mediawiki/extensions/WikibaseLexeme (REL1_41)

sourcepatches
$ date
--- stdout ---
Sun Nov  3 16:52:33 UTC 2024

--- end ---
$ git clone file:///srv/git/mediawiki-extensions-WikibaseLexeme.git repo --depth=1 -b REL1_41
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stderr ---
Submodule 'resources/special/new-lexeme' (https://phabricator.wikimedia.org/diffusion/NLSP/new-lexeme-special-page.git) registered for path 'resources/special/new-lexeme'
Cloning into '/src/repo/resources/special/new-lexeme'...
--- stdout ---
Submodule path 'resources/special/new-lexeme': checked out 'e66b9971573997ca91c59d1ba77eb6f119cfdef6'

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/REL1_41
--- stdout ---
5ad0b04d605e82ddbd0be378a7aec8d1e6d6e904 refs/heads/REL1_41

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "webdriverio"
      ],
      "effects": [],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/runner"
      ],
      "effects": [],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": ">=7.16.5",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1095029,
          "name": "diff",
          "dependency": "diff",
          "title": "Regular Expression Denial of Service (ReDoS)",
          "url": "https://github.com/advisories/GHSA-h6ch-v84p-w6p9",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.5.0"
        }
      ],
      "effects": [
        "unexpected"
      ],
      "range": "<3.5.0",
      "nodes": [
        "node_modules/unexpected/node_modules/diff"
      ],
      "fixAvailable": {
        "name": "unexpected",
        "version": "13.2.1",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "high",
      "isDirect": false,
      "via": [
        "request",
        "semver"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "11.0.0 - 22.11.1",
      "nodes": [
        "node_modules/devtools/node_modules/puppeteer-core",
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "semver": {
      "name": "semver",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098562,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.5.2"
        }
      ],
      "effects": [
        "mwbot"
      ],
      "range": "7.0.0 - 7.5.1",
      "nodes": [
        "node_modules/mwbot/node_modules/semver"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/request/node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "unexpected": {
      "name": "unexpected",
      "severity": "high",
      "isDirect": true,
      "via": [
        "diff"
      ],
      "effects": [],
      "range": "5.0.0-beta1 - 11.0.0",
      "nodes": [
        "node_modules/unexpected"
      ],
      "fixAvailable": {
        "name": "unexpected",
        "version": "13.2.1",
        "isSemVerMajor": true
      }
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "high",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [
        "wdio-wikibase"
      ],
      "range": "1.1.0 - 2.2.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "wdio-wikibase": {
      "name": "wdio-wikibase",
      "severity": "high",
      "isDirect": true,
      "via": [
        "wdio-mediawiki"
      ],
      "effects": [],
      "range": "5.1.0 - 5.2.0",
      "nodes": [
        "node_modules/wdio-wikibase"
      ],
      "fixAvailable": {
        "name": "wdio-wikibase",
        "version": "6.0.3",
        "isSemVerMajor": true
      }
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/devtools/node_modules/ws",
        "node_modules/puppeteer-core/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 2,
      "high": 13,
      "critical": 0,
      "total": 15
    },
    "dependencies": {
      "prod": 1,
      "dev": 978,
      "optional": 2,
      "peer": 0,
      "peerOptional": 0,
      "total": 978
    }
  }
}

