects": [
        "babel-core",
        "babel-template"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-traverse"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096543,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": "<1.0.2"
        }
      ],
      "effects": [
        "babel-core"
      ],
      "range": "<1.0.2",
      "nodes": [
        "node_modules/babel-core/node_modules/json5"
      ],
      "fixAvailable": {
        "name": "babel-core",
        "version": "4.7.16",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 2,
      "critical": 4,
      "total": 6
    },
    "dependencies": {
      "prod": 1,
      "dev": 992,
      "optional": 1,
      "peer": 331,
      "peerOptional": 0,
      "total": 992
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
  "added": 992,
  "removed": 0,
  "changed": 0,
  "audited": 993,
  "funding": 92,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "babel-core": {
        "name": "babel-core",
        "severity": "critical",
        "isDirect": true,
        "via": [
          "babel-helpers",
          "babel-register",
          "babel-template",
          "babel-traverse",
          "json5"
        ],
        "effects": [
          "babel-register"
        ],
        "range": "5.8.20 - 7.0.0-beta.3",
        "nodes": [
          "node_modules/babel-core"
        ],
        "fixAvailable": {
          "name": "babel-core",
          "version": "4.7.16",
          "isSemVerMajor": true
        }
      },
      "babel-helpers": {
        "name": "babel-helpers",
        "severity": "critical",
        "isDirect": false,
        "via": [
          "babel-template"
        ],
        "effects": [],
        "range": "*",
        "nodes": [
          "node_modules/babel-helpers"
        ],
        "fixAvailable": true
      },
      "babel-register": {
        "name": "babel-register",
        "severity": "high",
        "isDirect": false,
        "via": [
          "babel-core"
        ],
        "effects": [
          "babel-core"
        ],
        "range": "*",
        "nodes": [
          "node_modules/babel-register"
        ],
        "fixAvailable": {
          "name": "babel-core",
          "version": "4.7.16",
          "isSemVerMajor": true
        }
      },
      "babel-template": {
        "name": "babel-template",
        "severity": "critical",
        "isDirect": false,
        "via": [
          "babel-traverse"
        ],
        "effects": [
          "babel-helpers"
        ],
        "range": "*",
        "nodes": [
          "node_modules/babel-template"
        ],
        "fixAvailable": true
      },
      "babel-traverse": {
        "name": "babel-traverse",
        "severity": "critical",
        "isDirect": false,
        "via": [
          {
            "source": 1096879,
            "name": "babel-traverse",
            "dependency": "babel-traverse",
            "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
            "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
            "severity": "critical",
            "cwe": [
              "CWE-184",
              "CWE-697"
            ],
            "cvss": {
              "score": 9.4,
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
            },
            "range": "<7.23.2"
          }
        ],
        "effects": [
          "babel-core",
          "babel-template"
        ],
        "range": "*",
        "nodes": [
          "node_modules/babel-traverse"
        ],
        "fixAvailable": {
          "name": "babel-core",
          "version": "4.7.16",
          "isSemVerMajor": true
        }
      },
      "json5": {
        "name": "json5",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1096543,
            "name": "json5",
            "dependency": "json5",
            "title": "Prototype Pollution in JSON5 via Parse Method",
            "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
            "severity": "high",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 7.1,
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
            },
            "range": "<1.0.2"
          }
        ],
        "effects": [
          "babel-core"
        ],
        "range": "<1.0.2",
        "nodes": [
          "node_modules/babel-core/node_modules/json5"
        ],
        "fixAvailable": {
          "name": "babel-core",
          "version": "4.7.16",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 0,
        "high": 2,
        "critical": 4,
        "total": 6
      },
      "dependencies": {
        "prod": 1,
        "dev": 992,
        "optional": 1,
        "peer": 331,
        "peerOptional": 0,
        "total": 992
      }
    }
  }
}

