$ date
--- stdout ---
Fri Mar 24 22:19:21 UTC 2023
--- end ---
$ git clone file:///srv/git/mediawiki-skins-MinervaNeue.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
b09264b1f98783e08e9bdd79eba9b8931cf6d83b refs/heads/master
--- end ---
$ /usr/bin/npm audit --json --legacy-peer-deps
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@storybook/components": {
"name": "@storybook/components",
"severity": "moderate",
"isDirect": false,
"via": [
"react-syntax-highlighter"
],
"effects": [
"@storybook/ui"
],
"range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28",
"nodes": [
"node_modules/@storybook/components"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"@storybook/core": {
"name": "@storybook/core",
"severity": "critical",
"isDirect": false,
"via": [
"@storybook/ui",
"ejs",
"react-dev-utils"
],
"effects": [
"@storybook/html"
],
"range": "4.0.0-alpha.0 - 6.1.19 || 6.2.0-alpha.0 - 6.2.0-rc.13",
"nodes": [
"node_modules/@storybook/core"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"@storybook/html": {
"name": "@storybook/html",
"severity": "critical",
"isDirect": true,
"via": [
"@storybook/core"
],
"effects": [],
"range": "<=6.0.0-rc.30",
"nodes": [
"node_modules/@storybook/html"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"@storybook/ui": {
"name": "@storybook/ui",
"severity": "moderate",
"isDirect": false,
"via": [
"@storybook/components"
],
"effects": [
"@storybook/core"
],
"range": "4.2.0-alpha.1 - 5.3.0-rc.14 || 6.0.0-alpha.0 - 6.0.28",
"nodes": [
"node_modules/@storybook/ui"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"browserslist": {
"name": "browserslist",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1089762,
"name": "browserslist",
"dependency": "browserslist",
"title": "Regular Expression Denial of Service in browserslist",
"url": "https://github.com/advisories/GHSA-w8qv-6jwh-64r5",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <4.16.5"
}
],
"effects": [
"react-dev-utils"
],
"range": "4.0.0 - 4.16.4",
"nodes": [
"node_modules/react-dev-utils/node_modules/browserslist"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"chokidar": {
"name": "chokidar",
"severity": "high",
"isDirect": false,
"via": [
"glob-parent"
],
"effects": [
"fork-ts-checker-webpack-plugin",
"watchpack-chokidar2"
],
"range": "1.0.0-rc1 - 2.1.8",
"nodes": [
"node_modules/fork-ts-checker-webpack-plugin/node_modules/chokidar",
"node_modules/watchpack-chokidar2/node_modules/chokidar"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"ejs": {
"name": "ejs",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089270,
"name": "ejs",
"dependency": "ejs",
"title": "ejs template injection vulnerability",
"url": "https://github.com/advisories/GHSA-phwq-j96m-2c2q",
"severity": "critical",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<3.1.7"
}
],
"effects": [
"@storybook/core"
],
"range": "<3.1.7",
"nodes": [
"node_modules/ejs"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"fast-glob": {
"name": "fast-glob",
"severity": "high",
"isDirect": false,
"via": [
"glob-parent"
],
"effects": [
"globby"
],
"range": "<=2.2.7",
"nodes": [
"node_modules/fast-glob"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"fork-ts-checker-webpack-plugin": {
"name": "fork-ts-checker-webpack-plugin",
"severity": "high",
"isDirect": false,
"via": [
"chokidar"
],
"effects": [
"react-dev-utils"
],
"range": "<=3.1.0",
"nodes": [
"node_modules/fork-ts-checker-webpack-plugin"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"glob-parent": {
"name": "glob-parent",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091181,
"name": "glob-parent",
"dependency": "glob-parent",
"title": "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex",
"url": "https://github.com/advisories/GHSA-ww39-953v-wcq6",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<5.1.2"
}
],
"effects": [
"chokidar",
"fast-glob"
],
"range": "<5.1.2",
"nodes": [
"node_modules/fast-glob/node_modules/glob-parent",
"node_modules/fork-ts-checker-webpack-plugin/node_modules/glob-parent",
"node_modules/watchpack-chokidar2/node_modules/glob-parent"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"globby": {
