$ date
--- stdout ---
Fri Mar 24 21:58:59 UTC 2023
--- end ---
$ git clone file:///srv/git/mediawiki-services-push-notifications.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
5e7d387660ff5c58d0a66dd1d1fc57efc7e8f825 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@wikimedia/apn": {
"name": "@wikimedia/apn",
"severity": "moderate",
"isDirect": true,
"via": [
"jsonwebtoken",
"node-forge"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/@wikimedia/apn"
],
"fixAvailable": false
},
"ansi-regex": {
"name": "ansi-regex",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091188,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.0.1"
},
{
"source": 1091189,
"name": "ansi-regex",
"dependency": "ansi-regex",
"title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
"url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
"severity": "high",
"cwe": [
"CWE-697",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [],
"range": "3.0.0 || 4.0.0 - 4.1.0",
"nodes": [
"node_modules/ansi-align/node_modules/ansi-regex",
"node_modules/concurrently/node_modules/ansi-regex",
"node_modules/rewire/node_modules/ansi-regex",
"node_modules/service-runner/node_modules/ansi-regex",
"node_modules/wide-align/node_modules/ansi-regex"
],
"fixAvailable": true
},
"body-parser": {
"name": "body-parser",
"severity": "high",
"isDirect": true,
"via": [
"qs"
],
"effects": [],
"range": "1.19.0",
"nodes": [
"node_modules/body-parser"
],
"fixAvailable": true
},
"cookiejar": {
"name": "cookiejar",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088659,
"name": "cookiejar",
"dependency": "cookiejar",
"title": "cookiejar Regular Expression Denial of Service via Cookie.parse function",
"url": "https://github.com/advisories/GHSA-h452-7996-h45h",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.1.4"
}
],
"effects": [],
"range": "<2.1.4",
"nodes": [
"node_modules/cookiejar"
],
"fixAvailable": true
},
"degenerator": {
"name": "degenerator",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090403,
"name": "degenerator",
"dependency": "degenerator",
"title": "Code Injection in pac-resolver",
"url": "https://github.com/advisories/GHSA-9j49-mfvp-vmhm",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.0.1"
}
],
"effects": [
"pac-resolver"
],
"range": "<3.0.1",
"nodes": [
"node_modules/degenerator"
],
"fixAvailable": {
"name": "proxy-agent",
"version": "5.0.0",
"isSemVerMajor": true
}
},
"dicer": {
"name": "dicer",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088997,
"name": "dicer",
"dependency": "dicer",
"title": "Crash in HeaderParser in dicer",
"url": "https://github.com/advisories/GHSA-wm7h-9275-46v2",
"severity": "high",
"cwe": [
"CWE-248"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.3.1"
}
],
"effects": [
"firebase-admin"
],
"range": "*",
"nodes": [
"node_modules/dicer"
],
"fixAvailable": {
"name": "firebase-admin",
"version": "11.5.0",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": true,
"via": [
"body-parser",
"qs"
],
"effects": [],
"range": "4.17.0 - 4.17.1 || 5.0.0-alpha.1 - 5.0.0-alpha.8",
"nodes": [
"node_modules/express"
],
"fixAvailable": true
},
"firebase-admin": {
"name": "firebase-admin",
"severity": "high",
"isDirect": true,
"via": [
"dicer",
"jsonwebtoken",
"node-forge"
],
"effects": [],
"range": "4.0.0 - 11.4.0",
"nodes": [
"node_modules/firebase-admin"
],
"fixAvailable": {
"name": "firebase-admin",
"version": "11.5.0",
"isSemVerMajor": true
}
},
"google-gax": {
"name": "google-gax",
"severity": "high",
"isDirect": false,
"via": [
"protobufjs"
],
"effects": [],
"range": "2.2.1-pre - 2.2.1-pre.2 || 2.21.1 - 2.30.4 || 3.0.0 - 3.0.1",
"nodes": [
"node_modules/google-gax"
],
"fixAvailable": true
},
"google-p12-pem": {
"name": "google-p12-pem",
"severity": "low",
"isDirect": false,
"via": [
"node-forge"
],
"effects": [],
"range": "<=3.1.2",
"nodes": [
"node_modules/google-p12-pem"
],
"fixAvailable": true
},
"got": {
"name": "got",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088948,
"name": "got",
"dependency": "got",
"title": "Got allows a redirect to a UNIX socket",
"url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97",
"severity": "moderate",
"cwe": [],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<11.8.5"
}
],
"effects": [
"package-json"
],
"range": "<11.8.5",
"nodes": [
"node_modules/got"
],
"fixAvailable": true
},
"http-cache-semantics": {