--- end ---
{"added": 992, "removed": 0, "changed": 0, "audited": 993, "funding": 92, "audit": {"auditReportVersion": 2, "vulnerabilities": {"babel-core": {"name": "babel-core", "severity": "critical", "isDirect": true, "via": ["babel-helpers", "babel-register", "babel-template", "babel-traverse", "json5"], "effects": ["babel-register"], "range": "5.8.20 - 7.0.0-beta.3", "nodes": ["node_modules/babel-core"], "fixAvailable": {"name": "babel-core", "version": "4.7.16", "isSemVerMajor": true}}, "babel-helpers": {"name": "babel-helpers", "severity": "critical", "isDirect": false, "via": ["babel-template"], "effects": [], "range": "*", "nodes": ["node_modules/babel-helpers"], "fixAvailable": true}, "babel-register": {"name": "babel-register", "severity": "high", "isDirect": false, "via": ["babel-core"], "effects": ["babel-core"], "range": "*", "nodes": ["node_modules/babel-register"], "fixAvailable": {"name": "babel-core", "version": "4.7.16", "isSemVerMajor": true}}, "babel-template": {"name": "babel-template", "severity": "critical", "isDirect": false, "via": ["babel-traverse"], "effects": ["babel-helpers"], "range": "*", "nodes": ["node_modules/babel-template"], "fixAvailable": true}, "babel-traverse": {"name": "babel-traverse", "severity": "critical", "isDirect": false, "via": [{"source": 1096879, "name": "babel-traverse", "dependency": "babel-traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": ["CWE-184", "CWE-697"], "cvss": {"score": 9.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "range": "<7.23.2"}], "effects": ["babel-core", "babel-template"], "range": "*", "nodes": ["node_modules/babel-traverse"], "fixAvailable": {"name": "babel-core", "version": "4.7.16", "isSemVerMajor": true}}, "json5": {"name": "json5", "severity": "high", "isDirect": false, "via": [{"source": 1096543, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": ["CWE-1321"], "cvss": {"score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "range": "<1.0.2"}], "effects": ["babel-core"], "range": "<1.0.2", "nodes": ["node_modules/babel-core/node_modules/json5"], "fixAvailable": {"name": "babel-core", "version": "4.7.16", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 2, "critical": 4, "total": 6}, "dependencies": {"prod": 1, "dev": 992, "optional": 1, "peer": 331, "peerOptional": 0, "total": 992}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 991 packages, and audited 992 packages in 9s

92 packages are looking for funding
  run `npm fund` for details

# npm audit report

babel-traverse  *
Severity: critical
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
fix available via `npm audit fix --force`
Will install babel-core@4.7.16, which is a breaking change
node_modules/babel-traverse
  babel-core  5.8.20 - 7.0.0-beta.3
  Depends on vulnerable versions of babel-helpers
  Depends on vulnerable versions of babel-register
  Depends on vulnerable versions of babel-template
  Depends on vulnerable versions of babel-traverse
  Depends on vulnerable versions of json5
  node_modules/babel-core
    babel-register  *
    Depends on vulnerable versions of babel-core
    node_modules/babel-register
  babel-template  *
  Depends on vulnerable versions of babel-traverse
  node_modules/babel-template
    babel-helpers  *
    Depends on vulnerable versions of babel-template
    node_modules/babel-helpers

json5  <1.0.2
Severity: high
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
fix available via `npm audit fix --force`
Will install babel-core@4.7.16, which is a breaking change
node_modules/babel-core/node_modules/json5

6 vulnerabilities (2 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated w3c-hr-time@1.0.2: Use your platform's native performance.now() and performance.timeOrigin.
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 991 packages, and audited 992 packages in 9s

92 packages are looking for funding
  run `npm fund` for details

6 vulnerabilities (2 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stderr ---
PASS tests/jest/store/dom.test.js
PASS tests/jest/store/query.test.js
PASS tests/jest/store/root.test.js
PASS tests/jest/store/events.test.js
PASS tests/jest/store/requestStatus.test.js
PASS tests/jest/store/media.test.js

Test Suites: 6 passed, 6 total
Tests:       112 passed, 112 total
Snapshots:   0 total
Time:        4.505 s
Ran all test suites.
--- stdout ---