"name": "globby",
"severity": "high",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"react-dev-utils"
],
"range": "8.0.0 - 9.2.0",
"nodes": [
"node_modules/globby"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"highlight.js": {
"name": "highlight.js",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1086450,
"name": "highlight.js",
"dependency": "highlight.js",
"title": "ReDOS vulnerabities: multiple grammars",
"url": "https://github.com/advisories/GHSA-7wwv-vh3v-89cq",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-400"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <10.4.1"
},
{
"source": 1090060,
"name": "highlight.js",
"dependency": "highlight.js",
"title": "Prototype Pollution in highlight.js",
"url": "https://github.com/advisories/GHSA-vfrc-7r7c-w9mx",
"severity": "moderate",
"cwe": [
"CWE-471"
],
"cvss": {
"score": 5.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N"
},
"range": "<9.18.2"
}
],
"effects": [
"lowlight",
"react-syntax-highlighter"
],
"range": "<=10.4.0",
"nodes": [
"node_modules/highlight.js"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"immer": {
"name": "immer",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089281,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-c36v-fmgq-m8hx",
"severity": "high",
"cwe": [
"CWE-915",
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<9.0.6"
},
{
"source": 1089656,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-33f9-j839-rf8h",
"severity": "critical",
"cwe": [
"CWE-843",
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<9.0.6"
},
{
"source": 1090038,
"name": "immer",
"dependency": "immer",
"title": "Prototype Pollution in immer",
"url": "https://github.com/advisories/GHSA-9qmh-276g-x5pj",
"severity": "high",
"cwe": [
"CWE-471"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<8.0.1"
}
],
"effects": [
"react-dev-utils"
],
"range": "<=9.0.5",
"nodes": [
"node_modules/immer"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"jsdoc": {
"name": "jsdoc",
"severity": "high",
"isDirect": true,
"via": [
"taffydb"
],
"effects": [],
"range": "3.2.0-dev - 3.6.11",
"nodes": [
"node_modules/jsdoc"
],
"fixAvailable": {
"name": "jsdoc",
"version": "4.0.2",
"isSemVerMajor": true
}
},
"less": {
"name": "less",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [],
"range": "1.4.0-b1 - 2.6.1 || 2.7.2 - 3.11.3",
"nodes": [
"node_modules/less"
],
"fixAvailable": {
"name": "less",
"version": "3.13.1",
"isSemVerMajor": false
}
},
"loader-utils": {
"name": "loader-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1091186,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "Prototype pollution in webpack loader-utils",
"url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
"severity": "critical",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<1.4.1"
},
{
"source": 1091248,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable",
"url": "https://github.com/advisories/GHSA-3rfm-jhwj-7488",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
},
{
"source": 1091251,
"name": "loader-utils",
"dependency": "loader-utils",
"title": "loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)",
"url": "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.4.2"
}
],
"effects": [
"react-dev-utils"
],
"range": "<=1.4.1",
"nodes": [
"node_modules/react-dev-utils/node_modules/loader-utils"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"lowlight": {
"name": "lowlight",
"severity": "moderate",
"isDirect": false,
"via": [
"highlight.js"
],
"effects": [
"react-syntax-highlighter"
],
"range": "1.2.0 - 1.13.1",
"nodes": [
"node_modules/lowlight"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1091174,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS vulnerability",
"url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.0.5"
}
],
"effects": [
"recursive-readdir"
],
"range": "<3.0.5",
"nodes": [
"node_modules/recursive-readdir/node_modules/minimatch"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"mwbot": {
"name": "mwbot",
"severity": "moderate",
"isDirect": true,
"via": [
"request"
],
