mediawiki/services/zotero (main)

sourcepatches
$ date
--- stdout ---
Thu Nov 28 19:19:04 UTC 2024

--- end ---
$ git clone file:///srv/git/mediawiki-services-zotero.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---

--- end ---
$ git config user.name libraryupgrader
--- stdout ---

--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---

--- end ---
$ git submodule update --init
--- stderr ---
Submodule 'modules/translate' (https://github.com/zotero/translate.git) registered for path 'modules/translate'
Submodule 'modules/translators' (https://gitlab.wikimedia.org/repos/mediawiki/services/zotero-translators.git) registered for path 'modules/translators'
Submodule 'modules/utilities' (https://github.com/zotero/utilities.git) registered for path 'modules/utilities'
Submodule 'modules/zotero-schema' (https://github.com/zotero/zotero-schema.git) registered for path 'modules/zotero-schema'
Cloning into '/src/repo/modules/translate'...
Cloning into '/src/repo/modules/translators'...
Cloning into '/src/repo/modules/utilities'...
Cloning into '/src/repo/modules/zotero-schema'...
--- stdout ---
Submodule path 'modules/translate': checked out 'e0fe482b8a07e42cbf83545947382008ae7ddb82'
Submodule path 'modules/translators': checked out 'a806e223adabc55f04e2589d9543f9cb4141be9e'
Submodule path 'modules/utilities': checked out '9c89b23153ce621ed0f1d581a5e32248704c6fb7'
Submodule path 'modules/zotero-schema': checked out '1f5331e902ed2b765a379b9586c65d1a192c151d'

--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.

--- end ---
$ git show-ref refs/heads/master
--- stdout ---
b4995d086ff7d02edca0d6636ddbb482be980fbf refs/heads/master