--- end ---
$ /usr/bin/composer install
--- stderr ---
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 42 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.3.1)
  - Locking composer/semver (3.3.2)
  - Locking composer/spdx-licenses (1.5.8)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking davidrjonas/composer-lock-diff (1.7.0)
  - Locking doctrine/deprecations (1.1.3)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking giorgiosironi/eris (0.13.0)
  - Locking hamcrest/hamcrest-php (v2.0.1)
  - Locking mediawiki/mediawiki-codesniffer (v41.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.12.1)
  - Locking mediawiki/minus-x (1.1.1)
  - Locking mediawiki/phan-taint-check-plugin (4.0.0)
  - Locking microsoft/tolerant-php-parser (v0.1.1)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking phan/phan (5.4.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.3.2)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.4.1)
  - Locking phpdocumentor/type-resolver (1.8.2)
  - Locking phpstan/phpdoc-parser (1.33.0)
  - Locking psr/container (2.0.2)
  - Locking psr/log (2.0.0)
  - Locking sabre/event (5.1.7)
  - Locking serialization/serialization (4.0.0)
  - Locking squizlabs/php_codesniffer (3.7.2)
  - Locking symfony/console (v5.4.45)
  - Locking symfony/deprecation-contracts (v3.5.0)
  - Locking symfony/polyfill-ctype (v1.31.0)
  - Locking symfony/polyfill-intl-grapheme (v1.31.0)
  - Locking symfony/polyfill-intl-normalizer (v1.31.0)
  - Locking symfony/polyfill-mbstring (v1.31.0)
  - Locking symfony/polyfill-php73 (v1.31.0)
  - Locking symfony/polyfill-php80 (v1.31.0)
  - Locking symfony/service-contracts (v3.5.0)
  - Locking symfony/string (v6.4.13)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (1.11.0)
  - Locking wikimedia/assert (v0.5.1)
  - Locking wmde/php-vuejs-templating (2.0.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 42 installs, 0 updates, 0 removals
  - Downloading giorgiosironi/eris (0.13.0)
  - Downloading wmde/php-vuejs-templating (2.0.0)
 0/2 [>---------------------------]   0%
 2/2 [============================] 100%
  - Installing composer/pcre (3.3.1): Extracting archive
  - Installing davidrjonas/composer-lock-diff (1.7.0): Extracting archive
  - Installing giorgiosironi/eris (0.13.0): Extracting archive
  - Installing hamcrest/hamcrest-php (v2.0.1): Extracting archive
  - Installing symfony/polyfill-php80 (v1.31.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.7.2): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.31.0): Extracting archive
  - Installing composer/spdx-licenses (1.5.8): Extracting archive
  - Installing composer/semver (3.3.2): Extracting archive
  - Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive
  - Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
  - Installing symfony/polyfill-intl-normalizer (v1.31.0): Extracting archive
  - Installing symfony/polyfill-intl-grapheme (v1.31.0): Extracting archive
  - Installing symfony/polyfill-ctype (v1.31.0): Extracting archive
  - Installing symfony/string (v6.4.13): Extracting archive
  - Installing symfony/deprecation-contracts (v3.5.0): Extracting archive
  - Installing psr/container (2.0.2): Extracting archive
  - Installing symfony/service-contracts (v3.5.0): Extracting archive
  - Installing symfony/polyfill-php73 (v1.31.0): Extracting archive
  - Installing symfony/console (v5.4.45): Extracting archive
  - Installing sabre/event (5.1.7): Extracting archive
  - Installing netresearch/jsonmapper (v4.5.0): Extracting archive
  - Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive
  - Installing webmozart/assert (1.11.0): Extracting archive
  - Installing phpstan/phpdoc-parser (1.33.0): Extracting archive
  - Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
  - Installing doctrine/deprecations (1.1.3): Extracting archive
  - Installing phpdocumentor/type-resolver (1.8.2): Extracting archive
  - Installing phpdocumentor/reflection-docblock (5.4.1): Extracting archive
  - Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
  - Installing psr/log (2.0.0): Extracting archive
  - Installing composer/xdebug-handler (3.0.5): Extracting archive
  - Installing phan/phan (5.4.1): Extracting archive
  - Installing mediawiki/phan-taint-check-plugin (4.0.0): Extracting archive
  - Installing mediawiki/mediawiki-phan-config (0.12.1): Extracting archive
  - Installing mediawiki/minus-x (1.1.1): Extracting archive
  - Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
  - Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
  - Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive
  - Installing serialization/serialization (4.0.0): Extracting archive
  - Installing wikimedia/assert (v0.5.1): Extracting archive
  - Installing wmde/php-vuejs-templating (2.0.0): Extracting archive
  0/42 [>---------------------------]   0%
 20/42 [=============>--------------]  47%
 34/42 [======================>-----]  80%
 42/42 [============================] 100%
5 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
15 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@wdio/cli": {
      "name": "@wdio/cli",
      "severity": "high",
      "isDirect": true,
      "via": [
        "webdriverio"
      ],
      "effects": [],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/cli"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "@wdio/local-runner": {
      "name": "@wdio/local-runner",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@wdio/runner"
      ],
      "effects": [],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/local-runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "@wdio/runner": {
      "name": "@wdio/runner",
      "severity": "high",
      "isDirect": false,
      "via": [
        "webdriverio"
      ],
      "effects": [
        "@wdio/local-runner"
      ],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/@wdio/runner"
      ],
      "fixAvailable": {
        "name": "@wdio/local-runner",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "devtools": {
      "name": "devtools",
      "severity": "high",
      "isDirect": false,
      "via": [
        "puppeteer-core"
      ],
      "effects": [],
      "range": ">=7.16.5",
      "nodes": [
        "node_modules/devtools"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1095029,
          "name": "diff",
          "dependency": "diff",
          "title": "Regular Expression Denial of Service (ReDoS)",
          "url": "https://github.com/advisories/GHSA-h6ch-v84p-w6p9",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.5.0"
        }
      ],
      "effects": [
        "unexpected"
      ],
      "range": "<3.5.0",
      "nodes": [
        "node_modules/unexpected/node_modules/diff"
      ],
      "fixAvailable": {
        "name": "unexpected",
        "version": "13.2.1",
        "isSemVerMajor": true
      }
    },
    "mwbot": {
      "name": "mwbot",
      "severity": "high",
      "isDirect": false,
      "via": [
        "request",
        "semver"
      ],
      "effects": [
        "wdio-mediawiki"
      ],
      "range": ">=0.1.6",
      "nodes": [
        "node_modules/mwbot"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "ws"
      ],
      "effects": [
        "devtools",
        "webdriverio"
      ],
      "range": "11.0.0 - 22.11.1",
      "nodes": [
        "node_modules/devtools/node_modules/puppeteer-core",
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "request": {
      "name": "request",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "tough-cookie"
      ],
      "effects": [
        "mwbot"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "semver": {
      "name": "semver",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098562,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.5.2"
        }
      ],
      "effects": [
        "mwbot"
      ],
      "range": "7.0.0 - 7.5.1",
      "nodes": [
        "node_modules/mwbot/node_modules/semver"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "request"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/request/node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "unexpected": {
      "name": "unexpected",
      "severity": "high",
      "isDirect": true,
      "via": [
        "diff"
      ],
      "effects": [],
      "range": "5.0.0-beta1 - 11.0.0",
      "nodes": [
        "node_modules/unexpected"
      ],
      "fixAvailable": {
        "name": "unexpected",
        "version": "13.2.1",
        "isSemVerMajor": true
      }
    },
    "wdio-mediawiki": {
      "name": "wdio-mediawiki",
      "severity": "high",
      "isDirect": true,
      "via": [
        "mwbot"
      ],
      "effects": [
        "wdio-wikibase"
      ],
      "range": "1.1.0 - 2.2.0",
      "nodes": [
        "node_modules/wdio-mediawiki"
      ],
      "fixAvailable": {
        "name": "wdio-mediawiki",
        "version": "2.5.0",
        "isSemVerMajor": true
      }
    },
    "wdio-wikibase": {
      "name": "wdio-wikibase",
      "severity": "high",
      "isDirect": true,
      "via": [
        "wdio-mediawiki"
      ],
      "effects": [],
      "range": "5.1.0 - 5.2.0",
      "nodes": [
        "node_modules/wdio-wikibase"
      ],
      "fixAvailable": {
        "name": "wdio-wikibase",
        "version": "6.0.3",
        "isSemVerMajor": true
      }
    },
    "webdriverio": {
      "name": "webdriverio",
      "severity": "high",
      "isDirect": false,
      "via": [
        "devtools",
        "puppeteer-core"
      ],
      "effects": [
        "@wdio/cli",
        "@wdio/runner"
      ],
      "range": "7.16.5 - 8.40.6",
      "nodes": [
        "node_modules/webdriverio"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098392,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.17.1"
        }
      ],
      "effects": [
        "puppeteer-core"
      ],
      "range": "8.0.0 - 8.17.0",
      "nodes": [
        "node_modules/devtools/node_modules/ws",
        "node_modules/puppeteer-core/node_modules/ws"
      ],
      "fixAvailable": {
        "name": "@wdio/cli",
        "version": "9.2.8",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 2,
      "high": 13,
      "critical": 0,
      "total": 15
    },
    "dependencies": {
      "prod": 1,
      "dev": 978,
      "optional": 2,
      "peer": 0,
      "peerOptional": 0,
      "total": 978
    }
  }
}