"effects": [
"wdio-mediawiki"
],
"range": ">=0.1.6",
"nodes": [
"node_modules/mwbot"
],
"fixAvailable": false
},
"prismjs": {
"name": "prismjs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1087445,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-Site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-wvhm-4hhf-97x9",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
"range": ">=1.1.0 <1.21.0"
},
{
"source": 1089189,
"name": "prismjs",
"dependency": "prismjs",
"title": "prismjs Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-hqhp-5p83-hx96",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.25.0"
},
{
"source": 1089716,
"name": "prismjs",
"dependency": "prismjs",
"title": "Regular Expression Denial of Service (ReDoS) in Prism",
"url": "https://github.com/advisories/GHSA-gj77-59wh-66hg",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"
},
"range": "<1.24.0"
},
{
"source": 1090014,
"name": "prismjs",
"dependency": "prismjs",
"title": "Denial of service in prismjs",
"url": "https://github.com/advisories/GHSA-h4hr-7fg3-h35w",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.23.0"
},
{
"source": 1090424,
"name": "prismjs",
"dependency": "prismjs",
"title": "Cross-site Scripting in Prism",
"url": "https://github.com/advisories/GHSA-3949-f494-cm99",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L"
},
"range": ">=1.14.0 <1.27.0"
}
],
"effects": [
"refractor"
],
"range": "<=1.26.0",
"nodes": [
"node_modules/refractor/node_modules/prismjs"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"react-dev-utils": {
"name": "react-dev-utils",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1089062,
"name": "react-dev-utils",
"dependency": "react-dev-utils",
"title": "react-dev-utils OS Command Injection in function `getProcessForPort`",
"url": "https://github.com/advisories/GHSA-5q6m-3h65-w53x",
"severity": "moderate",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 5.6,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
"range": ">=0.4.0 <11.0.4"
},
"browserslist",
"fork-ts-checker-webpack-plugin",
"globby",
"immer",
"loader-utils",
"recursive-readdir",
"shell-quote"
],
"effects": [
"@storybook/core"
],
"range": "0.4.0 - 12.0.0-next.60",
"nodes": [
"node_modules/react-dev-utils"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"react-syntax-highlighter": {
"name": "react-syntax-highlighter",
"severity": "moderate",
"isDirect": false,
"via": [
"highlight.js",
"lowlight",
"refractor"
],
"effects": [
"@storybook/components"
],
"range": "2.0.4 - 12.2.1",
"nodes": [
"node_modules/react-syntax-highlighter"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"recursive-readdir": {
"name": "recursive-readdir",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [
"react-dev-utils"
],
"range": "1.2.0 - 2.2.2",
"nodes": [
"node_modules/recursive-readdir"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"refractor": {
"name": "refractor",
"severity": "moderate",
"isDirect": false,
"via": [
"prismjs"
],
"effects": [
"react-syntax-highlighter"
],
"range": "<=3.4.0 || 4.0.0 - 4.1.1",
"nodes": [
"node_modules/refractor"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"request": {
"name": "request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1091459,
"name": "request",
"dependency": "request",
"title": "Server-Side Request Forgery in Request",
"url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
"severity": "moderate",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
"range": "<=2.88.2"
}
],
"effects": [
"less",
"mwbot"
],
"range": "*",
"nodes": [
"node_modules/request"
],
"fixAvailable": false
},
"shell-quote": {
"name": "shell-quote",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1091418,
"name": "shell-quote",
"dependency": "shell-quote",
"title": "Improper Neutralization of Special Elements used in a Command in Shell-quote",
"url": "https://github.com/advisories/GHSA-g4rg-993r-mgx7",
"severity": "critical",
"cwe": [
"CWE-77"
],
"cvss": {
"score": 9.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": "<=1.7.2"
}
],
"effects": [
"react-dev-utils"
],
"range": "<=1.7.2",
"nodes": [