> test
> grunt test && npm run test:unit

Running "eslint:all" (eslint) task

/src/repo/resources/components/App.vue
   48:15  warning  'isMobile' is not defined                      vue/no-undef-properties
   91:11  warning  'toggleVisibily' is not defined                vue/no-undef-properties
   97:11  warning  'onPageClose' is not defined                   vue/no-undef-properties
  107:11  warning  'focusCurrentResult' is not defined            vue/no-undef-properties
  109:10  warning  'closeQuickView' is not defined                vue/no-undef-properties
  121:25  warning  'results' is not defined                       vue/no-undef-properties
  133:3   warning  'title' is not defined                         vue/no-undef-properties
  138:11  warning  'setQueryQuickViewTitle' is not defined        vue/no-undef-properties
  143:3   warning  'loading' is not defined                       vue/no-undef-properties
  149:11  warning  'updateTabbableElements' is not defined        vue/no-undef-properties
  155:3   warning  'visible' is not defined                       vue/no-undef-properties
  164:8   warning  'initEventLoggingSession' is not defined       vue/no-undef-properties
  166:49  warning  'leaving' is not defined                       vue/no-undef-properties
  170:38  warning  'searchResults' is not defined                 vue/no-undef-properties
  181:14  warning  'resultHasInfoToDisplay' is not defined        vue/no-undef-properties
  186:10  warning  'generateAndInsertAriaButton' is not defined   vue/no-undef-properties
  196:10  warning  'handleResultEvent' is not defined             vue/no-undef-properties
  204:11  warning  'focusDialog' is not defined                   vue/no-undef-properties
  211:38  warning  'multiMediaViewerIsOpen' is not defined        vue/no-undef-properties
  222:8   warning  'restoreQuickViewOnNavigation' is not defined  vue/no-undef-properties
  228:11  warning  'closeAndFocus' is not defined                 vue/no-undef-properties
  231:11  warning  'handleTabTrap' is not defined                 vue/no-undef-properties

/src/repo/resources/components/AppViewDesktop.vue
    6:18  warning  The "close" event has been triggered but not declared on `emits` option  vue/require-explicit-emits
   66:31  warning  'breakpoints' is not defined                                             vue/no-undef-properties
   81:16  warning  'pageContainer' is not defined                                           vue/no-undef-properties
   95:37  warning  'searchContainer' is not defined                                         vue/no-undef-properties
  116:26  warning  'columnWidth' is not defined                                             vue/no-undef-properties
  133:27  warning  'numberToPixel' is not defined                                           vue/no-undef-properties
  133:47  warning  'dynamicTop' is not defined                                              vue/no-undef-properties
  134:50  warning  'dynamicBottom' is not defined                                           vue/no-undef-properties
  135:55  warning  'dynamicRightMargin' is not defined                                      vue/no-undef-properties
  136:49  warning  'dynamicWidth' is not defined                                            vue/no-undef-properties
  162:15  warning  'isMobile' is not defined                                                vue/no-undef-properties
  175:3   warning  'isLargeScreen' is not defined                                           vue/no-undef-properties
  177:31  warning  'title' is not defined                                                   vue/no-undef-properties
  178:10  warning  'closeQuickView' is not defined                                          vue/no-undef-properties

/src/repo/resources/components/AppViewMobile.vue
  16:19  warning  The "close" event has been triggered but not declared on `emits` option  vue/require-explicit-emits

/src/repo/resources/components/QuickViewTutorialPopup.vue
  13:20  warning  The "close" event has been triggered but not declared on `emits` option  vue/require-explicit-emits
  28:1   warning  This line has a length of 234. Maximum allowed is 100                    max-len

/src/repo/resources/components/Tutorial.vue
   7:1  warning  This line has a length of 116. Maximum allowed is 100  max-len
  26:8  warning  Component name "Tutorial" should always be multi-word  vue/multi-word-component-names
  96:3  warning  'selectedIndex' is not defined                         vue/no-undef-properties

/src/repo/resources/components/generic/ImageWithLoadingBackground.vue
    3:7   warning  'image-container' is defined as ref, but never used                            vue/no-unused-refs
    5:13  warning  Identifier 'ImageWithLoadingBackground__loading' is not in camel case          vue/camelcase
   15:19  warning  The "image-click" event has been triggered but not declared on `emits` option  vue/require-explicit-emits
   80:16  warning  The "load" event has been triggered but not declared on `emits` option         vue/require-explicit-emits
   84:16  warning  The "load" event has been triggered but not declared on `emits` option         vue/require-explicit-emits
  114:1   warning  This line has a length of 173. Maximum allowed is 100                          max-len

/src/repo/resources/components/sections/QuickView.vue
   12:27  warning  The "close" event has been triggered but not declared on `emits` option  vue/require-explicit-emits
   32:1   warning  This line has a length of 219. Maximum allowed is 100                    max-len
  165:17  warning  'currentResult' is not defined                                           vue/no-undef-properties
  187:50  warning  'isMobile' is not defined                                                vue/no-undef-properties
  199:17  warning  'requestStatus' is not defined                                           vue/no-undef-properties
  199:46  warning  'requestStatuses' is not defined                                         vue/no-undef-properties
  202:18  warning  'queryRequestInProgress' is not defined                                  vue/no-undef-properties
  208:18  warning  'mediaRequestInProgress' is not defined                                  vue/no-undef-properties
  216:10  warning  'logQuickViewEvent' is not defined                                       vue/no-undef-properties
  218:26  warning  'selectedIndex' is not defined                                           vue/no-undef-properties
  228:11  warning  'updateTabbableElements' is not defined                                  vue/no-undef-properties
  247:1   warning  This line has a length of 115. Maximum allowed is 100                    max-len