--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---
{
  "added": 978,
  "removed": 0,
  "changed": 0,
  "audited": 979,
  "funding": 136,
  "audit": {
    "auditReportVersion": 2,
    "vulnerabilities": {
      "@wdio/cli": {
        "name": "@wdio/cli",
        "severity": "high",
        "isDirect": true,
        "via": [
          "webdriverio"
        ],
        "effects": [],
        "range": "7.16.5 - 8.40.6",
        "nodes": [
          "node_modules/@wdio/cli"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      },
      "@wdio/local-runner": {
        "name": "@wdio/local-runner",
        "severity": "high",
        "isDirect": true,
        "via": [
          "@wdio/runner"
        ],
        "effects": [],
        "range": "7.16.5 - 8.40.6",
        "nodes": [
          "node_modules/@wdio/local-runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      },
      "@wdio/runner": {
        "name": "@wdio/runner",
        "severity": "high",
        "isDirect": false,
        "via": [
          "webdriverio"
        ],
        "effects": [
          "@wdio/local-runner"
        ],
        "range": "7.16.5 - 8.40.6",
        "nodes": [
          "node_modules/@wdio/runner"
        ],
        "fixAvailable": {
          "name": "@wdio/local-runner",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      },
      "devtools": {
        "name": "devtools",
        "severity": "high",
        "isDirect": false,
        "via": [
          "puppeteer-core"
        ],
        "effects": [],
        "range": ">=7.16.5",
        "nodes": [
          "node_modules/devtools"
        ],
        "fixAvailable": true
      },
      "diff": {
        "name": "diff",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1095029,
            "name": "diff",
            "dependency": "diff",
            "title": "Regular Expression Denial of Service (ReDoS)",
            "url": "https://github.com/advisories/GHSA-h6ch-v84p-w6p9",
            "severity": "high",
            "cwe": [
              "CWE-400"
            ],
            "cvss": {
              "score": 0,
              "vectorString": null
            },
            "range": "<3.5.0"
          }
        ],
        "effects": [
          "unexpected"
        ],
        "range": "<3.5.0",
        "nodes": [
          "node_modules/unexpected/node_modules/diff"
        ],
        "fixAvailable": {
          "name": "unexpected",
          "version": "13.2.1",
          "isSemVerMajor": true
        }
      },
      "mwbot": {
        "name": "mwbot",
        "severity": "high",
        "isDirect": false,
        "via": [
          "request",
          "semver"
        ],
        "effects": [
          "wdio-mediawiki"
        ],
        "range": ">=0.1.6",
        "nodes": [
          "node_modules/mwbot"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "2.5.0",
          "isSemVerMajor": true
        }
      },
      "puppeteer-core": {
        "name": "puppeteer-core",
        "severity": "high",
        "isDirect": false,
        "via": [
          "ws"
        ],
        "effects": [
          "devtools",
          "webdriverio"
        ],
        "range": "11.0.0 - 22.11.1",
        "nodes": [
          "node_modules/devtools/node_modules/puppeteer-core",
          "node_modules/puppeteer-core"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      },
      "request": {
        "name": "request",
        "severity": "moderate",
        "isDirect": true,
        "via": [
          {
            "source": 1096727,
            "name": "request",
            "dependency": "request",
            "title": "Server-Side Request Forgery in Request",
            "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
            "severity": "moderate",
            "cwe": [
              "CWE-918"
            ],
            "cvss": {
              "score": 6.1,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
            },
            "range": "<=2.88.2"
          },
          "tough-cookie"
        ],
        "effects": [
          "mwbot"
        ],
        "range": "*",
        "nodes": [
          "node_modules/request"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "2.5.0",
          "isSemVerMajor": true
        }
      },
      "semver": {
        "name": "semver",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1098562,
            "name": "semver",
            "dependency": "semver",
            "title": "semver vulnerable to Regular Expression Denial of Service",
            "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
            "severity": "high",
            "cwe": [
              "CWE-1333"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=7.0.0 <7.5.2"
          }
        ],
        "effects": [
          "mwbot"
        ],
        "range": "7.0.0 - 7.5.1",
        "nodes": [
          "node_modules/mwbot/node_modules/semver"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "2.5.0",
          "isSemVerMajor": true
        }
      },
      "tough-cookie": {
        "name": "tough-cookie",
        "severity": "moderate",
        "isDirect": false,
        "via": [
          {
            "source": 1097682,
            "name": "tough-cookie",
            "dependency": "tough-cookie",
            "title": "tough-cookie Prototype Pollution vulnerability",
            "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
            "severity": "moderate",
            "cwe": [
              "CWE-1321"
            ],
            "cvss": {
              "score": 6.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
            },
            "range": "<4.1.3"
          }
        ],
        "effects": [
          "request"
        ],
        "range": "<4.1.3",
        "nodes": [
          "node_modules/request/node_modules/tough-cookie"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "2.5.0",
          "isSemVerMajor": true
        }
      },
      "unexpected": {
        "name": "unexpected",
        "severity": "high",
        "isDirect": true,
        "via": [
          "diff"
        ],
        "effects": [],
        "range": "5.0.0-beta1 - 11.0.0",
        "nodes": [
          "node_modules/unexpected"
        ],
        "fixAvailable": {
          "name": "unexpected",
          "version": "13.2.1",
          "isSemVerMajor": true
        }
      },
      "wdio-mediawiki": {
        "name": "wdio-mediawiki",
        "severity": "high",
        "isDirect": true,
        "via": [
          "mwbot"
        ],
        "effects": [
          "wdio-wikibase"
        ],
        "range": "1.1.0 - 2.2.0",
        "nodes": [
          "node_modules/wdio-mediawiki"
        ],
        "fixAvailable": {
          "name": "wdio-mediawiki",
          "version": "2.5.0",
          "isSemVerMajor": true
        }
      },
      "wdio-wikibase": {
        "name": "wdio-wikibase",
        "severity": "high",
        "isDirect": true,
        "via": [
          "wdio-mediawiki"
        ],
        "effects": [],
        "range": "5.1.0 - 5.2.0",
        "nodes": [
          "node_modules/wdio-wikibase"
        ],
        "fixAvailable": {
          "name": "wdio-wikibase",
          "version": "6.0.3",
          "isSemVerMajor": true
        }
      },
      "webdriverio": {
        "name": "webdriverio",
        "severity": "high",
        "isDirect": false,
        "via": [
          "devtools",
          "puppeteer-core"
        ],
        "effects": [
          "@wdio/cli",
          "@wdio/runner"
        ],
        "range": "7.16.5 - 8.40.6",
        "nodes": [
          "node_modules/webdriverio"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      },
      "ws": {
        "name": "ws",
        "severity": "high",
        "isDirect": false,
        "via": [
          {
            "source": 1098392,
            "name": "ws",
            "dependency": "ws",
            "title": "ws affected by a DoS when handling a request with many HTTP headers",
            "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
            "severity": "high",
            "cwe": [
              "CWE-476"
            ],
            "cvss": {
              "score": 7.5,
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "range": ">=8.0.0 <8.17.1"
          }
        ],
        "effects": [
          "puppeteer-core"
        ],
        "range": "8.0.0 - 8.17.0",
        "nodes": [
          "node_modules/devtools/node_modules/ws",
          "node_modules/puppeteer-core/node_modules/ws"
        ],
        "fixAvailable": {
          "name": "@wdio/cli",
          "version": "9.2.8",
          "isSemVerMajor": true
        }
      }
    },
    "metadata": {
      "vulnerabilities": {
        "info": 0,
        "low": 0,
        "moderate": 2,
        "high": 13,
        "critical": 0,
        "total": 15
      },
      "dependencies": {
        "prod": 1,
        "dev": 978,
        "optional": 2,
        "peer": 0,
        "peerOptional": 0,
        "total": 978
      }
    }
  }
}