"node_modules/shell-quote"
],
"fixAvailable": {
"name": "@storybook/html",
"version": "6.5.16",
"isSemVerMajor": true
}
},
"taffydb": {
"name": "taffydb",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1089386,
"name": "taffydb",
"dependency": "taffydb",
"title": "TaffyDB can allow access to any data items in the DB",
"url": "https://github.com/advisories/GHSA-mxhp-79qh-mcx6",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-668"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=2.7.3"
}
],
"effects": [
"jsdoc"
],
"range": "*",
"nodes": [
"node_modules/taffydb"
],
"fixAvailable": {
"name": "jsdoc",
"version": "4.0.2",
"isSemVerMajor": true
}
},
"watchpack": {
"name": "watchpack",
"severity": "high",
"isDirect": false,
"via": [
"watchpack-chokidar2"
],
"effects": [
"webpack"
],
"range": "1.7.2 - 1.7.5",
"nodes": [
"node_modules/watchpack"
],
"fixAvailable": true
},
"watchpack-chokidar2": {
"name": "watchpack-chokidar2",
"severity": "high",
"isDirect": false,
"via": [
"chokidar"
],
"effects": [
"watchpack"
],
"range": "*",
"nodes": [
"node_modules/watchpack-chokidar2"
],
"fixAvailable": true
},
"wdio-mediawiki": {
"name": "wdio-mediawiki",
"severity": "moderate",
"isDirect": true,
"via": [
"mwbot"
],
"effects": [],
"range": "*",
"nodes": [
"node_modules/wdio-mediawiki"
],
"fixAvailable": false
},
"webpack": {
"name": "webpack",
"severity": "high",
"isDirect": false,
"via": [
"watchpack"
],
"effects": [],
"range": "4.44.0 - 4.46.0",
"nodes": [
"node_modules/webpack"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 11,
"high": 13,
"critical": 7,
"total": 31
},
"dependencies": {
"prod": 1,
"dev": 2065,
"optional": 38,
"peer": 0,
"peerOptional": 0,
"total": 2065
}
}
}
--- end ---
$ /usr/bin/composer install
--- stderr ---
No lock file found. Updating dependencies instead of installing from lock file. Use composer update over composer install if you do not have a lock file.
Loading composer repositories with package information
Info from https://repo.packagist.org: [37;44m#StandWith[30;43mUkraine[0m
Updating dependencies
Lock file operations: 36 installs, 0 updates, 0 removals
- Locking composer/pcre (3.1.0)
- Locking composer/semver (3.3.2)
- Locking composer/spdx-licenses (1.5.7)
- Locking composer/xdebug-handler (3.0.3)
- Locking doctrine/deprecations (v1.0.0)
- Locking felixfbecker/advanced-json-rpc (v3.2.1)
- Locking mediawiki/mediawiki-codesniffer (v41.0.0)
- Locking mediawiki/mediawiki-phan-config (0.12.0)
- Locking mediawiki/minus-x (1.1.1)
- Locking mediawiki/phan-taint-check-plugin (4.0.0)
- Locking microsoft/tolerant-php-parser (v0.1.1)
- Locking netresearch/jsonmapper (v4.1.0)
- Locking phan/phan (5.4.1)
- Locking php-parallel-lint/php-console-color (v1.0.1)
- Locking php-parallel-lint/php-console-highlighter (v1.0.0)
- Locking php-parallel-lint/php-parallel-lint (v1.3.2)
- Locking phpdocumentor/reflection-common (2.2.0)
- Locking phpdocumentor/reflection-docblock (5.3.0)
- Locking phpdocumentor/type-resolver (1.7.0)
- Locking phpstan/phpdoc-parser (1.16.1)
- Locking psr/container (1.1.2)
- Locking psr/log (1.1.4)
- Locking sabre/event (5.1.4)
- Locking squizlabs/php_codesniffer (3.7.2)
- Locking symfony/console (v5.4.21)
- Locking symfony/deprecation-contracts (v2.5.2)
- Locking symfony/polyfill-ctype (v1.27.0)
- Locking symfony/polyfill-intl-grapheme (v1.27.0)
- Locking symfony/polyfill-intl-normalizer (v1.27.0)
- Locking symfony/polyfill-mbstring (v1.27.0)
- Locking symfony/polyfill-php73 (v1.27.0)
- Locking symfony/polyfill-php80 (v1.27.0)
- Locking symfony/service-contracts (v2.5.2)
- Locking symfony/string (v5.4.21)
- Locking tysonandre/var_representation_polyfill (0.1.3)
- Locking webmozart/assert (1.11.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 36 installs, 0 updates, 0 removals
0 [>---------------------------] 0 [->--------------------------] 0 [--->------------------------] - Installing composer/pcre (3.1.0): Extracting archive
- Installing symfony/polyfill-php80 (v1.27.0): Extracting archive
- Installing squizlabs/php_codesniffer (3.7.2): Extracting archive
- Installing symfony/polyfill-mbstring (v1.27.0): Extracting archive