/src/repo/resources/components/sections/QuickViewCommons.vue
  165:3   warning  'allImageLoaded' is not defined  vue/no-undef-properties
  171:20  warning  'isMobile' is not defined        vue/no-undef-properties

/src/repo/resources/components/sections/QuickViewSections.vue
  96:11  warning  All possible message keys should be documented. See https://w.wiki/4r9a for details  mediawiki/msg-doc
  97:5   warning  All possible message keys should be documented. See https://w.wiki/4r9a for details  mediawiki/msg-doc

/src/repo/resources/components/sections/QuickViewSnippet.vue
  39:11  warning  All possible message keys should be documented. See https://w.wiki/4r9a for details  mediawiki/msg-doc
  40:5   warning  All possible message keys should be documented. See https://w.wiki/4r9a for details  mediawiki/msg-doc

/src/repo/resources/composables/onResizeObserver.js
  22:25  warning  ResizeObserver is not supported in Safari 11  compat/compat

/src/repo/resources/stores/Query.js
  138:30  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  142:28  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  229:32  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp

/src/repo/tests/jest/store/query.test.js
  189:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  198:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  206:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  218:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  227:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  238:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  247:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  258:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  267:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  278:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp
  286:29  warning  Found non-literal argument to RegExp Constructor  security/detect-non-literal-regexp

✖ 81 problems (0 errors, 81 warnings)


Running "stylelint:all" (stylelint) task
>> Linted 19 files without errors

Running "banana:0" (banana) task
>> 1 message directory checked.

Running "banana:1" (banana) task
>> 1 message directory checked.

Running "banana:2" (banana) task
>> 1 message directory checked.

Running "banana:3" (banana) task
>> 1 message directory checked.

Running "banana:4" (banana) task
>> 1 message directory checked.

Done.

> test:unit
> jest

-----------------------|---------|----------|---------|---------|-----------------------------------------------
File                   | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                             
-----------------------|---------|----------|---------|---------|-----------------------------------------------
All files              |   69.67 |    81.44 |      60 |   69.82 |                                               
 resources             |       0 |      100 |       0 |       0 |                                               
  init.js              |       0 |      100 |       0 |       0 | 3-28                                          
 resources/composables |       0 |        0 |       0 |       0 |                                               
  onDocumentResize.js  |       0 |        0 |       0 |       0 | 1-60                                          
  onDocumentScroll.js  |       0 |        0 |       0 |       0 | 1-59                                          
  onResizeObserver.js  |       0 |      100 |       0 |       0 | 1-32                                          
 resources/directives  |       0 |      100 |       0 |       0 |                                               
  spinner.js           |       0 |      100 |       0 |       0 | 1-3                                           
 resources/stores      |   87.32 |     85.3 |    82.6 |   87.56 |                                               
  Dom.js               |     100 |    95.34 |     100 |     100 | 60,136                                        
  Event.js             |   96.77 |    91.66 |     100 |   96.77 | 146                                           
  Media.js             |   93.75 |    82.35 |      90 |   93.75 | 42,151-153                                    
  Query.js             |   82.03 |    85.18 |   76.47 |   82.67 | 67-69,191-195,226-231,250-256,288,308,389-398 
  RequestStatus.js     |     100 |      100 |     100 |     100 |                                               
  Root.js              |   91.01 |    77.14 |   76.92 |   91.01 | 108-121,213-215                               
  Timing.js            |       0 |        0 |       0 |       0 | 3-38                                          
-----------------------|---------|----------|---------|---------|-----------------------------------------------

--- end ---
{}
{}
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
[DNM] there are no updates
$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmp4zi_0r61
--- stdout ---
On branch REL1_41
Your branch is up to date with 'origin/REL1_41'.

nothing to commit, working tree clean

--- end ---

composer dependencies

Development dependencies

npm dependencies

Development dependencies

Logs

Source code is licensed under the AGPL.