--- end ---
{"added": 978, "removed": 0, "changed": 0, "audited": 979, "funding": 136, "audit": {"auditReportVersion": 2, "vulnerabilities": {"@wdio/cli": {"name": "@wdio/cli", "severity": "high", "isDirect": true, "via": ["webdriverio"], "effects": [], "range": "7.16.5 - 8.40.6", "nodes": ["node_modules/@wdio/cli"], "fixAvailable": {"name": "@wdio/cli", "version": "9.2.8", "isSemVerMajor": true}}, "@wdio/local-runner": {"name": "@wdio/local-runner", "severity": "high", "isDirect": true, "via": ["@wdio/runner"], "effects": [], "range": "7.16.5 - 8.40.6", "nodes": ["node_modules/@wdio/local-runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.2.8", "isSemVerMajor": true}}, "@wdio/runner": {"name": "@wdio/runner", "severity": "high", "isDirect": false, "via": ["webdriverio"], "effects": ["@wdio/local-runner"], "range": "7.16.5 - 8.40.6", "nodes": ["node_modules/@wdio/runner"], "fixAvailable": {"name": "@wdio/local-runner", "version": "9.2.8", "isSemVerMajor": true}}, "devtools": {"name": "devtools", "severity": "high", "isDirect": false, "via": ["puppeteer-core"], "effects": [], "range": ">=7.16.5", "nodes": ["node_modules/devtools"], "fixAvailable": true}, "diff": {"name": "diff", "severity": "high", "isDirect": false, "via": [{"source": 1095029, "name": "diff", "dependency": "diff", "title": "Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-h6ch-v84p-w6p9", "severity": "high", "cwe": ["CWE-400"], "cvss": {"score": 0, "vectorString": null}, "range": "<3.5.0"}], "effects": ["unexpected"], "range": "<3.5.0", "nodes": ["node_modules/unexpected/node_modules/diff"], "fixAvailable": {"name": "unexpected", "version": "13.2.1", "isSemVerMajor": true}}, "mwbot": {"name": "mwbot", "severity": "high", "isDirect": false, "via": ["request", "semver"], "effects": ["wdio-mediawiki"], "range": ">=0.1.6", "nodes": ["node_modules/mwbot"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "puppeteer-core": {"name": "puppeteer-core", "severity": "high", "isDirect": false, "via": ["ws"], "effects": ["devtools", "webdriverio"], "range": "11.0.0 - 22.11.1", "nodes": ["node_modules/devtools/node_modules/puppeteer-core", "node_modules/puppeteer-core"], "fixAvailable": {"name": "@wdio/cli", "version": "9.2.8", "isSemVerMajor": true}}, "request": {"name": "request", "severity": "moderate", "isDirect": true, "via": [{"source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": ["CWE-918"], "cvss": {"score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "range": "<=2.88.2"}, "tough-cookie"], "effects": ["mwbot"], "range": "*", "nodes": ["node_modules/request"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "semver": {"name": "semver", "severity": "high", "isDirect": false, "via": [{"source": 1098562, "name": "semver", "dependency": "semver", "title": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "severity": "high", "cwe": ["CWE-1333"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=7.0.0 <7.5.2"}], "effects": ["mwbot"], "range": "7.0.0 - 7.5.1", "nodes": ["node_modules/mwbot/node_modules/semver"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "tough-cookie": {"name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [{"source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": ["CWE-1321"], "cvss": {"score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}, "range": "<4.1.3"}], "effects": ["request"], "range": "<4.1.3", "nodes": ["node_modules/request/node_modules/tough-cookie"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "unexpected": {"name": "unexpected", "severity": "high", "isDirect": true, "via": ["diff"], "effects": [], "range": "5.0.0-beta1 - 11.0.0", "nodes": ["node_modules/unexpected"], "fixAvailable": {"name": "unexpected", "version": "13.2.1", "isSemVerMajor": true}}, "wdio-mediawiki": {"name": "wdio-mediawiki", "severity": "high", "isDirect": true, "via": ["mwbot"], "effects": ["wdio-wikibase"], "range": "1.1.0 - 2.2.0", "nodes": ["node_modules/wdio-mediawiki"], "fixAvailable": {"name": "wdio-mediawiki", "version": "2.5.0", "isSemVerMajor": true}}, "wdio-wikibase": {"name": "wdio-wikibase", "severity": "high", "isDirect": true, "via": ["wdio-mediawiki"], "effects": [], "range": "5.1.0 - 5.2.0", "nodes": ["node_modules/wdio-wikibase"], "fixAvailable": {"name": "wdio-wikibase", "version": "6.0.3", "isSemVerMajor": true}}, "webdriverio": {"name": "webdriverio", "severity": "high", "isDirect": false, "via": ["devtools", "puppeteer-core"], "effects": ["@wdio/cli", "@wdio/runner"], "range": "7.16.5 - 8.40.6", "nodes": ["node_modules/webdriverio"], "fixAvailable": {"name": "@wdio/cli", "version": "9.2.8", "isSemVerMajor": true}}, "ws": {"name": "ws", "severity": "high", "isDirect": false, "via": [{"source": 1098392, "name": "ws", "dependency": "ws", "title": "ws affected by a DoS when handling a request with many HTTP headers", "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q", "severity": "high", "cwe": ["CWE-476"], "cvss": {"score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "range": ">=8.0.0 <8.17.1"}], "effects": ["puppeteer-core"], "range": "8.0.0 - 8.17.0", "nodes": ["node_modules/devtools/node_modules/ws", "node_modules/puppeteer-core/node_modules/ws"], "fixAvailable": {"name": "@wdio/cli", "version": "9.2.8", "isSemVerMajor": true}}}, "metadata": {"vulnerabilities": {"info": 0, "low": 0, "moderate": 2, "high": 13, "critical": 0, "total": 15}, "dependencies": {"prod": 1, "dev": 978, "optional": 2, "peer": 0, "peerOptional": 0, "total": 978}}}}
$ /usr/bin/npm audit fix --only=dev
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated grunt-jasmine-nodejs@1.6.1: Deprecated in favor of npm scripts.
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 977 packages, and audited 978 packages in 10s