- Installing composer/spdx-licenses (1.5.7): Extracting archive
- Installing composer/semver (3.3.2): Extracting archive
- Installing mediawiki/mediawiki-codesniffer (v41.0.0): Extracting archive
- Installing tysonandre/var_representation_polyfill (0.1.3): Extracting archive
- Installing symfony/polyfill-intl-normalizer (v1.27.0): Extracting archive
- Installing symfony/polyfill-intl-grapheme (v1.27.0): Extracting archive
- Installing symfony/polyfill-ctype (v1.27.0): Extracting archive
- Installing symfony/string (v5.4.21): Extracting archive
- Installing symfony/deprecation-contracts (v2.5.2): Extracting archive
- Installing psr/container (1.1.2): Extracting archive
- Installing symfony/service-contracts (v2.5.2): Extracting archive
- Installing symfony/polyfill-php73 (v1.27.0): Extracting archive
- Installing symfony/console (v5.4.21): Extracting archive
- Installing sabre/event (5.1.4): Extracting archive
- Installing netresearch/jsonmapper (v4.1.0): Extracting archive
- Installing microsoft/tolerant-php-parser (v0.1.1): Extracting archive
- Installing webmozart/assert (1.11.0): Extracting archive
- Installing phpstan/phpdoc-parser (1.16.1): Extracting archive
- Installing phpdocumentor/reflection-common (2.2.0): Extracting archive
- Installing doctrine/deprecations (v1.0.0): Extracting archive
- Installing phpdocumentor/type-resolver (1.7.0): Extracting archive
- Installing phpdocumentor/reflection-docblock (5.3.0): Extracting archive
- Installing felixfbecker/advanced-json-rpc (v3.2.1): Extracting archive
- Installing psr/log (1.1.4): Extracting archive
- Installing composer/xdebug-handler (3.0.3): Extracting archive
- Installing phan/phan (5.4.1): Extracting archive
- Installing mediawiki/phan-taint-check-plugin (4.0.0): Extracting archive
- Installing mediawiki/mediawiki-phan-config (0.12.0): Extracting archive
- Installing mediawiki/minus-x (1.1.1): Extracting archive
- Installing php-parallel-lint/php-console-color (v1.0.1): Extracting archive
- Installing php-parallel-lint/php-console-highlighter (v1.0.0): Extracting archive
- Installing php-parallel-lint/php-parallel-lint (v1.3.2): Extracting archive
0/27 [>---------------------------] 0%
10/27 [==========>-----------------] 37%
19/27 [===================>--------] 70%
26/27 [==========================>-] 96%
27/27 [============================] 100%4 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
14 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
--- stdout ---
--- end ---
Upgrading n:eslint-config-wikimedia from 0.22.1 -> 0.24.0
Upgrading n:stylelint-config-wikimedia from 0.13.0 -> 0.14.0
$ /usr/bin/npm install
--- stderr ---
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN Found: @babel/core@7.7.7
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.7.7" from the root project
npm WARN 72 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining
npm WARN @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10
npm WARN node_modules/@babel/preset-env
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.21.3
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.13.0" from @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.16.7
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining
npm WARN @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@"^7.16.7" from @babel/preset-env@7.17.10
npm WARN node_modules/@babel/preset-env
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @babel/plugin-proposal-class-static-block@7.17.6
npm WARN Found: @babel/core@7.7.7
npm WARN node_modules/@babel/core
npm WARN dev @babel/core@"7.7.7" from the root project
npm WARN 72 more (@babel/helper-compilation-targets, ...)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block
npm WARN @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10
npm WARN node_modules/@babel/preset-env
npm WARN
npm WARN Conflicting peer dependency: @babel/core@7.21.3
npm WARN node_modules/@babel/core
npm WARN peer @babel/core@"^7.12.0" from @babel/plugin-proposal-class-static-block@7.17.6
npm WARN node_modules/@babel/preset-env/node_modules/@babel/plugin-proposal-class-static-block