"name": "http-cache-semantics",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090532,
"name": "http-cache-semantics",
"dependency": "http-cache-semantics",
"title": "http-cache-semantics vulnerable to Regular Expression Denial of Service",
"url": "https://github.com/advisories/GHSA-rc47-6667-2j5j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<4.1.1"
}
],
"effects": [],
"range": "<4.1.1",
"nodes": [
"node_modules/http-cache-semantics"
],
"fixAvailable": true
},
"ini": {
"name": "ini",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091252,
"name": "ini",
"dependency": "ini",
"title": "ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse",
"url": "https://github.com/advisories/GHSA-qqgx-2p2h-9c37",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<1.3.6"
}
],
"effects": [],
"range": "<1.3.6",
"nodes": [
"node_modules/gc-stats/node_modules/ini"
],
"fixAvailable": true
},
"jose": {
"name": "jose",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088856,
"name": "jose",
"dependency": "jose",
"title": "JOSE vulnerable to resource exhaustion via specifically crafted JWE",
"url": "https://github.com/advisories/GHSA-jv3g-j58f-9mq9",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0 <=2.0.5"
}
],
"effects": [],
"range": ">=2.0 <=2.0.5",
"nodes": [
"node_modules/jose"
],
"fixAvailable": true
},
"json-schema": {
"name": "json-schema",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1091472,
"name": "json-schema",
"dependency": "json-schema",
"title": "json-schema is vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
"severity": "critical",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<0.4.0"
}
],
"effects": [
"jsprim"
],
"range": "<0.4.0",
"nodes": [
"node_modules/json-schema"
],
"fixAvailable": true
},
"json5": {
"name": "json5",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091148,
"name": "json5",
"dependency": "json5",
"title": "Prototype Pollution in JSON5 via Parse Method",
"url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
"range": ">=2.0.0 <2.2.2"
}
],
"effects": [],
"range": "2.0.0 - 2.2.1",
"nodes": [
"node_modules/json5"
],
"fixAvailable": true
},
"jsonwebtoken": {
"name": "jsonwebtoken",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089434,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken unrestricted key type could lead to legacy keys usage ",
"url": "https://github.com/advisories/GHSA-8cf7-32gw-wr33",
"severity": "moderate",
"cwe": [
"CWE-327"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=8.5.1"
},
{
"source": 1091087,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC",
"url": "https://github.com/advisories/GHSA-hjrf-2m68-5959",
"severity": "moderate",
"cwe": [
"CWE-287"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<=8.5.1"
},
{
"source": 1091170,
"name": "jsonwebtoken",
"dependency": "jsonwebtoken",
"title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()",
"url": "https://github.com/advisories/GHSA-qwph-4952-7xr6",
"severity": "moderate",
"cwe": [
"CWE-287",
"CWE-327"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"
},
"range": "<9.0.0"
}
],
"effects": [
"firebase-admin"
],
"range": "<=8.5.1",
"nodes": [
"node_modules/jsonwebtoken"
],
"fixAvailable": {
"name": "firebase-admin",
"version": "11.5.0",
"isSemVerMajor": true
}
},
"jsprim": {
"name": "jsprim",
"severity": "critical",
"isDirect": false,
"via": [
"json-schema"
],
"effects": [],
"range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
"nodes": [
"node_modules/jsprim"
],
"fixAvailable": true
},
"latest-version": {
"name": "latest-version",
"severity": "moderate",
"isDirect": false,
"via": [
"package-json"
],
"effects": [
"update-notifier"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/latest-version"
],
"fixAvailable": true
},
"limitation": {
"name": "limitation",
"severity": "moderate",
"isDirect": false,
"via": [
"wikimedia-kad-fork"
],
"effects": [],
"range": ">=0.2.3",
"nodes": [
"node_modules/limitation"
],
"fixAvailable": true
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091174,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"mocha"
],
"range": "<3.0.5",
"nodes": [
"node_modules/gc-stats/node_modules/minimatch",
"node_modules/minimatch"
],
"fixAvailable": {
"name": "mocha",
"version": "10.2.0",
"isSemVerMajor": true
}
},
"minimist": {
"name": "minimist",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1090097,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.6,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": ">=1.0.0 <1.2.3"