136 packages are looking for funding
  run `npm fund` for details

# npm audit report

diff  <3.5.0
Severity: high
Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-h6ch-v84p-w6p9
fix available via `npm audit fix --force`
Will install unexpected@13.2.1, which is a breaking change
node_modules/unexpected/node_modules/diff
  unexpected  5.0.0-beta1 - 11.0.0
  Depends on vulnerable versions of diff
  node_modules/unexpected

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
fix available via `npm audit fix --force`
Will install wdio-mediawiki@2.5.0, which is a breaking change
node_modules/request
  mwbot  >=0.1.6
  Depends on vulnerable versions of request
  Depends on vulnerable versions of semver
  node_modules/mwbot
    wdio-mediawiki  1.1.0 - 2.2.0
    Depends on vulnerable versions of mwbot
    node_modules/wdio-mediawiki
      wdio-wikibase  5.1.0 - 5.2.0
      Depends on vulnerable versions of wdio-mediawiki
      node_modules/wdio-wikibase

semver  7.0.0 - 7.5.1
Severity: high
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install wdio-mediawiki@2.5.0, which is a breaking change
node_modules/mwbot/node_modules/semver

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install wdio-mediawiki@2.5.0, which is a breaking change
node_modules/request/node_modules/tough-cookie

ws  8.0.0 - 8.17.0
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @wdio/cli@9.2.8, which is a breaking change
node_modules/devtools/node_modules/ws
node_modules/puppeteer-core/node_modules/ws
  puppeteer-core  11.0.0 - 22.11.1
  Depends on vulnerable versions of ws
  node_modules/devtools/node_modules/puppeteer-core
  node_modules/puppeteer-core
    devtools  >=7.16.5
    Depends on vulnerable versions of puppeteer-core
    node_modules/devtools
    webdriverio  7.16.5 - 8.40.6
    Depends on vulnerable versions of devtools
    Depends on vulnerable versions of puppeteer-core
    node_modules/webdriverio
      @wdio/cli  7.16.5 - 8.40.6
      Depends on vulnerable versions of webdriverio
      node_modules/@wdio/cli
      @wdio/runner  7.16.5 - 8.40.6
      Depends on vulnerable versions of webdriverio
      node_modules/@wdio/runner
        @wdio/local-runner  7.16.5 - 8.40.6
        Depends on vulnerable versions of @wdio/runner
        node_modules/@wdio/local-runner