--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "acorn": {
      "name": "acorn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1085601,
          "name": "acorn",
          "dependency": "acorn",
          "title": "Regular Expression Denial of Service in Acorn",
          "url": "https://github.com/advisories/GHSA-6chw-6frg-f759",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.0.0 <6.4.1"
        }
      ],
      "effects": [],
      "range": "6.0.0 - 6.4.0",
      "nodes": [
        "node_modules/acorn"
      ],
      "fixAvailable": true
    },
    "ansi-regex": {
      "name": "ansi-regex",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1094090,
          "name": "ansi-regex",
          "dependency": "ansi-regex",
          "title": "Inefficient Regular Expression Complexity in chalk/ansi-regex",
          "url": "https://github.com/advisories/GHSA-93q8-gq69-wqmw",
          "severity": "high",
          "cwe": [
            "CWE-697",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.0.1"
        }
      ],
      "effects": [],
      "range": "3.0.0",
      "nodes": [
        "node_modules/ansi-regex"
      ],
      "fixAvailable": true
    },
    "aws-sdk": {
      "name": "aws-sdk",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1089198,
          "name": "aws-sdk",
          "dependency": "aws-sdk",
          "title": "Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader",
          "url": "https://github.com/advisories/GHSA-rrc9-gqf8-8rwg",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "<2.814.0"
        },
        "xml2js"
      ],
      "effects": [],
      "range": "<=2.1353.0",
      "nodes": [
        "node_modules/aws-sdk"
      ],
      "fixAvailable": true
    },
    "cookiejar": {
      "name": "cookiejar",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088659,
          "name": "cookiejar",
          "dependency": "cookiejar",
          "title": "cookiejar Regular Expression Denial of Service via Cookie.parse function",
          "url": "https://github.com/advisories/GHSA-h452-7996-h45h",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<2.1.4"
        }
      ],
      "effects": [],
      "range": "<2.1.4",
      "nodes": [
        "node_modules/cookiejar"
      ],
      "fixAvailable": true
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1100562,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.0.6"
        },
        {
          "source": 1100563,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.0.5"
        }
      ],
      "effects": [],
      "range": "<6.0.6 || >=7.0.0 <7.0.5",
      "nodes": [
        "node_modules/cross-spawn",
        "node_modules/eslint/node_modules/cross-spawn"
      ],
      "fixAvailable": true
    },
    "get-func-name": {
      "name": "get-func-name",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1094574,
          "name": "get-func-name",
          "dependency": "get-func-name",
          "title": "Chaijs/get-func-name vulnerable to ReDoS",
          "url": "https://github.com/advisories/GHSA-4q6p-r6v2-jvc5",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<2.0.1"
        }
      ],
      "effects": [],
      "range": "<2.0.1",
      "nodes": [
        "node_modules/get-func-name"
      ],
      "fixAvailable": true
    },
    "jsdom": {
      "name": "jsdom",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-native",
        "tough-cookie"
      ],
      "effects": [],
      "range": "0.1.20 || 0.2.0 - 16.5.3",
      "nodes": [
        "node_modules/jsdom"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "25.0.1",
        "isSemVerMajor": true
      }
    },
    "json-schema": {
      "name": "json-schema",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1095057,
          "name": "json-schema",
          "dependency": "json-schema",
          "title": "json-schema is vulnerable to Prototype Pollution",
          "url": "https://github.com/advisories/GHSA-896r-f27r-55mw",
          "severity": "critical",
          "cwe": [
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<0.4.0"
        }
      ],
      "effects": [
        "jsprim"
      ],
      "range": "<0.4.0",
      "nodes": [
        "node_modules/json-schema"
      ],
      "fixAvailable": true
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096543,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": "<1.0.2"
        }
      ],
      "effects": [],
      "range": "<1.0.2",
      "nodes": [
        "node_modules/json5"
      ],
      "fixAvailable": true
    },
    "jsprim": {
      "name": "jsprim",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "json-schema"
      ],
      "effects": [],
      "range": "0.3.0 - 1.4.1 || 2.0.0 - 2.0.1",
      "nodes": [
        "node_modules/jsprim"
      ],
      "fixAvailable": true
    },
    "lodash": {
      "name": "lodash",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1094500,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Regular Expression Denial of Service (ReDoS) in lodash",
          "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<4.17.21"
        },
        {
          "source": 1096305,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Prototype Pollution in lodash",
          "url": "https://github.com/advisories/GHSA-p6mc-m468-83gw",
          "severity": "high",
          "cwe": [
            "CWE-770",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": ">=3.7.0 <4.17.19"
        },
        {
          "source": 1096996,
          "name": "lodash",
          "dependency": "lodash",
          "title": "Command Injection in lodash",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "severity": "high",
          "cwe": [
            "CWE-77",
            "CWE-94"
          ],
          "cvss": {
            "score": 7.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<4.17.21"
        }
      ],
      "effects": [],
      "range": "<=4.17.20",
      "nodes": [
        "node_modules/lodash"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096485,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS vulnerability",
          "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.5"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<3.0.5",
      "nodes": [
        "node_modules/minimatch"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.8.2",
        "isSemVerMajor": true
      }
    },
    "minimist": {
      "name": "minimist",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096465,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.6,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": ">=1.0.0 <1.2.3"
        },
        {
          "source": 1096466,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-vh95-rmgr-6w4m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.6,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "<0.2.1"
        },
        {
          "source": 1097677,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<0.2.4"
        },
        {
          "source": 1097678,
          "name": "minimist",
          "dependency": "minimist",
          "title": "Prototype Pollution in minimist",
          "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h",
          "severity": "critical",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.0.0 <1.2.6"
        }
      ],
      "effects": [
        "mkdirp"
      ],
      "range": "<=0.2.3 || 1.0.0 - 1.2.5",
      "nodes": [
        "node_modules/minimist",
        "node_modules/mkdirp/node_modules/minimist"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.8.2",
        "isSemVerMajor": true
      }
    },
    "mkdirp": {
      "name": "mkdirp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "minimist"
      ],