},
{
"source": 1090098,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.6,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": "<0.2.1"
},
{
"source": 1091172,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<0.2.4"
},
{
"source": 1091173,
"name": "minimist",
"dependency": "minimist",
"title": "Prototype Pollution in minimist",
"url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=1.0.0 <1.2.6"
}
],
"effects": [
"mkdirp"
],
"range": "<=0.2.3 || 1.0.0 - 1.2.5",
"nodes": [
"node_modules/gc-stats/node_modules/minimist",
"node_modules/gc-stats/node_modules/rc/node_modules/minimist",
"node_modules/minimist"
],
"fixAvailable": true
},
"mkdirp": {
"name": "mkdirp",
"severity": "critical",
"isDirect": false,
"via": [
"minimist"
],
"effects": [],
"range": "0.4.1 - 0.5.1",
"nodes": [
"node_modules/gc-stats/node_modules/mkdirp"
],
"fixAvailable": true
},
"mocha": {
"name": "mocha",
"severity": "high",
"isDirect": true,
"via": [
"minimatch",
"nanoid"
],
"effects": [],
"range": "5.1.0 - 9.2.1",
"nodes": [
"node_modules/mocha"
],
"fixAvailable": {
"name": "mocha",
"version": "10.2.0",
"isSemVerMajor": true
}
},
"moment": {
"name": "moment",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091430,
"name": "moment",
"dependency": "moment",
"title": "Path Traversal: 'dir/../../filename' in moment.locale",
"url": "https://github.com/advisories/GHSA-8hfj-j24r-96c4",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-27"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<2.29.2"
},
{
"source": 1091441,
"name": "moment",
"dependency": "moment",
"title": "Moment.js vulnerable to Inefficient Regular Expression Complexity",
"url": "https://github.com/advisories/GHSA-wc69-rhjr-hc9g",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=2.18.0 <2.29.4"
}
],
"effects": [],
"range": "<=2.29.3",
"nodes": [
"node_modules/moment"
],
"fixAvailable": true
},
"ms": {
"name": "ms",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1088818,
"name": "ms",
"dependency": "ms",
"title": "Vercel ms Inefficient Regular Expression Complexity vulnerability",
"url": "https://github.com/advisories/GHSA-w9mr-4mfr-499f",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<2.0.0"
}
],
"effects": [
"wikimedia-kad-fork"
],
"range": "<2.0.0",
"nodes": [
"node_modules/wikimedia-kad-fork/node_modules/ms"
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089011,
"name": "nanoid",
"dependency": "nanoid",
"title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
"url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 5.5,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
"range": ">=3.0.0 <3.1.31"
}
],
"effects": [
"mocha"
],
"range": "3.0.0 - 3.1.30",
"nodes": [
"node_modules/nanoid"
],
"fixAvailable": {
"name": "mocha",
"version": "10.2.0",
"isSemVerMajor": true
}
},
"netmask": {
"name": "netmask",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089900,
"name": "netmask",
"dependency": "netmask",
"title": "Improper parsing of octal bytes in netmask",
"url": "https://github.com/advisories/GHSA-4c7m-wxvm-r7gc",
"severity": "critical",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 9.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
"range": "<1.1.0"
},
{
"source": 1089963,
"name": "netmask",
"dependency": "netmask",
"title": "netmask npm package vulnerable to octal input data",
"url": "https://github.com/advisories/GHSA-pch5-whg9-qr2r",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.0.1"
}
],
"effects": [
"pac-resolver"
],
"range": "<=2.0.0",
"nodes": [
"node_modules/netmask"
],
"fixAvailable": {
"name": "proxy-agent",
"version": "5.0.0",
"isSemVerMajor": true
}
},
"node-fetch": {
"name": "node-fetch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091239,
"name": "node-fetch",
"dependency": "node-fetch",
"title": "node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor",
"url": "https://github.com/advisories/GHSA-r683-j2x4-v87g",
"severity": "high",
"cwe": [
"CWE-173",
"CWE-200",
"CWE-601"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<2.6.7"
}
],
"effects": [],
"range": "<2.6.7",
"nodes": [
"node_modules/node-fetch"
],
"fixAvailable": true
},
"node-forge": {
"name": "node-forge",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1088227,
"name": "node-forge",
"dependency": "node-forge",
