$ date
--- stdout ---
Sat Mar 29 06:00:21 UTC 2025
--- end ---
$ git clone file:///srv/git/wikidata-query-builder.git repo --depth=1 -b master
--- stderr ---
Cloning into 'repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/master
--- stdout ---
d2b960af9b6417ce2c9c32d224671d5988d5ad37 refs/heads/master
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1103026,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@babel/runtime": {
"name": "@babel/runtime",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1103025,
"name": "@babel/runtime",
"dependency": "@babel/runtime",
"title": "Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/runtime"
],
"fixAvailable": true
},
"@netlify/build": {
"name": "@netlify/build",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/edge-bundler",
"@netlify/functions-utils",
"@netlify/zip-it-and-ship-it"
],
"effects": [
"netlify-cli"
],
"range": "0.0.24 - 0.0.26 || 9.1.0 - 11.17.0 || 11.37.2 - 12.1.2 || 16.0.0-rc || >=29.20.8",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@netlify/edge-bundler": {
"name": "@netlify/edge-bundler",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"netlify-cli"
],
"range": "8.20.0 - 11.4.0 || >=12.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/zip-it-and-ship-it"
],
"effects": [
"@netlify/build"
],
"range": "1.3.14 - 1.3.29 || 1.3.41 || >=5.2.24",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@netlify/zip-it-and-ship-it": {
"name": "@netlify/zip-it-and-ship-it",
"severity": "moderate",
"isDirect": false,
"via": [
"esbuild"
],
"effects": [
"@netlify/build",
"@netlify/functions-utils",
"netlify-cli"
],
"range": "2.2.0 - 4.2.7 || >=9.17.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@octokit/endpoint": {
"name": "@octokit/endpoint",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102258,
"name": "@octokit/endpoint",
"dependency": "@octokit/endpoint",
"title": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-x4c5-c7rf-jjgv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.0.5 <9.0.6"
}
],
"effects": [],
"range": "9.0.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/endpoint"
],
"fixAvailable": true
},
"@octokit/plugin-paginate-rest": {
"name": "@octokit/plugin-paginate-rest",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102899,
"name": "@octokit/plugin-paginate-rest",
"dependency": "@octokit/plugin-paginate-rest",
"title": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.3.0-beta.1 <11.4.1"
}
],
"effects": [
"@octokit/rest"
],
"range": "9.3.0-beta.1 - 11.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/plugin-paginate-rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@octokit/request": {
"name": "@octokit/request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102896,
"name": "@octokit/request",
"dependency": "@octokit/request",
"title": "@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-rmvr-2pp2-xj38",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <8.4.1"
}
],
"effects": [],
"range": "<=8.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request"
],
"fixAvailable": true
},
"@octokit/request-error": {
"name": "@octokit/request-error",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102256,
"name": "@octokit/request-error",
"dependency": "@octokit/request-error",
"title": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-xx4v-prfh-6cgc",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <5.1.1"
}
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request-error"
],
"fixAvailable": true
},
"@octokit/rest": {
"name": "@octokit/rest",
"severity": "moderate",
"isDirect": false,
"via": [
"@octokit/plugin-paginate-rest"
],
"effects": [
"netlify-cli"
],
"range": "20.1.1 || 21.0.0-beta.1 - 21.0.0-beta.4",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"@vitejs/plugin-vue": {
"name": "@vitejs/plugin-vue",
"severity": "moderate",
"isDirect": true,
"via": [
"vite"
],
"effects": [],
"range": "1.8.0 - 2.3.4",
"nodes": [
"node_modules/@vitejs/plugin-vue"
],
"fixAvailable": {
"name": "@vitejs/plugin-vue",
"version": "5.2.3",
"isSemVerMajor": true
}
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1102472,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.8.2"
}
],
"effects": [],
"range": "<1.8.2",
"nodes": [
"node_modules/axios"
],
"fixAvailable": true
},
"body-parser": {
"name": "body-parser",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099520,
"name": "body-parser",
"dependency": "body-parser",
"title": "body-parser vulnerable to denial of service when url encoding is enabled",
"url": "https://github.com/advisories/GHSA-qwcr-r2fm-qrc7",
"severity": "high",
"cwe": [
"CWE-405"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.20.3"
}
],
"effects": [
"express"
],
"range": "<1.20.3",
"nodes": [
"node_modules/netlify-cli/node_modules/body-parser"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"cookie": {
"name": "cookie",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1099846,
"name": "cookie",
"dependency": "cookie",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x",
"severity": "low",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.7.0"
}
],
"effects": [
"express",
"light-my-request",
"netlify-cli"
],