15 vulnerabilities (2 moderate, 13 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

--- end ---
Verifying that tests still pass
$ /usr/bin/npm ci
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated grunt-jasmine-nodejs@1.6.1: Deprecated in favor of npm scripts.
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated glob@7.1.7: Glob versions prior to v9 are no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 977 packages, and audited 978 packages in 14s

136 packages are looking for funding
  run `npm fund` for details

15 vulnerabilities (2 moderate, 13 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ /usr/bin/npm test
--- stderr ---
[Vue warn]: Avoid app logic that relies on enumerating keys on a component instance. The keys will be empty in production mode to avoid performance overhead.
[Vue warn]: Avoid app logic that relies on enumerating keys on a component instance. The keys will be empty in production mode to avoid performance overhead.
[Vue warn]: Avoid app logic that relies on enumerating keys on a component instance. The keys will be empty in production mode to avoid performance overhead.
[Vue warn]: Avoid app logic that relies on enumerating keys on a component instance. The keys will be empty in production mode to avoid performance overhead.
[Vue warn]: Avoid app logic that relies on enumerating keys on a component instance. The keys will be empty in production mode to avoid performance overhead.
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: '@es-joy/jsdoccomment@0.23.6',
npm WARN EBADENGINE   required: { node: '^12 || ^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: 'eslint-plugin-jsdoc@39.2.2',
npm WARN EBADENGINE   required: { node: '^14 || ^16 || ^17' },
npm WARN EBADENGINE   current: { node: 'v18.19.0', npm: '9.2.0' }
npm WARN EBADENGINE }
--- stdout ---

> test
> run-s test:*


> test:grunt
> grunt test

Running "eslint:all" (eslint) task

/src/repo/i18n/dga.json
  116:124  warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"Kͻkͻre kodi a ko yelbiŋmaa boͻloo tԑԑtԑԑ, aseŋ.  '$1'‎"'   security/detect-bidi-characters
  118:90   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"Yelbinyaa waaloŋ, aseŋ. '$1'‎"'                            security/detect-bidi-characters
  119:106  warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"Yelbiŋmaa koŋ baŋ pare  $1 {{PLURAL:$1|waabo|waaloŋ}}.‎"'  security/detect-bidi-characters
  123:94   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"A yelbiri laŋgbulo, aseŋ. 'numeral'‎"'                     security/detect-bidi-characters
  124:109  warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"A yelbiri yelbie laŋgbulo, aseŋ. '$1'‎"'                   security/detect-bidi-characters
  128:61   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"Maala la yelbiri...‎"'                                     security/detect-bidi-characters
  130:95   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"$1 {{PLURAL:$1|yeli|yԑlԑ}}, $2 {{PLURAL:$2|gane|gama}}‎"'  security/detect-bidi-characters

/src/repo/i18n/pnb.json
   19:46   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜"'                                security/detect-bidi-characters
   19:50   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜"'                                security/detect-bidi-characters
   19:55   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜"'                                security/detect-bidi-characters
   21:44   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜؜"'                               security/detect-bidi-characters
   21:48   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜؜"'                               security/detect-bidi-characters
   21:53   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜؜"'                               security/detect-bidi-characters
   21:54   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1 ؜($2)؜؜"'                               security/detect-bidi-characters
   95:74   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"،&#32;؜"'                                   security/detect-bidi-characters
   96:71   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"⁩/⁩"'                                       security/detect-bidi-characters
   96:73   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"⁩/⁩"'                                       security/detect-bidi-characters
  123:96   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"تعریف دا کوڈ، جویں کہ پنجابی نال ”pnb“‬"'   security/detect-bidi-characters
  124:108  warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"تعریف دا کوڈ، جویں کہ پنجابی نال ”$1“‬"'    security/detect-bidi-characters
  125:79   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"لفظ دا مکھ روپ، جویں کہ ”ڈڈّو“‬"'           security/detect-bidi-characters
  126:92   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"لفظ دا مکھ روپ، جویں کہ ”ڈڈّو“‬ یا ”$1“‬"'  security/detect-bidi-characters
  126:101  warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"لفظ دا مکھ روپ، جویں کہ ”ڈڈّو“‬ یا ”$1“‬"'  security/detect-bidi-characters
  138:80   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"⁩/⁩"'                                       security/detect-bidi-characters
  138:82   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"⁩/⁩"'                                       security/detect-bidi-characters
  139:57   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1،؜ $2؜"'                                 security/detect-bidi-characters
  139:61   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1،؜ $2؜"'                                 security/detect-bidi-characters
  139:65   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜$1،؜ $2؜"'                                 security/detect-bidi-characters
  143:60   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  143:61   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  143:64   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  143:66   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  144:61   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  144:62   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  144:65   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters
  144:67   warning  Detected potential trojan source attack with unicode bidi introduced in this code: '"؜‫$1‬ ؜بارے بیان"'                          security/detect-bidi-characters

/src/repo/resources/jquery.wikibase.lexemeformview.js
  287:0  warning  Missing JSDoc @param "lemmas" type           jsdoc/require-param-type
  288:0  warning  Missing JSDoc @param "formIndex" type        jsdoc/require-param-type
  289:0  warning  Missing JSDoc @param "formId" type           jsdoc/require-param-type
  290:0  warning  Missing JSDoc @param "representations" type  jsdoc/require-param-type

/src/repo/resources/special/NewLexemeFallback.js
  8:3  warning  NodeList.forEach not supported by Chrome<51, Firefox<50, Safari<10, IE & others. Use Array.prototype.forEach.call instead  mediawiki/no-nodelist-unsupported-methods