"title": "Prototype Pollution in node-forge debug API.",
"url": "https://github.com/advisories/GHSA-5rrq-pxf6-6jx5",
"severity": "low",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.0.0"
},
{
"source": 1088228,
"name": "node-forge",
"dependency": "node-forge",
"title": "Prototype Pollution in node-forge util.setPath API",
"url": "https://github.com/advisories/GHSA-wxgw-qj99-44c2",
"severity": "low",
"cwe": [],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.10.0"
},
{
"source": 1088229,
"name": "node-forge",
"dependency": "node-forge",
"title": "URL parsing in node-forge could lead to undesired behavior.",
"url": "https://github.com/advisories/GHSA-gf8q-jrpm-jvxq",
"severity": "low",
"cwe": [
"CWE-601"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.0.0"
},
{
"source": 1088746,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in `node-forge`",
"url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr",
"severity": "moderate",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<1.3.0"
},
{
"source": 1090460,
"name": "node-forge",
"dependency": "node-forge",
"title": "Open Redirect in node-forge",
"url": "https://github.com/advisories/GHSA-8fr3-hfg3-gpgp",
"severity": "moderate",
"cwe": [
"CWE-601"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.0.0"
},
{
"source": 1091350,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in node-forge",
"url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.3.0"
},
{
"source": 1091351,
"name": "node-forge",
"dependency": "node-forge",
"title": "Improper Verification of Cryptographic Signature in node-forge",
"url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.3.0"
},
{
"source": 1091353,
"name": "node-forge",
"dependency": "node-forge",
"title": "Prototype Pollution in node-forge",
"url": "https://github.com/advisories/GHSA-92xj-mqp7-vmcj",
"severity": "high",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
},
"range": "<0.10.0"
}
],
"effects": [
"@wikimedia/apn",
"firebase-admin",
"google-p12-pem"
],
"range": "<=1.2.1",
"nodes": [
"node_modules/firebase-admin/node_modules/node-forge",
"node_modules/google-p12-pem/node_modules/node-forge",
"node_modules/node-forge"
],
"fixAvailable": {
"name": "firebase-admin",
"version": "11.5.0",
"isSemVerMajor": true
}
},
"nodemon": {
"name": "nodemon",
"severity": "moderate",
"isDirect": true,
"via": [
"update-notifier"
],
"effects": [],
"range": "1.3.5 - 2.0.16 || 2.0.18",
"nodes": [
"node_modules/nodemon"
],
"fixAvailable": true
},
"pac-proxy-agent": {
"name": "pac-proxy-agent",
"severity": "high",
"isDirect": false,
"via": [
"pac-resolver"
],
"effects": [
"proxy-agent"
],
"range": "<=4.1.0",
"nodes": [
"node_modules/pac-proxy-agent"
],
"fixAvailable": {
"name": "proxy-agent",
"version": "5.0.0",
"isSemVerMajor": true
}
},
"pac-resolver": {
"name": "pac-resolver",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1090384,
"name": "pac-resolver",
"dependency": "pac-resolver",
"title": "Code Injection in pac-resolver",
"url": "https://github.com/advisories/GHSA-9j49-mfvp-vmhm",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<5.0.0"
},
"degenerator",
"netmask"
],
"effects": [
"pac-proxy-agent"
],
"range": "<=4.2.0",
"nodes": [
"node_modules/pac-resolver"
],
"fixAvailable": {
"name": "proxy-agent",
"version": "5.0.0",
"isSemVerMajor": true
}
},
"package-json": {
"name": "package-json",
"severity": "moderate",
"isDirect": false,
"via": [
"got"
],
"effects": [
"latest-version"
],
"range": "<=6.5.0",
"nodes": [
"node_modules/package-json"
],
"fixAvailable": true
},
"preq": {
"name": "preq",
"severity": "high",
"isDirect": true,
"via": [
"request",
"requestretry"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/preq"
],
"fixAvailable": false
},
"protobufjs": {
"name": "protobufjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091475,
"name": "protobufjs",
"dependency": "protobufjs",
"title": "Prototype Pollution in protobufjs",
"url": "https://github.com/advisories/GHSA-g954-5hwp-pp24",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=6.11.0 <6.11.3"
}
],
"effects": [
"google-gax"
],
"range": "6.11.0 - 6.11.2",
"nodes": [
"node_modules/protobufjs"
],
"fixAvailable": true
},
"proxy-agent": {
"name": "proxy-agent",
"severity": "high",
"isDirect": true,
"via": [
"pac-proxy-agent"
],
"effects": [],
"range": "1.1.0 - 4.0.1",
"nodes": [
"node_modules/proxy-agent"
],
"fixAvailable": {