"range": "<0.7.0",
"nodes": [
"node_modules/netlify-cli/node_modules/cookie"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"cross-spawn": {
"name": "cross-spawn",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100562,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.0.6"
},
{
"source": 1100563,
"name": "cross-spawn",
"dependency": "cross-spawn",
"title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
"url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=7.0.0 <7.0.5"
}
],
"effects": [],
"range": "<6.0.6 || >=7.0.0 <7.0.5",
"nodes": [
"node_modules/cross-spawn",
"node_modules/netlify-cli/node_modules/cross-spawn",
"node_modules/npm-run-all/node_modules/cross-spawn"
],
"fixAvailable": true
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/esbuild",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/esbuild",
"node_modules/netlify-cli/node_modules/esbuild"
],
"fixAvailable": {
"name": "vite",
"version": "6.2.3",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100530,
"name": "express",
"dependency": "express",
"title": "express vulnerable to XSS via response.redirect()",
"url": "https://github.com/advisories/GHSA-qw6h-vgh9-j6wx",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<4.20.0"
},
"body-parser",
"cookie",
"path-to-regexp",
"send",
"serve-static"
],
"effects": [
"netlify-cli"
],
"range": "<=4.21.1 || 5.0.0-alpha.1 - 5.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"find-my-way": {
"name": "find-my-way",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099853,
"name": "find-my-way",
"dependency": "find-my-way",
"title": "find-my-way has a ReDoS vulnerability in multiparametric routes",
"url": "https://github.com/advisories/GHSA-rrr8-f88r-h8q6",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.5.0 <8.2.2"
}
],
"effects": [],
"range": "5.5.0 - 8.2.1",
"nodes": [
"node_modules/netlify-cli/node_modules/find-my-way"
],
"fixAvailable": true
},
"http-proxy-middleware": {
"name": "http-proxy-middleware",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1100223,
"name": "http-proxy-middleware",
"dependency": "http-proxy-middleware",
"title": "Denial of service in http-proxy-middleware",
"url": "https://github.com/advisories/GHSA-c7qv-q95q-8v27",
"severity": "high",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.0.7"
}
],
"effects": [
"netlify-cli"
],
"range": "<2.0.7",
"nodes": [
"node_modules/netlify-cli/node_modules/http-proxy-middleware"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"light-my-request": {
"name": "light-my-request",
"severity": "low",
"isDirect": false,
"via": [
"cookie"
],
"effects": [],
"range": "3.7.0 - 5.13.0 || 6.0.0-pre.fv5.1 - 6.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/light-my-request"
],
"fixAvailable": true
},
"micromatch": {
"name": "micromatch",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1098681,
"name": "micromatch",
"dependency": "micromatch",
"title": "Regular Expression Denial of Service (ReDoS) in micromatch",
"url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<4.0.8"
}
],
"effects": [],
"range": "<4.0.8",
"nodes": [
"node_modules/micromatch",
"node_modules/netlify-cli/node_modules/micromatch"
],
"fixAvailable": true
},
"nanoid": {
"name": "nanoid",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1101163,
"name": "nanoid",
"dependency": "nanoid",
"title": "Predictable results in nanoid generation when given non-integer values",
"url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.3.8"
}
],
"effects": [],
"range": "<3.3.8",
"nodes": [
"node_modules/nanoid",
"node_modules/netlify-cli/node_modules/nanoid"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "high",
"isDirect": true,
"via": [
"@netlify/build",
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"@octokit/rest",
"cookie",
"express",
"http-proxy-middleware"
],
"effects": [],
"range": ">=2.14.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101844,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "Unpatched `path-to-regexp` ReDoS in 0.1.x",
"url": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.1.12"
},
{
"source": 1101850,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp outputs backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.10"
}
],
"effects": [
"express"
],
"range": "<=0.1.11",
"nodes": [
"node_modules/netlify-cli/node_modules/path-to-regexp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"rollup": {
"name": "rollup",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1099757,
"name": "rollup",
"dependency": "rollup",
"title": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS",
"url": "https://github.com/advisories/GHSA-gcx4-mw62-g8wm",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"
},
"range": "<2.79.2"
},
{
"source": 1099764,
"name": "rollup",
"dependency": "rollup",
"title": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS",
"url": "https://github.com/advisories/GHSA-gcx4-mw62-g8wm",
"severity": "high",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"
},
"range": ">=4.0.0 <4.22.4"
}
],
"effects": [
"vite"
],
"range": "<2.79.2 || >=4.0.0 <4.22.4",
"nodes": [
"node_modules/rollup",
"node_modules/vite/node_modules/rollup"
],
"fixAvailable": {
"name": "vite",