/src/repo/resources/view/ViewFactoryFactory.js
  17:0  warning  Syntax error in type: []  jsdoc/valid-types

/src/repo/resources/widgets/GlossWidget.js
  34:0  warning  Syntax error in type: [{ value: string, language: string }]  jsdoc/valid-types

/src/repo/tests/selenium/pageobjects/lexeme.page.js
  236:0  warning  Missing JSDoc @param "input" type       jsdoc/require-param-type
  237:0  warning  Missing JSDoc @param "value" type       jsdoc/require-param-type
  439:3  warning  Unexpected browser.pause() not allowed  wdio/no-pause
  441:3  warning  Unexpected browser.pause() not allowed  wdio/no-pause
  448:3  warning  Unexpected browser.pause() not allowed  wdio/no-pause
  450:3  warning  Unexpected browser.pause() not allowed  wdio/no-pause

/src/repo/tests/selenium/replication.js
  10:5  warning  Unexpected browser.pause() not allowed  wdio/no-pause

/src/repo/tests/selenium/specs/header.edit.js
  12:25  warning  "../../../../Wikibase/repo/tests/selenium/wdio-wikibase/wikibase.api" is not found  node/no-missing-require

/src/repo/tests/selenium/specs/special/recentchanges.js
  27:3  warning  Unexpected browser.pause() not allowed  wdio/no-pause

✖ 51 problems (0 errors, 51 warnings)


Running "banana:WikibaseLexeme" (banana) task
>> 3 message directories checked.

Running "jasmine_nodejs:all" (jasmine_nodejs) task

>> Executing 126 defined specs...

Test Suites & Specs:

1) RepresentationWidget
   ✔ cannot remove representation if not in edit mode
   ✔ can carry redundant representations
   ✔ shows only the representation it contains when editing the widget with some representation
   ✔ cannot add representation if not in edit mode
   ✔ adds a new representation with lemma language when editing the widget with no representations and one lemma
   ✔ adds a representation with unique lemmas language on add after delete
   ✔ adds a new empty representation when editing the widget with no representations and multiple lemmas
   ✔ can remove a representation
   ✔ adds an empty representation on add
   ✔ is not in edit mode after editing is stopped
   ✔ switches to edit mode when editing
   ✔ is not in edit mode after being created
   ✔ detects redundant representation languages and marks the widget
   ✔ detects redundant representation languages and can mark the individual languages

2) RedundantLanguageIndicator
   ✔ creates mixin definition method isRedundantLanguage returning false for empty redundantLanguages
   ✔ creates mixin definition providing computed property hasRedundantLanguage
   ✔ creates mixin definition with watch that monitors the property recursively
   ✔ creates mixin definition providing method to determine if language isRedundantLanguage
   ✔ creates mixin watch handler not taking offence in repeated empty language
   ✔ creates mixin watch handler that can find multiple redundant languages
   ✔ creates mixin watch handler that updates redundantLanguages with respective language values
   ✔ creates mixin definition with watch on desired property
   ✔ creates mixin definition with watch that fires immediately
   ✔ creates mixin property hasRedundantLanguage returning true for existing redundantLanguages
   ✔ creates mixin property hasRedundantLanguage returning false for empty redundantLanguages
   ✔ creates mixin definition that adds a redundantLanguages property to data

3) focusElement
   ✔ returns a callback without doing anything else

   4) callback
      ✔ can handle missing element
      ✔ calls focus on selected element

5) InvalidLanguageIndicator
   ✔ creates mixin definition with watch that monitors the property recursively
   ✔ creates mixin definition providing method to determine if language isInvalidLanguage
   ✔ creates mixin definition providing computed property hasInvalidLanguage
   ✔ creates mixin watch handler not taking offence in empty language
   ✔ creates mixin watch handler that updates InvalidLanguages with respective language values
   ✔ creates mixin definition with watch on desired property
   ✔ creates mixin watch handler that can find multiple invalid languages
   ✔ creates mixin definition with watch that does not fire immediately
   ✔ creates mixin property hasInvalidLanguage returning true for existing InvalidLanguages
   ✔ creates mixin definition method isInvalidLanguage returning false for empty InvalidLanguages
   ✔ creates mixin definition that adds an InvalidLanguages property to data
   ✔ creates mixin property hasInvalidLanguage returning false for empty InvalidLanguages

6) wikibase.lexeme.widgets.LemmaWidget
   ✔ detects redundant lemma languages to mark the widget
   ✔ can carry redundant lemma languages
   ✔ marks-up the lemma term with the lemma language
   ✔ edit mode is false
   ✔ initialize widget with one lemma
   ✔ detects redundant lemma language to mark the individual languages
   ✔ remove a lemma
   ✔ add a new lemma
   ✔ edit mode is true

7) LemmaList
   ✔ add
   ✔ length
   ✔ remove

   8) equals
      ✔ returns false for LemmaList of different length
      ✔ returns false for objects that are not of type LemmaList
      ✔ returns true for LemmaList with same lemmas
      ✔ returns false for LemmaList with different lemmas
      ✔ ignores empty lemmas

   9) copy
      ✔ creates an identical LemmaList
      ✔ clones Lemmas

   ✔ getLemmas

10) LexemeSubEntityId

   11) getIdSuffix
      ✔ returns the Sense id suffix
      ✔ returns the Form id suffix

12) actionTypes
   ✔ uses unique ids for all action types

13) wikibase.lexeme.widgets.LexemeHeader
   ✔ shows save button disabled when unsaveable
   ✔ switch to edit mode
   ✔ shows save button enabled when not unsaveable
   ✔ binds to lemma-widget hasRedundantLanguage event
   ✔ save lemma list with error