"name": "proxy-agent",
"version": "5.0.0",
"isSemVerMajor": true
}
},
"qs": {
"name": "qs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090135,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.5.0 <6.5.3"
},
{
"source": 1090137,
"name": "qs",
"dependency": "qs",
"title": "qs vulnerable to Prototype Pollution",
"url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.7.0 <6.7.3"
}
],
"effects": [
"body-parser",
"express"
],
"range": "6.5.0 - 6.5.2 || 6.7.0 - 6.7.2",
"nodes": [
"node_modules/preq/node_modules/qs",
"node_modules/qs",
"node_modules/request/node_modules/qs"
],
"fixAvailable": true
},
"request": {
"name": "request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1091459,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
}
],
"effects": [
"preq"
],
"range": "*",
"nodes": [
"node_modules/preq/node_modules/request"
],
"fixAvailable": false
},
"requestretry": {
"name": "requestretry",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1090420,
"name": "requestretry",
"dependency": "requestretry",
"title": "Cookie exposure in requestretry",
"url": "https://github.com/advisories/GHSA-hjp8-2cm3-cc45",
"severity": "high",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<7.0.0"
}
],
"effects": [
"preq"
],
"range": "<7.0.0",
"nodes": [
"node_modules/requestretry"
],
"fixAvailable": false
},
"swagger-ui-dist": {
"name": "swagger-ui-dist",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1085394,
"name": "swagger-ui-dist",
"dependency": "swagger-ui-dist",
"title": "Server side request forgery in SwaggerUI",
"url": "https://github.com/advisories/GHSA-qrmm-w75w-3wpx",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<4.1.3"
},
{
"source": 1088759,
"name": "swagger-ui-dist",
"dependency": "swagger-ui-dist",
"title": "Spoofing attack in swagger-ui-dist",
"url": "https://github.com/advisories/GHSA-6c9x-mj3g-h47x",
"severity": "moderate",
"cwe": [
"CWE-1021"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<4.1.3"
}
],
"effects": [],
"range": "<=4.1.2",
"nodes": [
"node_modules/swagger-ui-dist"
],
"fixAvailable": {
"name": "swagger-ui-dist",
"version": "5.0.0-alpha.4",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089684,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization",
"url": "https://github.com/advisories/GHSA-3jfq-g458-7qm9",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": ">=4.0.0 <4.4.14"
},
{
"source": 1091313,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning",
"url": "https://github.com/advisories/GHSA-r628-mhmh-qjhw",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-23",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": ">=4.0.0 <4.4.15"
},
{
"source": 1091343,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links",
"url": "https://github.com/advisories/GHSA-9r2w-394v-53qc",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": "<4.4.16"
},
{
"source": 1091346,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization",
"url": "https://github.com/advisories/GHSA-5955-9wpr-37jh",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": "<4.4.18"
},
{
"source": 1091349,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links",
"url": "https://github.com/advisories/GHSA-qq89-hq3f-393p",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
"range": "<4.4.18"
}
],
"effects": [],
"range": "<=4.4.17",
"nodes": [
"node_modules/gc-stats/node_modules/tar"
],
"fixAvailable": true
},
"update-notifier": {
"name": "update-notifier",
"severity": "moderate",
"isDirect": false,
"via": [
"latest-version"
],
"effects": [
"nodemon"
],
"range": "0.2.0 - 5.1.0",
"nodes": [
"node_modules/update-notifier"
],
"fixAvailable": true
},
"wikimedia-kad-fork": {
"name": "wikimedia-kad-fork",
"severity": "moderate",
"isDirect": false,
"via": [
"ms"
],
"effects": [
"limitation"
],
"range": "*",
"nodes": [
"node_modules/wikimedia-kad-fork"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 1,
"moderate": 15,
"high": 22,
"critical": 6,
"total": 44
},
"dependencies": {
"prod": 421,
"dev": 555,
"optional": 158,
"peer": 0,
"peerOptional": 0,
"total": 1132
}
}
}
--- end ---
$ /usr/bin/npm install
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'push-notifications@0.0.1',
npm WARN EBADENGINE required: { node: '^10' },
npm WARN EBADENGINE current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
npm WARN deprecated kad-fs@0.0.4: This package is no longer maintained.