      "effects": [
        "mocha"
      ],
      "range": "0.4.1 - 0.5.1",
      "nodes": [
        "node_modules/mkdirp"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.8.2",
        "isSemVerMajor": true
      }
    },
    "mocha": {
      "name": "mocha",
      "severity": "critical",
      "isDirect": true,
      "via": [
        "minimatch",
        "mkdirp"
      ],
      "effects": [],
      "range": "1.21.5 - 9.2.1",
      "nodes": [
        "node_modules/mocha"
      ],
      "fixAvailable": {
        "name": "mocha",
        "version": "10.8.2",
        "isSemVerMajor": true
      }
    },
    "path-to-regexp": {
      "name": "path-to-regexp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1099561,
          "name": "path-to-regexp",
          "dependency": "path-to-regexp",
          "title": "path-to-regexp outputs backtracking regular expressions",
          "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=0.2.0 <1.9.0"
        }
      ],
      "effects": [],
      "range": "0.2.0 - 1.8.0",
      "nodes": [
        "node_modules/path-to-regexp"
      ],
      "fixAvailable": true
    },
    "request": {
      "name": "request",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1096727,
          "name": "request",
          "dependency": "request",
          "title": "Server-Side Request Forgery in Request",
          "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<=2.88.2"
        },
        "tough-cookie"
      ],
      "effects": [
        "jsdom",
        "request-promise-core",
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "25.0.1",
        "isSemVerMajor": true
      }
    },
    "request-promise-core": {
      "name": "request-promise-core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "request"
      ],
      "effects": [
        "request-promise-native"
      ],
      "range": "*",
      "nodes": [
        "node_modules/request-promise-core"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "request-promise-native": {
      "name": "request-promise-native",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "request",
        "request-promise-core",
        "tough-cookie"
      ],
      "effects": [
        "jsdom"
      ],
      "range": ">=1.0.0",
      "nodes": [
        "node_modules/request-promise-native"
      ],
      "fixAvailable": {
        "name": "request-promise-native",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "semver": {
      "name": "semver",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098563,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<5.7.2"
        }
      ],
      "effects": [],
      "range": "<5.7.2",
      "nodes": [
        "node_modules/semver"
      ],
      "fixAvailable": true
    },
    "swagger-ui-dist": {
      "name": "swagger-ui-dist",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1088759,
          "name": "swagger-ui-dist",
          "dependency": "swagger-ui-dist",
          "title": "Spoofing attack in swagger-ui-dist",
          "url": "https://github.com/advisories/GHSA-6c9x-mj3g-h47x",
          "severity": "moderate",
          "cwe": [
            "CWE-1021"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        },
        {
          "source": 1092160,
          "name": "swagger-ui-dist",
          "dependency": "swagger-ui-dist",
          "title": "Server side request forgery in SwaggerUI",
          "url": "https://github.com/advisories/GHSA-qrmm-w75w-3wpx",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [],
      "range": "<=4.1.2",
      "nodes": [
        "node_modules/swagger-ui-dist"
      ],
      "fixAvailable": {
        "name": "swagger-ui-dist",
        "version": "5.18.2",
        "isSemVerMajor": true
      }
    },
    "tough-cookie": {
      "name": "tough-cookie",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1097682,
          "name": "tough-cookie",
          "dependency": "tough-cookie",
          "title": "tough-cookie Prototype Pollution vulnerability",
          "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<4.1.3"
        }
      ],
      "effects": [
        "jsdom",
        "request",
        "request-promise-native"
      ],
      "range": "<4.1.3",
      "nodes": [
        "node_modules/request/node_modules/tough-cookie",
        "node_modules/tough-cookie"
      ],
      "fixAvailable": {
        "name": "jsdom",
        "version": "25.0.1",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1090476,
          "name": "ws",
          "dependency": "ws",
          "title": "ReDoS in Sec-Websocket-Protocol header",
          "url": "https://github.com/advisories/GHSA-6fc8-4gx4-v693",
          "severity": "moderate",
          "cwe": [
            "CWE-345",
            "CWE-400"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.0.0 <6.2.2"
        },
        {
          "source": 1098394,
          "name": "ws",
          "dependency": "ws",
          "title": "ws affected by a DoS when handling a request with many HTTP headers",
          "url": "https://github.com/advisories/GHSA-3h5v-q93c-6h6q",
          "severity": "high",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.0.0 <6.2.3"
        }
      ],
      "effects": [],
      "range": "6.0.0 - 6.2.2",
      "nodes": [
        "node_modules/ws"
      ],
      "fixAvailable": true
    },
    "xml2js": {
      "name": "xml2js",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1096693,
          "name": "xml2js",
          "dependency": "xml2js",
          "title": "xml2js is vulnerable to prototype pollution",
          "url": "https://github.com/advisories/GHSA-776f-qx25-q3cc",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<0.5.0"
        }
      ],
      "effects": [
        "aws-sdk"
      ],
      "range": "<0.5.0",
      "nodes": [
        "node_modules/xml2js"
      ],
      "fixAvailable": true
    },
    "y18n": {
      "name": "y18n",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1095086,
          "name": "y18n",
          "dependency": "y18n",
          "title": "Prototype Pollution in y18n",
          "url": "https://github.com/advisories/GHSA-c4w7-xm78-47vh",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": "=4.0.0"
        }
      ],
      "effects": [],
      "range": "4.0.0",
      "nodes": [
        "node_modules/y18n"
      ],
      "fixAvailable": true
    },
    "yargs": {
      "name": "yargs",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "yargs-parser"
      ],
      "effects": [],
      "range": "8.0.0-candidate.0 - 12.0.5",
      "nodes": [
        "node_modules/yargs"
      ],
      "fixAvailable": {
        "name": "yargs",
        "version": "17.7.2",
        "isSemVerMajor": true
      }
    },
    "yargs-parser": {
      "name": "yargs-parser",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1088811,
          "name": "yargs-parser",
          "dependency": "yargs-parser",
          "title": "yargs-parser Vulnerable to Prototype Pollution",
          "url": "https://github.com/advisories/GHSA-p9pc-299p-vxgp",
          "severity": "moderate",
          "cwe": [
            "CWE-915",
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
          },
          "range": ">=6.0.0 <13.1.2"
        }
      ],
      "effects": [
        "yargs"
      ],
      "range": "6.0.0 - 13.1.1",
      "nodes": [
        "node_modules/yargs-parser"
      ],
      "fixAvailable": {
        "name": "yargs",
        "version": "17.7.2",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 10,
      "high": 12,
      "critical": 5,
      "total": 27
    },
    "dependencies": {
      "prod": 235,
      "dev": 134,
      "optional": 2,
      "peer": 0,
      "peerOptional": 0,
      "total": 370
    }
  }
}