"version": "6.2.3",
"isSemVerMajor": true
}
},
"send": {
"name": "send",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100526,
"name": "send",
"dependency": "send",
"title": "send vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-m6fv-jmcg-4jfg",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<0.19.0"
}
],
"effects": [
"express",
"serve-static"
],
"range": "<0.19.0",
"nodes": [
"node_modules/netlify-cli/node_modules/send"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"serve-static": {
"name": "serve-static",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1100528,
"name": "serve-static",
"dependency": "serve-static",
"title": "serve-static vulnerable to template injection that can lead to XSS",
"url": "https://github.com/advisories/GHSA-cm22-4g7w-348p",
"severity": "low",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
"range": "<1.16.0"
},
"send"
],
"effects": [
"express"
],
"range": "<=1.16.0",
"nodes": [
"node_modules/netlify-cli/node_modules/serve-static"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "17.38.1",
"isSemVerMajor": false
}
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1099690,
"name": "vite",
"dependency": "vite",
"title": "Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS",
"url": "https://github.com/advisories/GHSA-64vr-g452-qvp3",
"severity": "moderate",
"cwe": [
"CWE-79"
],
"cvss": {
"score": 6.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"
},
"range": "<3.2.11"
},
{
"source": 1099695,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs.deny` is bypassed when using `?import&raw`",
"url": "https://github.com/advisories/GHSA-9cwx-2883-4wfx",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
"range": "<=3.2.10"
},
{
"source": 1102436,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=4.5.5"
},
{
"source": 1103516,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<4.5.10"
},
"esbuild",
"rollup"
],
"effects": [
"@vitejs/plugin-vue"
],
"range": "<=6.1.2",
"nodes": [
"node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "6.2.3",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 4,
"moderate": 15,
"high": 10,
"critical": 0,
"total": 29
},
"dependencies": {
"prod": 121,
"dev": 2447,
"optional": 127,
"peer": 78,
"peerOptional": 0,
"total": 2585
}
}
}
--- end ---
Upgrading n:@wmde/eslint-config-wikimedia-typescript from ^0.2.9 -> 0.2.12
Upgrading n:eslint-config-wikimedia from ^0.28.2 -> 0.29.1
Upgrading n:stylelint from ^16.7.0 -> 16.12.0
Upgrading n:ts-jest from ^29.2.4 -> 29.2.5
Upgrading n:@vue/compiler-sfc from 3.4.35 -> 3.5.13
$ /usr/bin/npm install
--- stderr ---
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: @wmde/query-builder@1.0.0
npm WARN Found: eslint-config-wikimedia@0.28.2
npm WARN node_modules/eslint-config-wikimedia
npm WARN dev eslint-config-wikimedia@"0.29.1" from the root project
npm WARN 1 more (@wmde/eslint-config-wikimedia-typescript)
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer eslint-config-wikimedia@"^0.28.2" from @wmde/eslint-config-wikimedia-typescript@0.2.12
npm WARN node_modules/@wmde/eslint-config-wikimedia-typescript
npm WARN dev @wmde/eslint-config-wikimedia-typescript@"0.2.12" from the root project
npm WARN deprecated rdf-js@4.0.2: Use @types/rdf-js instead. See https://github.com/rdfjs/types?tab=readme-ov-file#what-about-typesrdf-js
npm WARN deprecated @types/rdf-js@4.0.2: This is a stub types definition. rdf-js provides its own type definitions, so you do not need this installed.
npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead
npm WARN deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated abab@2.0.6: Use your platform's native atob() and btoa() methods instead
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead
npm WARN deprecated glob@8.1.0: Glob versions prior to v9 are no longer supported
npm WARN deprecated domexception@4.0.0: Use your platform's native DOMException instead
--- stdout ---
added 2488 packages, and audited 2491 packages in 1m
406 packages are looking for funding
run `npm fund` for details
29 vulnerabilities (4 low, 15 moderate, 10 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
--- end ---
$ package-lock-lint package-lock.json
--- stdout ---
Checking package-lock.json
node_modules/netlify-cli/tools/lint-rules@unknown: Neither "resolved" nor "version" are present
--- end ---
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1964, in main
libup.run(args.repo, args.output, args.branch)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1902, in run
self.npm_upgrade(plan)
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 1237, in npm_upgrade
self.check_package_lock()
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/__init__.py", line 335, in check_package_lock
self.check_call(["package-lock-lint", "package-lock.json"])
File "/venv/lib/python3.11/site-packages/runner-0.1.0-py3.11.egg/runner/shell2.py", line 59, in check_call
res.check_returncode()
File "/usr/lib/python3.11/subprocess.py", line 502, in check_returncode
raise CalledProcessError(self.returncode, self.args, self.stdout,
subprocess.CalledProcessError: Command '['package-lock-lint', 'package-lock.json']' returned non-zero exit status 1.