   14) hasChanges
      ✔ returns true when language changes
      ✔ returns true when lexical category changes
      ✔ returns true when lemmas change
      ✔ ignores added empty lemmas
      ✔ returns false by default

   ✔ updates language and lexical category on save

   ✔ cancel edit mode

   15) isUnsaveable
      ✔ returns false by default
      ✔ returns true when there are no changes
      ✔ returns true when there are changes but saving is ongoing
      ✔ returns true when there are changes but also lemmas with redundant languages

   ✔ save lemma list

   ✔ shows save button disabled without changes

   ✔ passes language and lexical category to LanguageAndLexicalCategoryWidget

   ✔ attempting to save with empty lemmas fails

   ✔ passes lemmas to LemmaWidget

16) LexemeHeader.newLexemeHeaderStore
   ✔ mutation updateLanguage changes lexical category and the link to given values
   ✔ mutation finishSaving switches the isSaving flag to false
   ✔ action save calls API with correct parameters when adding, editing and removing lemmas
   ✔ mutation updateLanguage changes language and languageLink to given values
   ✔ action save calls API with correct parameters when removing one of several existing lemmas
   ✔ action save calls API with correct parameters when editing one of several existing lemmas
   ✔ mutation updateRevisionId changes baseRevId to given value
   ✔ failed save returns rejected promise with first error object if API returns multiple errors
   ✔ mutation startSaving switches the isSaving flag to true
   ✔ failed save returns rejected promise with a single error object
   ✔ mutation updateLemmas changes lemmas to given values
   ✔ action save calls API with correct parameters when editing an existing lemma
   ✔ action save calls API with correct parameters when removing an item from the state
   ✔ action save calls API with correct parameters and changes state using data from response
   ✔ action save on success mutates the state to start saving, updates state and finishes saving
   ✔ action save calls API with correct parameters when editing several existing lemmas

17) mutations
   ✔ DERIVE_REPRESENTATION_LANGUAGE_FROM_LEMMA changes representation language correctly
   ✔ REPLACE_ALL_REPRESENTATIONS replaces representations of correct form
   ✔ REMOVE_REPRESENTATION removes representation leaving others with updated index
   ✔ ADD_REPRESENTATION adds a new representation to the right form
   ✔ UPDATE_REPRESENTATION_LANGUAGE changes correct representation language
   ✔ UPDATE_REPRESENTATION_VALUE changes correct representation value

18) ItemSelectorWrapper
   ✔ passes the item ID to the entityselector widget on mount

19) mutationTypes
   ✔ uses unique ids for all mutation types

20) actions
   ✔ UPDATE_REPRESENTATION_VALUE delegates to mutation
   ✔ REMOVE_REPRESENTATION delegates to mutation
   ✔ ADD_REPRESENTATION on state having no representations and one lemma mutates to empty values and derives lemma language
   ✔ ADD_REPRESENTATION on state having existing representation and one lemma mutates to empty values
   ✔ ADD_REPRESENTATION on state having no representations and multiple lemmas mutates to empty values
   ✔ REPLACE_ALL_REPRESENTATIONS delegates to mutation
   ✔ UPDATE_REPRESENTATION_LANGUAGE delegates to mutation

21) GlossWidget
   ✔ stop editing
   ✔ remove a gloss
   ✔ initialize widget with one gloss
   ✔ switch to edit mode
   ✔ create with no glosses - when switched to edit mode empty gloss is added
   ✔ add a new gloss
   ✔ removes empty glosses when saved

22) store
   ✔ creates initial state

23) LanguageAndLexicalCategoryWidget
   ✔ shows the language and the lexical category
   ✔ switches to edit mode and back

>> Done!


Summary:

Suites:  23 of 23
Specs:   126 of 126
Expects: 0 (0 failures)
Finished in 0.547 seconds

>> Successful!

Running "stylelint:all" (stylelint) task
>> Linted 8 files without errors

Done.

> test:snl-distnodiff
> run-s snl:install snl:build snl:cp snl:diff


> snl:install
> npm -C $npm_package_config_snl_src i


> new-lexeme-special-page@0.0.1 prepare
> husky install

husky - Git hooks installed

added 1101 packages, and audited 1102 packages in 13s

162 packages are looking for funding
  run `npm fund` for details

22 vulnerabilities (15 moderate, 6 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

> snl:build
> npm -C $npm_package_config_snl_src run build


> new-lexeme-special-page@0.0.1 build
> vite build

vite v3.2.7 building for production...
transforming...
✓ 100 modules transformed.
rendering chunks...
dist/style.css                 26.63 KiB / gzip: 4.10 KiB
dist/SpecialNewLexeme.cjs.js   102.00 KiB / gzip: 33.97 KiB

> snl:cp
> run-p snl:cp:*


> snl:cp:css
> cp $npm_package_config_snl_src/dist/$npm_package_config_snl_css $npm_package_config_snl_dist/


> snl:cp:cjs
> cp $npm_package_config_snl_src/dist/$npm_package_config_snl_cjs $npm_package_config_snl_dist/


> snl:diff
> git diff --exit-code $npm_package_config_snl_dist


> test:snl-main
> git -C $npm_package_config_snl_src branch --contains HEAD main | grep -q .


> test:mwlibs
> echo 'disabled (T297381)' # ZUUL_BRANCH=${ZUUL_BRANCH:-master} lib-version-check

disabled (T297381)

--- end ---
{}
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json

--- end ---
[DNM] there are no updates
$ git add .
--- stdout ---

--- end ---
$ git commit -F /tmp/tmpx_nw4qi7
--- stdout ---
On branch REL1_41
Your branch is up to date with 'origin/REL1_41'.

nothing to commit, working tree clean

--- end ---

composer dependencies

Dependencies
Development dependencies

npm dependencies

Development dependencies

Logs

Source code is licensed under the AGPL.