--- end ---
Upgrading n:eslint from 8.31.0 -> 8.57.0
$ /usr/bin/npm install
--- stderr ---
npm WARN skipping integrity check for git dependency ssh://git@github.com/zotero/wicked-good-xpath.git 
npm WARN deprecated request-promise-native@1.0.7: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.3: this library is no longer supported
npm WARN deprecated formidable@1.2.1: Please upgrade to the upcoming v2, currently (until end of February) install using formidable@canary!
npm WARN deprecated uuid@3.3.2: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated mkdirp@0.5.1: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated request@2.88.0: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated buffer@4.9.1: This version of 'buffer' is out-of-date. You must update to v4.9.2 or newer
npm WARN deprecated eslint@8.57.0: This version is no longer supported. Please see https://eslint.org/version-support for other options.
npm WARN deprecated core-js@2.6.5: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---

added 370 packages, and audited 371 packages in 5s

24 packages are looking for funding
  run `npm fund` for details

27 vulnerabilities (10 moderate, 12 high, 5 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
node_modules/wrap-ansi@2.1.0: "resolved" does not use HTTPS: http://registry.npmjs.org/wrap-ansi/-/wrap-ansi-2.1.0.tgz
node_modules/strip-eof@1.0.0: "resolved" does not use HTTPS: http://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz
node_modules/events@1.1.1: "resolved" does not use HTTPS: http://registry.npmjs.org/events/-/events-1.1.1.tgz
node_modules/buffer@4.9.1: "resolved" does not use HTTPS: http://registry.npmjs.org/buffer/-/buffer-4.9.1.tgz

--- end ---
Traceback (most recent call last):
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1868, in main
    libup.run(args.repo, args.output, args.branch)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1807, in run
    self.npm_upgrade(plan)
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1190, in npm_upgrade
    self.check_package_lock()
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 335, in check_package_lock
    self.check_call(["package-lock-lint", "package-lock.json"])
  File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
    res.check_returncode()
  File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
    raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['package-lock-lint', 'package-lock.json']' returned non-zero exit status 1.

npm dependencies

Dependencies
Development dependencies

Logs

Source code is licensed under the AGPL.