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated kad-memstore@0.0.1: This package is no longer maintained.
npm WARN deprecated formidable@1.2.6: Please upgrade to latest, formidable@v2 or formidable@v3! Check these notes: https://bit.ly/2ZEqIau
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated superagent@3.8.3: Please upgrade to v7.0.2+ of superagent. We have fixed numerous issues with streams, form-data, attach(), filesystem errors not bubbling up (ENOENT on attach()), and all tests are now passing. See the releases tab for more information at <https://github.com/visionmedia/superagent/releases>.
--- stdout ---
added 977 packages, and audited 1044 packages in 34s
122 packages are looking for funding
run `npm fund` for details
24 vulnerabilities (8 moderate, 12 high, 4 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
Upgrading n:eslint-config-wikimedia from ^0.20.0 -> 0.24.0
$ /usr/bin/npm install
--- stderr ---
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: 'push-notifications@0.0.1',
npm WARN EBADENGINE required: { node: '^10' },
npm WARN EBADENGINE current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
--- stdout ---
added 65 packages, removed 13 packages, changed 13 packages, and audited 1096 packages in 4s
133 packages are looking for funding
run `npm fund` for details
24 vulnerabilities (8 moderate, 12 high, 4 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(
ESLint: 7.32.0
Error: .eslintrc.json » eslint-config-wikimedia/server » ./language/es2018:
Environment key "es2018" is unknown
at /src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:175:23
at Array.forEach (<anonymous>)
at ConfigValidator.validateEnvironment (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:169:34)
at ConfigValidator.validateConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:319:18)
at CascadingConfigArrayFactory._finalizeConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:493:23)
at CascadingConfigArrayFactory.getConfigArrayForFile (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:299:21)
at FileEnumerator._iterateFilesRecursive (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:445:49)
at _iterateFilesRecursive.next (<anonymous>)
at FileEnumerator.iterateFiles (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:296:49)
at iterateFiles.next (<anonymous>)
--- stdout ---
--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(
ESLint: 7.32.0
Error: .eslintrc.json » eslint-config-wikimedia/server » ./language/es2018:
Environment key "es2018" is unknown
at /src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:175:23
at Array.forEach (<anonymous>)
at ConfigValidator.validateEnvironment (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:169:34)
at ConfigValidator.validateConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/shared/config-validator.js:319:18)
at CascadingConfigArrayFactory._finalizeConfigArray (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:493:23)
at CascadingConfigArrayFactory.getConfigArrayForFile (/src/repo/node_modules/@eslint/eslintrc/lib/cascading-config-array-factory.js:299:21)
at FileEnumerator._iterateFilesRecursive (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:445:49)
at _iterateFilesRecursive.next (<anonymous>)
at FileEnumerator.iterateFiles (/src/repo/node_modules/eslint/lib/cli-engine/file-enumerator.js:296:49)
at iterateFiles.next (<anonymous>)
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade
hook(update)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint
errors = json.loads(self.check_call([
File "/usr/lib/python3.9/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3.9/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)