npm WARN @babel/plugin-proposal-class-static-block@"^7.17.6" from @babel/preset-env@7.17.10
npm WARN node_modules/@babel/preset-env
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE package: '@wdio/sync@7.19.5',
npm WARN EBADENGINE required: { node: '>=12.0.0 <16' },
npm WARN EBADENGINE current: { node: 'v16.17.1', npm: '8.15.0' }
npm WARN EBADENGINE }
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
npm WARN deprecated highlight.js@9.12.0: Version no longer supported. Upgrade to @latest
npm WARN deprecated puppeteer@9.1.1: Version no longer supported. Upgrade to @latest
npm WARN deprecated core-js@2.6.12: core-js@<3.4 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
--- stdout ---
added 2058 packages, and audited 2059 packages in 29s
188 packages are looking for funding
run `npm fund` for details
31 vulnerabilities (11 moderate, 13 high, 7 critical)
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
--- end ---
$ ./node_modules/.bin/eslint . --fix
--- stderr ---
Oops! Something went wrong! :(
ESLint: 8.36.0
Error: Cannot read config file: /src/repo/resources/.eslintrc.js
Error: Cannot find module 'eslint-config-wikimedia/language/merge.js'
Require stack:
- /src/repo/resources/.eslintrc.js
- /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs
- /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js
- /src/repo/node_modules/eslint/lib/eslint/eslint.js
- /src/repo/node_modules/eslint/lib/eslint/index.js
- /src/repo/node_modules/eslint/lib/cli.js
- /src/repo/node_modules/eslint/bin/eslint.js
Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json
at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15)
at Function.Module._load (node:internal/modules/cjs/loader:804:27)
at Module.require (node:internal/modules/cjs/loader:1028:19)
at require (node:internal/modules/cjs/helpers:102:18)
at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15)
at Module._compile (node:internal/modules/cjs/loader:1126:14)
at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10)
at Module.load (node:internal/modules/cjs/loader:1004:32)
at Function.Module._load (node:internal/modules/cjs/loader:839:12)
at Module.require (node:internal/modules/cjs/loader:1028:19)
--- stdout ---
--- end ---
$ ./node_modules/.bin/eslint . -f json
--- stderr ---
Oops! Something went wrong! :(
ESLint: 8.36.0
Error: Cannot read config file: /src/repo/resources/.eslintrc.js
Error: Cannot find module 'eslint-config-wikimedia/language/merge.js'
Require stack:
- /src/repo/resources/.eslintrc.js
- /src/repo/node_modules/@eslint/eslintrc/dist/eslintrc.cjs
- /src/repo/node_modules/eslint/lib/cli-engine/cli-engine.js
- /src/repo/node_modules/eslint/lib/eslint/eslint.js
- /src/repo/node_modules/eslint/lib/eslint/index.js
- /src/repo/node_modules/eslint/lib/cli.js
- /src/repo/node_modules/eslint/bin/eslint.js
Referenced from: /src/repo/includes/Skins/ToggleList/.eslintrc.json
at Function.Module._resolveFilename (node:internal/modules/cjs/loader:956:15)
at Function.Module._load (node:internal/modules/cjs/loader:804:27)
at Module.require (node:internal/modules/cjs/loader:1028:19)
at require (node:internal/modules/cjs/helpers:102:18)
at Object.<anonymous> (/src/repo/resources/.eslintrc.js:9:15)
at Module._compile (node:internal/modules/cjs/loader:1126:14)
at Object.Module._extensions..js (node:internal/modules/cjs/loader:1180:10)
at Module.load (node:internal/modules/cjs/loader:1004:32)
at Function.Module._load (node:internal/modules/cjs/loader:839:12)
at Module.require (node:internal/modules/cjs/loader:1028:19)
--- stdout ---
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1400, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1338, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1046, in npm_upgrade
hook(update)
File "/venv/lib/python3.9/site-packages/runner-0.1.0-py3.9.egg/runner/__init__.py", line 1126, in _handle_eslint
errors = json.loads(self.check_call([
File "/usr/lib/python3.9/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3.9/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python3.9/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)